@smileid/usesmileid 12.0.0 → 12.0.2

package/src/data/api/__tests__/smile_id_api.test.ts

@@ -39,6 +39,7 @@ import type {
   ConsentInformation,
   UserDetails,
 } from "../../../core/models/params";
+import type { TokenPayload } from "../../model/token_payload";
 import { UseSmileIDMetadata } from "../../../metadata/use_smile_id_metadata";
 
 type RecordedCall = {
@@ -109,7 +110,7 @@ const consent: ConsentInformation = Object.freeze({
 // builds this and it travels on every `JobRequest`; the API
 // serializes `request.metadata` as the `metadata` multipart part.
 const metadata = new UseSmileIDMetadata({
-  sdkVersion: "12.0.0",
+  sdkVersion: "12.0.2",
   sdk: "react-native-expo",
   deviceOs: "",
   deviceModel: "",
@@ -1071,6 +1072,279 @@ describe("SmileIDAPI response-body parse failures", () => {
   });
 });
 
+describe("SmileIDAPI — token-provided user details & consent (wire)", () => {
+  const livenessImages: readonly string[] = [
+    "file:///l1.jpg",
+    "file:///l2.jpg",
+    "file:///l3.jpg",
+    "file:///l4.jpg",
+    "file:///l5.jpg",
+    "file:///l6.jpg",
+    "file:///l7.jpg",
+  ];
+
+  const fullUserDetails: UserDetails = {
+    givenNames: "John",
+    lastName: "Doe",
+    email: "john@example.test",
+    phoneNumber: "+254700000000",
+  };
+
+  function tokenPayload(overrides: Partial<TokenPayload> = {}): TokenPayload {
+    return {
+      hasGivenNames: false,
+      hasLastName: false,
+      hasEmail: false,
+      hasPhoneNumber: false,
+      ...overrides,
+    };
+  }
+
+  const fullBinding = tokenPayload({
+    hasGivenNames: true,
+    hasLastName: true,
+    hasEmail: true,
+    hasPhoneNumber: true,
+  });
+
+  const completeTokenConsent = {
+    granted: true,
+    grantedAt: "2026-01-01T09:00:00.000Z",
+    noticeLanguage: "EN",
+    noticePrivacyPolicyUrl: "https://partner.test/privacy",
+  } as const;
+
+  function enrollmentRequest(
+    overrides: Partial<SmartSelfieEnrollmentRequest> = {},
+  ): SmartSelfieEnrollmentRequest {
+    return {
+      jobType: JobType.smartSelfieEnrollment,
+      selfieImage: "file:///selfie.jpg",
+      livenessImages,
+      consent,
+      metadata,
+      expectedLivenessImageCount: 7,
+      userDetails: fullUserDetails,
+      enhanced: false,
+      ...overrides,
+    };
+  }
+
+  it("a partial user_details payload sends only its remaining fields", async () => {
+    // Assembly already dropped the token-bound names (token always wins);
+    // only email/phone ride the wire.
+    const { api, calls } = makeApi();
+    await api.smartSelfieEnrollment(
+      enrollmentRequest({
+        userDetails: {
+          email: "john@example.test",
+          phoneNumber: "+254700000000",
+        },
+      }),
+    );
+    const parts = partsByName(calls[0]!.body);
+    const parsed = JSON.parse(await readJsonPart(parts["user_details"]![0]));
+    expect(parsed).toEqual({
+      email: "john@example.test",
+      phone_number: "+254700000000",
+    });
+  });
+
+  it("omits the user_details part when the request carries no userDetails", async () => {
+    const { api, calls } = makeApi();
+    const { userDetails: _details, ...withoutUserDetails } =
+      enrollmentRequest();
+    await api.smartSelfieEnrollment({
+      ...withoutUserDetails,
+      tokenPayload: fullBinding,
+    });
+    const parts = partsByName(calls[0]!.body);
+    expect(parts["user_details"]).toBeUndefined();
+  });
+
+  it("an empty user_details payload omits the part entirely", async () => {
+    const { api, calls } = makeApi();
+    await api.smartSelfieEnrollment(enrollmentRequest({ userDetails: {} }));
+    const parts = partsByName(calls[0]!.body);
+    expect(parts["user_details"]).toBeUndefined();
+  });
+
+  it("omits the consent part when the request carries no consent (token-complete path)", async () => {
+    const { api, calls } = makeApi();
+    const { consent: _consent, ...withoutConsent } = enrollmentRequest();
+    await api.smartSelfieEnrollment({
+      ...withoutConsent,
+      tokenPayload: {
+        ...tokenPayload(),
+        consent: completeTokenConsent,
+      },
+    });
+    const parts = partsByName(calls[0]!.body);
+    expect(parts["consent"]).toBeUndefined();
+    // The metadata part is unconditional — it must survive the omission.
+    expect(parts["metadata"]).toBeDefined();
+  });
+
+  it("sends a local consent in full even when the token also binds consent", async () => {
+    // Server merges per-subfield with the token winning; the SDK never
+    // trims a locally captured / preset consent.
+    const { api, calls } = makeApi();
+    await api.smartSelfieEnrollment(
+      enrollmentRequest({
+        tokenPayload: {
+          ...tokenPayload(),
+          consent: completeTokenConsent,
+        },
+      }),
+    );
+    const parts = partsByName(calls[0]!.body);
+    const parsed = JSON.parse(await readJsonPart(parts["consent"]![0]));
+    expect(parsed).toEqual({
+      granted: true,
+      granted_at: "2026-04-30T00:00:00.000Z",
+      notice_language: "EN",
+      notice_privacy_policy_url: "https://example.test/p",
+    });
+  });
+
+  it("regression: without a tokenPayload the parts are identical to today", async () => {
+    const { api, calls } = makeApi();
+    await api.smartSelfieEnrollment(enrollmentRequest());
+    const parts = partsByName(calls[0]!.body);
+    const userDetailsParsed = JSON.parse(
+      await readJsonPart(parts["user_details"]![0]),
+    );
+    expect(userDetailsParsed).toEqual({
+      given_names: "John",
+      last_name: "Doe",
+      email: "john@example.test",
+      phone_number: "+254700000000",
+    });
+    const consentParsed = JSON.parse(await readJsonPart(parts["consent"]![0]));
+    expect(consentParsed).toEqual({
+      granted: true,
+      granted_at: "2026-04-30T00:00:00.000Z",
+      notice_language: "EN",
+      notice_privacy_policy_url: "https://example.test/p",
+    });
+  });
+
+  it("keeps the stripped user_details part an untagged text form field", async () => {
+    const { api, calls } = makeApi();
+    await api.smartSelfieEnrollment(
+      enrollmentRequest({
+        tokenPayload: tokenPayload({ hasGivenNames: true }),
+      }),
+    );
+    const parts = partsByName(calls[0]!.body);
+    expectNoJsonContentType(parts["user_details"]![0]);
+  });
+
+  // Every endpoint routes user_details / consent through the same
+  // helpers — pin the omission behavior across all six.
+  const omissionSubmissions: ReadonlyArray<{
+    readonly endpoint: string;
+    readonly submit: (api: SmileIDAPI) => Promise<unknown>;
+  }> = [
+    {
+      endpoint: "/v3/registration",
+      submit: (api) =>
+        api.smartSelfieEnrollment({
+          jobType: JobType.smartSelfieEnrollment,
+          selfieImage: "file:///selfie.jpg",
+          livenessImages,
+          enhanced: false,
+          metadata,
+          expectedLivenessImageCount: 7,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+    {
+      endpoint: "/v3/authentication",
+      submit: (api) =>
+        api.smartSelfieAuthentication({
+          jobType: JobType.smartSelfieAuthentication,
+          selfieImage: "file:///selfie.jpg",
+          livenessImages,
+          userId: "user-1",
+          enhanced: false,
+          metadata,
+          expectedLivenessImageCount: 7,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+    {
+      endpoint: "/v3/enhanced_kyc",
+      submit: (api) =>
+        api.enhancedKyc({
+          jobType: JobType.enhancedKyc,
+          params: { idType: "NATIONAL_ID", idNumber: "1", country: "KE" },
+          metadata,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+    {
+      endpoint: "/v3/biometric_kyc",
+      submit: (api) =>
+        api.biometricKyc({
+          jobType: JobType.biometricKyc,
+          selfieImage: "file:///selfie.jpg",
+          livenessImages,
+          params: {
+            idType: "NATIONAL_ID",
+            idNumber: "1",
+            country: "KE",
+            useEnrolledImage: false,
+          },
+          metadata,
+          expectedLivenessImageCount: 7,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+    {
+      endpoint: "/v3/document_verification",
+      submit: (api) =>
+        api.documentVerification({
+          jobType: JobType.documentVerification,
+          selfieImage: "file:///selfie.jpg",
+          livenessImages,
+          frontDocument: "file:///front.jpg",
+          country: "KE",
+          metadata,
+          expectedLivenessImageCount: 7,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+    {
+      endpoint: "/v3/enhanced_document_verification",
+      submit: (api) =>
+        api.enhancedDocumentVerification({
+          jobType: JobType.enhancedDocumentVerification,
+          selfieImage: "file:///selfie.jpg",
+          livenessImages,
+          frontDocument: "file:///front.jpg",
+          country: "KE",
+          idType: "NATIONAL_ID",
+          metadata,
+          expectedLivenessImageCount: 7,
+          tokenPayload: { ...fullBinding, consent: completeTokenConsent },
+        }),
+    },
+  ];
+
+  for (const { endpoint, submit } of omissionSubmissions) {
+    it(`${endpoint} omits user_details and consent on the token-complete path`, async () => {
+      const { api, calls } = makeApi();
+      await submit(api);
+      expect(calls[0]!.url).toBe(endpoint);
+      const parts = partsByName(calls[0]!.body);
+      expect(parts["user_details"]).toBeUndefined();
+      expect(parts["consent"]).toBeUndefined();
+      expect(parts["metadata"]).toBeDefined();
+    });
+  }
+});
+
 describe("SmileIDAPI signed job opt-in (request MAC + attestation)", () => {
   // An endpoint missing the opt-in flags ships an unsigned job the
   // server rejects — while the interceptors' own tests stay green.

package/src/data/api/interceptors/__tests__/credential_header_redaction.test.ts

@@ -0,0 +1,144 @@
+import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+
+import { LogLevel } from "../../../../core/models/network_config";
+import { LoggingConfigBuilder } from "../../../dsl/builder/config_builder";
+import { InterceptorConfigBuilder } from "../../../dsl/builder/interceptor_config_builder";
+import { attachLoggingInterceptor } from "../logging_interceptor";
+
+const CANONICAL_CREDENTIAL_HEADERS: ReadonlyArray<
+  readonly [name: string, value: string]
+> = [
+  ["SmileID-Token", "secret-jwt-value"],
+  ["smileid-partner-id", "secret-partner-002"],
+  ["SmileID-Api-Key", "secret-api-key"],
+  ["smileid-device-nonce", "secret-nonce"],
+  ["Authorization", "Bearer secret-bearer"],
+  ["Cookie", "session=secret-cookie"],
+  ["Set-Cookie", "session=secret-set-cookie"],
+];
+
+function requestHeaders(): AxiosHeaders {
+  const headers = new AxiosHeaders();
+  for (const [name, value] of CANONICAL_CREDENTIAL_HEADERS) {
+    headers.set(name, value);
+  }
+  headers.set("Content-Type", "multipart/form-data");
+  return headers;
+}
+
+function invokeRequestFulfilled(
+  client: ReturnType<typeof axios.create>,
+): InternalAxiosRequestConfig {
+  const handlers = (
+    client.interceptors.request as unknown as {
+      handlers: {
+        fulfilled?: (
+          config: InternalAxiosRequestConfig,
+        ) => InternalAxiosRequestConfig;
+      }[];
+    }
+  ).handlers;
+  const lastHandler = handlers[handlers.length - 1];
+  if (typeof lastHandler?.fulfilled !== "function") {
+    throw new Error("No fulfilled request handler found");
+  }
+  return lastHandler.fulfilled({
+    method: "post",
+    baseURL: "https://testapi.smileidentity.com",
+    url: "/v2/submit-job",
+    headers: requestHeaders(),
+  } as InternalAxiosRequestConfig);
+}
+
+describe("credential headers under the partner-facing logging config", () => {
+  let client: ReturnType<typeof axios.create>;
+  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    client = axios.create();
+    consoleLogSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    consoleLogSpy.mockRestore();
+  });
+
+  function printedOutput(): string {
+    return consoleLogSpy.mock.calls
+      .map((call) => call.map((arg) => JSON.stringify(arg)).join(" "))
+      .join("\n");
+  }
+
+  const configurations: ReadonlyArray<
+    readonly [label: string, attach: (client_: typeof client) => void]
+  > = [
+    [
+      "network { config { logging { } } } at default redactHeaders",
+      (client_) => {
+        const builder = new LoggingConfigBuilder();
+        builder.level = LogLevel.headers;
+        attachLoggingInterceptor(client_, builder.build());
+      },
+    ],
+    [
+      "network { interceptors { logging() } } at default redactHeaders",
+      (client_) => {
+        const interceptors = new InterceptorConfigBuilder();
+        interceptors
+          .logging((l) => {
+            l.level = LogLevel.headers;
+          })
+          .attach(client_);
+      },
+    ],
+  ];
+
+  for (const [label, attach] of configurations) {
+    it(`masks every credential header — ${label}`, () => {
+      attach(client);
+      invokeRequestFulfilled(client);
+
+      const output = printedOutput();
+      expect(output).not.toBe("");
+      for (const [name, value] of CANONICAL_CREDENTIAL_HEADERS) {
+        expect(output, `${name} leaked its value`).not.toContain(value);
+      }
+      expect(output).toContain("multipart/form-data");
+    });
+
+    it(`keeps the header names visible so the audit trail survives — ${label}`, () => {
+      attach(client);
+      invokeRequestFulfilled(client);
+
+      const output = printedOutput().toLowerCase();
+      for (const [name] of CANONICAL_CREDENTIAL_HEADERS) {
+        expect(output, `${name} was dropped entirely`).toContain(
+          name.toLowerCase(),
+        );
+      }
+    });
+  }
+
+  it("does not print headers at the default verbosity", () => {
+    const builder = new LoggingConfigBuilder();
+    attachLoggingInterceptor(client, builder.build());
+    invokeRequestFulfilled(client);
+
+    expect(printedOutput()).not.toContain("headers");
+  });
+
+  it("unions the partner's list with the always-redact set rather than replacing it", () => {
+    const builder = new LoggingConfigBuilder();
+    builder.level = LogLevel.headers;
+    builder.redactHeaders = ["content-type"];
+    attachLoggingInterceptor(client, builder.build());
+    invokeRequestFulfilled(client);
+
+    const output = printedOutput();
+    expect(output).not.toContain("multipart/form-data");
+    for (const [, value] of CANONICAL_CREDENTIAL_HEADERS) {
+      expect(output).not.toContain(value);
+    }
+  });
+});

package/src/data/api/interceptors/__tests__/gzip_interceptor.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+import axios, { AxiosHeaders, type InternalAxiosRequestConfig } from "axios";
+
+import { createGzipInterceptor } from "../gzip_interceptor";
+
+/**
+ * Pins `createGzipInterceptor`'s wire shape: it stamps `Accept-Encoding: gzip` on every request
+ * (never reading `config.data`), leaves the body unmodified (no compression, no Content-Type/
+ * Length), never sets `Content-Encoding`, and overwrites any existing `Accept-Encoding`.
+ */
+describe("createGzipInterceptor", () => {
+  function attachAndRun(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    const client = axios.create();
+    createGzipInterceptor().attach(client);
+    const handlers = (
+      client.interceptors.request as unknown as {
+        handlers: {
+          fulfilled?: (
+            cfg: InternalAxiosRequestConfig,
+          ) => InternalAxiosRequestConfig | Promise<InternalAxiosRequestConfig>;
+        }[];
+      }
+    ).handlers;
+    const fulfilled = handlers[handlers.length - 1]?.fulfilled;
+    if (!fulfilled) throw new Error("gzip interceptor did not register");
+    return Promise.resolve(fulfilled(config));
+  }
+
+  it("stamps Accept-Encoding: gzip on a bodyless request", async () => {
+    const result = await attachAndRun({
+      headers: new AxiosHeaders(),
+    } as InternalAxiosRequestConfig);
+
+    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
+    expect(result.data).toBeUndefined();
+  });
+
+  it("stamps the header without touching a JSON string body", async () => {
+    const result = await attachAndRun({
+      headers: new AxiosHeaders(),
+      data: '{"hello":"world"}',
+    } as InternalAxiosRequestConfig);
+
+    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
+    // The body is not compressed or otherwise transformed.
+    expect(result.data).toBe('{"hello":"world"}');
+    expect(result.headers.get("Content-Type")).toBeUndefined();
+  });
+
+  it("stamps the header without touching a multipart FormData body", async () => {
+    // A minimal FormData-like stand-in; the interceptor never inspects
+    // `config.data`'s shape, so this is enough to prove pass-through.
+    const formData = { getParts: () => [] };
+    const result = await attachAndRun({
+      headers: new AxiosHeaders(),
+      data: formData,
+    } as unknown as InternalAxiosRequestConfig);
+
+    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
+    expect(result.data).toBe(formData);
+    expect(result.headers.get("Content-Type")).toBeUndefined();
+    expect(result.headers.get("Content-Length")).toBeUndefined();
+  });
+
+  it("never stamps Content-Encoding — the request body itself is never compressed", async () => {
+    const result = await attachAndRun({
+      headers: new AxiosHeaders(),
+      data: '{"hello":"world"}',
+    } as InternalAxiosRequestConfig);
+
+    expect(result.headers.get("Content-Encoding")).toBeUndefined();
+  });
+
+  it("overwrites an Accept-Encoding value set by an earlier interceptor", async () => {
+    const result = await attachAndRun({
+      headers: new AxiosHeaders({ "Accept-Encoding": "identity" }),
+    } as InternalAxiosRequestConfig);
+
+    expect(result.headers.get("Accept-Encoding")).toBe("gzip");
+  });
+});

package/src/data/api/interceptors/smile_auth_interceptor.ts

@@ -1,5 +1,5 @@
 import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
-import { Platform } from "react-native";
+import { sourceSdkIdentifier } from "@smileid/usesmileid_bridge";
 
 import type { PartnerConfig } from "../../../core/models/network_config";
 import { currentRequestTimestamp } from "../../security/request_timestamp";
@@ -26,22 +26,7 @@ import type { TokenHolder } from "../auth/token_holder";
  * by the next outgoing request.
  */
 
-const SDK_VERSION = "12.0.0";
-
-/**
- * Source-SDK identifier, suffixed with the runtime platform so the server can
- * attribute the request and resolve the matching per-SDK signing secret.
- */
-function sourceSdk(): string {
-  switch (Platform.OS) {
-    case "android":
-      return "react-native-expo (android)";
-    case "ios":
-      return "react-native-expo (iOS)";
-    default:
-      return "react-native-expo";
-  }
-}
+const SDK_VERSION = "12.0.2"; // x-release-please-version
 
 export type SmileAuthInterceptorOptions = {
   readonly partnerConfig: PartnerConfig;
@@ -73,7 +58,7 @@ export class SmileAuthInterceptor {
     config: InternalAxiosRequestConfig,
   ): Promise<InternalAxiosRequestConfig> {
     config.headers.set("smileid-token", this._tokenHolder.current);
-    config.headers.set("smileid-source-sdk", sourceSdk());
+    config.headers.set("smileid-source-sdk", sourceSdkIdentifier());
     config.headers.set("smileid-source-sdk-version", SDK_VERSION);
     config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
     if (this._partnerConfig.callbackUrl) {