@smileid/usesmileid 12.0.0-beta01

package/src/data/api/auth/token_holder.ts

@@ -0,0 +1,72 @@
+/**
+ * Thread-safe holder for the partner-supplied `smileid-token`.
+ *
+ * The token is mutable at runtime so a partner-supplied refresh callback can
+ * replace it on a 401 response and subsequent requests automatically pick up
+ * the fresh value via `SmileAuthInterceptor` (and `SmileRequestMacInterceptor`
+ * when MAC stamping is re-enabled). JavaScript's single-threaded event loop
+ * provides safe publication of field writes; this class adds **single-flight**
+ * refresh semantics so concurrent 401s collapse into one partner-callback
+ * invocation.
+ */
+export class TokenHolder {
+  private _token: string;
+  private _inflight: Promise<string | null> | null = null;
+
+  constructor(initialToken: string) {
+    this._token = initialToken;
+  }
+
+  /** Current token. Returns the latest value any refresh has written. */
+  get current(): string {
+    return this._token;
+  }
+
+  /**
+   * Replace the current token. Visible for integration tests that simulate a
+   * refresh without driving a full HTTP round-trip; production refresh flows
+   * always update the holder via {@link refreshSingleFlight}.
+   */
+  update(newToken: string): void {
+    this._token = newToken;
+  }
+
+  /**
+   * Single-flight refresh.
+   *
+   * If another concurrent caller already refreshed the token while this caller
+   * was awaiting, return the new token without re-invoking `refreshCallback`.
+   * If a refresh is already in flight, join it instead of starting a second
+   * one. Otherwise invoke the callback, store the result, and return it.
+   *
+   * `refreshCallback` is supplied by the caller as a non-throwing
+   * `Promise<string | null>` returning function; `TokenRefreshInterceptor`
+   * wraps the partner-facing `(previous) => Promise<string>` so any thrown
+   * exception is collapsed to `null`. A `null` return tells the caller to
+   * surface the original 401 unchanged.
+   */
+  async refreshSingleFlight(
+    previousToken: string,
+    refreshCallback: (previousToken: string) => Promise<string | null>,
+  ): Promise<string | null> {
+    if (this._token !== previousToken) {
+      return this._token;
+    }
+    if (this._inflight) {
+      return this._inflight;
+    }
+    const promise = (async () => {
+      try {
+        const next = await refreshCallback(previousToken);
+        if (next !== null) {
+          this._token = next;
+        }
+        return next;
+      } finally {
+        this._inflight = null;
+      }
+    })();
+    this._inflight = promise;
+    return promise;
+  }
+}

package/src/data/api/interceptors/__tests__/logging_interceptor.test.ts

@@ -0,0 +1,252 @@
+import axios, {
+  AxiosError,
+  AxiosHeaders,
+  type AxiosResponse,
+  type InternalAxiosRequestConfig,
+} from "axios";
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+
+import { LogLevel } from "../../../../core/models/network_config";
+import { attachLoggingInterceptor } from "../logging_interceptor";
+
+/**
+ * Invoke the response success handler of the most-recently attached
+ * interceptor.
+ */
+async function invokeResponseFulfilled(
+  client: ReturnType<typeof axios.create>,
+  response: AxiosResponse,
+): Promise<AxiosResponse> {
+  const handlers = (
+    client.interceptors.response as unknown as {
+      handlers: {
+        fulfilled?: (response: AxiosResponse) => AxiosResponse;
+      }[];
+    }
+  ).handlers;
+  const lastHandler = handlers[handlers.length - 1];
+  if (typeof lastHandler?.fulfilled === "function") {
+    return (await lastHandler.fulfilled(response)) as AxiosResponse;
+  }
+  throw new Error("No fulfilled response handler found");
+}
+
+/**
+ * Invoke the response error (rejected) handler of the most-recently
+ * attached interceptor.
+ */
+async function invokeResponseRejected(
+  client: ReturnType<typeof axios.create>,
+  error: AxiosError,
+): Promise<void> {
+  const handlers = (
+    client.interceptors.response as unknown as {
+      handlers: {
+        rejected?: (error: unknown) => Promise<unknown>;
+      }[];
+    }
+  ).handlers;
+  const lastHandler = handlers[handlers.length - 1];
+  if (typeof lastHandler?.rejected === "function") {
+    await lastHandler.rejected(error);
+  } else {
+    throw new Error("No rejected response handler found");
+  }
+}
+
+function makeAxiosResponse(data: unknown, status: number = 200): AxiosResponse {
+  return {
+    data,
+    status,
+    statusText: "OK",
+    headers: new AxiosHeaders(),
+    config: {
+      headers: new AxiosHeaders(),
+      url: "/v1/test",
+    } as InternalAxiosRequestConfig,
+  } as AxiosResponse;
+}
+
+function makeAxiosError(data: unknown, status: number = 400): AxiosError {
+  const config = {
+    headers: new AxiosHeaders(),
+    url: "/v1/test",
+  } as InternalAxiosRequestConfig;
+
+  const response = {
+    data,
+    status,
+    statusText: "Bad Request",
+    headers: new AxiosHeaders(),
+    config,
+  } as AxiosResponse;
+
+  const error = new AxiosError(
+    "Request failed",
+    "ERR_BAD_REQUEST",
+    config,
+    null,
+    response,
+  );
+  Object.assign(error, { isAxiosError: true });
+  return error;
+}
+
+describe("attachLoggingInterceptor — body redaction", () => {
+  let client: ReturnType<typeof axios.create>;
+  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
+  let consoleWarnSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    client = axios.create();
+    consoleLogSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+    consoleWarnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    consoleLogSpy.mockRestore();
+    consoleWarnSpy.mockRestore();
+  });
+
+  it("redacts sensitive top-level keys and passes non-sensitive ones through", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    const response = makeAxiosResponse({ token: "abc", user_id: "u1" });
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+    const loggedBody = bodyCall![1] as Record<string, unknown>;
+    expect(loggedBody["token"]).toBe("<redacted>");
+    expect(loggedBody["user_id"]).toBe("u1");
+  });
+
+  it("redacts sensitive keys nested inside an object", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    const response = makeAxiosResponse({ result: { signature: "s" } });
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+    const loggedBody = bodyCall![1] as Record<string, unknown>;
+    const nested = loggedBody["result"] as Record<string, unknown>;
+    expect(nested["signature"]).toBe("<redacted>");
+  });
+
+  it("redacts sensitive keys inside array elements", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    const response = makeAxiosResponse([{ api_key: "k" }, { name: "safe" }]);
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+    const loggedBody = bodyCall![1] as Array<Record<string, unknown>>;
+    expect(loggedBody[0]?.["api_key"]).toBe("<redacted>");
+    expect(loggedBody[1]?.["name"]).toBe("safe");
+  });
+
+  it("applies redaction on the error path at LogLevel.body", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    const error = makeAxiosError({ token: "secret-token", message: "bad" });
+    try {
+      await invokeResponseRejected(client, error);
+    } catch {
+      // Expected: the interceptor re-rejects.
+    }
+
+    const bodyCall = consoleWarnSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+    const loggedBody = bodyCall![1] as Record<string, unknown>;
+    expect(loggedBody["token"]).toBe("<redacted>");
+    expect(loggedBody["message"]).toBe("bad");
+  });
+
+  it("replaces values beyond the depth limit with '<depth-limit>'", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    // Build an object 8 levels deep — exceeds MAX_REDACT_DEPTH of 6.
+    const deepObject = {
+      a: { b: { c: { d: { e: { f: { g: { h: "leaf" } } } } } } },
+    };
+    const response = makeAxiosResponse(deepObject);
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+
+    // Navigate to the depth boundary — depth 6 (0-indexed from root) should
+    // be replaced by "<depth-limit>".
+    const logged = bodyCall![1] as {
+      a: { b: { c: { d: { e: { f: unknown } } } } };
+    };
+    expect(logged.a.b.c.d.e.f).toBe("<depth-limit>");
+  });
+
+  it("does not log the body at LogLevel.headers (regression pin)", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.headers,
+      redactHeaders: [],
+    });
+
+    const response = makeAxiosResponse({ token: "abc" });
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeUndefined();
+  });
+
+  it("redacts keys case-insensitively (capitalised key variant)", async () => {
+    attachLoggingInterceptor(client, {
+      enabled: true,
+      level: LogLevel.body,
+      redactHeaders: [],
+    });
+
+    const response = makeAxiosResponse({ Token: "t", UserId: "u" });
+    await invokeResponseFulfilled(client, response);
+
+    const bodyCall = consoleLogSpy.mock.calls.find((call: unknown[]) =>
+      String(call[0]).includes("body:"),
+    );
+    expect(bodyCall).toBeDefined();
+    const loggedBody = bodyCall![1] as Record<string, unknown>;
+    expect(loggedBody["Token"]).toBe("<redacted>");
+    expect(loggedBody["UserId"]).toBe("u");
+  });
+});

package/src/data/api/interceptors/__tests__/sensitive_headers.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { ALWAYS_REDACT } from "../sensitive_headers";
+
+describe("ALWAYS_REDACT", () => {
+  it("contains the credentials and partner-identity headers", () => {
+    // Canonical credential + partner-identity headers SmileID issues.
+    // Adding a new header here is a single edit that surfaces in the
+    // test failure first, then in the masking behaviour of every
+    // request the logging interceptor prints.
+    expect(ALWAYS_REDACT.has("smileid-token")).toBe(true);
+    expect(ALWAYS_REDACT.has("smileid-partner-id")).toBe(true);
+    expect(ALWAYS_REDACT.has("smileid-api-key")).toBe(true);
+    expect(ALWAYS_REDACT.has("authorization")).toBe(true);
+    expect(ALWAYS_REDACT.has("cookie")).toBe(true);
+    expect(ALWAYS_REDACT.has("set-cookie")).toBe(true);
+  });
+
+  it("stores every entry lowercase for case-insensitive matching", () => {
+    for (const header of ALWAYS_REDACT) {
+      expect(header).toBe(header.toLowerCase());
+    }
+  });
+
+  it("rejects an arbitrary non-sensitive header", () => {
+    // Sanity check that the set isn't a free-for-all.
+    expect(ALWAYS_REDACT.has("content-type")).toBe(false);
+    expect(ALWAYS_REDACT.has("user-agent")).toBe(false);
+  });
+});

package/src/data/api/interceptors/__tests__/smile_integrity_interceptor.test.ts

@@ -0,0 +1,156 @@
+import {
+  describe,
+  expect,
+  it,
+  beforeEach,
+  afterEach,
+  vi,
+  type Mock,
+} from "vitest";
+import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
+import {
+  AttestationErrorCode,
+  AttestationInternals,
+  AttestationTokenRequestFailedException,
+} from "@smileid/usesmileid_bridge";
+
+import {
+  SmileIntegrityInterceptor,
+  DEVICE_NONCE_HEADER,
+  ATTESTATION_OPT_IN_KEY,
+} from "../smile_integrity_interceptor";
+import { REQUEST_MAC_HEADER } from "../smile_request_mac_interceptor";
+
+/**
+ * Pins down the integrity interceptor's wire shape:
+ *   - Opt-out requests (no `_useSmileIDAttestation`) pass through.
+ *   - Opt-in requests with no upstream `smileid-request-mac` pass
+ *     through unattested (integrity token must bind to the MAC).
+ *   - Opt-in requests with a MAC stamp `smileid-device-nonce: <token>`
+ *     on success.
+ *   - Opt-in requests with a MAC stamp `smileid-device-nonce: ERR_<msg>`
+ *     on `AttestationException` (fail-open).
+ */
+// Structural mirror of the native module's attestation envelope — the
+// fields the mocks resolve with. `usesmileid_bridge` keeps the envelope
+// interface internal, so the test models the wire shape it observes.
+type TestAttestationEnvelope = {
+  success: boolean;
+  token?: string;
+  errorCode?: AttestationErrorCode;
+  errorMessage?: string;
+};
+
+describe("SmileIntegrityInterceptor", () => {
+  let client: ReturnType<typeof axios.create>;
+  let interceptor: SmileIntegrityInterceptor;
+  let warmUpAttestation: Mock<() => Promise<TestAttestationEnvelope>>;
+  let requestAttestationToken: Mock<
+    (requestHash: string) => Promise<TestAttestationEnvelope>
+  >;
+
+  beforeEach(() => {
+    client = axios.create();
+    interceptor = new SmileIntegrityInterceptor();
+    interceptor.attach(client);
+    warmUpAttestation = vi.fn();
+    requestAttestationToken = vi.fn();
+    AttestationInternals.setNativeModuleForTesting({
+      warmUpAttestation,
+      requestAttestationToken,
+      generateHardwareAttestation: vi.fn(),
+    });
+  });
+
+  afterEach(() => {
+    AttestationInternals.setNativeModuleForTesting(undefined);
+  });
+
+  async function run(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    const handlers = (
+      client.interceptors.request as unknown as {
+        handlers: {
+          fulfilled?: (cfg: InternalAxiosRequestConfig) => unknown;
+        }[];
+      }
+    ).handlers;
+    let current = config;
+    for (let i = handlers.length - 1; i >= 0; i--) {
+      const handler = handlers[i]?.fulfilled;
+      if (typeof handler === "function") {
+        current = (await handler(current)) as InternalAxiosRequestConfig;
+      }
+    }
+    return current;
+  }
+
+  function makeConfig(
+    overrides: Partial<InternalAxiosRequestConfig> = {},
+  ): InternalAxiosRequestConfig {
+    return {
+      headers: new AxiosHeaders(),
+      ...overrides,
+    } as InternalAxiosRequestConfig;
+  }
+
+  it("passes through when the opt-in flag is absent", async () => {
+    const result = await run(makeConfig());
+    expect(result.headers.get(DEVICE_NONCE_HEADER)).toBeUndefined();
+    expect(requestAttestationToken).not.toHaveBeenCalled();
+  });
+
+  it("passes through when opted in but upstream MAC header is missing", async () => {
+    const result = await run(
+      makeConfig({
+        [ATTESTATION_OPT_IN_KEY]: true,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      } as any),
+    );
+    expect(result.headers.get(DEVICE_NONCE_HEADER)).toBeUndefined();
+    expect(requestAttestationToken).not.toHaveBeenCalled();
+  });
+
+  it("stamps smileid-device-nonce on attestation success", async () => {
+    requestAttestationToken.mockResolvedValueOnce({
+      success: true,
+      token: "integrity-token",
+    });
+    const config = makeConfig({
+      [ATTESTATION_OPT_IN_KEY]: true,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any);
+    config.headers.set(REQUEST_MAC_HEADER, "mac-abc");
+
+    const result = await run(config);
+
+    expect(requestAttestationToken).toHaveBeenCalledWith("mac-abc");
+    expect(result.headers.get(DEVICE_NONCE_HEADER)).toBe("integrity-token");
+  });
+
+  it("stamps ERR_ nonce on AttestationException (fail-open)", async () => {
+    requestAttestationToken.mockResolvedValueOnce({
+      success: false,
+      errorCode: "ML_ATTESTATION_TOKEN_REQUEST_FAILED",
+      errorMessage: "Play Integrity outage",
+    });
+    const config = makeConfig({
+      [ATTESTATION_OPT_IN_KEY]: true,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any);
+    config.headers.set(REQUEST_MAC_HEADER, "mac-abc");
+
+    const result = await run(config);
+
+    const nonce = result.headers.get(DEVICE_NONCE_HEADER) as string;
+    expect(nonce).toMatch(/^ERR_/);
+    expect(nonce).toContain("Play%20Integrity%20outage");
+  });
+
+  it("AttestationException subtype error.message survives encoding", () => {
+    const ex = new AttestationTokenRequestFailedException("hello world");
+    expect(ex.message).toBe("hello world");
+    expect(encodeURIComponent(ex.message)).toBe("hello%20world");
+  });
+});

package/src/data/api/interceptors/__tests__/smile_request_mac_interceptor.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it, beforeEach } from "vitest";
+import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
+
+import { SmileIDCryptoManager } from "../../../security/smile_id_crypto_manager";
+import {
+  SmileRequestMacInterceptor,
+  REQUEST_MAC_HEADER,
+  REQUEST_MAC_OPT_IN_KEY,
+  REQUEST_TIMESTAMP_HEADER,
+} from "../smile_request_mac_interceptor";
+
+/**
+ * Pins down the MAC interceptor's wire shape:
+ *   - Opt-out requests (`_useSmileIDRequestMac` unset) ship without the header.
+ *   - Opt-in requests stamp `smileid-request-mac` with the Base64 HMAC that
+ *     {@link SmileIDCryptoManager} produces over the canonical headers and body.
+ *   - The timestamp stamped upstream is reused as-is; if it is missing the
+ *     request is left unsigned rather than signed against an invented value.
+ */
+describe("SmileRequestMacInterceptor", () => {
+  const TIMESTAMP = "1700000000000";
+  const cryptoManager = new SmileIDCryptoManager("test-signing-secret");
+
+  let client: ReturnType<typeof axios.create>;
+  let interceptor: SmileRequestMacInterceptor;
+
+  beforeEach(() => {
+    client = axios.create();
+    interceptor = new SmileRequestMacInterceptor({ cryptoManager });
+    interceptor.attach(client);
+  });
+
+  async function run(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    const handlers = (
+      client.interceptors.request as unknown as {
+        handlers: {
+          fulfilled?: (cfg: InternalAxiosRequestConfig) => unknown;
+        }[];
+      }
+    ).handlers;
+    let current = config;
+    for (let i = handlers.length - 1; i >= 0; i--) {
+      const handler = handlers[i]?.fulfilled;
+      if (typeof handler === "function") {
+        current = (await handler(current)) as InternalAxiosRequestConfig;
+      }
+    }
+    return current;
+  }
+
+  function makeConfig(
+    overrides: Partial<InternalAxiosRequestConfig> = {},
+  ): InternalAxiosRequestConfig {
+    return {
+      headers: new AxiosHeaders(),
+      ...overrides,
+    } as InternalAxiosRequestConfig;
+  }
+
+  it("passes through when the opt-in flag is absent", async () => {
+    const result = await run(makeConfig({ data: '{"hello":"world"}' }));
+    expect(result.headers.get(REQUEST_MAC_HEADER)).toBeUndefined();
+  });
+
+  it("stamps the Base64 MAC when opted in and the timestamp is present", async () => {
+    const result = await run(
+      makeConfig({
+        data: '{"hello":"world"}',
+        headers: new AxiosHeaders({
+          "smileid-token": "test-token",
+          [REQUEST_TIMESTAMP_HEADER]: TIMESTAMP,
+        }),
+        [REQUEST_MAC_OPT_IN_KEY]: true,
+      } as Partial<InternalAxiosRequestConfig>),
+    );
+
+    // Recompute with the same manager so the test pins the wiring rather than a
+    // hard-coded digest.
+    const expected = await cryptoManager.sign(
+      TIMESTAMP,
+      { "smileid-token": "test-token", [REQUEST_TIMESTAMP_HEADER]: TIMESTAMP },
+      '{"hello":"world"}',
+    );
+    expect(result.headers.get(REQUEST_MAC_HEADER)).toBe(expected);
+  });
+
+  it("leaves the request unsigned when the timestamp is missing", async () => {
+    const result = await run(
+      makeConfig({
+        data: '{"hello":"world"}',
+        [REQUEST_MAC_OPT_IN_KEY]: true,
+      } as Partial<InternalAxiosRequestConfig>),
+    );
+    expect(result.headers.get(REQUEST_MAC_HEADER)).toBeUndefined();
+  });
+});