Feat: new error code indicating that ios private key is corrupted

[mrejdak]

This pull request adds a new error code that can be returned by signWithOptions or ValidateKeyIntegrity, which indicates private key corruption (due to e.g. invalidation by credentials re-enrollment).

Summary by CodeRabbit

• Bug Fixes
  • Improved error reporting for biometric operations on iOS. When key data integrity issues are detected, the app now returns more accurate error messages instead of generic signature errors.

[coderabbitai]

📝 Walkthrough

Walkthrough

Import of CryptoTokenKit enables detection of corrupted cryptographic key data during signature operations. The error-handling logic in key-integrity signature creation and key-signature verification now specifically maps TKError.Code.corruptedData failures to keyAccessFailed instead of generic signatureCreationFailed.

Changes

Cohort / File(s)	Summary
Cryptographic Error Handling ios/ReactNativeBiometrics.swift	Added CryptoTokenKit import and updated two error-handling paths in signature operations to detect and remap TKError.Code.corruptedData errors to keyAccessFailed for more accurate error reporting.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• feat: invalidate biometric keys when biometric is changed on ios #79: Modifies the same file's signing and verification error-flow logic, suggesting coordinated work on cryptographic key error handling pathways.

Poem

🐰 A key grows corrupted, data turned to rust,
We catch the signal, map it right we must!
CryptoTokenKit shows the broken way,
Now keyAccessFailed saves the day! 🔐✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding error handling for corrupted iOS private keys by mapping TKError.Code.corruptedData to keyAccessFailed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

ios/ReactNativeBiometrics.swift (1)

830-831: Guard corruptedData mapping by error domain, not code alone.

Lines 830 and 1015 currently match only on numeric code. Add a TokenKit domain check using CFErrorGetDomain to avoid accidental misclassification when different error domains share the same code value.

Suggested patch

           let errorCode = CFErrorGetCode(cfError)
+          let errorDomain = CFErrorGetDomain(cfError) as String
           if errorCode == errSecUserCanceled {
             biometricsError = .userCancel
           } else if errorCode == errSecAuthFailed {
             biometricsError = .authenticationFailed
-          } else if errorCode == TKError.Code.corruptedData.rawValue {
+          } else if errorDomain == TKError.errorDomain &&
+                    errorCode == TKError.Code.corruptedData.rawValue {
             biometricsError = .keyAccessFailed
           } else {
             biometricsError = .signatureCreationFailed
           }

           let errorCode = CFErrorGetCode(cfError)
+          let errorDomain = CFErrorGetDomain(cfError) as String
           if errorCode == errSecUserCanceled {
             biometricsError = ReactNativeBiometricsError.userCancel
           } else if errorCode == errSecAuthFailed {
             biometricsError = ReactNativeBiometricsError.authenticationFailed
-          } else if errorCode == TKError.Code.corruptedData.rawValue {
+          } else if errorDomain == TKError.errorDomain &&
+                    errorCode == TKError.Code.corruptedData.rawValue {
             biometricsError = ReactNativeBiometricsError.keyAccessFailed
           } else {
             biometricsError = ReactNativeBiometricsError.signatureCreationFailed
           }

Also applies to: 1015-1016

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ios/ReactNativeBiometrics.swift` around lines 830 - 831, The mapping for
TKError.Code.corruptedData currently checks only the numeric code and may
misclassify errors from other domains; update the error-to-biometricsError
mapping (the branches that inspect TKError.Code.corruptedData and set
biometricsError = .keyAccessFailed) to first verify the CFError domain by
calling CFErrorGetDomain(error as CFError) (or comparing (error as
NSError).domain) equals TKErrorDomain before relying on the numeric code, and
apply this same domain-guarded check in both places where corruptedData is
handled so only TokenKit errors are mapped to .keyAccessFailed.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@ios/ReactNativeBiometrics.swift`:
- Around line 830-831: The mapping for TKError.Code.corruptedData currently
checks only the numeric code and may misclassify errors from other domains;
update the error-to-biometricsError mapping (the branches that inspect
TKError.Code.corruptedData and set biometricsError = .keyAccessFailed) to first
verify the CFError domain by calling CFErrorGetDomain(error as CFError) (or
comparing (error as NSError).domain) equals TKErrorDomain before relying on the
numeric code, and apply this same domain-guarded check in both places where
corruptedData is handled so only TokenKit errors are mapped to .keyAccessFailed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3ae4488d-b5aa-42d8-abcf-56a572bac395

📥 Commits

Reviewing files that changed from the base of the PR and between 7a435cf and c22a1da.

📒 Files selected for processing (1)

• ios/ReactNativeBiometrics.swift