@smileid/usesmileid 12.0.0 → 12.0.2

package/src/data/api/smile_id_api.ts

@@ -4,7 +4,9 @@ import type {
   PartnerConfig,
 } from "../../core/models/network_config";
 import { SmileIDUrls } from "../smile_id_urls";
-import type { ConsentInformation, UserDetails } from "../../core/models/params";
+import type { ConsentInformation } from "../../core/models/params";
+import { userDetailsPayloadToWire } from "../model/user_details_payload";
+import type { UserDetailsPayload } from "../model/user_details_payload";
 import type {
   BiometricKycRequest,
   DocumentVerificationRequest,
@@ -87,11 +89,7 @@ export class SmileIDAPI {
     request: SmartSelfieEnrollmentRequest,
   ): Promise<JobSubmissionResponse> {
     const formData = this._buildSelfieFormData(request);
-    appendJsonPart(
-      formData,
-      "user_details",
-      userDetailsToWire(request.userDetails),
-    );
+    appendUserDetailsPart(formData, request);
     this._appendPartnerConfigParts(formData);
     this._appendConsentAndMetadata(formData, request.consent, request.metadata);
     return this._postMultipart("/v3/registration", formData);
@@ -108,11 +106,7 @@ export class SmileIDAPI {
   ): Promise<JobSubmissionResponse> {
     const formData = this._buildSelfieFormData(request);
     appendStringPart(formData, "user_id", request.userId);
-    appendJsonPart(
-      formData,
-      "user_details",
-      userDetailsToWire(request.userDetails),
-    );
+    appendUserDetailsPart(formData, request);
     this._appendPartnerConfigParts(formData);
     this._appendConsentAndMetadata(formData, request.consent, request.metadata);
     return this._postMultipart("/v3/authentication", formData);
@@ -126,11 +120,7 @@ export class SmileIDAPI {
     // multipart/form-data`.
     const formData = new FormData();
     this._appendIdFields(formData, request.params);
-    appendJsonPart(
-      formData,
-      "user_details",
-      userDetailsToWire(request.userDetails),
-    );
+    appendUserDetailsPart(formData, request);
     if (request.params.bankCode) {
       appendStringPart(formData, "bank_code", request.params.bankCode);
     }
@@ -149,11 +139,7 @@ export class SmileIDAPI {
     const useEnrolled = request.params.useEnrolledImage;
     const formData = this._buildSelfieFormData(request);
     this._appendIdFields(formData, request.params);
-    appendJsonPart(
-      formData,
-      "user_details",
-      userDetailsToWire(request.userDetails),
-    );
+    appendUserDetailsPart(formData, request);
     if (useEnrolled) {
       appendStringPart(formData, "use_enrolled_image", "true");
     }
@@ -194,11 +180,7 @@ export class SmileIDAPI {
     if (request.idType) {
       appendStringPart(formData, "id_type", request.idType);
     }
-    appendJsonPart(
-      formData,
-      "user_details",
-      userDetailsToWire(request.userDetails),
-    );
+    appendUserDetailsPart(formData, request);
     this._appendPartnerConfigParts(formData);
     this._appendConsentAndMetadata(formData, request.consent, request.metadata);
     return this._postMultipart(url, formData);
@@ -306,6 +288,10 @@ export class SmileIDAPI {
    * the part with `Content-Type: application/json` causes the parser
    * to reject the part as "missing or invalid".
    *
+   * `consent` is `undefined` only when the token binds complete
+   * consent and no local source exists — the part is then omitted
+   * entirely and the server injects the token's consent.
+   *
    * The `metadata` snapshot is built by the request-construction site
    * (the flow navigation manager) and travels on the request — this
    * method serializes the snapshot it is handed rather than generating
@@ -313,19 +299,21 @@ export class SmileIDAPI {
    */
   private _appendConsentAndMetadata(
     formData: FormData,
-    consent: ConsentInformation,
+    consent: ConsentInformation | undefined,
     metadata: UseSmileIDMetadata,
   ): void {
     // Transform the JS camelCase shape into the canonical snake_case
     // wire JSON before serialization. The server validates the wire
     // shape exactly — `consent.granted` (snake_case via `granted`
     // already) and `consent.granted_at` are required.
-    appendJsonPart(formData, "consent", {
-      granted: consent.granted,
-      granted_at: consent.grantedAt,
-      notice_language: consent.noticeLanguage,
-      notice_privacy_policy_url: consent.noticePrivacyPolicyUrl,
-    });
+    if (consent !== undefined) {
+      appendJsonPart(formData, "consent", {
+        granted: consent.granted,
+        granted_at: consent.grantedAt,
+        notice_language: consent.noticeLanguage,
+        notice_privacy_policy_url: consent.noticePrivacyPolicyUrl,
+      });
+    }
     appendJsonPart(formData, "metadata", metadata.toEntries());
   }
 
@@ -386,23 +374,22 @@ function mapJobSubmissionResponse(data: unknown): JobSubmissionResponse {
 }
 
 /**
- * Convert `UserDetails` to the snake_case wire shape. Optional fields
- * are trimmed; blank values are omitted.
+ * Append the `user_details` JSON multipart part. The payload arrives
+ * pre-reduced from assembly (token-bound fields already dropped); the
+ * part is omitted entirely when nothing remains — or when `userDetails`
+ * was legitimately omitted because the token binds every required field.
  */
-function userDetailsToWire(details: UserDetails): Record<string, string> {
-  const wire: Record<string, string> = {
-    given_names: details.givenNames,
-    last_name: details.lastName,
-  };
-  const trimmedEmail = details.email?.trim();
-  if (trimmedEmail) {
-    wire["email"] = trimmedEmail;
-  }
-  const trimmedPhone = details.phoneNumber?.trim();
-  if (trimmedPhone) {
-    wire["phone_number"] = trimmedPhone;
-  }
-  return wire;
+function appendUserDetailsPart(
+  formData: FormData,
+  request: {
+    readonly userDetails?: UserDetailsPayload;
+  },
+): void {
+  const details = request.userDetails;
+  if (details === undefined) return;
+  const wire = userDetailsPayloadToWire(details);
+  if (Object.keys(wire).length === 0) return;
+  appendJsonPart(formData, "user_details", wire);
 }
 
 /**

package/src/data/compression/__tests__/payload_compressor_real_jpeg.test.ts

@@ -125,7 +125,9 @@ describe("PayloadCompressor with real JPEG bytes", () => {
 
   it(
     "compresses an inflated selfie+liveness bundle under the caps and keeps files decodable",
-    { timeout: 120_000 },
+    // Real JPEG (re)compression is CPU-heavy; under v8 coverage instrumentation on CI it runs
+    // ~2.5x slower (~120s), so allow generous headroom over the ~120s per-test CI runtime.
+    { timeout: 300_000 },
     async () => {
       const selfieUri = "file:///capture/selfie.jpg";
       const livenessUri = "file:///capture/liveness.jpg";
@@ -172,7 +174,9 @@ describe("PayloadCompressor with real JPEG bytes", () => {
 
   it(
     "compresses a document-heavy bundle back-first and lands under the guarantee caps",
-    { timeout: 120_000 },
+    // Real JPEG (re)compression is CPU-heavy; under v8 coverage instrumentation on CI it runs
+    // ~2.5x slower (~120s), so allow generous headroom over the ~120s per-test CI runtime.
+    { timeout: 300_000 },
     async () => {
       const frontUri = "file:///capture/front.jpg";
       const backUri = "file:///capture/back.jpg";

package/src/data/dsl/__tests__/use_smile_id_network_builder.test.ts

@@ -0,0 +1,157 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { UseSmileIDNetworkBuilder } from "../use_smile_id_network_builder";
+import { JobType } from "../../../core/models/job_type";
+import {
+  LogLevel,
+  RetryStrategy,
+  type Interceptor,
+} from "../../../core/models/network_config";
+
+/**
+ * The network DSL's top level: every block is lazily constructed, a
+ * repeated block keeps mutating the same receiver, and `build()` emits
+ * only the blocks the partner actually opened — an eagerly-created
+ * builder would ship defaults the partner never asked for.
+ */
+
+describe("UseSmileIDNetworkBuilder", () => {
+  it("emits an empty config when no block is opened", () => {
+    expect(new UseSmileIDNetworkBuilder().build()).toEqual({});
+  });
+
+  it("freezes the built configuration", () => {
+    const built = new UseSmileIDNetworkBuilder().build();
+    expect(Object.isFrozen(built)).toBe(true);
+  });
+
+  it("builds the config block from the partner's identity and job type", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.config((config) => {
+      config.jobType = JobType.enhancedKyc;
+      config.token = "jwt-token";
+      config.partnerConfig((partner) => {
+        partner.partnerId = "0001";
+        partner.useSandbox = true;
+      });
+      config.logging((logging) => {
+        logging.level = LogLevel.body;
+      });
+    });
+
+    const built = builder.build();
+    expect(built.config?.jobType).toBe(JobType.enhancedKyc);
+    expect(built.config?.token).toBe("jwt-token");
+    expect(built.config?.partnerConfig?.partnerId).toBe("0001");
+    expect(built.config?.partnerConfig?.useSandbox).toBe(true);
+    expect(built.config?.logging?.level).toBe(LogLevel.body);
+  });
+
+  it("builds per-phase timeouts", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.timeouts((timeouts) => {
+      timeouts.connect = 5;
+      timeouts.read = 10;
+      timeouts.write = 15;
+      timeouts.call = 20;
+    });
+
+    expect(builder.build().timeouts).toEqual({
+      connect: 5,
+      read: 10,
+      write: 15,
+      call: 20,
+    });
+  });
+
+  it("builds the cache block, including the megabytes helper", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.cache((cache) => {
+      cache.enabled = false;
+      cache.maxSize = cache.megabytes(8);
+    });
+
+    expect(builder.build().cache).toEqual({
+      enabled: false,
+      maxSize: 8 * 1024 * 1024,
+    });
+  });
+
+  it("builds the retry block", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.retry((retry) => {
+      retry.strategy = RetryStrategy.exponential;
+      retry.maxAttempts = 4;
+      retry.initialDelay = 2;
+    });
+
+    const retry = builder.build().retry;
+    expect(retry?.strategy).toBe(RetryStrategy.exponential);
+    expect(retry?.maxAttempts).toBe(4);
+    expect(retry?.initialDelay).toBe(2);
+  });
+
+  it("builds the interceptor chain in registration order", () => {
+    const custom: Interceptor = { attach: vi.fn() };
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.interceptors((interceptors) => {
+      interceptors.add(interceptors.gzip());
+      interceptors.add(custom);
+    });
+
+    const chain = builder.build().interceptors;
+    expect(chain).toHaveLength(2);
+    expect(chain?.[1]).toBe(custom);
+  });
+
+  it("reuses each block's builder across repeated calls", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    const seen: unknown[] = [];
+
+    builder.cache((cache) => {
+      seen.push(cache);
+      cache.maxSize = 1;
+    });
+    builder.cache((cache) => {
+      seen.push(cache);
+      cache.enabled = false;
+    });
+    builder.retry((retry) => {
+      seen.push(retry);
+      retry.strategy = RetryStrategy.fixed;
+    });
+    builder.retry((retry) => {
+      seen.push(retry);
+      retry.fixedDelay = 3;
+    });
+    builder.interceptors((interceptors) => {
+      seen.push(interceptors);
+      interceptors.add({ attach: vi.fn() });
+    });
+    builder.interceptors((interceptors) => {
+      seen.push(interceptors);
+      interceptors.add({ attach: vi.fn() });
+    });
+
+    expect(seen[0]).toBe(seen[1]);
+    expect(seen[2]).toBe(seen[3]);
+    expect(seen[4]).toBe(seen[5]);
+
+    const built = builder.build();
+    // Both mutations survived because the receiver was reused.
+    expect(built.cache).toEqual({ enabled: false, maxSize: 1 });
+    expect(built.retry?.strategy).toBe(RetryStrategy.fixed);
+    expect(built.retry?.fixedDelay).toBe(3);
+    expect(built.interceptors).toHaveLength(2);
+  });
+
+  it("omits blocks the partner never opened", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.cache((cache) => {
+      cache.enabled = false;
+    });
+
+    const built = builder.build();
+    expect(Object.keys(built)).toEqual(["cache"]);
+  });
+});

package/src/data/dsl/builder/__tests__/config_builders.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+
+import { CacheConfigBuilder } from "../cache_config_builder";
+import { RetryConfigBuilder, RetryStrategy } from "../retry_config_builder";
+
+/** Retry/cache DSL builders: pin the documented defaults, frozen output, and overrides. */
+describe("RetryConfigBuilder", () => {
+  it("builds a frozen config with the documented defaults", () => {
+    const config = new RetryConfigBuilder().build();
+
+    expect(config).toEqual({
+      maxAttempts: 1,
+      strategy: RetryStrategy.none,
+      initialDelay: 1,
+      multiplier: 2,
+      maxDelay: 32,
+      jitter: 0.2,
+      fixedDelay: 1,
+    });
+    expect(Object.isFrozen(config)).toBe(true);
+  });
+
+  it("forces maxAttempts to 1 for none, whatever the field says", () => {
+    const builder = new RetryConfigBuilder();
+    builder.maxAttempts = 5;
+
+    expect(builder.build().maxAttempts).toBe(1);
+  });
+
+  it("applies the attempt budget once a strategy opts in", () => {
+    const builder = new RetryConfigBuilder();
+    builder.strategy = RetryStrategy.exponential;
+
+    expect(builder.build().maxAttempts).toBe(3);
+  });
+
+  it("carries overridden fields through build()", () => {
+    const builder = new RetryConfigBuilder();
+    builder.maxAttempts = 5;
+    builder.strategy = RetryStrategy.fixed;
+    builder.fixedDelay = 4;
+
+    const config = builder.build();
+
+    expect(config.maxAttempts).toBe(5);
+    expect(config.strategy).toBe(RetryStrategy.fixed);
+    expect(config.fixedDelay).toBe(4);
+  });
+});
+
+describe("CacheConfigBuilder", () => {
+  it("defaults to enabled with a 50 MB ceiling", () => {
+    const config = new CacheConfigBuilder().build();
+
+    expect(config).toEqual({ enabled: true, maxSize: 50 * 1024 * 1024 });
+    expect(Object.isFrozen(config)).toBe(true);
+  });
+
+  it("megabytes() converts MB to bytes", () => {
+    expect(new CacheConfigBuilder().megabytes(10)).toBe(10 * 1024 * 1024);
+  });
+});

package/src/data/dsl/builder/retry_config_builder.ts

@@ -8,16 +8,16 @@ export { RetryStrategy };
 /**
  * DSL builder for request retry behaviour.
  *
- * Defaults to exponential backoff with 3 attempts, 1 s initial delay,
- * 32 s ceiling, ±20% jitter. `fixedDelay` is honoured only when
- * `strategy = RetryStrategy.fixed`.
+ * Defaults to no retry. Set `strategy` to opt in, and the remaining fields
+ * then apply: 3 attempts, 1 s initial delay, 32 s ceiling, ±20% jitter.
+ * `fixedDelay` is honoured only when `strategy = RetryStrategy.fixed`.
  */
 export class RetryConfigBuilder {
-  /** Maximum number of attempts per request, including the first. */
+  /** Attempts per request including the first; applies once `strategy` opts in. */
   maxAttempts = 3;
 
   /** Backoff strategy between attempts: exponential, fixed, or none. */
-  strategy: RetryStrategy = RetryStrategy.exponential;
+  strategy: RetryStrategy = RetryStrategy.none;
 
   /** Delay before the first retry, in seconds (exponential strategy). */
   initialDelay = 1;
@@ -45,7 +45,7 @@ export class RetryConfigBuilder {
 
   build(): RetryConfig {
     return Object.freeze({
-      maxAttempts: this.maxAttempts,
+      maxAttempts: this.strategy === RetryStrategy.none ? 1 : this.maxAttempts,
       strategy: this.strategy,
       initialDelay: this.initialDelay,
       multiplier: this.multiplier,

package/src/data/factory/__tests__/retry_gzip_mac_composition.test.ts

@@ -0,0 +1,163 @@
+import { describe, expect, it } from "vitest";
+import {
+  AxiosError,
+  type AxiosResponse,
+  type InternalAxiosRequestConfig,
+} from "axios";
+
+import { JobType } from "../../../core/models/job_type";
+import type { NetworkConfig } from "../../../core/models/network_config";
+import { makeNetworkingFactory } from "../networking_factory";
+import { SmileIDCryptoManager } from "../../security/smile_id_crypto_manager";
+import {
+  REQUEST_MAC_HEADER,
+  REQUEST_MAC_OPT_IN_KEY,
+  REQUEST_TIMESTAMP_HEADER,
+} from "../../api/interceptors/smile_request_mac_interceptor";
+
+/**
+ * Standing-guard composition test for token-refresh × gzip × request-MAC on a
+ * 401 → refresh → retry. `TokenRefreshInterceptor` re-issues the config, re-running the whole
+ * chain (auth re-stamps the token, MAC re-signs, gzip re-stamps `Accept-Encoding`). If a future
+ * change made gzip replace `config.data` with compressed bytes, the MAC would sign a body the
+ * canonicalizer no longer sees as FormData → `{}`. Pins the retried MAC against the uncompressed
+ * body so that regression fails loud.
+ */
+describe("token-refresh x gzip x request-MAC composition", () => {
+  const initialToken = "token-1";
+  const refreshedToken = "token-2";
+  const signingSecret = "test-signing-secret";
+  const cryptoManager = new SmileIDCryptoManager(signingSecret);
+
+  type FormDataPart = { fieldName: string; string?: string; uri?: string };
+
+  /**
+   * Stand-in for RN's `FormData`. Besides `getParts()` (what the canonicalizer reads), it
+   * satisfies axios's `isFormData()` (`Symbol.toStringTag` + `append`) so axios's request
+   * transform leaves it untouched instead of JSON-stringifying it.
+   */
+  class FakeFormData {
+    constructor(private readonly parts: readonly FormDataPart[]) {}
+    get [Symbol.toStringTag](): string {
+      return "FormData";
+    }
+    append(): void {
+      /* not exercised — only presence is checked by axios's isFormData() */
+    }
+    getParts(): readonly FormDataPart[] {
+      return this.parts;
+    }
+  }
+
+  function submissionBody(): FakeFormData {
+    return new FakeFormData([
+      { fieldName: "country", string: "NG" },
+      { fieldName: "partner_params", string: '{"flow":"enhanced"}' },
+      {
+        fieldName: "selfie_image",
+        uri: "data:application/octet-stream;base64,c2VsZmll",
+      },
+    ]);
+  }
+
+  /** Flattens the observed AxiosHeaders to a lower-cased record, matching how
+   *  RequestCanonicalizer lower-cases header names before signing. */
+  function headersRecord(
+    headers: InternalAxiosRequestConfig["headers"],
+  ): Record<string, string> {
+    const out: Record<string, string> = {};
+    for (const [key, value] of Object.entries(
+      headers as unknown as Record<string, unknown>,
+    )) {
+      if (value != null) out[key.toLowerCase()] = String(value);
+    }
+    return out;
+  }
+
+  function makeConfig(): NetworkConfig {
+    return {
+      config: {
+        jobType: JobType.smartSelfieEnrollment,
+        token: initialToken,
+        onTokenExpired: async () => refreshedToken,
+        partnerConfig: {
+          partnerId: "partner-1",
+          callbackUrl: "https://partner.example.com/cb",
+          useSandbox: true,
+        },
+      },
+    };
+  }
+
+  it("signs the refresh-retried request's MAC over the uncompressed submission body", async () => {
+    const requestsSeen: InternalAxiosRequestConfig[] = [];
+    const { client } = makeNetworkingFactory(makeConfig(), () => signingSecret);
+
+    // 401 first, 200 on the retry. A custom adapter bypasses axios's validateStatus, so it
+    // must reject non-2xx itself for TokenRefreshInterceptor's error handler to see it.
+    client.defaults.adapter = (
+      requestConfig: InternalAxiosRequestConfig,
+    ): Promise<AxiosResponse> => {
+      requestsSeen.push(requestConfig);
+      const isFirstCall = requestsSeen.length === 1;
+      const response: AxiosResponse = {
+        status: isFirstCall ? 401 : 200,
+        statusText: isFirstCall ? "Unauthorized" : "OK",
+        data: isFirstCall ? { error: "unauthorized" } : { jobId: "job-1" },
+        headers: {},
+        config: requestConfig,
+      };
+      if (isFirstCall) {
+        return Promise.reject(
+          new AxiosError(
+            "Request failed with status code 401",
+            AxiosError.ERR_BAD_REQUEST,
+            requestConfig,
+            undefined,
+            response,
+          ),
+        );
+      }
+      return Promise.resolve(response);
+    };
+
+    const body = submissionBody();
+    const response = await client.post("/v3/enhanced_kyc", body, {
+      [REQUEST_MAC_OPT_IN_KEY]: true,
+    } as Partial<InternalAxiosRequestConfig>);
+
+    expect(response.status).toBe(200);
+    expect(requestsSeen).toHaveLength(2);
+
+    const retried = requestsSeen[1]!;
+    const retriedHeaders = headersRecord(retried.headers);
+
+    expect(retriedHeaders["smileid-token"]).toBe(refreshedToken);
+    expect(retriedHeaders["accept-encoding"]).toBe("gzip");
+    // gzip is hint-only — it never compresses the body, so no Content-Encoding claim.
+    expect(retriedHeaders["content-encoding"]).toBeUndefined();
+
+    const retriedMac = retriedHeaders[REQUEST_MAC_HEADER];
+    const retriedTimestamp = retriedHeaders[REQUEST_TIMESTAMP_HEADER];
+    expect(retriedMac).toBeDefined();
+    expect(retriedTimestamp).toBeDefined();
+
+    // Recompute the server-verified MAC over the retried headers and the real body — gzip
+    // is hint-only (never replaces config.data), so `body` is the bytes that shipped.
+    const expectedMac = await cryptoManager.sign(
+      retriedTimestamp!,
+      retriedHeaders,
+      body,
+    );
+    expect(retriedMac).toBe(expectedMac);
+
+    // And it must not match a MAC computed against an empty body — the
+    // signature of the regression this test guards against.
+    const emptyBodyMac = await cryptoManager.sign(
+      retriedTimestamp!,
+      retriedHeaders,
+      undefined,
+    );
+    expect(retriedMac).not.toBe(emptyBodyMac);
+  });
+});

package/src/data/factory/__tests__/signed_job_submission_headers.test.ts

@@ -36,7 +36,7 @@ function makeBaseConfig(): NetworkConfig {
 }
 
 const metadata = new UseSmileIDMetadata({
-  sdkVersion: "12.0.0",
+  sdkVersion: "12.0.2",
   sdk: "react-native-expo",
   deviceOs: "",
   deviceModel: "",