@smileid/usesmileid 12.0.0 → 12.0.2

package/src/data/repository/__tests__/network_retries.test.ts

@@ -34,7 +34,7 @@ const CONSENT: ConsentInformation = Object.freeze({
 });
 
 const METADATA = new UseSmileIDMetadata({
-  sdkVersion: "12.0.0",
+  sdkVersion: "12.0.2",
   sdk: "react-native-expo",
   deviceOs: "",
   deviceModel: "",

package/src/data/repository/__tests__/repository_dispatch.test.ts

@@ -0,0 +1,366 @@
+import { describe, expect, it, beforeEach, vi } from "vitest";
+
+// `vi.mock` is hoisted above the imports, so anything its factory closes over
+// must be created with `vi.hoisted` or it is still in the TDZ when the factory
+// runs.
+const { compress } = vi.hoisted(() => ({ compress: vi.fn() }));
+
+vi.mock("axios", () => ({
+  __esModule: true,
+  default: { create: vi.fn(), isAxiosError: () => false },
+  isAxiosError: () => false,
+}));
+
+// The compression runner touches `expo-file-system` and the native re-encoder;
+// the repository only cares that it produces (or fails to produce) size hints.
+vi.mock("../../compression/payload_compression_runner", () => ({
+  PayloadCompressionRunner: { compress },
+}));
+
+import { UseSmileIDRepositoryImpl } from "../use_smile_id_repository_impl";
+import {
+  RetryStrategy,
+  type RetryConfig,
+} from "../../../core/models/network_config";
+import { JobType } from "../../../core/models/job_type";
+import { UseSmileIDMetadata } from "../../../metadata/use_smile_id_metadata";
+import { UseSmileIDValidationException } from "../../../core/exception/use_smile_id_validation_exception";
+import { UseSmileIDNetworkException } from "../../../core/exception/use_smile_id_network_exception";
+import type { JobRequest } from "../../model/job_request";
+import type { JobSubmissionResponse } from "../../model/job_submission_response";
+import type { ConsentInformation } from "../../../core/models/params";
+
+/**
+ * Repository dispatch + pre-flight compression tests: every job type must
+ * reach its matching API method, the compression sizes must land on the
+ * submitted metadata, and a compression failure must never block the
+ * submission. The BVN short-circuit lives in `use_smile_id_repository.test.ts`.
+ */
+
+const NO_RETRY: RetryConfig = Object.freeze({
+  maxAttempts: 1,
+  strategy: RetryStrategy.none,
+  initialDelay: 0,
+  multiplier: 1,
+  maxDelay: 0,
+  jitter: 0,
+  fixedDelay: 0,
+});
+
+const CONSENT: ConsentInformation = Object.freeze({
+  granted: true,
+  grantedAt: "2026-04-30T00:00:00.000Z",
+  noticeLanguage: "EN",
+  noticePrivacyPolicyUrl: "https://example.test/p",
+});
+
+const METADATA = new UseSmileIDMetadata({
+  sdkVersion: "12.0.2",
+  sdk: "react-native-expo",
+  deviceOs: "",
+  deviceModel: "",
+  appName: "",
+  sessionId: "test-session-id",
+  clientIp: "",
+  networkConnection: "",
+  carrierInfo: "",
+  timezone: "",
+  locale: "",
+  screenResolution: "",
+  memoryInfoMb: 0,
+  deviceOrientation: "",
+  systemArchitecture: "",
+  numberOfCameras: 0,
+  hostApplication: "",
+  securityPolicyVersion: "12.0.0",
+  sdkConfigSource: "default",
+  imageWidth: 0,
+  imageHeight: 0,
+  livenessImageWidth: 0,
+  livenessImageHeight: 0,
+});
+
+const RESPONSE: JobSubmissionResponse = {
+  jobId: "job-1",
+  userId: "user-1",
+  status: "approved",
+  message: "ok",
+};
+
+const USER_DETAILS = {
+  givenNames: "A",
+  lastName: "B",
+  email: "a@b.test",
+} as const;
+
+type StubApi = Record<string, ReturnType<typeof vi.fn>>;
+
+function makeApi(): StubApi {
+  return {
+    enhancedKyc: vi.fn(async () => RESPONSE),
+    biometricKyc: vi.fn(async () => RESPONSE),
+    smartSelfieEnrollment: vi.fn(async () => RESPONSE),
+    smartSelfieAuthentication: vi.fn(async () => RESPONSE),
+    documentVerification: vi.fn(async () => RESPONSE),
+    enhancedDocumentVerification: vi.fn(async () => RESPONSE),
+  };
+}
+
+function makeRepository(api: StubApi, retry: RetryConfig = NO_RETRY) {
+  return new UseSmileIDRepositoryImpl(
+    api as unknown as ConstructorParameters<typeof UseSmileIDRepositoryImpl>[0],
+    retry,
+  );
+}
+
+const selfieEnrollment: JobRequest = {
+  jobType: JobType.smartSelfieEnrollment,
+  selfieImage: "file:///selfie.jpg",
+  livenessImages: ["file:///liveness-1.jpg"],
+  userDetails: USER_DETAILS,
+  enhanced: false,
+  expectedLivenessImageCount: 1,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+const selfieAuthentication: JobRequest = {
+  jobType: JobType.smartSelfieAuthentication,
+  selfieImage: "file:///selfie.jpg",
+  livenessImages: [],
+  userDetails: USER_DETAILS,
+  userId: "user-1",
+  enhanced: true,
+  expectedLivenessImageCount: 0,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+const biometricKyc: JobRequest = {
+  jobType: JobType.biometricKyc,
+  selfieImage: "file:///selfie.jpg",
+  livenessImages: [],
+  params: { idType: "NIN", idNumber: "1", country: "NG" },
+  userDetails: USER_DETAILS,
+  expectedLivenessImageCount: 0,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+const enhancedKyc: JobRequest = {
+  jobType: JobType.enhancedKyc,
+  params: { idType: "NIN", idNumber: "1", country: "NG" },
+  userDetails: USER_DETAILS,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+const documentVerification: JobRequest = {
+  jobType: JobType.documentVerification,
+  selfieImage: "file:///selfie.jpg",
+  livenessImages: [],
+  frontDocument: "file:///front.jpg",
+  backDocument: "file:///back.jpg",
+  country: "NG",
+  userDetails: USER_DETAILS,
+  expectedLivenessImageCount: 0,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+const enhancedDocumentVerification: JobRequest = {
+  jobType: JobType.enhancedDocumentVerification,
+  selfieImage: "file:///selfie.jpg",
+  livenessImages: [],
+  frontDocument: "file:///front.jpg",
+  country: "NG",
+  idType: "NATIONAL_ID",
+  userDetails: USER_DETAILS,
+  expectedLivenessImageCount: 0,
+  consent: CONSENT,
+  metadata: METADATA,
+};
+
+function metadataNames(request: unknown): readonly string[] {
+  const { metadata } = request as { metadata: UseSmileIDMetadata };
+  return metadata.toEntries().map((entry) => entry.name);
+}
+
+function metadataValue(request: unknown, name: string): string | undefined {
+  const { metadata } = request as { metadata: UseSmileIDMetadata };
+  return metadata.toEntries().find((entry) => entry.name === name)?.value;
+}
+
+describe("UseSmileIDRepositoryImpl — dispatch", () => {
+  beforeEach(() => {
+    compress.mockReset().mockResolvedValue({});
+  });
+
+  const cases: ReadonlyArray<readonly [string, JobRequest, string]> = [
+    ["smart selfie enrollment", selfieEnrollment, "smartSelfieEnrollment"],
+    [
+      "smart selfie authentication",
+      selfieAuthentication,
+      "smartSelfieAuthentication",
+    ],
+    ["enhanced KYC", enhancedKyc, "enhancedKyc"],
+    ["biometric KYC", biometricKyc, "biometricKyc"],
+    ["document verification", documentVerification, "documentVerification"],
+    [
+      "enhanced document verification",
+      enhancedDocumentVerification,
+      "enhancedDocumentVerification",
+    ],
+  ];
+
+  for (const [label, request, method] of cases) {
+    it(`routes ${label} to api.${method}`, async () => {
+      const api = makeApi();
+      const result = await makeRepository(api).submit(request);
+
+      expect(result.status).toBe("success");
+      expect(api[method]).toHaveBeenCalledTimes(1);
+      for (const [, , other] of cases) {
+        if (other !== method) expect(api[other]).not.toHaveBeenCalled();
+      }
+    });
+  }
+});
+
+describe("UseSmileIDRepositoryImpl — pre-flight compression", () => {
+  beforeEach(() => {
+    compress.mockReset().mockResolvedValue({});
+  });
+
+  it("compresses the selfie bundle for selfie job types", async () => {
+    const api = makeApi();
+    await makeRepository(api).submit(selfieEnrollment);
+
+    expect(compress).toHaveBeenCalledTimes(1);
+    const args = compress.mock.calls[0]?.[0] as Record<string, unknown>;
+    expect(args.selfieImage).toBe("file:///selfie.jpg");
+    expect(args.livenessImages).toEqual(["file:///liveness-1.jpg"]);
+    expect(args.frontDocument).toBeUndefined();
+    expect(args.metadataBytes).toBeGreaterThan(0);
+  });
+
+  it("includes both document sides for document job types", async () => {
+    const api = makeApi();
+    await makeRepository(api).submit(documentVerification);
+
+    const args = compress.mock.calls[0]?.[0] as Record<string, unknown>;
+    expect(args.frontDocument).toBe("file:///front.jpg");
+    expect(args.backDocument).toBe("file:///back.jpg");
+  });
+
+  it("skips compression entirely for image-less job types", async () => {
+    const api = makeApi();
+    await makeRepository(api).submit(enhancedKyc);
+
+    expect(compress).not.toHaveBeenCalled();
+    expect(metadataNames(api.enhancedKyc.mock.calls[0]?.[0])).not.toContain(
+      "selfie_original_size",
+    );
+  });
+
+  it("stamps every measured size onto the submitted metadata", async () => {
+    compress.mockResolvedValue({
+      selfieOriginalMb: 1.5,
+      selfieFinalMb: 0.5,
+      frontOriginalMb: 2,
+      frontFinalMb: 1,
+      backOriginalMb: 3,
+      backFinalMb: 1.25,
+    });
+    const api = makeApi();
+    await makeRepository(api).submit(documentVerification);
+
+    const submitted = api.documentVerification.mock.calls[0]?.[0];
+    expect(metadataValue(submitted, "selfie_original_size")).toBe("1.5");
+    expect(metadataValue(submitted, "selfie_final_compressed_size")).toBe(
+      "0.5",
+    );
+    expect(metadataValue(submitted, "document_front_original_size")).toBe("2");
+    expect(
+      metadataValue(submitted, "document_front_final_compressed_size"),
+    ).toBe("1");
+    expect(metadataValue(submitted, "document_back_original_size")).toBe("3");
+    expect(
+      metadataValue(submitted, "document_back_final_compressed_size"),
+    ).toBe("1.25");
+    // The caller's metadata instance is never mutated.
+    expect(METADATA.toEntries().map((entry) => entry.name)).not.toContain(
+      "selfie_original_size",
+    );
+  });
+
+  it("drops absent and zero sizes rather than stamping them", async () => {
+    compress.mockResolvedValue({
+      selfieOriginalMb: 1.5,
+      selfieFinalMb: 0,
+      frontOriginalMb: undefined,
+    });
+    const api = makeApi();
+    await makeRepository(api).submit(documentVerification);
+
+    const submitted = api.documentVerification.mock.calls[0]?.[0];
+    const stamped = metadataNames(submitted);
+    expect(stamped).toContain("selfie_original_size");
+    expect(stamped).not.toContain("selfie_final_compressed_size");
+    expect(stamped).not.toContain("document_front_original_size");
+  });
+
+  it("leaves the metadata untouched when nothing was measured", async () => {
+    compress.mockResolvedValue({});
+    const api = makeApi();
+    await makeRepository(api).submit(selfieEnrollment);
+
+    const submitted = api.smartSelfieEnrollment.mock.calls[0]?.[0];
+    expect(submitted).toBe(selfieEnrollment);
+  });
+
+  it("submits the captured images as-is when compression throws", async () => {
+    compress.mockRejectedValue(new Error("native re-encoder unavailable"));
+    const api = makeApi();
+    const result = await makeRepository(api).submit(selfieEnrollment);
+
+    expect(result.status).toBe("success");
+    expect(api.smartSelfieEnrollment).toHaveBeenCalledTimes(1);
+    expect(
+      metadataNames(api.smartSelfieEnrollment.mock.calls[0]?.[0]),
+    ).not.toContain("selfie_original_size");
+  });
+});
+
+describe("UseSmileIDRepositoryImpl — error mapping", () => {
+  beforeEach(() => {
+    compress.mockReset().mockResolvedValue({});
+  });
+
+  it("surfaces a validation exception unchanged rather than as a network error", async () => {
+    const validationError = new UseSmileIDValidationException({
+      message: "liveness image count mismatch",
+    });
+    const api = makeApi();
+    api.smartSelfieEnrollment.mockRejectedValue(validationError);
+
+    const result = await makeRepository(api).submit(selfieEnrollment);
+
+    expect(result.status).toBe("failure");
+    if (result.status === "failure") {
+      expect(result.error).toBe(validationError);
+    }
+  });
+
+  it("maps any other thrown error into the network exception hierarchy", async () => {
+    const api = makeApi();
+    api.enhancedKyc.mockRejectedValue(new Error("socket hang up"));
+
+    const result = await makeRepository(api).submit(enhancedKyc);
+
+    expect(result.status).toBe("failure");
+    if (result.status === "failure") {
+      expect(result.error).toBeInstanceOf(UseSmileIDNetworkException);
+    }
+  });
+});

package/src/data/repository/__tests__/use_smile_id_repository.test.ts

@@ -51,7 +51,7 @@ const CONSENT: ConsentInformation = Object.freeze({
 // BVN path short-circuits before the API serializes it, but the field
 // is required on `BaseJobRequest` so the fixture must supply one.
 const METADATA = new UseSmileIDMetadata({
-  sdkVersion: "12.0.0",
+  sdkVersion: "12.0.2",
   sdk: "react-native-expo",
   deviceOs: "",
   deviceModel: "",

package/src/data/security/__tests__/request_canonicalizer.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, it } from "vitest";
+
+import { RequestCanonicalizer } from "../request_canonicalizer";
+import { SmileIDCryptoManager } from "../smile_id_crypto_manager";
+
+/**
+ * Golden-vector suite for `RequestCanonicalizer`: pins the exact canonical bytes and the resulting
+ * `smileid-request-mac` for a fixed key across the shapes `canonicalize()` distinguishes. This
+ * SDK's own contract with the server, not a cross-SDK guarantee.
+ */
+const TIMESTAMP = "1700000000000";
+const SIGNING_SECRET = "golden-vector-secret";
+const cryptoManager = new SmileIDCryptoManager(SIGNING_SECRET);
+
+const BASE_HEADERS = {
+  "smileid-token": "golden-token",
+  "smileid-request-timestamp": TIMESTAMP,
+};
+
+type FormDataPart = { fieldName: string; string?: string; uri?: string };
+
+/** Minimal stand-in for React Native's `FormData` (only `getParts` is read). */
+function formData(parts: readonly FormDataPart[]) {
+  return { getParts: () => parts };
+}
+
+function decode(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("utf-8");
+}
+
+const MULTIPART_BODY = formData([
+  { fieldName: "country", string: "NG" },
+  { fieldName: "allow_new_enroll", string: "true" },
+  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
+  {
+    fieldName: "selfie_image",
+    uri: "data:application/octet-stream;base64,c2VsZmll",
+  },
+]);
+
+// Same logical fields as MULTIPART_BODY, in reverse part order.
+const MULTIPART_BODY_REORDERED = formData([
+  {
+    fieldName: "selfie_image",
+    uri: "data:application/octet-stream;base64,c2VsZmll",
+  },
+  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
+  { fieldName: "allow_new_enroll", string: "true" },
+  { fieldName: "country", string: "NG" },
+]);
+
+const MIXED_CASE_HEADERS = {
+  "Smileid-Token": "golden-token",
+  "SMILEID-REQUEST-TIMESTAMP": TIMESTAMP,
+};
+
+describe("RequestCanonicalizer golden vectors", () => {
+  it("(a) canonicalizes a bodyless request to the signed headers + `{}`", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      undefined,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, undefined)).toBe(
+      "qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=",
+    );
+  });
+
+  it("(b) canonicalizes a raw JSON-string body the same as a bodyless request — only FormData-shaped bodies are reconstructed", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      '{"hello":"world"}',
+    );
+    // Same canonical bytes as case (a): a JSON string isn't FormData-like,
+    // so canonicalBody() falls through to the same `{}` as no body at all.
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, '{"hello":"world"}'),
+    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
+  });
+
+  it("(c) canonicalizes a multipart FormData body: scalar, boolean-coerced, JSON, and file parts", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      MULTIPART_BODY,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
+        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, MULTIPART_BODY),
+    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
+  });
+
+  it("(d) part ordering does not change the canonical bytes or the MAC", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      MULTIPART_BODY_REORDERED,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
+        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
+    );
+    expect(
+      await cryptoManager.sign(
+        TIMESTAMP,
+        BASE_HEADERS,
+        MULTIPART_BODY_REORDERED,
+      ),
+    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
+  });
+
+  it("(e) header key casing does not change the canonical bytes or the MAC", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      MIXED_CASE_HEADERS,
+      undefined,
+    );
+    // Identical to case (a): canonicalHeaders() lower-cases every header
+    // name before signing, so casing at the call site is not observable.
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, MIXED_CASE_HEADERS, undefined),
+    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
+  });
+});