@smileid/usesmileid 12.0.2 → 12.1.0

package/src/data/api/interceptors/logging_interceptor.ts

@@ -1,155 +0,0 @@
-import type {
-  AxiosInstance,
-  AxiosResponse,
-  AxiosError,
-  InternalAxiosRequestConfig,
-} from "axios";
-import {
-  LogLevel,
-  type NetworkLoggingConfig,
-} from "../../../core/models/network_config";
-import { ALWAYS_REDACT, ALWAYS_REDACT_BODY_KEYS } from "./sensitive_headers";
-
-/**
- * Logging interceptor.
- *
- * Levels:
- *   - `none`:    silent
- *   - `basic`:   request line + response status line
- *   - `headers`: basic + request/response headers (with redaction)
- *   - `body`:    headers + response body / error body (request body
- *                is large — multipart binaries — and not logged)
- *
- * Header redaction: the auth interceptor adds sensitive headers
- * (`SmileID-Token`, `smileid-partner-id`) and partners can extend
- * the redaction list via
- * `n.logging((l) => { l.redactHeaders = ['x-proxy-secret']; })`.
- *
- * One concrete security guard: redact list is case-insensitive —
- * partners pass `'x-Partner-Token'` and we redact `'x-partner-token'`
- * too.
- */
-
-// Canonical redact set lives in a dedicated module so a new sensitive
-// header can be added in one place and picked up by every logging path.
-
-export function attachLoggingInterceptor(
-  client: AxiosInstance,
-  config: NetworkLoggingConfig,
-): { request: number; response: number } {
-  if (!config.enabled || config.level === LogLevel.none) {
-    // Attach no-op interceptors so `eject(...)` calls match.
-    const noopReq = client.interceptors.request.use((c) => c);
-    const noopRes = client.interceptors.response.use((r) => r);
-    return { request: noopReq, response: noopRes };
-  }
-
-  const partnerRedact = new Set(
-    config.redactHeaders.map((h) => h.toLowerCase()),
-  );
-
-  const requestId = client.interceptors.request.use((c) => {
-    logRequest(c, config.level, partnerRedact);
-    return c;
-  });
-
-  const responseId = client.interceptors.response.use(
-    (response) => {
-      logResponse(response, config.level);
-      return response;
-    },
-    (error: AxiosError) => {
-      logError(error, config.level);
-      return Promise.reject(error);
-    },
-  );
-
-  return { request: requestId, response: responseId };
-}
-
-function logRequest(
-  config: InternalAxiosRequestConfig,
-  level: NetworkLoggingConfig["level"],
-  partnerRedact: ReadonlySet<string>,
-): void {
-  const method = (config.method ?? "GET").toUpperCase();
-  const url = `${config.baseURL ?? ""}${config.url ?? ""}`;
-  // eslint-disable-next-line no-console
-  console.log(`[UseSmileID] → ${method} ${url}`);
-  if (level === LogLevel.headers || level === LogLevel.body) {
-    const redacted = redactHeaders(
-      config.headers as unknown as Record<string, unknown>,
-      partnerRedact,
-    );
-    // eslint-disable-next-line no-console
-    console.log("[UseSmileID]   headers:", redacted);
-  }
-}
-
-function logResponse(
-  response: AxiosResponse,
-  level: NetworkLoggingConfig["level"],
-): void {
-  // eslint-disable-next-line no-console
-  console.log(
-    `[UseSmileID] ← ${response.status} ${response.statusText} ${response.config.url ?? ""}`,
-  );
-  if (level === LogLevel.body) {
-    // eslint-disable-next-line no-console
-    console.log("[UseSmileID]   body:", redactBody(response.data));
-  }
-}
-
-function logError(
-  error: AxiosError,
-  level: NetworkLoggingConfig["level"],
-): void {
-  const status = error.response?.status ?? "no-response";
-  // eslint-disable-next-line no-console
-  console.warn(
-    `[UseSmileID] ✗ ${status} ${error.config?.url ?? ""} — ${error.message}`,
-  );
-  if (level === LogLevel.body && error.response) {
-    // eslint-disable-next-line no-console
-    console.warn("[UseSmileID]   body:", redactBody(error.response.data));
-  }
-}
-
-const MAX_REDACT_DEPTH = 6;
-
-/**
- * Copy of `data` safe to log — sensitive keys masked, recursion capped
- * at {@link MAX_REDACT_DEPTH}. Never mutates the input.
- */
-function redactBody(data: unknown, depth: number = 0): unknown {
-  if (depth >= MAX_REDACT_DEPTH) return "<depth-limit>";
-  if (Array.isArray(data)) {
-    return data.map((item) => redactBody(item, depth + 1));
-  }
-  if (data !== null && typeof data === "object") {
-    const out: Record<string, unknown> = {};
-    for (const [key, value] of Object.entries(data)) {
-      out[key] = ALWAYS_REDACT_BODY_KEYS.has(key.toLowerCase())
-        ? "<redacted>"
-        : redactBody(value, depth + 1);
-    }
-    return out;
-  }
-  return data;
-}
-
-function redactHeaders(
-  headers: Record<string, unknown>,
-  partnerRedact: ReadonlySet<string>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(headers ?? {})) {
-    const lower = key.toLowerCase();
-    if (ALWAYS_REDACT.has(lower) || partnerRedact.has(lower)) {
-      out[key] = "<redacted>";
-    } else {
-      out[key] = value;
-    }
-  }
-  return out;
-}

package/src/data/api/interceptors/sensitive_headers.ts

@@ -1,46 +0,0 @@
-/**
- * Canonical list of HTTP headers the SDK redacts unconditionally from
- * any partner-visible log line, regardless of whether the partner
- * remembered to populate `redactHeaders` themselves.
- *
- * These headers carry credentials, session tokens, or partner-id signals
- * that would let a bystander reading the console output impersonate the
- * partner's backend. The logging interceptor replaces the value with
- * `██` while preserving the header name, so the audit trail still
- * shows the header was present.
- *
- * Partners can extend this set via
- * `n.logging((l) => { l.redactHeaders = ['x-partner-proxy-secret']; })` —
- * the auto-applied + partner-supplied lists are unioned before logging.
- *
- * Names are stored lowercase; the logging interceptor matches
- * case-insensitively.
- */
-export const ALWAYS_REDACT: ReadonlySet<string> = new Set(
-  [
-    "smileid-token",
-    "smileid-partner-id",
-    "smileid-api-key",
-    "smileid-device-nonce",
-    "authorization",
-    "cookie",
-    "set-cookie",
-  ].map((h) => h.toLowerCase()),
-);
-
-/**
- * JSON body fields redacted unconditionally from `LogLevel.body` log
- * lines — credentials the server may echo back (token exchange,
- * signed-response envelopes). Matched case-insensitively by full key.
- */
-export const ALWAYS_REDACT_BODY_KEYS: ReadonlySet<string> = new Set(
-  [
-    "token",
-    "api_key",
-    "apikey",
-    "signature",
-    "secret",
-    "authorization",
-    "session_id",
-  ].map((k) => k.toLowerCase()),
-);

package/src/data/api/interceptors/smile_auth_interceptor.ts

@@ -1,73 +0,0 @@
-import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
-import { sourceSdkIdentifier } from "@smileid/usesmileid_bridge";
-
-import type { PartnerConfig } from "../../../core/models/network_config";
-import { currentRequestTimestamp } from "../../security/request_timestamp";
-import type { TokenHolder } from "../auth/token_holder";
-
-/**
- * Auth interceptor.
- *
- * Responsibilities:
- *   1. Stamp the partner-supplied auth token onto every outbound
- *      request as the `smileid-token` header.
- *   2. Add the canonical SDK identification headers
- *      (`smileid-source-sdk`, `smileid-source-sdk-version`,
- *      `smileid-partner-id`, `callback-url`).
- *   3. Stamp `smileid-request-timestamp` (epoch ms) before the request-MAC
- *      interceptor runs, so it is part of the signed `smileid-*` set and the
- *      MAC reuses it as the salt.
- *
- * Token exchange is the partner application's responsibility — it
- * fetches a short-lived v3 token from its own backend and supplies the
- * result via the network DSL's `config.token`. The interceptor reads
- * the current value from the shared {@link TokenHolder} so a refreshed
- * value written by `TokenRefreshInterceptor` is observed automatically
- * by the next outgoing request.
- */
-
-const SDK_VERSION = "12.0.2"; // x-release-please-version
-
-export type SmileAuthInterceptorOptions = {
-  readonly partnerConfig: PartnerConfig;
-  readonly tokenHolder: TokenHolder;
-};
-
-export class SmileAuthInterceptor {
-  private readonly _partnerConfig: PartnerConfig;
-  private readonly _tokenHolder: TokenHolder;
-
-  constructor(options: SmileAuthInterceptorOptions) {
-    this._partnerConfig = options.partnerConfig;
-    this._tokenHolder = options.tokenHolder;
-  }
-
-  /**
-   * Attach to an axios instance. Returns the interceptor ID so the
-   * caller can detach later if needed (typically just on instance
-   * disposal — the interceptor's lifetime tracks the instance).
-   */
-  attach(client: AxiosInstance): { request: number } {
-    const requestId = client.interceptors.request.use(async (config) => {
-      return this._onRequest(config);
-    });
-    return { request: requestId };
-  }
-
-  private async _onRequest(
-    config: InternalAxiosRequestConfig,
-  ): Promise<InternalAxiosRequestConfig> {
-    config.headers.set("smileid-token", this._tokenHolder.current);
-    config.headers.set("smileid-source-sdk", sourceSdkIdentifier());
-    config.headers.set("smileid-source-sdk-version", SDK_VERSION);
-    config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
-    if (this._partnerConfig.callbackUrl) {
-      config.headers.set("callback-url", this._partnerConfig.callbackUrl);
-    }
-    // Generated at request time and stamped before the request-MAC interceptor
-    // runs, so it is part of the signed `smileid-*` header set and the MAC
-    // reuses the same value as its salt rather than reading the clock again.
-    config.headers.set("smileid-request-timestamp", currentRequestTimestamp());
-    return config;
-  }
-}

package/src/data/api/interceptors/smile_integrity_interceptor.ts

@@ -1,99 +0,0 @@
-import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
-
-import { Attestation, AttestationException } from "@smileid/usesmileid_bridge";
-
-import type { SecurityPolicy } from "../../security/security_policy";
-import { REQUEST_MAC_HEADER } from "./smile_request_mac_interceptor";
-
-/**
- * Stamps the `smileid-device-nonce` header on every outbound request
- * whose axios config declares `_useSmileIDAttestation: true`. The
- * header carries the base64-encoded envelope from
- * `Attestation.requestToken`, bound to the `smileid-request-mac`
- * value set upstream by `SmileRequestMacInterceptor`.
- *
- * Native side (Play Integrity on Android, App Attest on iOS) is
- * already wired through `usesmileid_bridge`'s Expo module; this
- * interceptor is a thin TS-side coordinator that:
- *
- *   1. Skips requests that don't opt in via `_useSmileIDAttestation`.
- *   2. Reads the upstream `smileid-request-mac` header. If missing
- *      (e.g. the endpoint opted into attestation but not MAC), ships
- *      unattested — the integrity guarantee is the body binding, so
- *      a stamped nonce without a MAC adds noise rather than security.
- *   3. Calls `Attestation.requestToken(macHeader)`.
- *   4. On success → stamp `smileid-device-nonce: <token>`.
- *   5. On `AttestationException` → stamp
- *      `smileid-device-nonce: ERR_<urlEncoded>`. **Fail-open by
- *      design**: failing closed on the client means an outage at
- *      Google / Apple takes the SDK offline; the server logs the
- *      failure mode and decides policy.
- *
- * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
- * once at flow mount so the per-request `requestToken` call doesn't
- * pay the multi-second warm-up cost on every submission.
- *
- * Attestation is additionally gated by the server-driven {@link SecurityPolicy}:
- * when the session's policy disables the device-attestation check, an opted-in
- * request ships without a device nonce. The policy is fail-secure, so a token
- * that omits the claim attests as before.
- */
-
-export const DEVICE_NONCE_HEADER = "smileid-device-nonce";
-
-/** Axios config key that opts a request into attestation stamping. */
-export const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
-
-export type SmileIntegrityInterceptorOptions = {
-  readonly securityPolicy: SecurityPolicy;
-};
-
-export class SmileIntegrityInterceptor {
-  private readonly _securityPolicy: SecurityPolicy;
-
-  constructor(options: SmileIntegrityInterceptorOptions) {
-    this._securityPolicy = options.securityPolicy;
-  }
-
-  attach(client: AxiosInstance): { request: number } {
-    const requestId = client.interceptors.request.use(async (config) => {
-      return this._onRequest(config);
-    });
-    return { request: requestId };
-  }
-
-  private async _onRequest(
-    config: InternalAxiosRequestConfig,
-  ): Promise<InternalAxiosRequestConfig> {
-    const optedIn =
-      (config as InternalAxiosRequestConfig & Record<string, unknown>)[
-        ATTESTATION_OPT_IN_KEY
-      ] === true;
-    if (!optedIn) return config;
-
-    // Server-driven policy can switch device attestation off for this session; when it is off,
-    // ship the opted-in request without requesting a token.
-    if (!this._securityPolicy.isPlayIntegrityCheckActive()) return config;
-
-    const macHeader = config.headers.get(REQUEST_MAC_HEADER);
-    if (typeof macHeader !== "string") return config;
-
-    try {
-      const token = await Attestation.requestToken(macHeader);
-      config.headers.set(DEVICE_NONCE_HEADER, token);
-    } catch (error) {
-      const message = errorMessage(error);
-      config.headers.set(
-        DEVICE_NONCE_HEADER,
-        `ERR_${encodeURIComponent(message)}`,
-      );
-    }
-    return config;
-  }
-}
-
-function errorMessage(error: unknown): string {
-  if (error instanceof AttestationException) return error.message;
-  if (error instanceof Error) return error.message;
-  return String(error);
-}

package/src/data/api/interceptors/smile_request_mac_interceptor.ts

@@ -1,106 +0,0 @@
-import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
-
-import { SmileIDCryptoError } from "../../security/smile_id_crypto_error";
-import type { SmileIDCryptoManager } from "../../security/smile_id_crypto_manager";
-import type { SecurityPolicy } from "../../security/security_policy";
-
-/**
- * Stamps the `smileid-request-mac` header on every outbound request whose axios
- * config declares `_useSmileIDRequestMac: true`. The value is computed by
- * {@link SmileIDCryptoManager}: an HMAC-SHA256 over the canonicalised
- * `smileid-*` headers and request body, keyed by a PBKDF2-derived key from the
- * Arkana signing secret, Base64-encoded.
- *
- * The MAC is salted with the request timestamp, which is stamped upstream by
- * `SmileAuthInterceptor` and carried as the signed `smileid-request-timestamp`
- * header. This interceptor reuses that value as the single source of truth for
- * the salt; if it is absent (a MAC endpoint that is not auth-annotated — a
- * misconfiguration), the request is left unsigned for the server to reject
- * rather than signed against an invented timestamp.
- *
- * Requests without the opt-in flag pass through unchanged.
- *
- * Signing is additionally gated by the server-driven {@link SecurityPolicy}: when the session's
- * policy disables payload signing, an opted-in request still ships, just unsigned — the same wire
- * shape as an opt-out request. The policy is fail-secure, so a token that omits the claim signs as
- * before.
- */
-
-export const REQUEST_MAC_HEADER = "smileid-request-mac";
-export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
-
-/** Axios config key that opts a request into MAC stamping. */
-export const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
-
-export type SmileRequestMacInterceptorOptions = {
-  readonly cryptoManager: SmileIDCryptoManager;
-  readonly securityPolicy: SecurityPolicy;
-};
-
-export class SmileRequestMacInterceptor {
-  private readonly _cryptoManager: SmileIDCryptoManager;
-  private readonly _securityPolicy: SecurityPolicy;
-
-  constructor(options: SmileRequestMacInterceptorOptions) {
-    this._cryptoManager = options.cryptoManager;
-    this._securityPolicy = options.securityPolicy;
-  }
-
-  attach(client: AxiosInstance): { request: number } {
-    const requestId = client.interceptors.request.use(async (config) => {
-      return this._onRequest(config);
-    });
-    return { request: requestId };
-  }
-
-  private async _onRequest(
-    config: InternalAxiosRequestConfig,
-  ): Promise<InternalAxiosRequestConfig> {
-    const optedIn =
-      (config as InternalAxiosRequestConfig & Record<string, unknown>)[
-        REQUEST_MAC_OPT_IN_KEY
-      ] === true;
-    if (!optedIn) return config;
-
-    // Server-driven policy can switch payload signing off for this session; when it is off, ship
-    // the opted-in request unsigned and let the server apply its policy.
-    if (!this._securityPolicy.isPayloadSigningActive()) return config;
-
-    const timestamp = config.headers.get(REQUEST_TIMESTAMP_HEADER);
-    if (typeof timestamp !== "string") return config;
-
-    try {
-      const mac = await this._cryptoManager.sign(
-        timestamp,
-        headersToRecord(config.headers),
-        config.data,
-      );
-      config.headers.set(REQUEST_MAC_HEADER, mac);
-    } catch (error) {
-      if (!(error instanceof SmileIDCryptoError)) throw error;
-      // Signing failed (e.g. the signing secret is unavailable). Proceed
-      // without the MAC header rather than breaking the request; the server
-      // rejects the unsigned request with a clear error.
-    }
-
-    return config;
-  }
-}
-
-/** Flattens axios `AxiosHeaders` (or a plain object) to a string record. */
-function headersToRecord(
-  headers: InternalAxiosRequestConfig["headers"],
-): Record<string, string> {
-  const source =
-    typeof (headers as { toJSON?: () => unknown }).toJSON === "function"
-      ? ((headers as { toJSON: () => unknown }).toJSON() as Record<
-          string,
-          unknown
-        >)
-      : (headers as unknown as Record<string, unknown>);
-  const out: Record<string, string> = {};
-  for (const [key, value] of Object.entries(source)) {
-    if (value != null) out[key] = String(value);
-  }
-  return out;
-}

package/src/data/api/interceptors/token_refresh_interceptor.ts

@@ -1,122 +0,0 @@
-import type {
-  AxiosError,
-  AxiosInstance,
-  AxiosResponse,
-  InternalAxiosRequestConfig,
-} from "axios";
-
-import type { TokenHolder } from "../auth/token_holder";
-
-/**
- * Refreshes the partner-supplied `smileid-token` when the server responds
- * with a `401 Unauthorized` and retries the request once with the fresh
- * token.
- *
- * Policy:
- * - **401 only.** A 403 means the token is valid but unauthorized for the
- *   resource — a refresh will not change that, so 403s pass through unchanged.
- * - **At most one refresh per request.** A marker is stamped on the request
- *   config so a second 401 surfaces unchanged instead of looping.
- * - **Single-flight via {@link TokenHolder}.** Concurrent 401s share one
- *   refresh invocation.
- *
- * Sits outermost of the SDK-owned response interceptors so its retry — which
- * re-issues via the same axios instance — re-runs the downstream interceptors
- * (mac, integrity, auth) with the now-refreshed token (auth reads from the
- * same `TokenHolder` this interceptor wrote into).
- */
-export type TokenRefreshInterceptorOptions = {
-  readonly tokenHolder: TokenHolder;
-  /**
-   * Partner-supplied refresh callback. `undefined` disables refresh — every
-   * 401 surfaces unchanged. The callback receives the token the SDK was
-   * using and returns a fresh one; any thrown exception is treated as a
-   * refresh failure and the original 401 is surfaced unchanged.
-   *
-   * Field is `T | undefined` (not just `T?`) so that under
-   * `exactOptionalPropertyTypes`, callers can pass `onTokenExpired: maybeUndefined`
-   * directly without a narrowing dance.
-   */
-  readonly onTokenExpired:
-    | ((previousToken: string) => Promise<string>)
-    | undefined;
-};
-
-/** Marker on `RequestOptions.config` so a second 401 stops here instead of looping. */
-const RETRIED_FLAG = "__smileid_token_refresh_retried" as const;
-
-type RetryableConfig = InternalAxiosRequestConfig & {
-  [RETRIED_FLAG]?: boolean;
-};
-
-export class TokenRefreshInterceptor {
-  private readonly _tokenHolder: TokenHolder;
-  private readonly _onTokenExpired:
-    | ((previousToken: string) => Promise<string>)
-    | undefined;
-
-  constructor(options: TokenRefreshInterceptorOptions) {
-    this._tokenHolder = options.tokenHolder;
-    this._onTokenExpired = options.onTokenExpired;
-  }
-
-  /** Attach a response interceptor that intercepts 401s and retries once. */
-  attach(client: AxiosInstance): { response: number } {
-    const responseId = client.interceptors.response.use(
-      (response) => response,
-      (error: unknown) => this._onError(client, error),
-    );
-    return { response: responseId };
-  }
-
-  private async _onError(
-    client: AxiosInstance,
-    error: unknown,
-  ): Promise<AxiosResponse> {
-    const refresh = this._onTokenExpired;
-    if (!refresh) throw error;
-
-    if (!isAxiosErrorLike(error)) throw error;
-    const response = error.response;
-    if (!response || response.status !== 401) throw error;
-
-    const config = error.config as RetryableConfig | undefined;
-    if (!config) throw error;
-    if (config[RETRIED_FLAG] === true) throw error;
-
-    const previousToken = this._tokenHolder.current;
-    const newToken = await this._tokenHolder.refreshSingleFlight(
-      previousToken,
-      async (previous) => {
-        try {
-          return await refresh(previous);
-        } catch {
-          // Partner-supplied callback: opaque error surface. Any failure →
-          // null, caller surfaces the original 401 unchanged.
-          return null;
-        }
-      },
-    );
-
-    if (newToken === null || newToken === previousToken) {
-      throw error;
-    }
-
-    config[RETRIED_FLAG] = true;
-    return client.request(config);
-  }
-}
-
-/**
- * Narrow `unknown` to the shape `TokenRefreshInterceptor` needs to read
- * (`response.status`, `config`). Avoids relying on `axios.isAxiosError`
- * which requires the package's named export at runtime.
- */
-function isAxiosErrorLike(error: unknown): error is AxiosError {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    "isAxiosError" in error &&
-    (error as { isAxiosError?: boolean }).isAxiosError === true
-  );
-}