Implements NativePHP Mobile's SecureStorage facade on Android and iOS: SecureStorage::set(), get(), read() and delete().

nativephp/mobile core ships the PHP side (Native\Mobile\Facades\SecureStorage) but registers the SecureStorage.* bridge functions on neither platform, so without a plugin every call silently returns false / null on a device. This plugin adds the native side only. There is no new facade to learn.

• Android: AES-256-GCM, with the key held in the Android Keystore (it never leaves secure hardware or the TEE). The ciphertext lives in the app's private SharedPreferences. No Gradle dependencies; EncryptedSharedPreferences is deprecated, so it isn't used.
• iOS: one Keychain generic-password item per key, scoped to the app's bundle id. Every accessibility is a ThisDeviceOnly one, so items never sync to iCloud Keychain or restore onto another device.

Uninstalling the app removes everything on Android. On iOS the Keychain can outlive an uninstall, as it does for every app.

• nativephp/mobile ^4.1
• Android API 23+
• iOS 15.0+

composer require smronju/nativephp-secure-storage
php artisan vendor:publish --tag=nativephp-plugins-provider
php artisan native:plugin:register smronju/nativephp-secure-storage

Then rebuild: php artisan native:run.

Don't install it alongside nativephp/mobile-secure-storage: both register the same SecureStorage.* functions.

Exactly as core documents it:

use Native\Mobile\Facades\SecureStorage;
use Native\Mobile\SecureStorageAccessibility;

SecureStorage::set('api_token', $token);
SecureStorage::set('refresh_token', $refresh, SecureStorageAccessibility::AfterFirstUnlock);

$token = SecureStorage::get('api_token');   // ?string

$result = SecureStorage::read('api_token'); // found() / missing() / unavailable() / failed()

SecureStorage::set('api_token', null);      // null deletes
SecureStorage::delete('refresh_token');

read() statuses:

The accessibility argument is ignored on Android, as core documents: a Keystore key without user-authentication requirements is usable whenever the app runs, which is already after-first-unlock behaviour.

composer test

MIT