Don't compute auth key on the client (closes #1)

Author: Minishlink

README.md

@@ -39,7 +39,6 @@ defaultConfig {
     ...
     resValue "string", "GCM_SENDER_ID", "%YOUR_GCM_SENDER_ID%"
     resValue "string", "BATCH_API_KEY", "%YOUR_BATCH_API_KEY%"
-    resValue "string", "BATCH_INBOX_SECRET", "%YOUR_BATCH_INBOX_SECRET%" // only if you want to use Batch's optional Inbox feature
 }
 ```
 
@@ -75,7 +74,7 @@ Only on Android at the moment. See the [Batch's docs](https://batch.com/doc/ios/
 ```js
 import BatchPush from 'react-native-batch-push';
 
-BatchPush.fetchNewNotifications('theUserId')
+Batch.fetchNewNotifications('theUserId', 'authKey')
 .then(notifications => {
   // notifications is Array<{ title: string, body: string, timestamp: number, payload: Object }>
 })

android/src/main/java/tech/bam/RNBatchPush/RNBatchPushModule.java

@@ -19,20 +19,13 @@
 import com.facebook.react.bridge.WritableArray;
 import com.facebook.react.bridge.WritableMap;
 
-import java.security.InvalidKeyException;
-import java.security.NoSuchAlgorithmException;
-import java.util.Formatter;
 import java.util.List;
 import java.util.Map;
 
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
-
 public class RNBatchPushModule extends ReactContextBaseJavaModule implements LifecycleEventListener {
 
   private final ReactApplicationContext reactContext;
   private String batchAPIKey;
-  private String batchInboxSecret;
 
   public RNBatchPushModule(ReactApplicationContext reactContext) {
     super(reactContext);
@@ -44,12 +37,6 @@ public RNBatchPushModule(ReactApplicationContext reactContext) {
       String packageName = reactContext.getApplicationContext().getPackageName();
       this.batchAPIKey = resources.getString(resources.getIdentifier("BATCH_API_KEY", "string", packageName));
 
-      // Inbox is optional
-      int batchInboxSecretIdentifier = resources.getIdentifier("BATCH_INBOX_SECRET", "string", packageName);
-      if (batchInboxSecretIdentifier > 0) {
-        this.batchInboxSecret = resources.getString(batchInboxSecretIdentifier);
-      }
-
       Batch.Push.setGCMSenderId(resources.getString(resources.getIdentifier("GCM_SENDER_ID", "string", packageName)));
       Batch.setConfig(new Config(this.batchAPIKey));
 
@@ -88,14 +75,9 @@ public void logoutUser() {
   }
 
   @ReactMethod
-  public void fetchNewNotifications(String userID, final Promise promise) {
+  public void fetchNewNotifications(String userID, String authKey, final Promise promise) {
     try {
-      SecretKeySpec signinKey = new SecretKeySpec(this.batchInboxSecret.getBytes(), "HmacSHA256");
-      Mac mac = Mac.getInstance("HmacSHA256");
-      mac.init(signinKey);
-      String hash = toHexString(mac.doFinal((this.batchAPIKey + userID).getBytes()));
-
-      BatchInboxFetcher inboxFetcher = Batch.Inbox.getFetcher(userID, hash);
+      BatchInboxFetcher inboxFetcher = Batch.Inbox.getFetcher(userID, authKey);
       inboxFetcher.fetchNewNotifications(new BatchInboxFetcher.OnNewNotificationsFetchedListener() {
         public void onFetchSuccess(@NonNull List<BatchInboxNotificationContent> notifications, boolean foundNewNotifications, boolean endReached) {
           WritableArray jsNotifications = Arguments.createArray();
@@ -120,25 +102,11 @@ public void onFetchFailure(@NonNull String error) {
           promise.reject("BATCH_ERROR", "Error fetching new notifications: " + error);
         }
       });
-    } catch (NoSuchAlgorithmException exception) {
-      Log.e("RNBatchPush", "HmacSHA256 is not available");
-    } catch (InvalidKeyException exception) {
-      Log.e("RNBatchPush", "Key is invalid");
     } catch (Exception exception) {
       Log.e("RNBatchPush", "Unknown exception: " + exception.getMessage());
     }
   }
 
-  private static String toHexString(byte[] bytes) {
-    Formatter formatter = new Formatter();
-
-    for (byte b : bytes) {
-      formatter.format("%02x", b);
-    }
-
-    return formatter.toString();
-  }
-
   @Override
   public void onHostResume()
   {

index.js.flow

@@ -2,5 +2,5 @@ declare module.exports: {
   registerForRemoteNotifications: Function,
   loginUser: (userId: string) => void,
   logoutUser: Function,
-  fetchNewNotifications: (userId: string) => ({ title: string, body: string, timestamp: number, payload: Object }),
+  fetchNewNotifications: (userId: string, authKey: string) => Array<{ title: string, body: string, timestamp: number, payload: Object }>,
 };