@necessarysdk/react-native 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.6
+
+- `runtime_maps`, `instrumentation_threads` and iOS `dyld_images` leave the app's own folders, package name
+  and main executable out of what they read as names.
+- Android: `root_shell` keeps the shell's error stream out of `su_path`, where a complaint that `which`
+  is missing would have read as `su` found.
+- Android: a step-up signature that fails after the person approved, with any exception, answers the app;
+  a keystore's `ProviderException` there used to end the app. A location permission request is answered
+  when its activity goes, or the runtime does, with what the app holds then; it used to wait for ever.
+- A step-up key the phone lost and a re-enrolment made again leaves approvals waiting until the backend
+  takes it, like a key replaced.
+- A backend's answer that lacks a field the SDK needs is an `ApiException` (`invalid_backend_answer`): it
+  used to pass unseen, or to be a `TypeError` for a scan's challenge.
+- The Python sample backend answers a malformed request: it used to drop the connection. Its other
+  requests answer as before.
+- `doc/measurements.md`: `installer_package` is left out or null when no installer is named, as the
+  collectors send it; the report's format is the same for every SDK, as it says now.
+
 ## 0.1.5
 
 The first release of Necessary for React Native: the client of the integration guide, for Android and

package/android/src/main/java/com/necessarysdk/reactnative/InstallationKeyManager.kt

@@ -198,7 +198,7 @@ class InstallationKeyManager(private val context: Context) {
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
             throw InstallationKeyFailure(
                 "UNSUPPORTED_ANDROID_VERSION",
-                "This prototype requires Android 6.0 (API 23) or newer.",
+                "The installation key requires Android 6.0 (API 23) or newer.",
             )
         }
     }

package/android/src/main/java/com/necessarysdk/reactnative/IntegrityProbeManager.kt

@@ -679,9 +679,11 @@ class IntegrityProbeManager(
     )
 
     // A lookup that could not start, or never finished, is not "no su": the
-    // probe fails, and the report says it measured nothing.
+    // probe fails, and the report says it measured nothing. What the shell
+    // says on its error stream is kept out: runCommand merges it, and a
+    // complaint that `which` is missing would read as a path to su.
     private fun probeRootShell(): Map<String, Any> = ProbeReads.rootShell(
-        runCommand(listOf("/system/bin/sh", "-c", "command -v su || which su || true"))
+        runCommand(listOf("/system/bin/sh", "-c", "command -v su 2>/dev/null || which su 2>/dev/null || true"))
     )
 
     private fun probeSystemProperties(): Map<String, Any> {
@@ -745,18 +747,13 @@ class IntegrityProbeManager(
         var mapsLines = 0
         val file = File("/proc/self/maps")
         if (!file.canRead()) return unavailable("/proc/self/maps is not readable")
+        val folders = ownFolders()
         run {
-            file.forEachLine { original ->
+            file.forEachLine { line ->
                 mapsLines++
-                val line = original.lowercase(Locale.US)
-                var lineMatched = false
-                for (token in suspiciousRuntimeTokens) {
-                    if (line.contains(token)) {
-                        found.add(token)
-                        lineMatched = true
-                    }
-                }
-                if (lineMatched) suspiciousLines++
+                val named = ProbeReads.namesIn(line, folders, context.packageName, suspiciousRuntimeTokens)
+                found.addAll(named)
+                if (named.isNotEmpty()) suspiciousLines++
             }
         }
         if (mapsLines == 0) return unavailable("/proc/self/maps returned no lines")
@@ -853,7 +850,9 @@ class IntegrityProbeManager(
             }
             names.add(name)
         }
-        return ProbeReads.threads(names, unreadable, fridaThreads, glibThreads, suspiciousRuntimeTokens)
+        return ProbeReads.threads(
+            names, unreadable, fridaThreads, glibThreads, suspiciousRuntimeTokens, context.packageName
+        )
     }
 
     /**
@@ -961,6 +960,17 @@ class IntegrityProbeManager(
         )
     }
 
+    /** The folders the app's own files live in: its install folder and its data folders. */
+    private fun ownFolders(): List<String> {
+        val info = context.applicationInfo
+        return listOfNotNull(
+            info.sourceDir?.let { File(it).parent }?.let { "$it/" },
+            info.dataDir?.let { "$it/" },
+            "/data/data/${context.packageName}/",
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) info.deviceProtectedDataDir?.let { "$it/" } else null,
+        ).distinct()
+    }
+
     /** The size of one /proc/self/maps range, "start-end" in hex; 0 if unreadable. */
     private fun mappingSize(range: String): Long {
         val dash = range.indexOf('-')
@@ -998,12 +1008,7 @@ class IntegrityProbeManager(
         val info = context.applicationInfo
         val apks = (listOf(info.sourceDir) + info.splitSourceDirs.orEmpty().toList())
             .filterNotNull().distinct().toTypedArray()
-        val dirs = listOfNotNull(
-            info.sourceDir?.let { File(it).parent }?.let { "$it/" },
-            info.dataDir?.let { "$it/" },
-            "/data/data/${context.packageName}/",
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) info.deviceProtectedDataDir?.let { "$it/" } else null,
-        ).distinct().toTypedArray()
+        val dirs = ownFolders().toTypedArray()
         val started = System.nanoTime()
         val json = try {
             nativeCodeIntegrity(apks, dirs)

package/android/src/main/java/com/necessarysdk/reactnative/NecessaryNative.kt

@@ -23,6 +23,7 @@ import java.lang.ref.WeakReference
 import java.security.SecureRandom
 import java.util.concurrent.ExecutorService
 import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicReference
 
 /**
  * The SDK's native side on Android, one per React Native runtime and shared by its five modules:
@@ -48,9 +49,10 @@ internal class NecessaryNative(private val reactContext: ReactApplicationContext
     private val stepUpKeys = StepUpKeyManager(context)
     private val secureStore = SecureStore(context)
     private val screenGuard = ScreenGuard()
-    // The app's own request for the location permission, answered when the person chooses; the
-    // collector itself never asks.
-    private var pendingLocation: Promise? = null
+    // The app's own request for the location permission, answered when the person chooses, or when
+    // the activity that asked goes; the collector itself never asks. Whichever comes first takes
+    // it: invalidate() runs off the main thread.
+    private val pendingLocation = AtomicReference<Promise?>(null)
     // The activity the window state belongs to: a new one, while the screen is protected, is
     // protected too.
     private var attached: WeakReference<Activity>? = null
@@ -94,23 +96,30 @@ internal class NecessaryNative(private val reactContext: ReactApplicationContext
     // app's own screen.
     fun requestLocationPermission(promise: Promise) = mainHandler.post {
         val activity = reactContext.currentActivity
-        if (locationState() == "precise" || pendingLocation != null || activity !is PermissionAwareActivity) {
+        if (
+            locationState() == "precise" ||
+            activity !is PermissionAwareActivity ||
+            !pendingLocation.compareAndSet(null, promise)
+        ) {
             promise.resolve(locationState())
             return@post
         }
-        pendingLocation = promise
         activity.requestPermissions(
             arrayOf(Manifest.permission.ACCESS_FINE_LOCATION, Manifest.permission.ACCESS_COARSE_LOCATION),
             LOCATION_REQUEST,
             PermissionListener { requestCode, _, _ ->
                 if (requestCode != LOCATION_REQUEST) return@PermissionListener false
-                pendingLocation?.resolve(locationState())
-                pendingLocation = null
+                answerLocationRequest()
                 true
             },
         )
     }
 
+    /** The request still waiting, if one is, hears what the app holds now. */
+    private fun answerLocationRequest() {
+        pendingLocation.getAndSet(null)?.resolve(locationState())
+    }
+
     private fun locationState(): String = when {
         context.checkSelfPermission(Manifest.permission.ACCESS_FINE_LOCATION) ==
             PackageManager.PERMISSION_GRANTED -> "precise"
@@ -241,10 +250,15 @@ internal class NecessaryNative(private val reactContext: ReactApplicationContext
 
     override fun onHostPause() {}
 
+    // A location request ends with the activity that asked, recreated or not: React Native keeps
+    // the permission listener in that activity's delegate, and the next one has none, so the
+    // person's choice would never reach it.
+    //
     // Gone for good: a step-up waiting for the confirm-credential result would never hear it, and
     // would hold every later approval at STEPUP_BUSY. A recreated activity still receives the
     // result, so a step-up waiting for it keeps waiting.
     override fun onHostDestroy() {
+        answerLocationRequest()
         val activity = attached?.get() ?: reactContext.currentActivity
         if (activity?.isChangingConfigurations == true) return
         stepUpKeys.cancelPendingConfirmation()
@@ -255,6 +269,7 @@ internal class NecessaryNative(private val reactContext: ReactApplicationContext
         reactContext.removeActivityEventListener(this)
         reactContext.removeLifecycleEventListener(this)
         stepUpKeys.cancelPendingConfirmation()
+        answerLocationRequest()
         worker.shutdown()
         storageWorker.shutdown()
     }

package/android/src/main/java/com/necessarysdk/reactnative/ProbeReads.kt

@@ -101,6 +101,20 @@ object ProbeReads {
         return ok("tracer_pid" to pid, "seccomp" to seccomp, "no_new_privs" to noNewPrivs)
     }
 
+    /**
+     * The listed names in one line of the memory map, in any case. The app's
+     * own folders and package name are taken out of the line first: Android
+     * names those folders after the package, with random text beside it, and
+     * neither names a tool. What lies inside those folders is still read, so a
+     * library the app was rebuilt with is found by its own name.
+     */
+    fun namesIn(line: String, ownFolders: List<String>, packageName: String, tokens: List<String>): List<String> {
+        var text = line
+        for (folder in ownFolders) text = text.replace(folder, "/")
+        val lower = text.replace(packageName, "").lowercase(java.util.Locale.US)
+        return tokens.filter { lower.contains(it) }
+    }
+
     /** The two developer settings, each read on its own: a read that threw is unread, not "off". */
     fun developerSettings(adb: Result<Boolean>, developer: Result<Boolean>): Map<String, Any> {
         if (adb.isFailure && developer.isFailure) {
@@ -166,7 +180,9 @@ object ProbeReads {
     /**
      * This process's thread names. A thread that ended between listing and
      * reading is gone, not unread; one whose name could not be read is
-     * unread, since a renamed instrumentation thread could be that one.
+     * unread, since a renamed instrumentation thread could be that one. A
+     * thread named for the app itself - Android gives the main thread part of
+     * the package's name, 15 characters at most - names no tool.
      */
     fun threads(
         names: List<String>,
@@ -174,6 +190,7 @@ object ProbeReads {
         fridaThreads: List<String>,
         glibThreads: List<String>,
         tokens: List<String>,
+        packageName: String = "",
     ): Map<String, Any> {
         val named = names.filter { it.isNotEmpty() }
         if (named.isEmpty()) return error("no thread of this process could be enumerated")
@@ -184,7 +201,9 @@ object ProbeReads {
             val lower = name.lowercase(java.util.Locale.US)
             for (t in fridaThreads) if (lower == t || lower.startsWith(t)) fridaHits.add(t)
             for (t in glibThreads) if (lower == t) glibHits.add(t)
-            for (t in tokens) if (lower.contains(t)) tokenHits.add(t)
+            if (!packageName.contains(name)) {
+                for (t in tokens) if (lower.contains(t)) tokenHits.add(t)
+            }
         }
         val unread = if (unreadable > 0) {
             mapOf("thread_names" to "$unreadable of ${named.size + unreadable} could not be read")

package/android/src/main/java/com/necessarysdk/reactnative/StepUpKeyManager.kt

@@ -304,12 +304,16 @@ class StepUpKeyManager(private val context: Context) {
             object : BiometricPrompt.AuthenticationCallback() {
                 override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
                     val authorised = result.cryptoObject?.signature ?: signer
-                    try {
+                    // Any failure here is told, a keystore's ProviderException
+                    // among them: unanswered, this runs on the main thread, and
+                    // an exception would end the app with the approval waiting.
+                    val outcome: Result<String> = try {
                         authorised.update(payload)
-                        done(Result.success(base64Url(authorised.sign())))
-                    } catch (error: GeneralSecurityException) {
-                        done(Result.failure(signingFailed(error)))
+                        Result.success(base64Url(authorised.sign()))
+                    } catch (error: Exception) {
+                        Result.failure(signingFailed(error))
                     }
+                    done(outcome)
                 }
 
                 override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
@@ -443,23 +447,24 @@ class StepUpKeyManager(private val context: Context) {
         payload: ByteArray,
         done: (Result<String>) -> Unit,
     ) {
-        try {
-            done(Result.success(signNow(entry, payload)))
+        // Runs on the main thread after the person answered: every failure is
+        // told, as in authenticateOperation.
+        val outcome: Result<String> = try {
+            Result.success(signNow(entry, payload))
         } catch (error: KeyPermanentlyInvalidatedException) {
-            done(Result.failure(discardDeadKey(error)))
+            Result.failure(discardDeadKey(error))
         } catch (error: UserNotAuthenticatedException) {
-            done(
-                Result.failure(
-                    InstallationKeyFailure(
-                        "STEPUP_AUTH_FAILED",
-                        "The keystore did not accept the authentication for the step-up key.",
-                        error,
-                    ),
+            Result.failure(
+                InstallationKeyFailure(
+                    "STEPUP_AUTH_FAILED",
+                    "The keystore did not accept the authentication for the step-up key.",
+                    error,
                 ),
             )
-        } catch (error: GeneralSecurityException) {
-            done(Result.failure(signingFailed(error)))
+        } catch (error: Exception) {
+            Result.failure(signingFailed(error))
         }
+        done(outcome)
     }
 
     /**

package/contract/report-1/android-8-ios-5/report.schema.json

@@ -251,7 +251,7 @@
           "description": "the app's version code"
         },
         "installer_package": {
-          "description": "the package that installed the app; null when none is named"
+          "description": "the package that installed the app; left out or null when none is named"
         },
         "source_dir": {
           "description": "the base APK's path"

package/doc/integration_guide.md

@@ -117,8 +117,8 @@ so that you need not store it. The app answers with `installation_id`, `challeng
 | `optional_probes` | the personal measurements you ask for, answered only where the app enables them (section 8) |
 | `expires_at` | 60 seconds ahead |
 
-Ask for every measurement you rely on every time, and vary the others from scan to scan, so that a
-tampered app cannot prepare its answers. **Rely on every measurement that would catch tampering** — the
+Ask for every measurement you need every time, and vary the others from scan to scan, so that a
+tampered app cannot prepare its answers. **Use every measurement that would catch tampering** — the
 hooks, gadgets and changes to the app's code in memory among them: on Android `runtime_maps`,
 `frida_ports`, `instrumentation_threads`, `exec_mappings` and `code_integrity`; on iOS `dyld_images`,
 `environment` and `code_integrity`. One left to chance is one a tampered app waits out, scanning again
@@ -629,8 +629,8 @@ normal looks like.
 3. **The memory around it** (`exec_mappings`, on Android). Code loaded at run time needs executable
    memory: memory both writable and executable (`wx_bytes`, `wx_size_classes`, `wx_largest_bytes`) and
    executable regions with no file behind them (`anon_exec_unlabeled_bytes`). Some runtimes compile
-   code as they run and map some of each — one that compiles each method the first time it runs,
-   say. Such a runtime shows itself by how it grows: it maps more as more of the app is used, keeps it
+   code as they run — each method the first time it is called — and map some of each. Such a runtime
+   shows itself by how it grows: it maps more as more of the app is used, keeps it
    while the app runs, and maps it in blocks of one size (64 KiB on the phones measured; your own runs
    show yours). Record the most of each your release maps, per OS version, processor and page size,
    **over whole sessions through your app's main features, not at a cold start** — or a genuine

package/doc/measurements.md

@@ -1,8 +1,8 @@
 # Measurements — what the SDKs measure on the phone
 
 Every measurement a Necessary SDK can put in a signed report, field by field: what it is, how the
-SDK measures it, and what a complete answer holds. Every SDK sends the same report, whatever framework
-your app is built with, and none sends a score or a verdict;
+SDK measures it, and what a complete answer holds. Every SDK sends its report in the same format, whatever
+framework your app is built with, and none sends a score or a verdict;
 what a measurement means for a request is your backend's decision. The integration guide
 (`integration_guide.md`, beside this file) is the protocol — how your backend asks for a scan and checks
 the report — and its section 7 is about deciding with these measurements.
@@ -44,8 +44,8 @@ measurements — a probe — and each row of a table one of its fields.
 Each probe says when it comes:
 
 - **your backend asks for it**, in the challenge's `required_probes`. Ask every time for each
-  measurement you rely on, and vary the others from scan to scan;
-- **every scan**, whether or not your backend asks. Rely on one only by asking for it: until you do, its
+  measurement you need, and vary the others from scan to scan;
+- **every scan**, whether or not your backend asks. If you need one, ask for it: until you do, its
   absence or failure does not make a report incomplete;
 - **a personal measurement**, only when your backend lists it in `optional_probes` and your app enables
   it in its SDK (the SDK's README says how) — the location only with the person's permission as well.
@@ -93,7 +93,7 @@ APK that could not be hashed as `split_apks:<file name>`.
 | `split_apks` | list |  | the installed split APKs, apart from the base APK: each its file `name` and its `sha256`, sorted by name, at most 64; empty for an install without splits |
 | `version_name` | text |  | the app's version name |
 | `version_code` | integer |  | the app's version code |
-| `installer_package` | text, or null |  | the package that installed the app; null when none is named — installed with adb, or by an installer that names none |
+| `installer_package` | text, or null |  | the package that installed the app; left out or null when none is named — installed with adb, or by an installer that names none |
 | `source_dir` | text |  | the base APK's path on the phone |
 
 ### `debug_state`

package/ios/IntegrityProbeManager.swift

@@ -881,20 +881,19 @@ final class IntegrityProbeManager {
         var suspiciousCount = 0
         var unnamed = 0
         let imageCount = _dyld_image_count()
+        let bundlePath = Bundle.main.bundlePath
+        let mainName = Bundle.main.executableURL?.lastPathComponent
 
         for index in 0..<imageCount {
             guard let raw = _dyld_get_image_name(index) else {
                 unnamed += 1
                 continue
             }
-            let name = String(cString: raw).lowercased()
-            var matched = false
-            for token in IntegrityProbeManager.suspiciousImageTokens
-            where name.contains(token) {
-                tokens.insert(token)
-                matched = true
-            }
-            if matched { suspiciousCount += 1 }
+            let named = ProbeReads.imageTokens(
+                path: String(cString: raw), bundlePath: bundlePath, mainExecutable: mainName,
+                tokens: IntegrityProbeManager.suspiciousImageTokens)
+            tokens.formUnion(named)
+            if !named.isEmpty { suspiciousCount += 1 }
         }
 
         var result: [String: Any] = [

package/ios/ProbeReads.swift

@@ -165,6 +165,23 @@ enum ProbeReads {
         missing > 0 ? ["image_names": "\(missing) of \(total) could not be read"] : [:]
     }
 
+    /// The listed names in one loaded image's path, in any case. The app's own
+    /// bundle is read from the inside: its path and its main executable carry
+    /// the app's name, and neither names a tool. What the bundle holds beside
+    /// them is still read, so a library the app was rebuilt with is found by
+    /// its own name.
+    static func imageTokens(
+        path: String, bundlePath: String, mainExecutable: String?, tokens: [String]
+    ) -> [String] {
+        var name = path
+        if path.hasPrefix(bundlePath) {
+            name = String(path.dropFirst(bundlePath.count).drop(while: { $0 == "/" }))
+            if name == mainExecutable { return [] }
+        }
+        let lower = name.lowercased()
+        return tokens.filter { lower.contains($0) }
+    }
+
     /// How one app image's comparison ended.
     enum ImageOutcome: Equatable {
         /// Compared: its __text bytes and how many differ, and the same for

package/lib/deviceTrust.js

@@ -16,6 +16,7 @@ const report_1 = require("./report");
 const requestProof_1 = require("./requestProof");
 const stepUpKey_1 = require("./stepUpKey");
 const transport_1 = require("./transport");
+const answers_1 = require("./util/answers");
 /**
  * The personal measurements an app may enable (the public guide, section 8). Each is collected
  * only when the backend asks for it as well -- the location only with the person's permission too.
@@ -276,15 +277,15 @@ class DeviceTrust {
         this.current(generation);
         try {
             const challenge = await this.client.createInstallationChallenge(identity.installationId);
-            const payload = challenge['payload'];
+            const payload = (0, answers_1.answerText)(challenge, 'payload');
             const verified = await this.client.verifyInstallation({
                 installationId: identity.installationId,
-                challengeId: challenge['challenge_id'],
+                challengeId: (0, answers_1.answerText)(challenge, 'challenge_id'),
                 payload,
                 signature: await identity.signPayload(payload),
             });
             this.current(generation);
-            this.session = verified['device_token'];
+            this.session = (0, answers_1.answerText)(verified, 'device_token');
             return this.session;
         }
         catch (error) {
@@ -566,21 +567,29 @@ class DeviceTrust {
         const identity = await this.loadIdentity();
         this.current(generation);
         this.stepUpKeyNative.configuredMode = options.mode;
+        // From here the phone's key and the backend's differ until the backend takes the new one:
+        // approvals wait for that.
+        const holdApprovals = async () => {
+            await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
+            this.current(generation);
+            this.offeredStepUpKey = null;
+            this.stepUpUnavailable = DeviceTrust.reenrolPending();
+        };
         const newKey = async (replace) => {
             if (replace) {
-                // From here the phone's key and the backend's differ until the backend takes the new one:
-                // approvals wait for that.
-                await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
-                this.current(generation);
-                this.offeredStepUpKey = null;
-                this.stepUpUnavailable = DeviceTrust.reenrolPending();
+                await holdApprovals();
                 await this.mutate(generation, () => this.stepUpKeyNative.deleteKey());
             }
-            return this.mutate(generation, () => this.stepUpKeyNative.getOrCreateKey({
+            const made = await this.mutate(generation, () => this.stepUpKeyNative.getOrCreateKey({
                 factor: options.factor,
                 mode: options.mode,
                 windowSeconds: options.windowSeconds,
             }));
+            // None to replace, the phone having lost it: this one is as new.
+            if (made.created && !replace) {
+                await holdApprovals();
+            }
+            return made;
         };
         // A re-enrolment is the explicit recovery: a key the keystore cannot vouch for
         // (STEPUP_KEY_UNAVAILABLE), or one that can never sign again, is replaced here -- and only here.

package/lib/report.js

@@ -5,6 +5,7 @@ exports.SignedReport = exports.ScanChallenge = exports.shortenableLists = export
 exports.fitReport = fitReport;
 exports.collectReport = collectReport;
 const errors_1 = require("./errors");
+const answers_1 = require("./util/answers");
 const bytes_1 = require("./util/bytes");
 const native_1 = require("./util/native");
 /** The most a backend takes: a report of 65,536 bytes of JSON (the measurement contract, section 1). */
@@ -67,17 +68,10 @@ class ScanChallenge {
     }
     static fromJson(value) {
         const names = (list) => (Array.isArray(list) ? list.map((item) => String(item)) : []);
-        const text = (field) => {
-            const item = value[field];
-            if (typeof item !== 'string') {
-                throw new TypeError(`The scan challenge has no ${field}.`);
-            }
-            return item;
-        };
         return new ScanChallenge({
-            challengeId: text('challenge_id'),
-            nonce: text('nonce'),
-            platform: text('platform'),
+            challengeId: (0, answers_1.answerText)(value, 'challenge_id'),
+            nonce: (0, answers_1.answerText)(value, 'nonce'),
+            platform: (0, answers_1.answerText)(value, 'platform'),
             requiredProbes: names(value['required_probes']),
             optionalProbes: names(value['optional_probes']),
             answer: value,

package/lib/util/answers.d.ts

@@ -0,0 +1,6 @@
+/** Reading what your backend answered. */
+/**
+ * The text [field] of an [answer] your backend gave. A field it left out is an [ApiException], as
+ * every failure of a call is: a cast would let it through unseen.
+ */
+export declare function answerText(answer: Record<string, unknown>, field: string): string;

package/lib/util/answers.js

@@ -0,0 +1,16 @@
+"use strict";
+/** Reading what your backend answered. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.answerText = answerText;
+const errors_1 = require("../errors");
+/**
+ * The text [field] of an [answer] your backend gave. A field it left out is an [ApiException], as
+ * every failure of a call is: a cast would let it through unseen.
+ */
+function answerText(answer, field) {
+    const value = answer[field];
+    if (typeof value === 'string' && value.length > 0) {
+        return value;
+    }
+    throw new errors_1.ApiException(`The backend answered no ${field}.`, { code: 'invalid_backend_answer' });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@necessarysdk/react-native",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Device integrity for React Native apps: a key the SDK never exports, signed measurements of the phone and the app, and request proofs. The app's backend decides.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/deviceTrust.ts

@@ -21,6 +21,7 @@ import {
 } from './requestProof';
 import { NativeStepUpKey, stepUpReenrolProof, StepUpKeyMetadata, StepUpOptions } from './stepUpKey';
 import { HttpTransport, type DeviceTrustTransport, type JsonObject } from './transport';
+import { answerText } from './util/answers';
 
 /**
  * The personal measurements an app may enable (the public guide, section 8). Each is collected
@@ -376,15 +377,15 @@ export class DeviceTrust {
     this.current(generation);
     try {
       const challenge = await this.client.createInstallationChallenge(identity.installationId);
-      const payload = challenge['payload'] as string;
+      const payload = answerText(challenge, 'payload');
       const verified = await this.client.verifyInstallation({
         installationId: identity.installationId,
-        challengeId: challenge['challenge_id'] as string,
+        challengeId: answerText(challenge, 'challenge_id'),
         payload,
         signature: await identity.signPayload(payload),
       });
       this.current(generation);
-      this.session = verified['device_token'] as string;
+      this.session = answerText(verified, 'device_token');
       return this.session;
     } catch (error) {
       if (!(error instanceof ApiException) || retried) {
@@ -711,23 +712,31 @@ export class DeviceTrust {
     const identity = await this.loadIdentity();
     this.current(generation);
     this.stepUpKeyNative.configuredMode = options.mode;
+    // From here the phone's key and the backend's differ until the backend takes the new one:
+    // approvals wait for that.
+    const holdApprovals = async (): Promise<void> => {
+      await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
+      this.current(generation);
+      this.offeredStepUpKey = null;
+      this.stepUpUnavailable = DeviceTrust.reenrolPending();
+    };
     const newKey = async (replace: boolean): Promise<StepUpKeyMetadata> => {
       if (replace) {
-        // From here the phone's key and the backend's differ until the backend takes the new one:
-        // approvals wait for that.
-        await this.mutate(generation, () => this.store.setStepUpReenrolPending(true));
-        this.current(generation);
-        this.offeredStepUpKey = null;
-        this.stepUpUnavailable = DeviceTrust.reenrolPending();
+        await holdApprovals();
         await this.mutate(generation, () => this.stepUpKeyNative.deleteKey());
       }
-      return this.mutate(generation, () =>
+      const made = await this.mutate(generation, () =>
         this.stepUpKeyNative.getOrCreateKey({
           factor: options.factor,
           mode: options.mode,
           windowSeconds: options.windowSeconds,
         }),
       );
+      // None to replace, the phone having lost it: this one is as new.
+      if (made.created && !replace) {
+        await holdApprovals();
+      }
+      return made;
     };
 
     // A re-enrolment is the explicit recovery: a key the keystore cannot vouch for

package/src/report.ts

@@ -2,6 +2,7 @@
 
 import type { NativeIntegrityCollector } from './collector';
 import { ApiException } from './errors';
+import { answerText } from './util/answers';
 import { base64UrlNoPadding, utf8Encode } from './util/bytes';
 import { isObject } from './util/native';
 import type { InstallationIdentity } from './installationKey';
@@ -87,17 +88,10 @@ export class ScanChallenge {
 
   static fromJson(value: Record<string, unknown>): ScanChallenge {
     const names = (list: unknown): string[] => (Array.isArray(list) ? list.map((item) => String(item)) : []);
-    const text = (field: string): string => {
-      const item = value[field];
-      if (typeof item !== 'string') {
-        throw new TypeError(`The scan challenge has no ${field}.`);
-      }
-      return item;
-    };
     return new ScanChallenge({
-      challengeId: text('challenge_id'),
-      nonce: text('nonce'),
-      platform: text('platform'),
+      challengeId: answerText(value, 'challenge_id'),
+      nonce: answerText(value, 'nonce'),
+      platform: answerText(value, 'platform'),
       requiredProbes: names(value['required_probes']),
       optionalProbes: names(value['optional_probes']),
       answer: value,

package/src/util/answers.ts

@@ -0,0 +1,15 @@
+/** Reading what your backend answered. */
+
+import { ApiException } from '../errors';
+
+/**
+ * The text [field] of an [answer] your backend gave. A field it left out is an [ApiException], as
+ * every failure of a call is: a cast would let it through unseen.
+ */
+export function answerText(answer: Record<string, unknown>, field: string): string {
+  const value = answer[field];
+  if (typeof value === 'string' && value.length > 0) {
+    return value;
+  }
+  throw new ApiException(`The backend answered no ${field}.`, { code: 'invalid_backend_answer' });
+}