@sanctum-key/react-native-sdk 1.0.61 → 1.0.62

package/src/components/TemplateKYCFlowRefactored.tsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
 import { View, Text, StyleSheet, SafeAreaView, TouchableOpacity, ActivityIndicator, Dimensions, ScrollView, Platform } from 'react-native';
 import { KYCTemplate, VerificationState } from '../types/KYC.types';
 import { TemplateKYCFlowProvider, useTemplateKYCFlowContext } from '../hooks/useTemplateKYCFlow';
@@ -21,8 +21,15 @@ import { AdditionalDocumentsTemplate } from './KYCElements/AdditionalDocumentsTe
 import { KycEnvironment, BackendEnvironment } from '../types/env.types';
 import KYCConfig from '../config/KYCConfig';
 import { logger, sdkLogger } from '../utils/logger'; 
-
-interface TemplateKYCFlowProps {
+import {
+  checkDeviceSecurity,
+  getDeviceSecurityViolations,
+  type DeviceSecurityCheckResult,
+  type DeviceSecurityPolicy,
+  type DeviceSecurityViolation,
+} from '../security/deviceSecurity';
+
+export interface TemplateKYCFlowProps {
   template?: KYCTemplate;        
   templateId?: string;           
   onComplete?: (data: VerificationState) => void;
@@ -40,6 +47,33 @@ interface TemplateKYCFlowProps {
   onSessionSave?: (sessionId: string) => void;
   kyc_session_id?: string;
   templateConfig?: Record<string, string>;
+  deviceSecurityPolicy?: DeviceSecurityPolicy;
+  onDeviceSecurityCheck?: (result: DeviceSecurityCheckResult) => void;
+}
+
+function deviceSecurityErrorMessage(
+  violations: DeviceSecurityViolation[],
+  language: string,
+): string {
+  const french = language.toLowerCase().startsWith('fr');
+  const labels: Record<DeviceSecurityViolation, string> = french
+    ? {
+        compromised_device: 'appareil rooté ou jailbreaké',
+        developer_mode: 'mode développeur ou débogueur activé',
+        emulator: 'émulateur ou simulateur détecté',
+        check_unavailable: 'vérification de sécurité indisponible',
+      }
+    : {
+        compromised_device: 'rooted or jailbroken device',
+        developer_mode: 'developer mode or debugger enabled',
+        emulator: 'emulator or simulator detected',
+        check_unavailable: 'device security check unavailable',
+      };
+  const details = violations.map(violation => labels[violation]).join(', ');
+
+  return french
+    ? `La vérification d'identité ne peut pas continuer : ${details}.`
+    : `Identity verification cannot continue: ${details}.`;
 }
 
 export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
@@ -60,15 +94,118 @@ export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
   onSessionSave,
   kyc_session_id,
   templateConfig,
+  deviceSecurityPolicy,
+  onDeviceSecurityCheck,
 }) => {
   const { t } = useI18n();
   const { template: loadedTemplate, isLoading, error, loadTemplate } = useTemplateLoader();
   const [resolvedTemplateId, setResolvedTemplateId] = useState<string | undefined>(templateId);
   const [isResolving, setIsResolving] = useState<boolean>(!templateId && !!templateConfig);
+  const securityCheckEnabled = Platform.OS !== 'web' && deviceSecurityPolicy?.enabled !== false;
+  const enforceSecurity = env === 'PRODUCTION';
+  const blockCompromisedDevices = deviceSecurityPolicy?.blockCompromisedDevices ?? enforceSecurity;
+  const blockDeveloperMode = deviceSecurityPolicy?.blockDeveloperMode ?? enforceSecurity;
+  const blockEmulators = deviceSecurityPolicy?.blockEmulators ?? enforceSecurity;
+  const failClosed = deviceSecurityPolicy?.failClosed ?? enforceSecurity;
+  const [securityStatus, setSecurityStatus] = useState<'checking' | 'allowed' | 'blocked'>(
+    securityCheckEnabled ? 'checking' : 'allowed',
+  );
+  const [securityError, setSecurityError] = useState('');
+  const [securityRetryToken, setSecurityRetryToken] = useState(0);
+  const onErrorRef = useRef(onError);
+  const onDeviceSecurityCheckRef = useRef(onDeviceSecurityCheck);
+
+  useEffect(() => { onErrorRef.current = onError; }, [onError]);
+  useEffect(() => { onDeviceSecurityCheckRef.current = onDeviceSecurityCheck; }, [onDeviceSecurityCheck]);
 
   // 🚨 1. Determine the active API key based on the environment
   const activeApiKey = env === 'PRODUCTION' ? API_KEY : (TEST_API_KEY || API_KEY);
 
+  useEffect(() => {
+    let cancelled = false;
+
+    if (!securityCheckEnabled) {
+      setSecurityStatus('allowed');
+      setSecurityError('');
+      return () => { cancelled = true; };
+    }
+
+    setSecurityStatus('checking');
+    setSecurityError('');
+
+    const runSecurityCheck = async () => {
+      try {
+        const result = await checkDeviceSecurity();
+        if (cancelled) return;
+
+        onDeviceSecurityCheckRef.current?.(result);
+        const violations = getDeviceSecurityViolations(result, {
+          blockCompromisedDevices,
+          blockDeveloperMode,
+          blockEmulators,
+          failClosed,
+        });
+
+        sdkLogger.info('Device security check completed', {
+          platform: result.platform,
+          supported: result.supported,
+          isCompromised: result.isCompromised,
+          isDeveloperModeEnabled: result.isDeveloperModeEnabled,
+          isEmulator: result.isEmulator,
+          riskSignals: result.riskSignals,
+          blocked: violations.length > 0,
+        });
+
+        if (violations.length > 0) {
+          const message = deviceSecurityErrorMessage(violations, language);
+          setSecurityError(message);
+          setSecurityStatus('blocked');
+          onErrorRef.current?.(message);
+          return;
+        }
+
+        setSecurityStatus('allowed');
+      } catch (error: any) {
+        if (cancelled) return;
+        const unavailableResult: DeviceSecurityCheckResult = {
+          platform: Platform.OS === 'android' || Platform.OS === 'ios' ? Platform.OS : 'unknown',
+          supported: false,
+          isRooted: false,
+          isJailbroken: false,
+          isEmulator: false,
+          isDeveloperModeEnabled: false,
+          developerModeCheckSupported: false,
+          isDebuggerAttached: false,
+          isCompromised: false,
+          riskSignals: ['native_device_security_check_failed'],
+          checkedAt: new Date().toISOString(),
+        };
+        onDeviceSecurityCheckRef.current?.(unavailableResult);
+        sdkLogger.error('Device security check failed', { error: error?.message });
+
+        if (failClosed) {
+          const message = deviceSecurityErrorMessage(['check_unavailable'], language);
+          setSecurityError(message);
+          setSecurityStatus('blocked');
+          onErrorRef.current?.(message);
+        } else {
+          setSecurityStatus('allowed');
+        }
+      }
+    };
+
+    void runSecurityCheck();
+    return () => { cancelled = true; };
+  }, [
+    securityCheckEnabled,
+    blockCompromisedDevices,
+    blockDeveloperMode,
+    blockEmulators,
+    failClosed,
+    securityRetryToken,
+    language,
+  ]);
+
   useEffect(() => {
     if (activeApiKey) {
       if (sdkLogger.setApiKey) sdkLogger.setApiKey(activeApiKey);
@@ -83,6 +220,8 @@ export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
 
 
   useEffect(() => {
+    if (securityStatus !== 'allowed') return;
+
     // If a strict templateId is provided, use it immediately and skip geolocation
     if (templateId) {
       setResolvedTemplateId(templateId);
@@ -125,12 +264,12 @@ export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
     };
 
     fetchLocationAndRoute();
-  }, [templateId, templateConfig]); // Only re-run if the props change
+  }, [templateId, templateConfig, securityStatus]); // Only re-run if the props change
 
 
 
   useEffect(() => {
-    if (isResolving) return;
+    if (isResolving || securityStatus !== 'allowed') return;
 
     // Updated error check to include templateConfig
     if (!providedTemplate && !resolvedTemplateId) {
@@ -148,7 +287,7 @@ export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
       logger.log(`Fetching template ${resolvedTemplateId} via API Key`);
       loadTemplate(resolvedTemplateId, activeApiKey);
     }
-  }, [resolvedTemplateId, activeApiKey, providedTemplate, loadTemplate, onError, isResolving]);
+  }, [resolvedTemplateId, activeApiKey, providedTemplate, loadTemplate, onError, isResolving, securityStatus]);
 
   useEffect(() => {
     if (error) {
@@ -180,7 +319,44 @@ export const TemplateKYCFlow: React.FC<TemplateKYCFlowProps> = ({
 
   const template = providedTemplate || loadedTemplate;
 
-  
+  if (securityStatus === 'checking') {
+    return (
+      <View style={styles.loadingContainer}>
+        <ActivityIndicator size="large" color="#2DBD60" />
+        <Text style={styles.loadingText}>
+          {language.toLowerCase().startsWith('fr')
+            ? 'Vérification de la sécurité de l’appareil…'
+            : 'Checking device security…'}
+        </Text>
+      </View>
+    );
+  }
+
+  if (securityStatus === 'blocked') {
+    return (
+      <View style={styles.errorContainer}>
+        <Text style={styles.securityTitle}>
+          {language.toLowerCase().startsWith('fr') ? 'Appareil non sécurisé' : 'Device security issue'}
+        </Text>
+        <Text style={styles.errorText}>{securityError}</Text>
+        <TouchableOpacity
+          style={styles.retryButton}
+          onPress={() => setSecurityRetryToken(value => value + 1)}
+        >
+          <Text style={styles.retryButtonText}>
+            {language.toLowerCase().startsWith('fr') ? 'Réessayer' : 'Retry'}
+          </Text>
+        </TouchableOpacity>
+        {onCancel ? (
+          <TouchableOpacity style={styles.cancelSecurityButton} onPress={onCancel}>
+            <Text style={styles.cancelSecurityButtonText}>
+              {language.toLowerCase().startsWith('fr') ? 'Annuler' : 'Cancel'}
+            </Text>
+          </TouchableOpacity>
+        ) : null}
+      </View>
+    );
+  }
 
   if (templateId && isLoading && !template) {
     return (
@@ -352,14 +528,20 @@ const TemplateKYCFlowContent: React.FC<{ onCancel?: () => void }> = ({ onCancel
           </View>
         ) : null}
 
-        <ScrollView
-          style={styles.scrollView}
-          contentContainerStyle={styles.content}
-          showsVerticalScrollIndicator={Platform.OS === 'web'}
-          bounces={false}
-        >
-          {renderCurrentComponent()}
-        </ScrollView>
+        {currentComponent.type === 'country_selection' ? (
+          <View style={styles.selfScrollingContent}>
+            {renderCurrentComponent()}
+          </View>
+        ) : (
+          <ScrollView
+            style={styles.scrollView}
+            contentContainerStyle={styles.content}
+            showsVerticalScrollIndicator={Platform.OS === 'web'}
+            bounces={false}
+          >
+            {renderCurrentComponent()}
+          </ScrollView>
+        )}
 
         {state.isProcessing && (
           <View style={styles.processingContainer}>
@@ -386,6 +568,7 @@ const styles = StyleSheet.create({
   stepDescription: { fontSize: 14, color: '#666', lineHeight: 20, },
   scrollView: { flex: 1, },
   content: { flexGrow: 1, alignItems: 'center', paddingBottom: 20, },
+  selfScrollingContent: { flex: 1, minHeight: 0, alignItems: 'center', paddingBottom: 20, },
   navigation: { flexDirection: 'row', justifyContent: 'space-between', padding: 20, backgroundColor: 'white', borderTopWidth: 1, borderTopColor: '#e0e0e0', },
   navButton: { paddingHorizontal: 24, paddingVertical: 12, borderRadius: 8, minWidth: 100, alignItems: 'center', },
   primaryButton: { backgroundColor: '#2DBD60', },
@@ -400,4 +583,7 @@ const styles = StyleSheet.create({
   errorContainer: { flex: 1, justifyContent: 'center', alignItems: 'center', backgroundColor: '#f5f5f5', padding: 20, },
   retryButton: { marginTop: 20, paddingHorizontal: 24, paddingVertical: 12, backgroundColor: '#2DBD60', borderRadius: 8, },
   retryButtonText: { color: '#fff', fontSize: 16, fontWeight: '600', },
-});
+  securityTitle: { color: '#991b1b', fontSize: 22, fontWeight: '700', textAlign: 'center', },
+  cancelSecurityButton: { marginTop: 12, paddingHorizontal: 24, paddingVertical: 12, },
+  cancelSecurityButtonText: { color: '#4b5563', fontSize: 16, fontWeight: '600', },
+});

package/src/config/region_mapping.json

@@ -594,6 +594,18 @@
         }
     },
     "Kenya": {
+        "drivers_licence": {
+            "root": [
+                {
+                    "py_file": "dl_back.py",
+                    "keys_found": null
+                },
+                {
+                    "py_file": "dl_front.py",
+                    "keys_found": null
+                }
+            ]
+        },
         "identity_card": {
             "root": [
                 {

package/src/config/region_mapping.ts

@@ -608,6 +608,18 @@ export const countryMapping: Record<string, Record<string, Record<string, ICount
       }
     },
     "KE": {
+        "drivers_licence": {
+            "root": [
+                {
+                    "py_file": "dl_back.py",
+                    "keys_found": null
+                },
+                {
+                    "py_file": "dl_front.py",
+                    "keys_found": null
+                }
+            ]
+        },
       "identity_card": {
         "root": [
           {

package/src/index.ts

@@ -25,5 +25,13 @@ export { WelcomeTemplate } from './components/KYCElements/WelcomeTemplate';
 export { EnhancedCameraView } from './components/EnhancedCameraView';
 export { UnifiedCameraModule } from './modules/camera';
 
+// Export native device-integrity checks and policy types.
+export { checkDeviceSecurity, getDeviceSecurityViolations } from './security/deviceSecurity';
+export type {
+  DeviceSecurityCheckResult,
+  DeviceSecurityPolicy,
+  DeviceSecurityViolation,
+} from './security/deviceSecurity';
+
 // Export Web KYC Components
-export { default as WebKYCEntry } from './web/WebKYCEntry';
+export { default as WebKYCEntry } from './web/WebKYCEntry';

package/src/security/deviceSecurity.ts

@@ -0,0 +1,106 @@
+import { Platform } from 'react-native';
+import SanctumKeySdkModule from '../SanctumKeySdkModule';
+
+export type DeviceSecurityPlatform = 'android' | 'ios' | 'web' | 'unknown';
+
+export interface DeviceSecurityCheckResult {
+  platform: DeviceSecurityPlatform;
+  supported: boolean;
+  isRooted: boolean;
+  isJailbroken: boolean;
+  isEmulator: boolean;
+  isDeveloperModeEnabled: boolean;
+  developerModeCheckSupported: boolean;
+  isDebuggerAttached: boolean;
+  isCompromised: boolean;
+  riskSignals: string[];
+  checkedAt: string;
+}
+
+export interface DeviceSecurityPolicy {
+  /** Run the check. Defaults to true on Android and iOS. */
+  enabled?: boolean;
+  /** Block rooted Android or jailbroken iOS devices. Defaults to true in production. */
+  blockCompromisedDevices?: boolean;
+  /** Block Android developer options or an attached iOS debugger. Defaults to true in production. */
+  blockDeveloperMode?: boolean;
+  /** Block Android emulators and the iOS Simulator. Defaults to true in production. */
+  blockEmulators?: boolean;
+  /** Block when the native check is unavailable or fails. Defaults to true in production. */
+  failClosed?: boolean;
+}
+
+export type DeviceSecurityViolation =
+  | 'compromised_device'
+  | 'developer_mode'
+  | 'emulator'
+  | 'check_unavailable';
+
+type NativeDeviceSecurityResult = Partial<Omit<DeviceSecurityCheckResult, 'checkedAt'>>;
+
+const booleanValue = (value: unknown): boolean => value === true;
+
+const stringArray = (value: unknown): string[] => (
+  Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : []
+);
+
+export async function checkDeviceSecurity(): Promise<DeviceSecurityCheckResult> {
+  if (Platform.OS === 'web') {
+    return {
+      platform: 'web',
+      supported: false,
+      isRooted: false,
+      isJailbroken: false,
+      isEmulator: false,
+      isDeveloperModeEnabled: false,
+      developerModeCheckSupported: false,
+      isDebuggerAttached: false,
+      isCompromised: false,
+      riskSignals: ['native_device_security_check_unavailable_on_web'],
+      checkedAt: new Date().toISOString(),
+    };
+  }
+
+  if (typeof SanctumKeySdkModule.checkDeviceSecurity !== 'function') {
+    throw new Error(
+      'The native device-security checker is unavailable. Rebuild the Android or iOS application with the latest SanctumKey SDK.',
+    );
+  }
+
+  const nativeResult = await SanctumKeySdkModule.checkDeviceSecurity() as NativeDeviceSecurityResult;
+  const isRooted = booleanValue(nativeResult.isRooted);
+  const isJailbroken = booleanValue(nativeResult.isJailbroken);
+
+  return {
+    platform: nativeResult.platform === 'android' || nativeResult.platform === 'ios'
+      ? nativeResult.platform
+      : 'unknown',
+    supported: nativeResult.supported !== false,
+    isRooted,
+    isJailbroken,
+    isEmulator: booleanValue(nativeResult.isEmulator),
+    isDeveloperModeEnabled: booleanValue(nativeResult.isDeveloperModeEnabled),
+    developerModeCheckSupported: booleanValue(nativeResult.developerModeCheckSupported),
+    isDebuggerAttached: booleanValue(nativeResult.isDebuggerAttached),
+    isCompromised: booleanValue(nativeResult.isCompromised) || isRooted || isJailbroken,
+    riskSignals: stringArray(nativeResult.riskSignals),
+    checkedAt: new Date().toISOString(),
+  };
+}
+
+export function getDeviceSecurityViolations(
+  result: DeviceSecurityCheckResult,
+  policy: Required<Pick<
+    DeviceSecurityPolicy,
+    'blockCompromisedDevices' | 'blockDeveloperMode' | 'blockEmulators' | 'failClosed'
+  >>,
+): DeviceSecurityViolation[] {
+  const violations: DeviceSecurityViolation[] = [];
+
+  if (!result.supported && policy.failClosed) violations.push('check_unavailable');
+  if (result.isCompromised && policy.blockCompromisedDevices) violations.push('compromised_device');
+  if (result.isDeveloperModeEnabled && policy.blockDeveloperMode) violations.push('developer_mode');
+  if (result.isEmulator && policy.blockEmulators) violations.push('emulator');
+
+  return violations;
+}

package/src/utils/logger.ts

@@ -1,5 +1,6 @@
 import { Platform, AppState, AppStateStatus } from 'react-native';
 import PostHog from 'posthog-react-native';
+import AsyncStorage from '@react-native-async-storage/async-storage';
 
 const posthogClient = new PostHog('phc_qjCHjCgkdVniammXrrfLrmNPoPH5uAmkzoQMhrEhGaYR', {
   host: 'https://eu.i.posthog.com',
@@ -7,6 +8,10 @@ const posthogClient = new PostHog('phc_qjCHjCgkdVniammXrrfLrmNPoPH5uAmkzoQMhrEhG
   captureAppLifecycleEvents: false,
   flushAt: 1,
   flushInterval: 1000,  // Backup: flush automatically every 1 second
+  customStorage: {
+    getItem: async (key) => await AsyncStorage.getItem(key),
+    setItem: async (key, value) => await AsyncStorage.setItem(key, value),
+  }
 });
 
 const isProduction = (): boolean => {