@smileid/usesmileid 12.0.1 → 12.0.2

package/src/data/dsl/__tests__/use_smile_id_network_builder.test.ts

@@ -0,0 +1,157 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { UseSmileIDNetworkBuilder } from "../use_smile_id_network_builder";
+import { JobType } from "../../../core/models/job_type";
+import {
+  LogLevel,
+  RetryStrategy,
+  type Interceptor,
+} from "../../../core/models/network_config";
+
+/**
+ * The network DSL's top level: every block is lazily constructed, a
+ * repeated block keeps mutating the same receiver, and `build()` emits
+ * only the blocks the partner actually opened — an eagerly-created
+ * builder would ship defaults the partner never asked for.
+ */
+
+describe("UseSmileIDNetworkBuilder", () => {
+  it("emits an empty config when no block is opened", () => {
+    expect(new UseSmileIDNetworkBuilder().build()).toEqual({});
+  });
+
+  it("freezes the built configuration", () => {
+    const built = new UseSmileIDNetworkBuilder().build();
+    expect(Object.isFrozen(built)).toBe(true);
+  });
+
+  it("builds the config block from the partner's identity and job type", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.config((config) => {
+      config.jobType = JobType.enhancedKyc;
+      config.token = "jwt-token";
+      config.partnerConfig((partner) => {
+        partner.partnerId = "0001";
+        partner.useSandbox = true;
+      });
+      config.logging((logging) => {
+        logging.level = LogLevel.body;
+      });
+    });
+
+    const built = builder.build();
+    expect(built.config?.jobType).toBe(JobType.enhancedKyc);
+    expect(built.config?.token).toBe("jwt-token");
+    expect(built.config?.partnerConfig?.partnerId).toBe("0001");
+    expect(built.config?.partnerConfig?.useSandbox).toBe(true);
+    expect(built.config?.logging?.level).toBe(LogLevel.body);
+  });
+
+  it("builds per-phase timeouts", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.timeouts((timeouts) => {
+      timeouts.connect = 5;
+      timeouts.read = 10;
+      timeouts.write = 15;
+      timeouts.call = 20;
+    });
+
+    expect(builder.build().timeouts).toEqual({
+      connect: 5,
+      read: 10,
+      write: 15,
+      call: 20,
+    });
+  });
+
+  it("builds the cache block, including the megabytes helper", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.cache((cache) => {
+      cache.enabled = false;
+      cache.maxSize = cache.megabytes(8);
+    });
+
+    expect(builder.build().cache).toEqual({
+      enabled: false,
+      maxSize: 8 * 1024 * 1024,
+    });
+  });
+
+  it("builds the retry block", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.retry((retry) => {
+      retry.strategy = RetryStrategy.exponential;
+      retry.maxAttempts = 4;
+      retry.initialDelay = 2;
+    });
+
+    const retry = builder.build().retry;
+    expect(retry?.strategy).toBe(RetryStrategy.exponential);
+    expect(retry?.maxAttempts).toBe(4);
+    expect(retry?.initialDelay).toBe(2);
+  });
+
+  it("builds the interceptor chain in registration order", () => {
+    const custom: Interceptor = { attach: vi.fn() };
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.interceptors((interceptors) => {
+      interceptors.add(interceptors.gzip());
+      interceptors.add(custom);
+    });
+
+    const chain = builder.build().interceptors;
+    expect(chain).toHaveLength(2);
+    expect(chain?.[1]).toBe(custom);
+  });
+
+  it("reuses each block's builder across repeated calls", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    const seen: unknown[] = [];
+
+    builder.cache((cache) => {
+      seen.push(cache);
+      cache.maxSize = 1;
+    });
+    builder.cache((cache) => {
+      seen.push(cache);
+      cache.enabled = false;
+    });
+    builder.retry((retry) => {
+      seen.push(retry);
+      retry.strategy = RetryStrategy.fixed;
+    });
+    builder.retry((retry) => {
+      seen.push(retry);
+      retry.fixedDelay = 3;
+    });
+    builder.interceptors((interceptors) => {
+      seen.push(interceptors);
+      interceptors.add({ attach: vi.fn() });
+    });
+    builder.interceptors((interceptors) => {
+      seen.push(interceptors);
+      interceptors.add({ attach: vi.fn() });
+    });
+
+    expect(seen[0]).toBe(seen[1]);
+    expect(seen[2]).toBe(seen[3]);
+    expect(seen[4]).toBe(seen[5]);
+
+    const built = builder.build();
+    // Both mutations survived because the receiver was reused.
+    expect(built.cache).toEqual({ enabled: false, maxSize: 1 });
+    expect(built.retry?.strategy).toBe(RetryStrategy.fixed);
+    expect(built.retry?.fixedDelay).toBe(3);
+    expect(built.interceptors).toHaveLength(2);
+  });
+
+  it("omits blocks the partner never opened", () => {
+    const builder = new UseSmileIDNetworkBuilder();
+    builder.cache((cache) => {
+      cache.enabled = false;
+    });
+
+    const built = builder.build();
+    expect(Object.keys(built)).toEqual(["cache"]);
+  });
+});

package/src/data/factory/__tests__/signed_job_submission_headers.test.ts

@@ -36,7 +36,7 @@ function makeBaseConfig(): NetworkConfig {
 }
 
 const metadata = new UseSmileIDMetadata({
-  sdkVersion: "12.0.1",
+  sdkVersion: "12.0.2",
   sdk: "react-native-expo",
   deviceOs: "",
   deviceModel: "",

package/src/data/model/__tests__/token_payload.test.ts

@@ -0,0 +1,224 @@
+import { describe, expect, it } from "vitest";
+import {
+  isTokenConsentComplete,
+  tokenConsentMissingSubfields,
+  parseTokenPayload,
+  bindsRequiredUserDetails,
+  type TokenPayload,
+} from "../token_payload";
+
+// Canonical backend claim — user-detail values are opaque vault
+// references; only key presence is meaningful client-side.
+const FULL_CLAIM = {
+  given_names: "pii_abc",
+  last_name: "pii_def",
+  email: "pii_ghi",
+  phone_number: "pii_jkl",
+  consent: {
+    granted: true,
+    granted_at: "2026-01-01T09:00:00.000Z",
+    notice_language: "EN",
+    notice_privacy_policy_url: "https://partner.test/privacy",
+  },
+} as const;
+
+describe("parseTokenPayload — claim-shape tolerance", () => {
+  it("parses the full canonical claim into presence flags + complete consent", () => {
+    const payload = parseTokenPayload(FULL_CLAIM);
+    expect(payload).toEqual({
+      hasGivenNames: true,
+      hasLastName: true,
+      hasEmail: true,
+      hasPhoneNumber: true,
+      consent: {
+        granted: true,
+        grantedAt: "2026-01-01T09:00:00.000Z",
+        noticeLanguage: "EN",
+        noticePrivacyPolicyUrl: "https://partner.test/privacy",
+      },
+    });
+  });
+
+  it("parses a subset claim — only the present keys flag true", () => {
+    const payload = parseTokenPayload({ email: "pii_x" });
+    expect(payload).toEqual({
+      hasGivenNames: false,
+      hasLastName: false,
+      hasEmail: true,
+      hasPhoneNumber: false,
+    });
+  });
+
+  it("returns undefined for a non-object claim (string / array / number / null)", () => {
+    expect(parseTokenPayload("payload")).toBeUndefined();
+    expect(parseTokenPayload(["pii_x"])).toBeUndefined();
+    expect(parseTokenPayload(42)).toBeUndefined();
+    expect(parseTokenPayload(null)).toBeUndefined();
+    expect(parseTokenPayload(undefined)).toBeUndefined();
+  });
+
+  it("treats an empty string value as not binding the field", () => {
+    const payload = parseTokenPayload({ given_names: "", email: "pii_x" });
+    expect(payload?.hasGivenNames).toBe(false);
+    expect(payload?.hasEmail).toBe(true);
+  });
+
+  it("degrades a wrong-typed identity field to absent without dropping its siblings", () => {
+    const payload = parseTokenPayload({
+      given_names: 42,
+      last_name: ["pii"],
+      email: "pii_x",
+    });
+    expect(payload?.hasGivenNames).toBe(false);
+    expect(payload?.hasLastName).toBe(false);
+    expect(payload?.hasEmail).toBe(true);
+  });
+
+  it("ignores unknown keys and the out-of-scope id/callback fields", () => {
+    const payload = parseTokenPayload({
+      country: "NG",
+      id_type: "NIN",
+      id_number: "pii_id",
+      callback_url: "callback_x",
+      something_new: { nested: true },
+      last_name: "pii_def",
+    });
+    expect(payload).toEqual({
+      hasGivenNames: false,
+      hasLastName: true,
+      hasEmail: false,
+      hasPhoneNumber: false,
+    });
+  });
+
+  it("treats a non-object consent (string / array) as absent", () => {
+    expect(parseTokenPayload({ consent: "granted" })?.consent).toBeUndefined();
+    expect(parseTokenPayload({ consent: [true] })?.consent).toBeUndefined();
+  });
+
+  it("treats an empty consent object as absent", () => {
+    expect(parseTokenPayload({ consent: {} })?.consent).toBeUndefined();
+  });
+
+  it('never trusts granted: false or granted: "yes" as a binding', () => {
+    const deniedConsent = parseTokenPayload({
+      consent: { granted: false, granted_at: "2026-01-01T09:00:00.000Z" },
+    })?.consent;
+    expect(deniedConsent?.granted).toBeUndefined();
+    expect(deniedConsent?.grantedAt).toBe("2026-01-01T09:00:00.000Z");
+
+    const stringGranted = parseTokenPayload({
+      consent: { granted: "yes" },
+    })?.consent;
+    expect(stringGranted).toBeUndefined();
+  });
+
+  it("degrades wrong-typed consent subfields individually", () => {
+    const consent = parseTokenPayload({
+      consent: { granted: true, granted_at: 12345, notice_language: "EN" },
+    })?.consent;
+    expect(consent).toEqual({ granted: true, noticeLanguage: "EN" });
+  });
+
+  it("never throws for arbitrary claim shapes", () => {
+    const inputs: unknown[] = [
+      {},
+      FULL_CLAIM,
+      { consent: { granted: null } },
+      { given_names: { nested: true } },
+      Object.create(null),
+    ];
+    for (const input of inputs) {
+      expect(() => parseTokenPayload(input)).not.toThrow();
+    }
+  });
+});
+
+describe("isTokenConsentComplete", () => {
+  const completeConsent = {
+    granted: true,
+    grantedAt: "2026-01-01T09:00:00.000Z",
+    noticeLanguage: "EN",
+    noticePrivacyPolicyUrl: "https://partner.test/privacy",
+  } as const;
+
+  it("is true only when granted and all three subfields are non-blank", () => {
+    expect(isTokenConsentComplete(completeConsent)).toBe(true);
+  });
+
+  it("is false when any subfield is missing or blank", () => {
+    expect(isTokenConsentComplete(undefined)).toBe(false);
+    const { granted: _granted, ...withoutGranted } = completeConsent;
+    expect(isTokenConsentComplete(withoutGranted)).toBe(false);
+    const { noticeLanguage: _language, ...withoutLanguage } = completeConsent;
+    expect(isTokenConsentComplete(withoutLanguage)).toBe(false);
+    expect(
+      isTokenConsentComplete({ ...completeConsent, grantedAt: "  " }),
+    ).toBe(false);
+    expect(
+      isTokenConsentComplete({
+        ...completeConsent,
+        noticePrivacyPolicyUrl: "",
+      }),
+    ).toBe(false);
+  });
+
+  it("missingSubfields names exactly the absent or blank consent subfields", () => {
+    expect(tokenConsentMissingSubfields(completeConsent)).toEqual([]);
+    const { granted: _granted, ...withoutGranted } = completeConsent;
+    expect(tokenConsentMissingSubfields(withoutGranted)).toEqual(["granted"]);
+    const { noticeLanguage: _language, ...withoutLanguage } = completeConsent;
+    expect(
+      tokenConsentMissingSubfields({ ...withoutLanguage, grantedAt: " " }),
+    ).toEqual(["granted_at", "notice_language"]);
+    expect(tokenConsentMissingSubfields({})).toEqual([
+      "granted",
+      "granted_at",
+      "notice_language",
+      "notice_privacy_policy_url",
+    ]);
+  });
+});
+
+describe("bindsRequiredUserDetails", () => {
+  function payload(overrides: Partial<TokenPayload>): TokenPayload {
+    return {
+      hasGivenNames: false,
+      hasLastName: false,
+      hasEmail: false,
+      hasPhoneNumber: false,
+      ...overrides,
+    };
+  }
+
+  it("requires both names plus at least one contact field", () => {
+    expect(
+      bindsRequiredUserDetails(
+        payload({ hasGivenNames: true, hasLastName: true, hasEmail: true }),
+      ),
+    ).toBe(true);
+    expect(
+      bindsRequiredUserDetails(
+        payload({
+          hasGivenNames: true,
+          hasLastName: true,
+          hasPhoneNumber: true,
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  it("is false when a name or every contact field is missing", () => {
+    expect(
+      bindsRequiredUserDetails(
+        payload({ hasGivenNames: true, hasLastName: true }),
+      ),
+    ).toBe(false);
+    expect(
+      bindsRequiredUserDetails(
+        payload({ hasGivenNames: true, hasEmail: true }),
+      ),
+    ).toBe(false);
+    expect(bindsRequiredUserDetails(undefined)).toBe(false);
+  });
+});

package/src/data/model/__tests__/user_details_payload.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import type { UserDetails } from "../../../core/models/params";
+import {
+  isUserDetailsPayloadEmpty,
+  userDetailsPayloadFrom,
+  userDetailsPayloadToWire,
+} from "../user_details_payload";
+
+// Pins the `user_details` wire carrier: token-bound fields are stripped,
+// nothing-stripped output matches the legacy `UserDetails` encoding, and an
+// all-stripped payload reads as empty so the part is omitted rather than
+// sent as `{}`.
+describe("UserDetailsPayload", () => {
+  const details: UserDetails = {
+    givenNames: "Ada",
+    lastName: "Lovelace",
+    email: "ada@example.test",
+    phoneNumber: "+2348000000000",
+  };
+
+  it("no token binding keeps every field and matches the UserDetails wire encoding", () => {
+    const payload = userDetailsPayloadFrom(details, undefined);
+
+    expect(payload).toEqual(details);
+    expect(isUserDetailsPayloadEmpty(payload)).toBe(false);
+    expect(userDetailsPayloadToWire(payload)).toEqual({
+      given_names: "Ada",
+      last_name: "Lovelace",
+      email: "ada@example.test",
+      phone_number: "+2348000000000",
+    });
+  });
+
+  it("an empty token payload binding nothing keeps every field", () => {
+    const payload = userDetailsPayloadFrom(details, {
+      hasGivenNames: false,
+      hasLastName: false,
+      hasEmail: false,
+      hasPhoneNumber: false,
+    });
+
+    expect(payload).toEqual(details);
+  });
+
+  it("token-bound fields are dropped individually", () => {
+    const payload = userDetailsPayloadFrom(details, {
+      hasGivenNames: true,
+      hasLastName: true,
+      hasEmail: false,
+      hasPhoneNumber: false,
+    });
+
+    expect(payload.givenNames).toBeUndefined();
+    expect(payload.lastName).toBeUndefined();
+    expect(payload.email).toBe("ada@example.test");
+    expect(payload.phoneNumber).toBe("+2348000000000");
+    expect(Object.keys(userDetailsPayloadToWire(payload)).sort()).toEqual([
+      "email",
+      "phone_number",
+    ]);
+  });
+
+  it("fully bound details read as empty", () => {
+    const payload = userDetailsPayloadFrom(details, {
+      hasGivenNames: true,
+      hasLastName: true,
+      hasEmail: true,
+      hasPhoneNumber: true,
+    });
+
+    expect(isUserDetailsPayloadEmpty(payload)).toBe(true);
+  });
+
+  it("blank contact fields count as empty and are omitted from the wire", () => {
+    const payload = userDetailsPayloadFrom(
+      { givenNames: "Ada", lastName: "Lovelace", email: "  ", phoneNumber: "" },
+      {
+        hasGivenNames: true,
+        hasLastName: true,
+        hasEmail: false,
+        hasPhoneNumber: false,
+      },
+    );
+
+    // Blank contacts encode to nothing, so nothing remains.
+    expect(isUserDetailsPayloadEmpty(payload)).toBe(true);
+    expect(userDetailsPayloadToWire(payload)).toEqual({});
+  });
+
+  it("contact fields are trimmed on the wire", () => {
+    const wire = userDetailsPayloadToWire({
+      givenNames: "Ada",
+      lastName: "Lovelace",
+      email: " ada@example.test ",
+    });
+
+    expect(wire["email"]).toBe("ada@example.test");
+    expect(wire["phone_number"]).toBeUndefined();
+  });
+});

package/src/data/model/job_request.ts

@@ -2,8 +2,8 @@ import type {
   ConsentInformation,
   EnhancedKYCParams,
   BiometricKYCParams,
-  UserDetails,
 } from "../../core/models/params";
+import type { UserDetailsPayload } from "./user_details_payload";
 import { JobType } from "../../core/models/job_type";
 import type { UseSmileIDMetadata } from "../../metadata/use_smile_id_metadata";
 
@@ -12,10 +12,11 @@ import type { UseSmileIDMetadata } from "../../metadata/use_smile_id_metadata";
  * narrows the union and tells the repository which API method to
  * dispatch to.
  *
- * Every variant intersects [BaseJobRequest], which carries the two
+ * Every variant intersects [BaseJobRequest], which carries the
  * fields shared by all submissions: the partner-captured `consent`
- * record and the per-submission `metadata` snapshot. Variants keep a
- * narrowed `jobType` literal so the union still discriminates.
+ * record, the per-submission `metadata` snapshot, and the decoded
+ * token bindings. Variants keep a narrowed `jobType` literal so the
+ * union still discriminates.
  *
  * `metadata` is built at the request-construction site (the flow
  * navigation manager) and travels on the request itself — the API
@@ -23,7 +24,14 @@ import type { UseSmileIDMetadata } from "../../metadata/use_smile_id_metadata";
  * multipart part rather than generating the snapshot at submit time.
  */
 export interface BaseJobRequest {
-  readonly consent: ConsentInformation;
+  /**
+   * Local consent record (captured on the consent screen or
+   * pre-supplied via the builder). Omitted only when no local source
+   * exists AND the token binds complete consent — the API layer then
+   * omits the `consent` multipart part and the server injects the
+   * token's consent.
+   */
+  readonly consent?: ConsentInformation;
   readonly metadata: UseSmileIDMetadata;
 }
 
@@ -31,7 +39,8 @@ export type SmartSelfieEnrollmentRequest = BaseJobRequest & {
   readonly jobType: typeof JobType.smartSelfieEnrollment;
   readonly selfieImage: string;
   readonly livenessImages: readonly string[];
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
   /**
    * Screen-level enhanced-liveness intent marker. The wire path is
    * always `/v3/registration` (and `/v3/authentication` on the auth
@@ -59,7 +68,8 @@ export type SmartSelfieAuthenticationRequest = BaseJobRequest & {
   readonly jobType: typeof JobType.smartSelfieAuthentication;
   readonly selfieImage: string;
   readonly livenessImages: readonly string[];
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
   /**
    * The `user_id` returned by a prior enrollment — the v3
    * `/v3/authentication` endpoint requires it so the server can match
@@ -77,7 +87,8 @@ export type SmartSelfieAuthenticationRequest = BaseJobRequest & {
 export type EnhancedKycRequest = BaseJobRequest & {
   readonly jobType: typeof JobType.enhancedKyc;
   readonly params: EnhancedKYCParams;
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
 };
 
 /**
@@ -90,7 +101,8 @@ export type EnhancedKycRequest = BaseJobRequest & {
 export type BvnRequest = BaseJobRequest & {
   readonly jobType: typeof JobType.bvn;
   readonly params: EnhancedKYCParams;
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
 };
 
 export type BiometricKycRequest = BaseJobRequest & {
@@ -98,7 +110,8 @@ export type BiometricKycRequest = BaseJobRequest & {
   readonly selfieImage: string;
   readonly livenessImages: readonly string[];
   readonly params: BiometricKYCParams;
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
   /** See `SmartSelfieEnrollmentRequest.expectedLivenessImageCount`. */
   readonly expectedLivenessImageCount: number;
 };
@@ -114,7 +127,8 @@ export type DocumentVerificationRequest = BaseJobRequest & {
   readonly country: string;
   /** Optional — the server classifies the document when omitted. */
   readonly idType?: string;
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
   /** See `SmartSelfieEnrollmentRequest.expectedLivenessImageCount`. */
   readonly expectedLivenessImageCount: number;
 };
@@ -135,7 +149,8 @@ export type EnhancedDocumentVerificationRequest = BaseJobRequest & {
   readonly backDocument?: string;
   readonly country: string;
   readonly idType: string;
-  readonly userDetails: UserDetails;
+  /** Omitted when the token binds every required field, or reduced to the unbound remainder. */
+  readonly userDetails?: UserDetailsPayload;
   /** See `SmartSelfieEnrollmentRequest.expectedLivenessImageCount`. */
   readonly expectedLivenessImageCount: number;
 };