This phone as the second factor: a Keystore key opened by fingerprint, face or PIN approves sign-ins and sensitive changes on the web by the number the browser shows (closes #32) 263c6cad5e51

package io.oxygenhub.android.secondfactor

import androidx.lifecycle.ViewModel

import androidx.lifecycle.viewModelScope

import io.oxygenhub.android.api.HubApi

import io.oxygenhub.android.api.HubException

import io.oxygenhub.android.api.PendingApproval

import kotlinx.coroutines.CancellationException

import kotlinx.coroutines.delay

import kotlinx.coroutines.flow.MutableStateFlow

import kotlinx.coroutines.flow.StateFlow

import kotlinx.coroutines.flow.asStateFlow

import kotlinx.coroutines.launch

/**

 * Approvals waiting for this phone (#32, oxygenhub#356): looked for every

 * few seconds while the app is in front (and when an alert wakes it), one

 * shown at a time; answering signs with the phone's key.

 */

class ApprovalsViewModel(private val api: HubApi) : ViewModel() {

    private val _waiting = MutableStateFlow<PendingApproval?>(null)

    val waiting: StateFlow<PendingApproval?> = _waiting.asStateFlow()

    /** What the last answer came to, to say once. */

    private val _said = MutableStateFlow<String?>(null)

    val said: StateFlow<String?> = _said.asStateFlow()

    private val _busy = MutableStateFlow(false)

    val busy: StateFlow<Boolean> = _busy.asStateFlow()

    /** Answered or put aside here: not shown again. */

    private val done = mutableSetOf<String>()

    /** Look now. */

    suspend fun check() {

        val list = try {

            api.approvals()

        } catch (e: CancellationException) {

            throw e

        } catch (_: Exception) {

            return

        }

        if (!_busy.value) _waiting.value = list.firstOrNull { it.id !in done }

    }

    /** Look every [everyMs] for as long as the caller's scope lives (the app in front). */

    suspend fun watch(everyMs: Long = 3_000) {

        while (true) {

            check()

            delay(everyMs)

        }

    }

    /** Approve with [number]: [sign] signs the message after the system's prompt, or gives null when the person backs out. */

    fun approve(a: PendingApproval, number: Long, sign: suspend (ByteArray) -> ByteArray?) {

        viewModelScope.launch {

            _busy.value = true

            try {

                val signature = sign(ApprovalMessage.of(a.id, number, true))

                if (signature == null) {

                    _said.value = "Not approved: the phone's check did not finish."

                    return@launch

                }

                val state = api.answerApproval(a.id, true, number, signature.toHex()).state

                _said.value = when (state) {

                    "approved" -> if (a.kind == "signin") "Approved: the browser is signing in." else "Approved."

                    else -> "That was not the number the browser showed, so it was refused. Start again in the browser."

                }

                finish(a)

            } catch (e: CancellationException) {

                throw e

            } catch (e: HubException) {

                _said.value = e.message ?: "The hub did not take the answer."

                finish(a)

            } finally {

                _busy.value = false

            }

        }

    }

    /** Say no: the browser is told, and nobody gets in. */

    fun deny(a: PendingApproval) {

        viewModelScope.launch {

            _busy.value = true

            try {

                api.answerApproval(a.id, false, 0, "")

                _said.value = "Refused. If that was not you, change your password."

            } catch (e: CancellationException) {

                throw e

            } catch (_: Exception) {

                _said.value = "Refused here; the hub could not be told."

            } finally {

                _busy.value = false

                finish(a)

            }

        }

    }

    fun shown() {

        _said.value = null

    }

    private fun finish(a: PendingApproval) {

        done += a.id

        if (_waiting.value?.id == a.id) _waiting.value = null

    }

}

package io.oxygenhub.android.secondfactor

import android.content.Context

import android.hardware.biometrics.BiometricManager.Authenticators

import android.hardware.biometrics.BiometricPrompt

import android.os.CancellationSignal

import android.security.keystore.KeyGenParameterSpec

import android.security.keystore.KeyProperties

import kotlinx.coroutines.flow.MutableStateFlow

import kotlinx.coroutines.flow.StateFlow

import kotlinx.coroutines.flow.asStateFlow

import kotlinx.coroutines.suspendCancellableCoroutine

import java.security.KeyPairGenerator

import java.security.KeyStore

import java.security.PrivateKey

import java.security.Signature

import java.security.spec.ECGenParameterSpec

import kotlin.coroutines.resume

/** What the phone signs to answer an approval: the hub checks the same bytes (oxygenhub#356). */

object ApprovalMessage {

    fun of(id: String, number: Long, approve: Boolean): ByteArray =

        "oxygenhub approval v1\n$id\n$number\n${if (approve) "approve" else "deny"}".toByteArray()

}

fun ByteArray.toHex(): String = joinToString("") { "%02x".format(it) }

/**

 * This phone's second-factor key (#32): a P-256 key made in the Android

 * Keystore that never leaves it and signs only after a fingerprint, face

 * or the device PIN, each time.

 */

object PhoneKey {

    private const val ALIAS = "oxygenhub-second-factor"

    private fun store(): KeyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }

    fun exists(): Boolean = runCatching { store().containsAlias(ALIAS) }.getOrDefault(false)

    /** Whether this phone holds its key: the app looks for approvals only then. */

    private val _present = MutableStateFlow(false)

    val present: StateFlow<Boolean> = _present.asStateFlow()

    fun refresh() {

        _present.value = exists()

    }

    /** A new key, replacing any before it: its SubjectPublicKeyInfo, in hex, for the hub. */

    fun create(): String {

        val ks = store()

        if (ks.containsAlias(ALIAS)) ks.deleteEntry(ALIAS)

        val gen = KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore")

        gen.initialize(

            KeyGenParameterSpec.Builder(ALIAS, KeyProperties.PURPOSE_SIGN)

                .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))

                .setDigests(KeyProperties.DIGEST_SHA256)

                .setUserAuthenticationRequired(true)

                // Every use asks: a fingerprint or face, or the device PIN.

                .setUserAuthenticationParameters(0, KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL)

                // The PIN opens it anyway, so a new fingerprint need not end it.

                .setInvalidatedByBiometricEnrollment(false)

                .build(),

        )

        return gen.generateKeyPair().public.encoded.toHex().also { _present.value = true }

    }

    fun delete() {

        runCatching { store().deleteEntry(ALIAS) }

        _present.value = false

    }

    /** A signature ready to be opened by the prompt; null when the key is gone or no longer usable. */

    fun signature(): Signature? = runCatching {

        val key = store().getKey(ALIAS, null) as? PrivateKey ?: return null

        Signature.getInstance("SHA256withECDSA").apply { initSign(key) }

    }.getOrNull()

    /**

     * Sign [message] after the system's prompt: null when the person

     * cancels, the prompt fails, or the key is gone (the lock screen was

     * removed, say).

     */

    suspend fun sign(context: Context, title: String, subtitle: String, message: ByteArray): ByteArray? {

        val sig = signature() ?: return null

        return suspendCancellableCoroutine { cont ->

            val cancel = CancellationSignal()

            cont.invokeOnCancellation { cancel.cancel() }

            val prompt = BiometricPrompt.Builder(context)

                .setTitle(title)

                .setSubtitle(subtitle)

                .setAllowedAuthenticators(Authenticators.BIOMETRIC_STRONG or Authenticators.DEVICE_CREDENTIAL)

                .build()

            prompt.authenticate(

                BiometricPrompt.CryptoObject(sig),

                cancel,

                context.mainExecutor,

                object : BiometricPrompt.AuthenticationCallback() {

                    override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {

                        val signed = runCatching {

                            val s = result.cryptoObject.signature ?: sig

                            s.update(message)

                            s.sign()

                        }.getOrNull()

                        if (cont.isActive) cont.resume(signed)

                    }

                    override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {

                        if (cont.isActive) cont.resume(null)

                    }

                },

            )

        }

    }

}

package io.oxygenhub.android.secondfactor

import android.widget.Toast

import androidx.compose.foundation.layout.Arrangement

import androidx.compose.foundation.layout.Column

import androidx.compose.foundation.layout.Row

import androidx.compose.foundation.layout.fillMaxWidth

import androidx.compose.foundation.layout.padding

import androidx.compose.foundation.layout.size

import androidx.compose.foundation.text.KeyboardOptions

import androidx.compose.material3.AlertDialog

import androidx.compose.material3.CircularProgressIndicator

import androidx.compose.material3.FilledTonalButton

import androidx.compose.material3.MaterialTheme

import androidx.compose.material3.OutlinedButton

import androidx.compose.material3.OutlinedTextField

import androidx.compose.material3.Text

import androidx.compose.material3.TextButton

import androidx.compose.runtime.Composable

import androidx.compose.runtime.LaunchedEffect

import androidx.compose.runtime.getValue

import androidx.compose.runtime.mutableStateOf

import androidx.compose.runtime.remember

import androidx.compose.runtime.rememberCoroutineScope

import androidx.compose.runtime.setValue

import androidx.compose.ui.Alignment

import androidx.compose.ui.Modifier

import androidx.compose.ui.platform.LocalContext

import androidx.compose.ui.text.font.FontWeight

import androidx.compose.ui.text.input.KeyboardType

import androidx.compose.ui.unit.dp

import androidx.compose.ui.unit.sp

import androidx.lifecycle.Lifecycle

import androidx.lifecycle.compose.LocalLifecycleOwner

import androidx.lifecycle.compose.collectAsStateWithLifecycle

import androidx.lifecycle.repeatOnLifecycle

import io.oxygenhub.android.api.HubApi

import io.oxygenhub.android.api.HubException

import io.oxygenhub.android.ui.common.Panel

import kotlinx.coroutines.CancellationException

import kotlinx.coroutines.launch

/**

 * Account › Second factor (#32): this phone approves sign-ins and

 * sensitive changes on the web, with a fingerprint, face or the PIN.

 * Adding it needs a code from the authenticator app, which stays the way

 * in when the phone is not to hand.

 */

@Composable

fun SecondFactorCard(api: HubApi, onChanged: () -> Unit = {}) {

    val scope = rememberCoroutineScope()

    // null while asking the hub; then whether this phone approves.

    var on by remember { mutableStateOf<Boolean?>(null) }

    var asking by remember { mutableStateOf(false) }

    var working by remember { mutableStateOf(false) }

    var error by remember { mutableStateOf<String?>(null) }

    LaunchedEffect(Unit) {

        on = try {

            api.authenticators().any { it.isThis } && PhoneKey.exists()

        } catch (e: CancellationException) {

            throw e

        } catch (_: Exception) {

            false

        }

    }

    Panel(Modifier.fillMaxWidth()) {

        Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {

            Text("Second factor", style = MaterialTheme.typography.titleMedium)

            Text(

                when (on) {

                    true -> "This phone approves your sign-ins and sensitive changes on the web: pick the number the browser shows, then your fingerprint, face or PIN."

                    else -> "Approve sign-ins on the web with this phone instead of typing a code. Needs two-factor sign-in turned on (Settings › Security on the hub)."

                },

                style = MaterialTheme.typography.bodyMedium,

                color = MaterialTheme.colorScheme.onSurfaceVariant,

            )

            error?.let { Text(it, color = MaterialTheme.colorScheme.error, style = MaterialTheme.typography.bodySmall) }

            when (on) {

                null -> CircularProgressIndicator(Modifier.size(20.dp), strokeWidth = 2.dp)

                false -> FilledTonalButton(onClick = { error = null; asking = true }, enabled = !working) { Text("Use this phone as a second factor") }

                true -> OutlinedButton(onClick = {

                    working = true

                    scope.launch {

                        try {

                            api.removeAuthenticator()

                            PhoneKey.delete()

                            on = false

                            onChanged()

                        } catch (e: CancellationException) {

                            throw e

                        } catch (e: Exception) {

                            error = e.message ?: "The hub could not be reached."

                        } finally {

                            working = false

                        }

                    }

                }, enabled = !working) { Text("Stop using this phone") }

            }

        }

    }

    if (asking) {

        var code by remember { mutableStateOf("") }

        AlertDialog(

            onDismissRequest = { if (!working) asking = false },

            title = { Text("Use this phone as a second factor") },

            text = {

                Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {

                    Text("Enter the six-digit code your authenticator app shows now. It stays the way in if this phone is lost.")

                    OutlinedTextField(

                        value = code,

                        onValueChange = { code = it.filter(Char::isDigit).take(8) },

                        label = { Text("Code") },

                        singleLine = true,

                        keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.NumberPassword),

                    )

                    error?.let { Text(it, color = MaterialTheme.colorScheme.error, style = MaterialTheme.typography.bodySmall) }

                }

            },

            confirmButton = {

                TextButton(onClick = {

                    working = true

                    error = null

                    scope.launch {

                        try {

                            val key = PhoneKey.create()

                            api.addAuthenticator(key, code)

                            on = true

                            asking = false

                            onChanged()

                        } catch (e: CancellationException) {

                            throw e

                        } catch (e: HubException) {

                            PhoneKey.delete()

                            error = e.message ?: "The hub refused it."

                        } catch (e: Exception) {

                            PhoneKey.delete()

                            error = "This phone could not make a key: ${e.message ?: e::class.simpleName}. A screen lock is needed."

                        } finally {

                            working = false

                        }

                    }

                }, enabled = code.length >= 6 && !working) { Text("Add") }

            },

            dismissButton = { TextButton(onClick = { asking = false }, enabled = !working) { Text("Cancel") } },

        )

    }

}

/**

 * Approvals for this phone, while the app is in front (#32): "Is this

 * you?", the three numbers, and No. Picking a number asks for the

 * fingerprint, face or PIN, then signs.

 */

@Composable

fun ApprovalSheet(vm: ApprovalsViewModel) {

    val owner = LocalLifecycleOwner.current

    LaunchedEffect(owner) { owner.repeatOnLifecycle(Lifecycle.State.RESUMED) { vm.watch() } }

    val context = LocalContext.current

    val waiting by vm.waiting.collectAsStateWithLifecycle()

    val busy by vm.busy.collectAsStateWithLifecycle()

    val said by vm.said.collectAsStateWithLifecycle()

    LaunchedEffect(said) {

        said?.let {

            Toast.makeText(context, it, Toast.LENGTH_LONG).show()

            vm.shown()

        }

    }

    val a = waiting ?: return

    AlertDialog(

        onDismissRequest = {},

        title = { Text(if (a.kind == "signin") "Is this you signing in?" else "Is this you?") },

        text = {

            Column(verticalArrangement = Arrangement.spacedBy(12.dp)) {

                Text(a.what)

                Text("Pick the number your browser shows.", color = MaterialTheme.colorScheme.onSurfaceVariant)

                Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceEvenly, verticalAlignment = Alignment.CenterVertically) {

                    a.choices.forEach { n ->

                        FilledTonalButton(

                            onClick = {

                                vm.approve(a, n) { message ->

                                    PhoneKey.sign(context, "Approve on OxygenHub", a.what, message)

                                }

                            },

                            enabled = !busy,

                        ) { Text("$n", fontSize = 22.sp, fontWeight = FontWeight.Bold) }

                    }

                }

            }

        },

        confirmButton = {},

        dismissButton = { TextButton(onClick = { vm.deny(a) }, enabled = !busy) { Text("No, it is not me") } },

    )

}

package io.oxygenhub.android.secondfactor

import io.oxygenhub.android.FakeHubApi

import io.oxygenhub.android.MainDispatcherRule

import io.oxygenhub.android.api.HubException

import io.oxygenhub.android.api.PendingApproval

import kotlinx.coroutines.test.runTest

import org.junit.Assert.assertEquals

import org.junit.Assert.assertNull

import org.junit.Assert.assertTrue

import org.junit.Rule

import org.junit.Test

class ApprovalsViewModelTest {

    @get:Rule val main = MainDispatcherRule()

    private val signIn = PendingApproval("ab12", "signin", "Sign in from Firefox on Linux, 203.0.113.9", listOf(12, 47, 83))

    @Test

    fun theMessageIsTheOneTheHubChecks() {

        // oxygenhub's auth::phone::message, byte for byte.

        assertEquals("oxygenhub approval v1\nab12\n47\napprove", ApprovalMessage.of("ab12", 47, true).decodeToString())

        assertEquals("oxygenhub approval v1\nab12\n47\ndeny", ApprovalMessage.of("ab12", 47, false).decodeToString())

        assertEquals("00ff10", byteArrayOf(0, -1, 16).toHex())

    }

    @Test

    fun aWaitingApprovalIsShownAndApprovingSignsTheNumberPicked() = runTest {

        val api = FakeHubApi()

        api.approvals = { listOf(signIn) }

        val vm = ApprovalsViewModel(api)

        vm.check()

        assertEquals(signIn, vm.waiting.value)

        var signed: String? = null

        vm.approve(signIn, 47) { m -> signed = m.decodeToString(); byteArrayOf(1, 2) }

        assertEquals("oxygenhub approval v1\nab12\n47\napprove", signed)

        assertEquals(listOf(Triple("ab12", true, 47L)), api.answers)

        assertTrue(api.calls.contains("answer ab12 true 47 true"))

        assertNull("answered: not shown again", vm.waiting.value)

        assertEquals("Approved: the browser is signing in.", vm.said.value)

        vm.check()

        assertNull("still listed until the hub catches up, but not shown again", vm.waiting.value)

    }

    @Test

    fun backingOutOfThePromptSendsNothing() = runTest {

        val api = FakeHubApi()

        api.approvals = { listOf(signIn) }

        val vm = ApprovalsViewModel(api)

        vm.check()

        vm.approve(signIn, 47) { null }

        assertTrue(api.answers.isEmpty())

        assertEquals(signIn, vm.waiting.value)

        assertTrue(vm.said.value!!.startsWith("Not approved"))

    }

    @Test

    fun aWrongNumberAndANoAreSaidPlainly() = runTest {

        val api = FakeHubApi()

        api.approvals = { listOf(signIn) }

        api.answerState = { n -> if (n == 47L) "approved" else "denied" }

        val vm = ApprovalsViewModel(api)

        vm.check()

        vm.approve(signIn, 12) { byteArrayOf(1) }

        assertTrue(vm.said.value!!.contains("not the number"))

        val other = signIn.copy(id = "cd34")

        api.approvals = { listOf(other) }

        vm.check()

        vm.deny(other)

        assertEquals(Triple("cd34", false, 0L), api.answers.last())

        assertTrue(vm.said.value!!.startsWith("Refused"))

    }

    @Test

    fun aHubThatCannotSayLeavesNothingShown() = runTest {

        val api = FakeHubApi()

        api.approvals = { throw HubException.Http(404, "no such API route") }

        val vm = ApprovalsViewModel(api)

        vm.check()

        assertNull(vm.waiting.value)

    }

}

## Unreleased

- **This phone as your second factor (#32, oxygenhub#356):** Account › Second factor › *Use this phone as a second factor* makes a P-256 key in the Android Keystore that signs only after your fingerprint, face or PIN, and registers it with the hub (with a current code from your authenticator app, which stays the way in if the phone is lost). Signing in on the web, or confirming a sensitive change there, then asks the phone: while the app is open it shows "Is this you?" with three numbers, you pick the one the browser shows, confirm, and the browser carries on; "No, it is not me" refuses. Where the hub sends alerts, an approval wakes the phone and a tap opens the app. Needs OxygenHub with `/api/v1/user/approvals`.

    <!-- The phone as a second factor (#32): the system prompt that opens its key. -->

    <uses-permission android:name="android.permission.USE_BIOMETRIC" />

import io.oxygenhub.android.MainActivity

        // An approval (#32) opens the app, which shows it with its numbers.

        val open = if (alert.kind == "approval") {

            Intent(context, MainActivity::class.java).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_SINGLE_TOP)

        } else {

            Intent(Intent.ACTION_VIEW, Uri.parse(alert.url)).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)

        }

            .setContentTitle(if (alert.kind == "approval") "Is this you? Open to approve" else alert.title.substringBefore(": ", alert.title))

    /** This phone as a second factor (#32, oxygenhub#356): its Keystore key's SubjectPublicKeyInfo in hex and a current app code. */

    suspend fun addAuthenticator(publicKey: String, code: String): Authenticator

    /** The account's phones that approve. */

    suspend fun authenticators(): List<Authenticator>

    /** This phone stops approving. */

    suspend fun removeAuthenticator()

    /** Approvals waiting for this phone's answer. */

    suspend fun approvals(): List<PendingApproval>

    /** Answer an approval: to approve, the number picked and the key's signature (hex DER) over [io.oxygenhub.android.secondfactor.ApprovalMessage]. */

    suspend fun answerApproval(id: String, approve: Boolean, number: Long, signature: String): ApprovalState

    override suspend fun addAuthenticator(publicKey: String, code: String): Authenticator =

        sendJson("POST", url("user", "authenticators"), buildJsonObject {

            put("public_key", publicKey)

            put("code", code)

        }, Authenticator.serializer())

    override suspend fun authenticators(): List<Authenticator> = get(url("user", "authenticators"), ListSerializer(Authenticator.serializer()))

    override suspend fun removeAuthenticator() {

        send("DELETE", url("user", "authenticators"))

    }

    override suspend fun approvals(): List<PendingApproval> = get(url("user", "approvals"), ListSerializer(PendingApproval.serializer()))

    override suspend fun answerApproval(id: String, approve: Boolean, number: Long, signature: String): ApprovalState =

        sendJson("POST", url("user", "approvals", id), buildJsonObject {

            put("approve", approve)

            put("number", number)

            put("signature", signature)

        }, ApprovalState.serializer())

/** A phone that approves for its account (oxygenhub#356, #32). */

@Serializable

data class Authenticator(

    val id: Long,

    val name: String = "",

    @SerialName("created_ms") val createdMs: Long = 0,

    @SerialName("last_used_ms") val lastUsedMs: Long = 0,

    /** This phone. */

    @SerialName("this") val isThis: Boolean = false,

)

/** An approval waiting for this phone: a sign-in or a sensitive change on the web. */

@Serializable

data class PendingApproval(

    val id: String,

    /** `signin` or `stepup`. */

    val kind: String = "",

    val what: String = "",

    /** The three numbers to offer; the browser shows one of them. */

    val choices: List<Long> = emptyList(),

    @SerialName("created_ms") val createdMs: Long = 0,

    @SerialName("expires_ms") val expiresMs: Long = 0,

)

@Serializable

data class ApprovalState(val state: String = "")

import io.oxygenhub.android.secondfactor.SecondFactorCard

                SecondFactorCard(api)

import io.oxygenhub.android.secondfactor.ApprovalSheet

import io.oxygenhub.android.secondfactor.ApprovalsViewModel

import io.oxygenhub.android.secondfactor.PhoneKey

        // Approvals for this phone, when it is a second factor (#32).

        LaunchedEffect(Unit) { PhoneKey.refresh() }

        val approves by PhoneKey.present.collectAsStateWithLifecycle()

        if (approves) ApprovalSheet(rememberViewModel { ApprovalsViewModel(api) })

    var approvals: () -> List<io.oxygenhub.android.api.PendingApproval> = { emptyList() }

    var answers = mutableListOf<Triple<String, Boolean, Long>>()

    var answerState: (Long) -> String = { "approved" }

    var authenticators: () -> List<io.oxygenhub.android.api.Authenticator> = { emptyList() }

    var addAuthenticator: (String, String) -> io.oxygenhub.android.api.Authenticator = { _, _ -> io.oxygenhub.android.api.Authenticator(1, "phone", isThis = true) }

    override suspend fun addAuthenticator(publicKey: String, code: String) = addAuthenticator.invoke(publicKey, code).also { calls += "add authenticator" }

    override suspend fun authenticators() = authenticators.invoke().also { calls += "authenticators" }

    override suspend fun removeAuthenticator() {

        calls += "remove authenticator"

    }

    override suspend fun approvals() = approvals.invoke().also { calls += "approvals" }

    override suspend fun answerApproval(id: String, approve: Boolean, number: Long, signature: String): io.oxygenhub.android.api.ApprovalState {

        calls += "answer $id $approve $number ${signature.isNotEmpty()}"

        answers += Triple(id, approve, number)

        return io.oxygenhub.android.api.ApprovalState(if (approve) answerState(number) else "denied")

    }