bridge/com.lastlock.bridge.credlink/CredLink

CredLink

class CredLink(blueLink: BlueLink, networkConnectivityMonitor: NetworkConnectivityMonitor, iOSCryptoHandler: CredLinkCryptoHandler? = null, iOSTrueTimeManager: ITrueTimeManager? = null) : ConnectivityListener

Shared CredLink orchestration for PKOC credential exchange and offline time sync over BlueLink.

Responsibilities:

Session lifecycle (onSessionStart, onSessionEnd) and phone key management (validateLegacyPhoneKeys)
Queuing BlueLink operations and per-device timeouts
Thread-safe device registry and coordination with the internal exchange state machine

Platform cryptography is delegated to CredLinkCryptoHandler (Android Keystore + BouncyCastle, or iOS CryptoKit + Keychain via Swift).

Constructors

CredLink

constructor(blueLink: BlueLink, networkConnectivityMonitor: NetworkConnectivityMonitor, iOSCryptoHandler: CredLinkCryptoHandler? = null, iOSTrueTimeManager: ITrueTimeManager? = null)

Properties

credentialExchangeListener

@Volatile

var credentialExchangeListener: CredentialExchangeListener?

networkAvailable

val networkAvailable: StateFlow<Boolean?>

Functions

createEphemeralTokenUnlockCredential

suspend fun createEphemeralTokenUnlockCredential(): EphemeralTokenUnlockCredential?

Creates a fresh P-256 credential for Ephemeral Temporary Access valid for two minutes. The key pair generated is only persisted in session memory and is purged on session end.

deleteTokenUnlockPass

suspend fun deleteTokenUnlockPass(namespace: String): Boolean

Removes the token unlock pass data associated with namespace.

didChangeConnectivity

open override fun didChangeConnectivity(isConnected: Boolean)

ConnectivityListener callback; drives offline PKOC time-sync eligibility via networkAvailable.

discardEphemeralTokenUnlockCredential

suspend fun discardEphemeralTokenUnlockCredential(credential: EphemeralTokenUnlockCredential): Boolean

fetchPublicCredential

suspend fun fetchPublicCredential(namespace: String, force: Boolean = false): ByteArray

Creates or reuses the P-256 key bound to a temporary-pass namespace.

getPublicKeyHex

suspend fun getPublicKeyHex(): String?

Returns the wire-format PKOC public key for the current config.phoneKeysAlias, as hex.

getPublicKeyHexForAlias

suspend fun getPublicKeyHexForAlias(alias: String): String?

getPublicKeyHexForUser

suspend fun getPublicKeyHexForUser(userId: String, serverAddress: String): String?

Returns the persisted public key hex for userId and serverAddress without mutating the active phone key alias or CredLink session state.

getTokenUnlockPass

suspend fun getTokenUnlockPass(namespace: String): TokenUnlockPass?

Fetches the persisted token-unlock-pass persisted under the provided namespace

onSessionEnd

fun onSessionEnd()

Clears in-memory CredLink state when a Bridge session ends. Long-term keys are preserved.

onSessionStart

fun onSessionStart()

Resets in-memory CredLink state when a Bridge session starts. Long-term keys are preserved.

performCredLinkOperation

suspend fun performCredLinkOperation(peripheral: BluetoothDevice, operation: CredLinkOperation)

Queues a credential exchange or offline time-sync operation on BlueLink for peripheral.

resetPhoneKeys

fun resetPhoneKeys()

Clears phone keys asynchronously for legacy callers. Prefer resetPhoneKeysAndWait.

resetPhoneKeysAndWait

suspend fun resetPhoneKeysAndWait()

Clears the in-memory phone key alias and all active exchange sessions. Keystore keys are preserved. The operation completes before this function returns so callers can safely start a new authenticated session afterward.

scopePhoneKeysForUser

suspend fun scopePhoneKeysForUser(userId: String, serverAddress: String)

Scopes persisted phone keys to userId and serverAddress without generating new keys or contacting the server. Use when resuming an offline session.

storeEphemeralTokenUnlockPass

suspend fun storeEphemeralTokenUnlockPass(credential: EphemeralTokenUnlockCredential, pass: TokenUnlockPass): Boolean

Stores pass when credential identifies the active ephemeral setup session.

storeTokenUnlockPass

suspend fun storeTokenUnlockPass(namespace: String, tokenUnlockPass: TokenUnlockPass): Boolean

Persists the provided token-unlock-pass in platform secure storage under namespace.

validateLegacyPhoneKeys

fun validateLegacyPhoneKeys(userId: String, serverAddress: String, forceGeneration: Boolean = false, callback: (ValidatePhoneKeysResult) -> Unit)

Ensures a P-256 key pair exists for the given user and server, generating and persisting one if needed.