@amityco/social-plus-vise 0.8.1 → 0.12.2

package/rules/live-data.yaml

@@ -8,10 +8,35 @@
       "title": "Android live data observers must be cleaned up",
       "severity": "warning",
       "rationale": "Live Object and Live Collection observers should be disposed when their lifecycle owner ends.",
-      "applies_when": { "platforms": ["android"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "android"
+        ],
+        "outcomes": [
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.live.cleanup" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "android.live.cleanup"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "lifecycle_owner",
+              "description": "Lifecycle owner and cleanup location.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
       }
     },
     {
@@ -20,10 +45,35 @@
       "title": "Flutter live data subscriptions must be cleaned up",
       "severity": "warning",
       "rationale": "Live Object and Live Collection subscriptions should be cancelled from dispose or equivalent cleanup.",
-      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "flutter"
+        ],
+        "outcomes": [
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.live.cleanup" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "flutter.live.cleanup"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "lifecycle_owner",
+              "description": "Lifecycle owner and cleanup location.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
       }
     },
     {
@@ -32,10 +82,35 @@
       "title": "TypeScript live data subscriptions must be cleaned up",
       "severity": "warning",
       "rationale": "Live Object and Live Collection subscriptions should be unsubscribed from the owning component, route, or store lifecycle.",
-      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "typescript"
+        ],
+        "outcomes": [
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.live.cleanup" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "typescript.live.cleanup"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "lifecycle_owner",
+              "description": "Lifecycle owner and cleanup location.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
       }
     },
     {
@@ -44,10 +119,35 @@
       "title": "React Native live data subscriptions must be cleaned up",
       "severity": "warning",
       "rationale": "Live Object and Live Collection subscriptions should be unsubscribed from the owning component, route, or store lifecycle.",
-      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.live.cleanup" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.live.cleanup"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "lifecycle_owner",
+              "description": "Lifecycle owner and cleanup location.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
       }
     },
     {
@@ -56,10 +156,35 @@
       "title": "iOS live data observers must be cleaned up",
       "severity": "warning",
       "rationale": "Live Object and Live Collection notification tokens should be invalidated when the view, controller, or owning object's lifecycle ends.",
-      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "ios"
+        ],
+        "outcomes": [
+          "setup-live-data",
+          "add-feed",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.live.cleanup" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location (deinit, viewWillDisappear, etc.).", "upload_policy": "upload-with-consent" }] }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "ios.live.cleanup"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "lifecycle_owner",
+              "description": "Lifecycle owner and cleanup location (deinit, viewWillDisappear, etc.).",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
       }
     },
     {
@@ -68,11 +193,42 @@
       "title": "Android list UIs should use reactive LiveCollections",
       "severity": "warning",
       "rationale": "Using one-shot Future-style queries for lists means the feed won't update when a new item is created. Use the reactive LiveCollection/observe API instead.",
-      "applies_when": { "platforms": ["android"], "outcomes": ["add-feed", "add-comments", "add-chat", "setup-live-data", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "android"
+        ],
+        "outcomes": [
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "setup-live-data",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.live-collection.api-mismatch" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "query_lifetime", "description": "Why a one-shot query is appropriate here (e.g. static search).", "upload_policy": "upload-with-consent" }] }
-      }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "android.live-collection.api-mismatch"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "query_lifetime",
+              "description": "Why a one-shot query is appropriate here (e.g. static search).",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "OutOfMemoryError",
+        "Subscription leak"
+      ]
     },
     {
       "id": "flutter.live-collection.api-mismatch",
@@ -80,11 +236,42 @@
       "title": "Flutter list UIs should use reactive LiveCollections",
       "severity": "warning",
       "rationale": "Using one-shot Future-style queries for lists means the feed won't update when a new item is created. Use the reactive LiveCollection/listen API instead.",
-      "applies_when": { "platforms": ["flutter"], "outcomes": ["add-feed", "add-comments", "add-chat", "setup-live-data", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "flutter"
+        ],
+        "outcomes": [
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "setup-live-data",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.live-collection.api-mismatch" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "query_lifetime", "description": "Why a one-shot query is appropriate here.", "upload_policy": "upload-with-consent" }] }
-      }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "flutter.live-collection.api-mismatch"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "query_lifetime",
+              "description": "Why a one-shot query is appropriate here.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "OutOfMemoryError",
+        "Subscription leak"
+      ]
     },
     {
       "id": "ios.live-collection.api-mismatch",
@@ -92,23 +279,85 @@
       "title": "iOS list UIs should use reactive LiveCollections",
       "severity": "warning",
       "rationale": "Using one-shot Future-style queries for lists means the feed won't update when a new item is created. Use the reactive observe API instead.",
-      "applies_when": { "platforms": ["ios"], "outcomes": ["add-feed", "add-comments", "add-chat", "setup-live-data", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "ios"
+        ],
+        "outcomes": [
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "setup-live-data",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.live-collection.api-mismatch" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "query_lifetime", "description": "Why a one-shot query is appropriate here.", "upload_policy": "upload-with-consent" }] }
-      }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "ios.live-collection.api-mismatch"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "query_lifetime",
+              "description": "Why a one-shot query is appropriate here.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "OutOfMemoryError",
+        "Subscription leak"
+      ]
     },
     {
       "id": "typescript.live-collection.api-mismatch",
       "version": 1,
       "title": "TypeScript list UIs should use reactive LiveCollections",
       "severity": "warning",
-      "rationale": "Using one-shot Promise-style queries for lists means the feed won't update when a new item is created. Use the reactive onData API instead.",
-      "applies_when": { "platforms": ["typescript"], "outcomes": ["add-feed", "add-comments", "add-chat", "setup-live-data", "validate-setup"] },
+      "rationale": "Using one-shot Promise-style queries for lists means the feed won't update when a new item is created. Use the reactive onData API instead, and preserve existing pagination/query wiring while converting the list to live updates.",
+      "applies_when": {
+        "platforms": [
+          "typescript"
+        ],
+        "outcomes": [
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "setup-live-data",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.live-collection.api-mismatch" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "query_lifetime", "description": "Why a one-shot query is appropriate here.", "upload_policy": "upload-with-consent" }] }
-      }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "typescript.live-collection.api-mismatch"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "query_lifetime",
+              "description": "Why a one-shot query is appropriate here.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "OutOfMemoryError",
+        "Subscription leak"
+      ]
     },
     {
       "id": "react-native.live-collection.api-mismatch",
@@ -116,11 +365,42 @@
       "title": "React Native list UIs should use reactive LiveCollections",
       "severity": "warning",
       "rationale": "Using one-shot Promise-style queries for lists means the feed won't update when a new item is created. Use the reactive onData API instead.",
-      "applies_when": { "platforms": ["react-native"], "outcomes": ["add-feed", "add-comments", "add-chat", "setup-live-data", "validate-setup"] },
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "add-feed",
+          "add-comments",
+          "add-chat",
+          "setup-live-data",
+          "validate-setup"
+        ]
+      },
       "enforcement": {
-        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.live-collection.api-mismatch" }],
-        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "query_lifetime", "description": "Why a one-shot query is appropriate here.", "upload_policy": "upload-with-consent" }] }
-      }
+        "deterministic": [
+          {
+            "check": "validator-finding-absent",
+            "finding_rule_id": "react-native.live-collection.api-mismatch"
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "query_lifetime",
+              "description": "Why a one-shot query is appropriate here.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      },
+      "symptoms": [
+        "OutOfMemoryError",
+        "Subscription leak"
+      ]
     }
   ]
 }

package/rules/push.yaml

@@ -541,6 +541,146 @@
           ]
         }
       }
+    },
+    {
+      "id": "react-native.push.apns-token-before-fcm",
+      "version": 1,
+      "title": "React Native iOS must retrieve APNs token before fetching FCM token",
+      "severity": "warning",
+      "rationale": "On iOS, calling Firebase messaging().getToken() before the APNs token is registered with Firebase yields an error or generates an invalid FCM token. You must retrieve the APNs token first by calling messaging().getAPNSToken() and ensuring it is available before requesting the FCM token.",
+      "feedforward": "You MUST verify that messaging().getAPNSToken() is called and returns a valid token before calling messaging().getToken() on iOS.",
+      "applies_when": {
+        "platforms": [
+          "react-native"
+        ],
+        "outcomes": [
+          "setup-push",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "inferential": {
+          "prompt": "Review the React Native Push Notification setup. Does the code ensure messaging().getAPNSToken() successfully returns a token on iOS before calling messaging().getToken()?",
+          "target_signer": "host-agent"
+        },
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "apns_token_check",
+              "description": "How the application ensures the APNs token is fetched and verified on iOS before requesting the FCM token.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "ios.push.apns-credentials-configured",
+      "version": 1,
+      "title": "iOS APNs credentials must be correctly configured and uploaded",
+      "severity": "warning",
+      "rationale": "To deliver push notifications to iOS devices, Apple Push Notification service (APNs) credentials (.p12 certificate or .p8 private key) must be generated on the Apple Developer portal and uploaded to the Amity Admin Console. When generating credentials, selecting 'Apple Push Notification service SSL (Sandbox & Production)' ensures a single certificate covers both development and production. If your architecture uses a Firebase FCM bridge, the APNs private key or certificate must also be uploaded to the Firebase Console, and credentials must not be expired.",
+      "feedforward": "You MUST upload a valid, non-expired APNs certificate (.p12) or private key (.p8) to the Amity Admin Console, ensuring it is generated as 'Apple Push Notification service SSL (Sandbox & Production)'. If using the FCM bridge, you MUST also upload the APNs key to your Firebase project settings.",
+      "applies_when": {
+        "platforms": [
+          "ios"
+        ],
+        "outcomes": [
+          "setup-push",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "inferential": {
+          "prompt": "Review the iOS Push Notification integration. Has a Sandbox & Production APNs credential (.p12 or .p8) been uploaded to the Amity Admin Console? If using FCM, has the APNs key also been uploaded to Firebase?",
+          "target_signer": "host-agent"
+        },
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "credentials_upload_verification",
+              "description": "Evidence or confirmation of the Sandbox & Production APNs credentials uploaded to the Amity Admin Console (and Firebase if using FCM).",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "ios.push.app-entitlements-enabled",
+      "version": 1,
+      "title": "iOS application capability and App ID must match push credentials",
+      "severity": "warning",
+      "rationale": "Push notifications require the Push Notifications capability to be enabled in the Xcode project (under Signing & Capabilities). In addition, the App ID/Bundle ID of the iOS application must match the Bundle ID associated with the uploaded APNs certificate or key.",
+      "feedforward": "You MUST enable the 'Push Notifications' capability in Xcode and verify that the application's Bundle ID matches the App ID of the uploaded APNs certificate.",
+      "applies_when": {
+        "platforms": [
+          "ios"
+        ],
+        "outcomes": [
+          "setup-push",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "inferential": {
+          "prompt": "Review the Xcode project configuration. Is the 'Push Notifications' capability enabled under Signing & Capabilities, and does the Bundle ID match the uploaded APNs credentials?",
+          "target_signer": "host-agent"
+        },
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "entitlements_verification",
+              "description": "Details showing the enabled Push Notifications capability and Bundle ID in the Xcode project settings.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    },
+    {
+      "id": "ios.push.testing-environment-requirements",
+      "version": 1,
+      "title": "iOS push notifications must be tested on a real device with proper build configuration",
+      "severity": "warning",
+      "rationale": "Apple does not support receiving remote push notifications on the iOS Simulator; testing must be performed on a physical iOS device. When testing with a production APNs certificate, the app must be a production/TestFlight build. Additionally, user notification permissions must be explicitly granted, and the device must not be in Do Not Disturb (DND) or Focus mode, as these OS states suppress notification delivery.",
+      "feedforward": "You MUST test remote push notifications on a physical iOS device (not the simulator) using a TestFlight or App Store build when testing production certificates. Verify that the user has granted notification permissions and the device is not in Do Not Disturb or Focus mode.",
+      "applies_when": {
+        "platforms": [
+          "ios"
+        ],
+        "outcomes": [
+          "setup-push",
+          "validate-setup"
+        ]
+      },
+      "enforcement": {
+        "inferential": {
+          "prompt": "Review the push notification testing setup. Is verification performed on a physical iOS device using a TestFlight/production build (for production certs) with granted notifications permissions and Focus/DND mode off?",
+          "target_signer": "host-agent"
+        },
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "testing_setup_verification",
+              "description": "Confirmation of testing on a real device, build configuration (production/TestFlight for prod cert), user permission check, and Focus/DND check.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
     }
   ]
 }