@necessarysdk/react-native 0.0.0-stage → 0.1.6

package/lib/deviceTrust.js

@@ -0,0 +1,699 @@
+"use strict";
+/**
+ * DeviceTrust: the one object an app configures -- its backend, the personal measurements it
+ * enables, step-up and the app PIN -- and what it asks of it: start, scan, and sign a request (the
+ * public guide).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceTrust = exports.ScanResult = exports.AppPinOptions = exports.personalMeasurements = exports.PersonalMeasurement = void 0;
+const client_1 = require("./client");
+const collector_1 = require("./collector");
+const errors_1 = require("./errors");
+const installationStore_1 = require("./installationStore");
+const protocol_1 = require("./protocol");
+const reinstallHint_1 = require("./reinstallHint");
+const report_1 = require("./report");
+const requestProof_1 = require("./requestProof");
+const stepUpKey_1 = require("./stepUpKey");
+const transport_1 = require("./transport");
+const answers_1 = require("./util/answers");
+/**
+ * The personal measurements an app may enable (the public guide, section 8). Each is collected
+ * only when the backend asks for it as well -- the location only with the person's permission too.
+ */
+exports.PersonalMeasurement = {
+    localAddresses: 'local_addresses',
+    accessibility: 'accessibility',
+    notificationAccess: 'notification_access',
+    otherAccess: 'other_access',
+    screenCapture: 'screen_capture',
+    location: 'location',
+    mockLocation: 'mock_location',
+};
+/** Every personal measurement, in the guide's order. */
+exports.personalMeasurements = Object.values(exports.PersonalMeasurement);
+/** Where the backend takes the app PIN's two calls (the public guide, section 4). */
+class AppPinOptions {
+    constructor(options = {}) {
+        this.path = options.path ?? client_1.DeviceTrustClient.appPinPath;
+        this.proofPath = options.proofPath ?? client_1.DeviceTrustClient.appPinProofPath;
+    }
+}
+exports.AppPinOptions = AppPinOptions;
+/** One scan: the challenge it answered, the report as signed, and the backend's answer, whole. */
+class ScanResult {
+    constructor(value) {
+        this.challenge = value.challenge;
+        this.report = value.report;
+        this.answer = value.answer;
+    }
+    /** The stored report (`integrity.report_id`), which a scan made for one request sends back with that request. */
+    get reportId() {
+        const integrity = this.answer['integrity'];
+        const id = typeof integrity === 'object' && integrity !== null ? integrity['report_id'] : null;
+        return typeof id === 'string' ? id : null;
+    }
+}
+exports.ScanResult = ScanResult;
+function settled(promise) {
+    return promise.then(() => undefined, () => undefined);
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+class DeviceTrust {
+    constructor(options) {
+        this.identityValue = null;
+        this.session = null;
+        // One call of each kind in flight; a second waits for the first's result.
+        this.loading = null;
+        this.starting = null;
+        this.proving = null;
+        this.scanning = new Map();
+        // Which installation the calls running now belong to: reset() and close() move on to the next,
+        // and a call of an earlier one keeps nothing it finds.
+        this.generation = 0;
+        // A reset's deletion, which every later load waits for; and the installation ID being saved and a
+        // re-enrolment, which a reset waits for.
+        this.resetting = null;
+        this.saving = null;
+        this.reenrolling = null;
+        // The persistent writes and key changes running now (mutate): a reset waits for each before it
+        // deletes, so none outlives the deletion.
+        this.mutations = new Set();
+        this.offeredStepUpKey = null;
+        this.hint = null;
+        this.hintRead = false;
+        /** Why step-up is off on this phone although the app turned it on -- no screen lock, say -- or null. */
+        this.stepUpUnavailable = null;
+        const transport = options.transport ?? new transport_1.HttpTransport(options.baseUrl ?? '');
+        this.client = new client_1.DeviceTrustClient(transport, options.platform ? { platform: options.platform } : {});
+        this.personalMeasurements = new Set(options.personalMeasurements ?? []);
+        this.stepUp = options.stepUp ?? null;
+        this.appPin = options.appPin ?? null;
+        this.onRegistered = options.onRegistered ?? null;
+        this.store = options.store ?? new installationStore_1.InstallationStore();
+        this.collector = options.collector ?? new collector_1.NativeIntegrityCollector();
+        this.hintReader = options.hintReader ?? new reinstallHint_1.ReinstallHintReader();
+        this.stepUpKeyNative = options.stepUpKey ?? new stepUpKey_1.NativeStepUpKey();
+    }
+    /** The same over the app's own [transport]; [parts] replace the native ones in tests. */
+    static over(transport, parts = {}) {
+        return new DeviceTrust({ ...parts, transport });
+    }
+    get identity() {
+        return this.identityValue;
+    }
+    /** The installation session from proving the key, or null before [start]. */
+    get installationSession() {
+        return this.session;
+    }
+    /** The step-up key offered at the last registration. */
+    get stepUpKey() {
+        return this.offeredStepUpKey;
+    }
+    /** The wire names of [personalMeasurements], in the guide's order. */
+    get enabledMeasurements() {
+        return exports.personalMeasurements.filter((measurement) => this.personalMeasurements.has(measurement));
+    }
+    /**
+     * The installation: its key, made on first use, and its ID. A key made now is a new installation
+     * ([InstallationIdentity.createdThisLaunch]): whatever the app kept for the one before belongs to
+     * that one. Calls at once share one load, so one key gets one ID.
+     */
+    loadIdentity() {
+        const known = this.identityValue;
+        if (known !== null) {
+            return Promise.resolve(known);
+        }
+        const running = this.loading;
+        if (running !== null) {
+            return running;
+        }
+        const loading = this.load().finally(() => {
+            if (this.loading === loading) {
+                this.loading = null;
+            }
+        });
+        this.loading = loading;
+        return loading;
+    }
+    async load() {
+        // A reset's deletion first, so that nothing loads the key it deletes.
+        await this.resetting;
+        const generation = this.generation;
+        const loaded = await this.store.loadOrCreate();
+        this.current(generation);
+        if (this.identityValue === null) {
+            this.identityValue = loaded;
+        }
+        return this.identityValue;
+    }
+    /**
+     * A persistent write or a key change for the installation [generation]: refused before it starts
+     * when reset() or close() has ended that installation, and waited for by a reset that began while
+     * it ran. The order is the whole guarantee: endCalls() moves the generation on at once, in the
+     * same turn as reset() is called, so a write asked for after that throws here without writing;
+     * one asked for before is in [mutations], which the reset waits for before it deletes anything.
+     */
+    mutate(generation, change) {
+        this.current(generation);
+        const running = change();
+        const tracked = settled(running);
+        this.mutations.add(tracked);
+        void tracked.then(() => this.mutations.delete(tracked));
+        return running;
+    }
+    /** Throws when reset() or close() ended the installation [generation] belongs to: a call keeps nothing of one that is gone. */
+    current(generation) {
+        if (generation !== this.generation) {
+            throw new errors_1.InterruptedCallException('The installation was reset, or the client closed, while this call ran: nothing it found was kept.');
+        }
+    }
+    /**
+     * Loads or makes the key, registers it -- with the step-up key, when step-up is on -- and proves
+     * the installation holds it: the installation session. A refusal outside the guide's protocol
+     * errors goes to the app as it came. A second call while one runs gets its result.
+     */
+    start() {
+        const running = this.starting;
+        if (running !== null) {
+            return running;
+        }
+        const starting = this.startOnce().finally(() => {
+            if (this.starting === starting) {
+                this.starting = null;
+            }
+        });
+        this.starting = starting;
+        return starting;
+    }
+    async startOnce() {
+        const generation = this.generation;
+        await this.loadIdentity();
+        await this.register(generation);
+        await this.prove();
+        this.current(generation);
+        return this.identityValue;
+    }
+    /** A new installation session: the key's challenge, answered. A second call while one runs gets its result. */
+    prove() {
+        const running = this.proving;
+        if (running !== null) {
+            return running;
+        }
+        const proving = this.proveOnce(this.generation, false).finally(() => {
+            if (this.proving === proving) {
+                this.proving = null;
+            }
+        });
+        this.proving = proving;
+        return proving;
+    }
+    /**
+     * Deletes the key, the installation ID (InstallationStore.clear) and the step-up key, and forgets
+     * the session: the next start is a new installation, linked to this one by nothing it holds.
+     * Calls still running end with InterruptedCallException and keep nothing; calls made from now on
+     * wait for the deletion, and never join one made before.
+     */
+    reset() {
+        const loading = this.loading;
+        const saving = this.saving;
+        const reenrolling = this.reenrolling;
+        const earlier = this.resetting;
+        const changing = Array.from(this.mutations);
+        this.endCalls();
+        this.offeredStepUpKey = null;
+        this.hint = null;
+        this.hintRead = false;
+        const deleting = (async () => {
+            await earlier;
+            // A load or a save still running finishes first, so that nothing it writes outlives the
+            // deletion. So does a re-enrolment: its key, which a backend may already have taken, is
+            // deleted after it, and the marker it writes is cleared. So does every write and key change
+            // still running (mutate): the step-up marker, a step-up key being made.
+            await Promise.all([
+                ...(loading !== null ? [settled(loading)] : []),
+                ...(saving !== null ? [settled(saving)] : []),
+                ...(reenrolling !== null ? [reenrolling] : []),
+                ...changing,
+            ]);
+            await this.store.clear();
+            // The step-up key goes with the installation, as on a reinstall: kept, it would link the next
+            // installation to this one. None to delete is no failure; nor is a phone or a build with no
+            // step-up key at all. A key that stays is: reset() fails with it, the installation itself
+            // gone, so the app knows and may call reset() again.
+            try {
+                await this.stepUpKeyNative.deleteKey();
+            }
+            catch (error) {
+                if (!(error instanceof errors_1.NativeKeyException)) {
+                    throw error;
+                }
+                if (error.code !== 'NATIVE_STEPUP_PLUGIN_MISSING' && error.code !== 'UNSUPPORTED_ANDROID_VERSION') {
+                    throw new errors_1.NativeKeyException(error.code, `The installation was reset, but its step-up key could not be deleted: ${error.message} Call reset() again.`);
+                }
+            }
+        })();
+        // Later loads wait for the deletion, whatever came of it; the caller of reset hears what did.
+        this.resetting = settled(deleting);
+        return deleting;
+    }
+    /** Moves on to the next installation: the calls running now keep nothing, and the next ones start afresh. */
+    endCalls() {
+        this.generation++;
+        this.identityValue = null;
+        this.session = null;
+        this.loading = null;
+        this.starting = null;
+        this.proving = null;
+        this.scanning.clear();
+    }
+    async proveOnce(generation, retried) {
+        const identity = await this.loadIdentity();
+        this.current(generation);
+        try {
+            const challenge = await this.client.createInstallationChallenge(identity.installationId);
+            const payload = (0, answers_1.answerText)(challenge, 'payload');
+            const verified = await this.client.verifyInstallation({
+                installationId: identity.installationId,
+                challengeId: (0, answers_1.answerText)(challenge, 'challenge_id'),
+                payload,
+                signature: await identity.signPayload(payload),
+            });
+            this.current(generation);
+            this.session = (0, answers_1.answerText)(verified, 'device_token');
+            return this.session;
+        }
+        catch (error) {
+            if (!(error instanceof errors_1.ApiException) || retried) {
+                throw error;
+            }
+            switch ((0, protocol_1.protocolStepFor)(error, { deviceSession: true })) {
+                case protocol_1.ProtocolStep.askAgain:
+                    break;
+                case protocol_1.ProtocolStep.registerAgain:
+                    await this.register(generation);
+                    break;
+                case protocol_1.ProtocolStep.waitThenRetry:
+                    await delay((0, protocol_1.protocolWait)(error));
+                    break;
+                case protocol_1.ProtocolStep.proveAgain:
+                case protocol_1.ProtocolStep.stop:
+                    throw error;
+            }
+            return this.proveOnce(generation, true);
+        }
+    }
+    async register(generation) {
+        const identity = await this.loadIdentity();
+        this.current(generation);
+        if (!this.hintRead) {
+            const hint = await this.hintReader.read();
+            this.current(generation);
+            this.hint = hint;
+            this.hintRead = true;
+        }
+        const offered = await this.prepareStepUpKey(generation);
+        const answer = await this.client.registerInstallation(identity, this.hint, { stepUpKey: offered });
+        this.current(generation);
+        // The key is the installation's identity: a backend that holds it under another ID answers with
+        // that one, which is kept.
+        const held = answer['installation_id'];
+        if (typeof held === 'string' && held.length > 0 && held !== identity.installationId) {
+            this.identityValue = identity.withInstallationId(held);
+            const saving = this.store.saveInstallationId(held);
+            this.saving = saving;
+            await saving;
+        }
+        await this.settleStepUpKey(answer, offered, generation);
+        await this.onRegistered?.(answer);
+    }
+    /**
+     * Whether the backend holds the step-up key offered: it takes one only when it first registers an
+     * installation, so a key made later -- after the screen lock was removed and set again, say -- it
+     * takes by re-enrolment alone. Its answer says so (`stepup_key_matches`, or for an installation
+     * new to it `stepup_key_registered`); until it holds this key, approvals wait for reenrolStepUp,
+     * across restarts too. A registration without a key, the phone unable to make one, leaves any key
+     * made later waiting the same way. A backend whose answer says nothing is taken at its word unless
+     * a re-enrolment is pending.
+     */
+    async settleStepUpKey(answer, offered, generation) {
+        if (this.stepUp === null) {
+            return;
+        }
+        const matches = answer['stepup_key_matches'];
+        const registered = answer['stepup_key_registered'];
+        const bound = offered === null
+            ? null
+            : typeof matches === 'boolean'
+                ? matches
+                : typeof registered === 'boolean'
+                    ? registered
+                    : null;
+        if (offered === null || bound === false) {
+            await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
+        }
+        else if (bound === true) {
+            await this.mutate(generation, () => this.store.setStepUpReenrolPending(false));
+        }
+        const pending = offered !== null && bound !== true && (await this.store.stepUpReenrolPending());
+        this.current(generation);
+        if (pending) {
+            this.offeredStepUpKey = null;
+            this.stepUpUnavailable = DeviceTrust.reenrolPending();
+        }
+    }
+    /**
+     * The step-up key as [stepUp] asks: an existing key is kept as it is. Step-up is optional, so a
+     * key the phone cannot make leaves it off. Its use waits for the backend's answer
+     * (settleStepUpKey).
+     */
+    async prepareStepUpKey(generation) {
+        const options = this.stepUp;
+        if (options === null) {
+            this.stepUpUnavailable = null;
+            this.offeredStepUpKey = null;
+            return null;
+        }
+        this.stepUpKeyNative.configuredMode = options.mode;
+        let key = null;
+        let unavailable = null;
+        try {
+            key = await this.mutate(generation, () => this.stepUpKeyNative.getOrCreateKey({
+                factor: options.factor,
+                mode: options.mode,
+                windowSeconds: options.windowSeconds,
+            }));
+        }
+        catch (error) {
+            if (!(error instanceof errors_1.NativeKeyException)) {
+                throw error;
+            }
+            unavailable = error;
+        }
+        this.current(generation);
+        this.stepUpUnavailable = unavailable;
+        this.offeredStepUpKey = key;
+        return key;
+    }
+    /** A step-up key a re-enrolment replaces: one that can never sign again, or one the keystore cannot vouch for. */
+    static replaceableKey(error) {
+        return error.code === 'STEPUP_KEY_INVALIDATED' || error.code === 'STEPUP_KEY_UNAVAILABLE';
+    }
+    /** What approvals answer while the backend does not hold the step-up key. */
+    static reenrolPending() {
+        return new errors_1.NativeKeyException('STEPUP_REENROL_PENDING', 'The backend does not hold this step-up key -- a re-enrolment unfinished, or a key made after the ' +
+            'installation was registered: reenrolStepUp() first.');
+    }
+    /**
+     * A scan: under the installation session -- or, for a scan that approves one [operation]
+     * ([describeOperation]), under the app's account [session] for this installation, the one that
+     * will send that request. The guide's protocol errors are acted on once; an account session is
+     * the app's to renew. A second call for the same scan while one runs gets its result; a scan
+     * whose answer was lost is simply asked for again.
+     */
+    scan(options = {}) {
+        const session = options.session ?? null;
+        const operation = options.operation ?? null;
+        if (operation !== null && session === null) {
+            throw new TypeError('session: a scan for one operation is asked under the account session that will send it');
+        }
+        // The personal measurements enabled now are part of the scan: one asked for after the person
+        // changed them never joins one asked for before.
+        const enabled = this.enabledMeasurements;
+        const kind = JSON.stringify([session, operation, enabled]);
+        const running = this.scanning.get(kind);
+        if (running !== undefined) {
+            return running;
+        }
+        const scanning = this.scanWithProtocol(this.generation, session, operation, enabled).finally(() => {
+            if (this.scanning.get(kind) === scanning) {
+                this.scanning.delete(kind);
+            }
+        });
+        this.scanning.set(kind, scanning);
+        return scanning;
+    }
+    async scanWithProtocol(generation, session, operation, enabled) {
+        try {
+            return await this.scanOnce(generation, session, operation, enabled);
+        }
+        catch (error) {
+            if (!(error instanceof errors_1.ApiException)) {
+                throw error;
+            }
+            const installationSession = session === null;
+            switch ((0, protocol_1.protocolStepFor)(error, { deviceSession: installationSession })) {
+                case protocol_1.ProtocolStep.askAgain:
+                    break;
+                case protocol_1.ProtocolStep.proveAgain:
+                    await this.prove();
+                    break;
+                case protocol_1.ProtocolStep.registerAgain:
+                    // An account session belongs to the installation the backend lost: the app signs in again.
+                    if (!installationSession) {
+                        throw error;
+                    }
+                    await this.register(generation);
+                    await this.prove();
+                    break;
+                case protocol_1.ProtocolStep.waitThenRetry:
+                    await delay((0, protocol_1.protocolWait)(error));
+                    break;
+                case protocol_1.ProtocolStep.stop:
+                    throw error;
+            }
+            return this.scanOnce(generation, session, operation, enabled);
+        }
+    }
+    async scanOnce(generation, session, operation, enabled) {
+        const identity = await this.loadIdentity();
+        const bearer = session ?? this.session ?? (await this.prove());
+        this.current(generation);
+        const challenge = await this.client.integrityChallenge({ session: bearer, identity, operation });
+        const report = await (0, report_1.collectReport)({
+            challenge,
+            identity,
+            collector: this.collector,
+            enabledMeasurements: enabled,
+        });
+        // A report of an installation reset meanwhile is never sent.
+        this.current(generation);
+        const answer = await this.client.submitIntegrityReport({ session: bearer, identity, report });
+        this.current(generation);
+        return new ScanResult({ challenge, report, answer });
+    }
+    /**
+     * Signs one request to your backend under [bearer], your account session: [body] is sent exactly
+     * as given. With [stepUp] the person approves it with the step-up key -- the phone asks, saying
+     * [reason]; with [appPin] the backend checks the PIN for it first; [reportId] names the scan made
+     * for it alone. Send it with RequestProof.headers beside `Authorization: Bearer`, or with [send];
+     * each proof serves this request once.
+     */
+    async signRequest(args) {
+        const generation = this.generation;
+        const identity = await this.loadIdentity();
+        this.current(generation);
+        let approval = null;
+        if (args.stepUp === true) {
+            // Only the key the backend received at registration: a key made later would sign approvals
+            // the backend cannot check.
+            const key = this.offeredStepUpKey;
+            if (key === null) {
+                throw (this.stepUpUnavailable ??
+                    new errors_1.NativeKeyException('STEPUP_OFF', this.stepUp === null
+                        ? 'Step-up is off: new DeviceTrust({ stepUp: new StepUpOptions(), ... }).'
+                        : 'No step-up key was registered: start() first.'));
+            }
+            const reason = args.reason ?? 'Approve this request';
+            approval = {
+                factor: key.factor,
+                sign: (payload) => this.stepUpKeyNative.sign(payload, { reason }),
+            };
+        }
+        let proof = await (0, requestProof_1.signRequest)({
+            identity,
+            method: args.method,
+            path: args.path,
+            bearerToken: args.bearer,
+            encodedBody: args.body ?? '',
+            stepUp: approval,
+        });
+        // The installation reset, or the client closed, while the phone signed: the proof is of an
+        // installation that is gone, and is never handed out.
+        this.current(generation);
+        if (args.appPin != null) {
+            const options = this.appPin;
+            if (options === null) {
+                throw new Error('The app PIN is off: new DeviceTrust({ appPin: new AppPinOptions(), ... }).');
+            }
+            proof = await this.client.proveAppPin({
+                session: args.bearer,
+                identity,
+                pin: args.appPin,
+                request: proof,
+                path: options.proofPath,
+            });
+            this.current(generation);
+        }
+        return args.reportId == null ? proof : proof.withIntegrityReport(args.reportId);
+    }
+    /**
+     * Re-enrols the step-up key under the account [session], with the person's own
+     * [reauthentication] -- the account's password, say: `{password: ...}`. For a key the phone has
+     * lost or can no longer use -- the screen lock removed (`STEPUP_KEY_INVALIDATED`) -- or one made
+     * for other options: the person unlocks the new key to sign its proof, the phone showing
+     * [reason], and the backend takes it for that account alone (the public guide, section 3).
+     * Approvals use it from then on. A key replaced before the backend took the new one -- the person
+     * cancelled, the password was wrong, the answer was lost -- leaves step-up waiting: approvals
+     * answer `STEPUP_REENROL_PENDING`, across restarts too, until a call of this succeeds.
+     */
+    reenrolStepUp(args) {
+        const running = this.reenrolStepUpOnce(args.session, args.reauthentication ?? {}, args.reason ?? 'Confirm your new step-up key');
+        // reset() waits for it, whatever comes of it.
+        this.reenrolling = settled(running);
+        return running;
+    }
+    async reenrolStepUpOnce(session, reauthentication, reason) {
+        const options = this.stepUp;
+        if (options === null) {
+            throw new errors_1.NativeKeyException('STEPUP_OFF', 'Step-up is off: new DeviceTrust({ stepUp: new StepUpOptions(), ... }).');
+        }
+        const generation = this.generation;
+        const identity = await this.loadIdentity();
+        this.current(generation);
+        this.stepUpKeyNative.configuredMode = options.mode;
+        // From here the phone's key and the backend's differ until the backend takes the new one:
+        // approvals wait for that.
+        const holdApprovals = async () => {
+            await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
+            this.current(generation);
+            this.offeredStepUpKey = null;
+            this.stepUpUnavailable = DeviceTrust.reenrolPending();
+        };
+        const newKey = async (replace) => {
+            if (replace) {
+                await holdApprovals();
+                await this.mutate(generation, () => this.stepUpKeyNative.deleteKey());
+            }
+            const made = await this.mutate(generation, () => this.stepUpKeyNative.getOrCreateKey({
+                factor: options.factor,
+                mode: options.mode,
+                windowSeconds: options.windowSeconds,
+            }));
+            // None to replace, the phone having lost it: this one is as new.
+            if (made.created && !replace) {
+                await holdApprovals();
+            }
+            return made;
+        };
+        // A re-enrolment is the explicit recovery: a key the keystore cannot vouch for
+        // (STEPUP_KEY_UNAVAILABLE), or one that can never sign again, is replaced here -- and only here.
+        let key;
+        try {
+            key = await newKey(false);
+        }
+        catch (error) {
+            if (!(error instanceof errors_1.NativeKeyException) || !DeviceTrust.replaceableKey(error)) {
+                throw error;
+            }
+            key = await newKey(true);
+        }
+        if (!key.created && !options.accepts(key)) {
+            key = await newKey(true);
+        }
+        // The new key signs a proof bound to this request's own nonce, which the request proof then
+        // signs too.
+        const nonce = await (0, requestProof_1.freshNonce)();
+        const proveWith = async (current) => {
+            const payload = (0, stepUpKey_1.stepUpReenrolProof)({
+                installationId: identity.installationId,
+                stepUpKeyThumbprint: current.thumbprint,
+                nonce: (0, requestProof_1.base64UrlNoPadding)(nonce),
+                timestamp: nowSeconds(),
+            });
+            return {
+                stepup_key_proof: payload,
+                stepup_key_signature: await this.stepUpKeyNative.sign(payload, { reason }),
+            };
+        };
+        let keyProof;
+        try {
+            keyProof = await proveWith(key);
+        }
+        catch (error) {
+            // A key that died with the screen lock is found only when it signs.
+            if (!(error instanceof errors_1.NativeKeyException) ||
+                (!DeviceTrust.replaceableKey(error) && error.code !== 'STEPUP_KEY_NOT_FOUND')) {
+                throw error;
+            }
+            key = await newKey(true);
+            keyProof = await proveWith(key);
+        }
+        const proof = await (0, requestProof_1.signRequest)({
+            identity,
+            method: 'POST',
+            path: options.reenrolPath,
+            bearerToken: session,
+            encodedBody: JSON.stringify({
+                ...reauthentication,
+                stepup_public_key: key.publicKey,
+                stepup_key_auth: key.authJson,
+                ...keyProof,
+            }),
+            nonce,
+        });
+        const answer = await this.send(proof);
+        await this.mutate(generation, () => this.store.setStepUpReenrolPending(false));
+        this.current(generation);
+        this.offeredStepUpKey = key;
+        this.stepUpUnavailable = null;
+        return answer;
+    }
+    /** Sends [proof]'s request through the SDK's transport. */
+    send(proof) {
+        return this.client.sendSigned(proof);
+    }
+    /**
+     * Sets the account's app PIN under the account [session], with the person's own
+     * [reauthentication] -- the account's password, say: `{password: ...}`.
+     */
+    async setAppPin(args) {
+        const options = this.appPin;
+        if (options === null) {
+            throw new Error('The app PIN is off: new DeviceTrust({ appPin: new AppPinOptions(), ... }).');
+        }
+        const generation = this.generation;
+        const identity = await this.loadIdentity();
+        this.current(generation);
+        const answer = await this.client.setAppPin({
+            session: args.session,
+            identity,
+            pin: args.pin,
+            reauthentication: args.reauthentication ?? {},
+            path: options.path,
+        });
+        this.current(generation);
+        return answer;
+    }
+    /**
+     * Asks the person for the location permission, for the location measurements: from a button on
+     * the app's own screen, since a scan never asks. Answers `precise`, `approximate` or `none`.
+     */
+    requestLocationPermission() {
+        return this.collector.requestLocationPermission();
+    }
+    /**
+     * Closes the transport. Calls still running end with InterruptedCallException, or with the
+     * transport's own failure, and keep nothing; the key and the installation stay as they are.
+     */
+    close() {
+        this.endCalls();
+        this.client.close();
+    }
+}
+exports.DeviceTrust = DeviceTrust;