@smileid/usesmileid 12.0.2 → 12.1.0

package/src/data/factory/networking_factory.ts

@@ -1,201 +0,0 @@
-import type { AxiosInstance } from "axios";
-import type { NetworkConfig } from "../../core/models/network_config";
-import {
-  SmileIDAPI,
-  buildAxiosClient,
-  SmileAuthInterceptor,
-  attachLoggingInterceptor,
-} from "../api/smile_id_api";
-import { createGzipInterceptor } from "../api/interceptors/gzip_interceptor";
-import { SmileRequestMacInterceptor } from "../api/interceptors/smile_request_mac_interceptor";
-import { SmileIntegrityInterceptor } from "../api/interceptors/smile_integrity_interceptor";
-import { TokenRefreshInterceptor } from "../api/interceptors/token_refresh_interceptor";
-import { TokenHolder } from "../api/auth/token_holder";
-import { SmileIDCryptoManager } from "../security/smile_id_crypto_manager";
-import { SecurityPolicy } from "../security/security_policy";
-import { decodeSecurityPolicyBitCode } from "../util/use_smile_id_token_decoder";
-import { Attestation, SigningSecretProvider } from "@smileid/usesmileid_bridge";
-import { MissingPartnerConfigException } from "../../core/exception";
-import { UseSmileIDMetadataFactory } from "../../metadata/use_smile_id_metadata_factory";
-import type { MetadataProvider } from "../../metadata/use_smile_id_metadata_factory";
-
-/**
- * Wire an axios instance + the SDK's interceptor chain and return a
- * `SmileIDAPI`.
- *
- * Canonical request-path order (outermost → wire):
- *   `partner-custom → token-refresh → auth → request-mac → integrity →
- *    logging → gzip → wire`
- *
- * - **Partner-custom interceptors** sit outermost so partners can
- *   inject debugging tools (Charles, Sentry breadcrumbs) before any
- *   SDK headers attach.
- * - **TokenRefreshInterceptor** sits next so its retry — which re-issues
- *   via `client.request(config)` — re-runs the rest of the SDK chain
- *   with the refreshed token (auth re-stamps from the same `TokenHolder`
- *   the refresh wrote into, mac/integrity re-stamp on opt-in endpoints).
- *   It only attaches a response interceptor — the 401 → refresh → retry
- *   pathway lives on the error branch.
- * - **Auth** runs before the MAC interceptor so the `smileid-*` headers it
- *   stamps (token, partner id, `smileid-request-timestamp`) are present to be
- *   signed; it also sits after partner-custom interceptors so they cannot strip
- *   the token. Reads the current token from the shared `TokenHolder`.
- * - **Request MAC** stamps `smileid-request-mac` (the canonicalised-request
- *   HMAC from `SmileIDCryptoManager`) for endpoints that opt in via
- *   `_useSmileIDRequestMac: true`. It runs before the integrity interceptor so
- *   the integrity token can bind to the freshly-computed MAC value.
- * - **Integrity** stamps `smileid-device-nonce` with the
- *   `Attestation.requestToken(macHeader)` envelope for endpoints that
- *   opt in via `_useSmileIDAttestation: true`. Reads the MAC header the
- *   previous interceptor set.
- * - **Logging** sits second-to-last so the line it prints reflects
- *   the request after auth has stamped headers but before gzip
- *   transforms the body. Sensitive headers are redacted via the
- *   [`ALWAYS_REDACT`](../api/interceptors/logging_interceptor.ts)
- *   set. On the response path the order naturally inverts.
- * - **Gzip** sits closest to the wire — it stamps `Accept-Encoding:
- *   gzip` on every request so axios auto-decompresses responses.
- *
- * axios applies **request interceptors LIFO** (last registered runs
- * first) and **response interceptors FIFO** (first registered runs
- * first). The registration order below is therefore the *reverse* of
- * the request-path order so the LIFO unwind lands on the canonical
- * order described above.
- */
-export function makeNetworkingFactory(
-  config: NetworkConfig,
-  // The request-signing secret source; defaults to the native bridge and exists
-  // so tests can supply a known secret without the native module.
-  signingSecret: () => string = () => SigningSecretProvider.signingSecret(),
-): {
-  readonly api: SmileIDAPI;
-  readonly client: AxiosInstance;
-  readonly metadata: MetadataProvider;
-} {
-  // Reject blank credentials with a typed exception at client
-  // construction so an unauthenticated request never reaches the wire.
-  const partnerConfig = config.config?.partnerConfig;
-  if (!partnerConfig || partnerConfig.partnerId.trim() === "") {
-    throw MissingPartnerConfigException.missingPartnerId();
-  }
-  if (!config.config?.token || config.config.token.trim() === "") {
-    throw MissingPartnerConfigException.missingAuthToken();
-  }
-
-  const client = buildAxiosClient(config);
-  // Wire a single per-flow metadata provider — every submission
-  // endpoint requires a `metadata` part. The factory reads
-  // `expo-device` lazily when present and falls back to empty values
-  // otherwise, so this is safe to construct unconditionally. The
-  // provider is returned to the caller so the request-construction
-  // site (the flow navigation manager) can stamp a fresh snapshot
-  // onto each `JobRequest` via `metadata.make()`.
-  const metadata = new UseSmileIDMetadataFactory();
-  const api = new SmileIDAPI(client, partnerConfig);
-
-  // Warm up the Play Integrity / App Attest token provider off the
-  // submission path so the integrity interceptor's per-request
-  // `requestToken` doesn't pay the multi-second first-call cost (and
-  // doesn't fail `NOT_INITIALIZED`). Fire-and-forget + fail-open: on
-  // failure the interceptor stamps an `ERR_` nonce and the server decides
-  // policy.
-  void Attestation.warmUp().catch(() => {
-    /* fail-open — handled per-request by SmileIntegrityInterceptor */
-  });
-
-  // Shared mutable holder for the partner-supplied auth token.
-  // SmileAuthInterceptor reads from it on every request;
-  // TokenRefreshInterceptor writes a refreshed value on a 401 so the
-  // next outgoing request automatically picks up the new token.
-  const tokenHolder = new TokenHolder(config.config?.token ?? "");
-
-  // Server-driven security policy for this flow, decoded from the top-level `policy` claim on the
-  // JWT (a sibling of `sdk_config`). Decoding is fail-secure: a malformed token, an absent claim, or an absent
-  // bit-code all resolve to "every behaviour active", so a token without the claim keeps the
-  // pre-policy behaviour rather than dropping security.
-  const securityPolicy = SecurityPolicy.fromBitCode(
-    decodeSecurityPolicyBitCode(config.config?.token ?? ""),
-  );
-
-  // 1. Gzip is registered FIRST so it runs LAST on the request path
-  //    (innermost / closest to the wire). It stamps `Accept-Encoding:
-  //    gzip` so the server can compress responses (axios
-  //    transparently decompresses).
-  const gzip = createGzipInterceptor();
-  gzip.attach(client);
-
-  // 2. Logging is registered SECOND so it runs SECOND-TO-LAST on the
-  //    request path — the printed body and headers reflect the
-  //    request after auth has stamped headers but before gzip
-  //    transforms the wire bytes. Lives at `config.config.logging`
-  //    under the `network → config → logging` nesting.
-  const logging = config.config?.logging;
-  if (logging) {
-    attachLoggingInterceptor(client, logging);
-  }
-
-  // 3. Integrity is registered THIRD so it runs after MAC stamping on the
-  //    request path — it reads the `smileid-request-mac` header the MAC
-  //    interceptor sets and binds the per-request token to it. Per-request
-  //    opt-in via `config._useSmileIDAttestation`; pass-through otherwise.
-  const integrityInterceptor = new SmileIntegrityInterceptor({
-    securityPolicy,
-  });
-  integrityInterceptor.attach(client);
-
-  // 4. Request MAC runs after auth (so the `smileid-*` headers + timestamp it
-  //    signs are present) and before integrity (which binds to the MAC). The
-  //    signing key is PBKDF2-derived from the native Arkana secret. Per-request
-  //    opt-in via `config._useSmileIDRequestMac`; pass-through otherwise.
-  const cryptoManager = new SmileIDCryptoManager(signingSecret());
-  const requestMacInterceptor = new SmileRequestMacInterceptor({
-    cryptoManager,
-    securityPolicy,
-  });
-  requestMacInterceptor.attach(client);
-
-  // 5. Auth is registered LAST of these three so it runs FIRST on the request
-  //    path — after partner-custom interceptors (which therefore cannot strip
-  //    the token), before logging. It stamps the token + partner id +
-  //    `smileid-request-timestamp` before the MAC interceptor signs them, and
-  //    reads from the shared `TokenHolder` so a refreshed value is picked up on
-  //    the next outbound request.
-  const authInterceptor = new SmileAuthInterceptor({
-    partnerConfig,
-    tokenHolder,
-  });
-  authInterceptor.attach(client);
-
-  // 6. TokenRefreshInterceptor only attaches a response interceptor —
-  //    its 401 → refresh → retry pathway lives on the error branch.
-  //    Registered after the SDK request-side interceptors so its
-  //    response error handler sees the 401 BEFORE bubbling up to
-  //    partner-custom handlers downstream; the retry re-issues via
-  //    `client.request(config)` and re-runs all request interceptors
-  //    above (auth re-reads the now-refreshed `TokenHolder`).
-  const tokenRefreshInterceptor = new TokenRefreshInterceptor({
-    tokenHolder,
-    onTokenExpired: config.config?.onTokenExpired,
-  });
-  tokenRefreshInterceptor.attach(client);
-
-  // 7. Partner-custom interceptors are registered LAST so they run
-  //    FIRST on the request path (outermost) — ideal for Charles,
-  //    Sentry breadcrumbs, etc. that should observe the request
-  //    before any SDK headers attach.
-  if (config.interceptors) {
-    for (const interceptor of config.interceptors) {
-      // Partner contracts: `interceptor` may be `(client) => void` or
-      // an object with `attach(client)`. We support both shapes.
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const handler = interceptor as any;
-      if (typeof handler === "function") {
-        handler(client);
-      } else if (typeof handler?.attach === "function") {
-        handler.attach(client);
-      }
-    }
-  }
-
-  return { api, client, metadata };
-}

package/src/data/model/__tests__/sdk_config.test.ts

@@ -1,85 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  numSamplesOverride,
-  sdkConfigSchema,
-  type SdkConfig,
-} from "../sdk_config";
-
-describe("numSamplesOverride", () => {
-  it("converts livenessImageCount to numSamples via +1", () => {
-    // 7 liveness images → numSamples = 8 (1 selfie + 7 liveness).
-    expect(numSamplesOverride({ livenessImageCount: 7 })).toBe(8);
-  });
-
-  it("handles the minimum valid count (1 → 2)", () => {
-    expect(numSamplesOverride({ livenessImageCount: 1 })).toBe(2);
-  });
-
-  it("returns undefined when livenessImageCount is 0 (treated as absent)", () => {
-    expect(numSamplesOverride({ livenessImageCount: 0 })).toBeUndefined();
-  });
-
-  it("returns undefined when livenessImageCount is negative", () => {
-    expect(numSamplesOverride({ livenessImageCount: -3 })).toBeUndefined();
-  });
-
-  it("returns undefined when livenessImageCount is absent", () => {
-    expect(numSamplesOverride({})).toBeUndefined();
-  });
-
-  it("returns undefined when config is undefined", () => {
-    expect(numSamplesOverride(undefined)).toBeUndefined();
-  });
-});
-
-describe("sdkConfigSchema — Zod parsing", () => {
-  it("accepts an empty object (all fields optional)", () => {
-    const result = sdkConfigSchema.safeParse({});
-    expect(result.success).toBe(true);
-  });
-
-  it("parses the canonical backend fixture — selfie, liveness, document, livenessImageCount", () => {
-    // Matches the lambda authentication test fixture exactly.
-    const raw = {
-      selfie: { width: 640, height: 480, quality: 90 },
-      liveness: { width: 640, height: 480, quality: 80 },
-      document: { quality: 70 },
-      livenessImageCount: 7,
-    };
-    const result = sdkConfigSchema.safeParse(raw);
-    expect(result.success).toBe(true);
-    if (result.success) {
-      const config: SdkConfig = result.data;
-      expect(config.selfie?.width).toBe(640);
-      expect(config.selfie?.height).toBe(480);
-      expect(config.selfie?.quality).toBe(90);
-      expect(config.liveness?.quality).toBe(80);
-      expect(config.document?.quality).toBe(70);
-      expect(config.livenessImageCount).toBe(7);
-    }
-  });
-
-  it("parses a partial claim that only specifies liveness quality", () => {
-    const result = sdkConfigSchema.safeParse({ liveness: { quality: 60 } });
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(result.data.liveness?.quality).toBe(60);
-      expect(result.data.selfie).toBeUndefined();
-      expect(result.data.document).toBeUndefined();
-      expect(result.data.livenessImageCount).toBeUndefined();
-    }
-  });
-
-  it("fails when livenessImageCount is a float", () => {
-    const result = sdkConfigSchema.safeParse({ livenessImageCount: 6.5 });
-    expect(result.success).toBe(false);
-  });
-
-  it("parses livenessImageCount: 6 and numSamplesOverride returns 7", () => {
-    const result = sdkConfigSchema.safeParse({ livenessImageCount: 6 });
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(numSamplesOverride(result.data)).toBe(7);
-    }
-  });
-});

package/src/data/model/__tests__/sdk_config_capture.test.ts

@@ -1,140 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  resolveDimensions,
-  resolveJpegQuality,
-  sdkConfigCaptureSchema,
-  type SdkConfigCapture,
-} from "../sdk_config_capture";
-
-describe("resolveDimensions — pair-fallback rule", () => {
-  it("returns the pair when both width and height are present and > 0", () => {
-    expect(resolveDimensions({ width: 640, height: 480 })).toEqual({
-      width: 640,
-      height: 480,
-    });
-  });
-
-  it("returns undefined when only width is present", () => {
-    expect(resolveDimensions({ width: 640 })).toBeUndefined();
-  });
-
-  it("returns undefined when only height is present", () => {
-    expect(resolveDimensions({ height: 480 })).toBeUndefined();
-  });
-
-  it("returns undefined when width is zero", () => {
-    expect(resolveDimensions({ width: 0, height: 480 })).toBeUndefined();
-  });
-
-  it("returns undefined when height is zero", () => {
-    expect(resolveDimensions({ width: 640, height: 0 })).toBeUndefined();
-  });
-
-  it("returns undefined when width is negative", () => {
-    expect(resolveDimensions({ width: -1, height: 480 })).toBeUndefined();
-  });
-
-  it("returns undefined when height is negative", () => {
-    expect(resolveDimensions({ width: 640, height: -1 })).toBeUndefined();
-  });
-
-  it("returns undefined when the capture block is undefined", () => {
-    expect(resolveDimensions(undefined)).toBeUndefined();
-  });
-
-  it("returns undefined for an empty capture block (no width / height)", () => {
-    expect(resolveDimensions({})).toBeUndefined();
-  });
-
-  it("returns the pair when quality is also present (extra fields ignored)", () => {
-    expect(resolveDimensions({ width: 320, height: 240, quality: 80 })).toEqual(
-      {
-        width: 320,
-        height: 240,
-      },
-    );
-  });
-});
-
-describe("resolveJpegQuality — 1..100 range rule", () => {
-  it("returns the quality when in range (1)", () => {
-    expect(resolveJpegQuality({ quality: 1 })).toBe(1);
-  });
-
-  it("returns the quality when in range (100)", () => {
-    expect(resolveJpegQuality({ quality: 100 })).toBe(100);
-  });
-
-  it("returns the quality at a midrange value (75)", () => {
-    expect(resolveJpegQuality({ quality: 75 })).toBe(75);
-  });
-
-  it("returns undefined when quality is 0 (out of range)", () => {
-    expect(resolveJpegQuality({ quality: 0 })).toBeUndefined();
-  });
-
-  it("returns undefined when quality is negative", () => {
-    expect(resolveJpegQuality({ quality: -1 })).toBeUndefined();
-  });
-
-  it("returns undefined when quality is 101 (out of range)", () => {
-    expect(resolveJpegQuality({ quality: 101 })).toBeUndefined();
-  });
-
-  it("returns undefined when quality is absent from the capture block", () => {
-    expect(resolveJpegQuality({ width: 640, height: 480 })).toBeUndefined();
-  });
-
-  it("returns undefined when the capture block is undefined", () => {
-    expect(resolveJpegQuality(undefined)).toBeUndefined();
-  });
-
-  it("does not clamp — 0 returns undefined, not 1", () => {
-    // The contract is never-clamp: out-of-range values are treated as
-    // absent so the caller uses its own default.
-    expect(resolveJpegQuality({ quality: 0 })).toBeUndefined();
-    expect(resolveJpegQuality({ quality: 101 })).toBeUndefined();
-  });
-});
-
-describe("sdkConfigCaptureSchema — Zod parsing", () => {
-  it("accepts an empty object (all fields optional)", () => {
-    const result = sdkConfigCaptureSchema.safeParse({});
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts a fully-populated block", () => {
-    const result = sdkConfigCaptureSchema.safeParse({
-      width: 640,
-      height: 480,
-      quality: 90,
-    });
-    expect(result.success).toBe(true);
-    if (result.success) {
-      const capture: SdkConfigCapture = result.data;
-      expect(capture.width).toBe(640);
-      expect(capture.height).toBe(480);
-      expect(capture.quality).toBe(90);
-    }
-  });
-
-  it("fails when width is a non-integer float", () => {
-    // The schema requires int values to reject partial-pixel nonsense.
-    const result = sdkConfigCaptureSchema.safeParse({ width: 640.5 });
-    expect(result.success).toBe(false);
-  });
-
-  it("strips unknown fields via Zod's default strip behaviour", () => {
-    const result = sdkConfigCaptureSchema.safeParse({
-      width: 640,
-      height: 480,
-      unknownField: "ignored",
-    });
-    expect(result.success).toBe(true);
-    if (result.success) {
-      expect(
-        (result.data as Record<string, unknown>)["unknownField"],
-      ).toBeUndefined();
-    }
-  });
-});

package/src/data/model/__tests__/token_payload.test.ts

@@ -1,224 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  isTokenConsentComplete,
-  tokenConsentMissingSubfields,
-  parseTokenPayload,
-  bindsRequiredUserDetails,
-  type TokenPayload,
-} from "../token_payload";
-
-// Canonical backend claim — user-detail values are opaque vault
-// references; only key presence is meaningful client-side.
-const FULL_CLAIM = {
-  given_names: "pii_abc",
-  last_name: "pii_def",
-  email: "pii_ghi",
-  phone_number: "pii_jkl",
-  consent: {
-    granted: true,
-    granted_at: "2026-01-01T09:00:00.000Z",
-    notice_language: "EN",
-    notice_privacy_policy_url: "https://partner.test/privacy",
-  },
-} as const;
-
-describe("parseTokenPayload — claim-shape tolerance", () => {
-  it("parses the full canonical claim into presence flags + complete consent", () => {
-    const payload = parseTokenPayload(FULL_CLAIM);
-    expect(payload).toEqual({
-      hasGivenNames: true,
-      hasLastName: true,
-      hasEmail: true,
-      hasPhoneNumber: true,
-      consent: {
-        granted: true,
-        grantedAt: "2026-01-01T09:00:00.000Z",
-        noticeLanguage: "EN",
-        noticePrivacyPolicyUrl: "https://partner.test/privacy",
-      },
-    });
-  });
-
-  it("parses a subset claim — only the present keys flag true", () => {
-    const payload = parseTokenPayload({ email: "pii_x" });
-    expect(payload).toEqual({
-      hasGivenNames: false,
-      hasLastName: false,
-      hasEmail: true,
-      hasPhoneNumber: false,
-    });
-  });
-
-  it("returns undefined for a non-object claim (string / array / number / null)", () => {
-    expect(parseTokenPayload("payload")).toBeUndefined();
-    expect(parseTokenPayload(["pii_x"])).toBeUndefined();
-    expect(parseTokenPayload(42)).toBeUndefined();
-    expect(parseTokenPayload(null)).toBeUndefined();
-    expect(parseTokenPayload(undefined)).toBeUndefined();
-  });
-
-  it("treats an empty string value as not binding the field", () => {
-    const payload = parseTokenPayload({ given_names: "", email: "pii_x" });
-    expect(payload?.hasGivenNames).toBe(false);
-    expect(payload?.hasEmail).toBe(true);
-  });
-
-  it("degrades a wrong-typed identity field to absent without dropping its siblings", () => {
-    const payload = parseTokenPayload({
-      given_names: 42,
-      last_name: ["pii"],
-      email: "pii_x",
-    });
-    expect(payload?.hasGivenNames).toBe(false);
-    expect(payload?.hasLastName).toBe(false);
-    expect(payload?.hasEmail).toBe(true);
-  });
-
-  it("ignores unknown keys and the out-of-scope id/callback fields", () => {
-    const payload = parseTokenPayload({
-      country: "NG",
-      id_type: "NIN",
-      id_number: "pii_id",
-      callback_url: "callback_x",
-      something_new: { nested: true },
-      last_name: "pii_def",
-    });
-    expect(payload).toEqual({
-      hasGivenNames: false,
-      hasLastName: true,
-      hasEmail: false,
-      hasPhoneNumber: false,
-    });
-  });
-
-  it("treats a non-object consent (string / array) as absent", () => {
-    expect(parseTokenPayload({ consent: "granted" })?.consent).toBeUndefined();
-    expect(parseTokenPayload({ consent: [true] })?.consent).toBeUndefined();
-  });
-
-  it("treats an empty consent object as absent", () => {
-    expect(parseTokenPayload({ consent: {} })?.consent).toBeUndefined();
-  });
-
-  it('never trusts granted: false or granted: "yes" as a binding', () => {
-    const deniedConsent = parseTokenPayload({
-      consent: { granted: false, granted_at: "2026-01-01T09:00:00.000Z" },
-    })?.consent;
-    expect(deniedConsent?.granted).toBeUndefined();
-    expect(deniedConsent?.grantedAt).toBe("2026-01-01T09:00:00.000Z");
-
-    const stringGranted = parseTokenPayload({
-      consent: { granted: "yes" },
-    })?.consent;
-    expect(stringGranted).toBeUndefined();
-  });
-
-  it("degrades wrong-typed consent subfields individually", () => {
-    const consent = parseTokenPayload({
-      consent: { granted: true, granted_at: 12345, notice_language: "EN" },
-    })?.consent;
-    expect(consent).toEqual({ granted: true, noticeLanguage: "EN" });
-  });
-
-  it("never throws for arbitrary claim shapes", () => {
-    const inputs: unknown[] = [
-      {},
-      FULL_CLAIM,
-      { consent: { granted: null } },
-      { given_names: { nested: true } },
-      Object.create(null),
-    ];
-    for (const input of inputs) {
-      expect(() => parseTokenPayload(input)).not.toThrow();
-    }
-  });
-});
-
-describe("isTokenConsentComplete", () => {
-  const completeConsent = {
-    granted: true,
-    grantedAt: "2026-01-01T09:00:00.000Z",
-    noticeLanguage: "EN",
-    noticePrivacyPolicyUrl: "https://partner.test/privacy",
-  } as const;
-
-  it("is true only when granted and all three subfields are non-blank", () => {
-    expect(isTokenConsentComplete(completeConsent)).toBe(true);
-  });
-
-  it("is false when any subfield is missing or blank", () => {
-    expect(isTokenConsentComplete(undefined)).toBe(false);
-    const { granted: _granted, ...withoutGranted } = completeConsent;
-    expect(isTokenConsentComplete(withoutGranted)).toBe(false);
-    const { noticeLanguage: _language, ...withoutLanguage } = completeConsent;
-    expect(isTokenConsentComplete(withoutLanguage)).toBe(false);
-    expect(
-      isTokenConsentComplete({ ...completeConsent, grantedAt: "  " }),
-    ).toBe(false);
-    expect(
-      isTokenConsentComplete({
-        ...completeConsent,
-        noticePrivacyPolicyUrl: "",
-      }),
-    ).toBe(false);
-  });
-
-  it("missingSubfields names exactly the absent or blank consent subfields", () => {
-    expect(tokenConsentMissingSubfields(completeConsent)).toEqual([]);
-    const { granted: _granted, ...withoutGranted } = completeConsent;
-    expect(tokenConsentMissingSubfields(withoutGranted)).toEqual(["granted"]);
-    const { noticeLanguage: _language, ...withoutLanguage } = completeConsent;
-    expect(
-      tokenConsentMissingSubfields({ ...withoutLanguage, grantedAt: " " }),
-    ).toEqual(["granted_at", "notice_language"]);
-    expect(tokenConsentMissingSubfields({})).toEqual([
-      "granted",
-      "granted_at",
-      "notice_language",
-      "notice_privacy_policy_url",
-    ]);
-  });
-});
-
-describe("bindsRequiredUserDetails", () => {
-  function payload(overrides: Partial<TokenPayload>): TokenPayload {
-    return {
-      hasGivenNames: false,
-      hasLastName: false,
-      hasEmail: false,
-      hasPhoneNumber: false,
-      ...overrides,
-    };
-  }
-
-  it("requires both names plus at least one contact field", () => {
-    expect(
-      bindsRequiredUserDetails(
-        payload({ hasGivenNames: true, hasLastName: true, hasEmail: true }),
-      ),
-    ).toBe(true);
-    expect(
-      bindsRequiredUserDetails(
-        payload({
-          hasGivenNames: true,
-          hasLastName: true,
-          hasPhoneNumber: true,
-        }),
-      ),
-    ).toBe(true);
-  });
-
-  it("is false when a name or every contact field is missing", () => {
-    expect(
-      bindsRequiredUserDetails(
-        payload({ hasGivenNames: true, hasLastName: true }),
-      ),
-    ).toBe(false);
-    expect(
-      bindsRequiredUserDetails(
-        payload({ hasGivenNames: true, hasEmail: true }),
-      ),
-    ).toBe(false);
-    expect(bindsRequiredUserDetails(undefined)).toBe(false);
-  });
-});