@trustchex/react-native-sdk 1.409.0 → 1.472.0

package/src/Shared/EIDReader/protocol/paceResult.ts

@@ -0,0 +1,62 @@
+import type { AccessKeySpec } from '../accessKeySpec';
+import type { SecureMessagingWrapper } from '../secureMessagingWrapper';
+import type { MappingType } from '../paceInfo';
+
+/**
+ * Result of PACE protocol execution.
+ */
+export class PACEResult {
+  private paceKey: AccessKeySpec;
+  private mappingType: MappingType;
+  private agreementAlg: string;
+  private cipherAlg: string;
+  private digestAlg: string;
+  private keyLength: number;
+  private wrapper: SecureMessagingWrapper;
+
+  constructor(
+    paceKey: AccessKeySpec,
+    mappingType: MappingType,
+    agreementAlg: string,
+    cipherAlg: string,
+    digestAlg: string,
+    keyLength: number,
+    wrapper: SecureMessagingWrapper
+  ) {
+    this.paceKey = paceKey;
+    this.mappingType = mappingType;
+    this.agreementAlg = agreementAlg;
+    this.cipherAlg = cipherAlg;
+    this.digestAlg = digestAlg;
+    this.keyLength = keyLength;
+    this.wrapper = wrapper;
+  }
+
+  public getPACEKey(): AccessKeySpec {
+    return this.paceKey;
+  }
+
+  public getMappingType(): MappingType {
+    return this.mappingType;
+  }
+
+  public getAgreementAlg(): string {
+    return this.agreementAlg;
+  }
+
+  public getCipherAlg(): string {
+    return this.cipherAlg;
+  }
+
+  public getDigestAlg(): string {
+    return this.digestAlg;
+  }
+
+  public getKeyLength(): number {
+    return this.keyLength;
+  }
+
+  public getWrapper(): SecureMessagingWrapper {
+    return this.wrapper;
+  }
+}

package/src/Shared/EIDReader/secureMessagingWrapper.ts

@@ -87,7 +87,7 @@ export abstract class SecureMessagingWrapper implements APDUWrapper {
       dataOutputStream.push(...paddedData);
       let cc2 = Uint8Array.from(
         Buffer.from(
-          cryptoUtils.computeMac(
+          this.computeMAC(
             Buffer.from(dataOutputStream).toString('hex'),
             this.ksMac
           ),
@@ -116,6 +116,30 @@ export abstract class SecureMessagingWrapper implements APDUWrapper {
 
   protected abstract getEncodedSendSequenceCounter(): Uint8Array;
 
+  /**
+   * Encrypt data using the session encryption key.
+   * Subclasses override for AES vs 3DES.
+   */
+  protected encrypt(dataHex: string, keyHex: string): string {
+    return cryptoUtils.encryptWith3DES(dataHex, keyHex);
+  }
+
+  /**
+   * Decrypt data using the session encryption key.
+   * Subclasses override for AES vs 3DES.
+   */
+  protected decrypt(dataHex: string, keyHex: string): string {
+    return cryptoUtils.decryptWith3DES(dataHex, keyHex);
+  }
+
+  /**
+   * Compute MAC over data using the session MAC key.
+   * Subclasses override for AES-CMAC vs 3DES MAC.
+   */
+  protected computeMAC(dataHex: string, keyHex: string): string {
+    return cryptoUtils.computeMac(dataHex, keyHex);
+  }
+
   private wrapCommandAPDU(commandAPDU: CommandAPDU): CommandAPDU {
     const cla = commandAPDU.getCLA();
     const ins = commandAPDU.getINS();
@@ -149,10 +173,7 @@ export abstract class SecureMessagingWrapper implements APDUWrapper {
         this.getPadLength()
       );
       const ciphertext = Buffer.from(
-        cryptoUtils.encryptWith3DES(
-          Buffer.from(data).toString('hex'),
-          this.ksEnc
-        ),
+        this.encrypt(Buffer.from(data).toString('hex'), this.ksEnc),
         'hex'
       );
       output.push(hasDO85 ? 0x85 : 0x87);
@@ -180,7 +201,7 @@ export abstract class SecureMessagingWrapper implements APDUWrapper {
     );
 
     const cc = Buffer.from(
-      cryptoUtils.computeMac(Buffer.from(n).toString('hex'), this.ksMac),
+      this.computeMAC(Buffer.from(n).toString('hex'), this.ksMac),
       'hex'
     );
     let ccLength = cc.length;
@@ -329,10 +350,7 @@ export abstract class SecureMessagingWrapper implements APDUWrapper {
     inputStream.readFully(ciphertext);
     const paddedData = Array.from(
       Buffer.from(
-        cryptoUtils.decryptWith3DES(
-          Buffer.from(ciphertext).toString('hex'),
-          this.ksEnc
-        ),
+        this.decrypt(Buffer.from(ciphertext).toString('hex'), this.ksEnc),
         'hex'
       )
     );

package/src/Shared/EIDReader/smartcards/commandAPDU.ts

@@ -18,7 +18,8 @@ export class CommandAPDU {
     ne?: number
   ) {
     this.nc = dataLength || 0;
-    this.ne = ne || 0;
+    // Java JMRTD uses -1 to mean "no Le field" (ne=0). Guard against negatives.
+    this.ne = ne == null || ne < 0 ? 0 : ne;
     this.apdu = this.buildAPDU(
       cla,
       ins,

package/src/Shared/EIDReader/tlv/tlv.helpers.ts

@@ -88,7 +88,7 @@ export class TLVHelpers extends ASN1Constants {
   private static log(n: number, base: number): number {
     let result = 0;
     while (n > 0) {
-      n = n / base;
+      n = Math.floor(n / base);
       result++;
     }
     return result;

package/src/Shared/EIDReader/tlv/tlv.utils.ts

@@ -6,7 +6,6 @@ import { Buffer } from 'buffer';
 import { TLVHelpers } from './tlv.helpers';
 
 class TLVUtil extends TLVHelpers {
-
   public static wrapDO(tag: number, data: number[]): Uint8Array {
     if (data == null) {
       throw new Error('Data to wrap is null');
@@ -49,7 +48,7 @@ class TLVUtil extends TLVHelpers {
       const actualTag = await tlvInputStream.readTag();
       if (actualTag !== expectedTag) {
         throw new Error(
-          `Expected tag ${expectedTag.toString(16)}, found tag ${actualTag.toString(16)}`
+          `Expected TLV tag 0x${expectedTag.toString(16)}, found 0x${actualTag.toString(16)} in data: ${Buffer.from(wrappedData.slice(0, 16)).toString('hex')}`
         );
       }
 
@@ -61,8 +60,13 @@ class TLVUtil extends TLVHelpers {
       }
       return result;
     } catch (ioe) {
-      // Never happens.
-      throw new Error('Error reading from stream');
+      // Re-throw original error with context rather than masking it
+      if (ioe instanceof Error && ioe.message.includes('Expected TLV tag')) {
+        throw ioe;
+      }
+      throw new Error(
+        `TLV unwrap error (expected tag 0x${expectedTag.toString(16)}): ${ioe instanceof Error ? ioe.message : String(ioe)}`
+      );
     } finally {
       try {
         tlvInputStream.close();
@@ -72,7 +76,6 @@ class TLVUtil extends TLVHelpers {
       }
     }
   }
-
 }
 
 export default TLVUtil;

package/src/Shared/EIDReader/utils/aesCrypto.utils.ts

@@ -0,0 +1,217 @@
+import CryptoJS from 'crypto-js';
+import { Buffer } from 'buffer';
+import 'react-native-get-random-values';
+
+/**
+ * AES cryptographic utilities for PACE protocol.
+ */
+
+/**
+ * Encrypt data using AES in CBC mode with zero IV.
+ */
+export const aesEncryptCBC = (
+  dataHex: string,
+  keyHex: string,
+  ivHex: string = '00000000000000000000000000000000'
+): string => {
+  const data = CryptoJS.enc.Hex.parse(dataHex);
+  const key = CryptoJS.enc.Hex.parse(keyHex);
+  const iv = CryptoJS.enc.Hex.parse(ivHex);
+
+  const encrypted = CryptoJS.AES.encrypt(data, key, {
+    mode: CryptoJS.mode.CBC,
+    padding: CryptoJS.pad.NoPadding,
+    iv,
+  });
+
+  return encrypted.ciphertext.toString(CryptoJS.enc.Hex);
+};
+
+/**
+ * Decrypt data using AES in CBC mode with zero IV.
+ */
+export const aesDecryptCBC = (
+  dataHex: string,
+  keyHex: string,
+  ivHex: string = '00000000000000000000000000000000'
+): string => {
+  const data = CryptoJS.enc.Hex.parse(dataHex);
+  const key = CryptoJS.enc.Hex.parse(keyHex);
+  const iv = CryptoJS.enc.Hex.parse(ivHex);
+
+  const cipherParams = CryptoJS.lib.CipherParams.create({
+    ciphertext: data,
+  });
+
+  const decrypted = CryptoJS.AES.decrypt(cipherParams, key, {
+    mode: CryptoJS.mode.CBC,
+    padding: CryptoJS.pad.NoPadding,
+    iv,
+  });
+
+  return decrypted.toString(CryptoJS.enc.Hex);
+};
+
+/**
+ * Encrypt a single block with AES in ECB mode (for SSC encryption).
+ */
+export const aesEncryptECB = (dataHex: string, keyHex: string): string => {
+  const data = CryptoJS.enc.Hex.parse(dataHex);
+  const key = CryptoJS.enc.Hex.parse(keyHex);
+
+  const encrypted = CryptoJS.AES.encrypt(data, key, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.NoPadding,
+  });
+
+  return encrypted.ciphertext.toString(CryptoJS.enc.Hex);
+};
+
+/**
+ * Compute AES CMAC (OMAC1) as defined in RFC 4493.
+ */
+export const aesCMAC = (dataHex: string, keyHex: string): string => {
+  const key = Buffer.from(keyHex, 'hex');
+  const data = Buffer.from(dataHex, 'hex');
+  const blockSize = 16;
+
+  // Step 1: Generate subkeys
+  const zeroBlock = '00000000000000000000000000000000';
+  const L = Buffer.from(aesEncryptECB(zeroBlock, keyHex), 'hex');
+  const K1 = generateSubkey(L);
+  const K2 = generateSubkey(K1);
+
+  // Step 2: Determine if we need to pad
+  const n = data.length === 0 ? 1 : Math.ceil(data.length / blockSize);
+  const lastBlockComplete = data.length > 0 && data.length % blockSize === 0;
+
+  // Step 3: Process last block
+  const lastBlock = Buffer.alloc(blockSize);
+  if (lastBlockComplete) {
+    const start = (n - 1) * blockSize;
+    for (let i = 0; i < blockSize; i++) {
+      lastBlock[i] = data[start + i] ^ K1[i];
+    }
+  } else {
+    // Pad with 10*
+    const start = (n - 1) * blockSize;
+    const remaining = data.length - start;
+    const padded = Buffer.alloc(blockSize);
+    for (let i = 0; i < remaining; i++) {
+      padded[i] = data[start + i];
+    }
+    padded[remaining] = 0x80;
+    for (let i = 0; i < blockSize; i++) {
+      lastBlock[i] = padded[i] ^ K2[i];
+    }
+  }
+
+  // Step 4: CBC-MAC
+  let X = Buffer.alloc(blockSize);
+  for (let i = 0; i < n - 1; i++) {
+    const block = data.subarray(i * blockSize, (i + 1) * blockSize);
+    const Y = Buffer.alloc(blockSize);
+    for (let j = 0; j < blockSize; j++) {
+      Y[j] = X[j] ^ block[j];
+    }
+    X = Buffer.from(aesEncryptECB(Y.toString('hex'), keyHex), 'hex');
+  }
+
+  // Process last block
+  const Y = Buffer.alloc(blockSize);
+  for (let j = 0; j < blockSize; j++) {
+    Y[j] = X[j] ^ lastBlock[j];
+  }
+  const T = aesEncryptECB(Y.toString('hex'), keyHex);
+
+  return T;
+};
+
+function generateSubkey(input: Buffer): Buffer {
+  const blockSize = 16;
+  const Rb = Buffer.alloc(blockSize);
+  Rb[blockSize - 1] = 0x87;
+
+  // Left shift by 1
+  const output = Buffer.alloc(blockSize);
+  const msb = (input[0] & 0x80) !== 0;
+  for (let i = 0; i < blockSize - 1; i++) {
+    output[i] = ((input[i] << 1) | (input[i + 1] >> 7)) & 0xff;
+  }
+  output[blockSize - 1] = (input[blockSize - 1] << 1) & 0xff;
+
+  if (msb) {
+    for (let i = 0; i < blockSize; i++) {
+      output[i] ^= Rb[i];
+    }
+  }
+
+  return output;
+}
+
+/**
+ * Derive AES key from shared secret using KDF as per TR-SAC.
+ *
+ * @param sharedSecretHex the shared secret bytes as hex
+ * @param cipherAlg 'AES' or 'DESede'
+ * @param keyLength 128, 192, or 256
+ * @param mode 1 = ENC, 2 = MAC, 3 = PACE
+ */
+export const deriveKey = (
+  sharedSecretHex: string,
+  cipherAlg: string,
+  keyLength: number,
+  mode: number
+): string => {
+  const input = sharedSecretHex + '000000' + mode.toString(16).padStart(2, '0');
+
+  let hash: string;
+  if (cipherAlg === 'AES' && keyLength > 128) {
+    // Use SHA-256 for AES-192 and AES-256
+    hash = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(input)).toString(
+      CryptoJS.enc.Hex
+    );
+  } else {
+    // Use SHA-1 for DESede and AES-128
+    hash = CryptoJS.SHA1(CryptoJS.enc.Hex.parse(input)).toString(
+      CryptoJS.enc.Hex
+    );
+  }
+
+  if (cipherAlg === 'DESede') {
+    // 3DES: 24-byte key (K1 || K2 || K1)
+    const ka = hash.substring(0, 16);
+    const kb = hash.substring(16, 32);
+    return ka + kb + ka;
+  } else {
+    // AES: return first keyLength/8 bytes
+    const keyBytes = keyLength / 4; // hex chars = keyLength / 8 * 2
+    return hash.substring(0, keyBytes);
+  }
+};
+
+/**
+ * Pad data using ISO 9797-1 method 2 with given block size.
+ */
+export const padISO9797 = (data: Buffer, blockSize: number = 16): Buffer => {
+  const n = data.length;
+  const padLength = blockSize - (n % blockSize);
+  const out = Buffer.alloc(n + padLength);
+  data.copy(out);
+  out[n] = 0x80;
+  return out;
+};
+
+/**
+ * Unpad ISO 9797-1 method 2.
+ */
+export const unpadISO9797 = (data: Buffer): Buffer => {
+  let i = data.length - 1;
+  while (i >= 0 && data[i] === 0x00) {
+    i--;
+  }
+  if (i >= 0 && data[i] === 0x80) {
+    return data.subarray(0, i);
+  }
+  return data;
+};

package/src/Shared/Libs/PERMISSIONS_MANAGER.md

@@ -0,0 +1,268 @@
+# PermissionManager Documentation
+
+## Overview
+
+`PermissionManager` is a centralized utility for handling all platform-specific permission requests (camera, microphone, NFC, etc.) in the React Native SDK. It abstracts away platform differences (iOS vs Android) and provides a clean, consistent API.
+
+## Location
+
+- **File**: `src/Shared/Libs/permissions.utils.ts`
+- **Export**: Can be imported from `src/Shared/Libs/index.ts`
+
+## Supported Permissions
+
+```typescript
+type PermissionType = 'camera' | 'microphone' | 'nfc';
+```
+
+| Permission   | iOS | Android | Notes                                    |
+| ------------ | --- | ------- | ---------------------------------------- |
+| `camera`     | ✅  | ✅      | Camera access for video recording        |
+| `microphone` | ✅  | ✅      | Microphone access for audio recording    |
+| `nfc`        | ✅  | ✅      | NFC chip reading (document verification) |
+
+## API Reference
+
+### Request Methods
+
+#### `requestPermission(permission: PermissionType): Promise<boolean>`
+
+Request a single permission. Returns `true` if granted, `false` if denied.
+
+```typescript
+import PermissionManager from '../../Shared/Libs/permissions.utils';
+
+const hasCamera = await PermissionManager.requestPermission('camera');
+if (!hasCamera) {
+  console.log('Camera permission denied');
+}
+```
+
+#### `requestPermissions(permissions: PermissionType[]): Promise<Map<PermissionType, boolean>>`
+
+Request multiple permissions at once. Returns a Map with permission status for each.
+
+```typescript
+const results = await PermissionManager.requestPermissions([
+  'camera',
+  'microphone',
+]);
+const hasCamera = results.get('camera') ?? false;
+const hasMicrophone = results.get('microphone') ?? false;
+```
+
+#### `requestCameraAndMicrophone(): Promise<boolean>`
+
+**⭐ Convenience method** — Request camera and microphone together (common for video recording). Returns `true` only if BOTH are granted.
+
+```typescript
+const hasBothPermissions = await PermissionManager.requestCameraAndMicrophone();
+if (!hasBothPermissions) {
+  showError('Camera and microphone access required for video call');
+}
+```
+
+#### `requestCamera(): Promise<boolean>`
+
+Request camera permission only.
+
+```typescript
+const hasCamera = await PermissionManager.requestCamera();
+```
+
+#### `requestMicrophone(): Promise<boolean>`
+
+Request microphone permission only.
+
+```typescript
+const hasMicrophone = await PermissionManager.requestMicrophone();
+```
+
+#### `requestNFC(): Promise<boolean>`
+
+Request NFC permission for document verification.
+
+```typescript
+const hasNFC = await PermissionManager.requestNFC();
+```
+
+#### `requestWithFallback(permission: PermissionType, onDenied?: () => void): Promise<boolean>`
+
+Request permission with custom callback when denied.
+
+```typescript
+const granted = await PermissionManager.requestWithFallback('camera', () => {
+  showAlert('Camera access is required for verification');
+});
+```
+
+### Check Methods (Non-requesting)
+
+Check if a permission is already granted without requesting.
+
+#### `checkPermission(permission: PermissionType): Promise<boolean>`
+
+Check a single permission status.
+
+```typescript
+const hasCamera = await PermissionManager.checkPermission('camera');
+```
+
+#### `hasCameraAndMicrophone(): Promise<boolean>`
+
+Check if both camera and microphone are granted.
+
+```typescript
+const ready = await PermissionManager.hasCameraAndMicrophone();
+```
+
+#### `hasCamera(): Promise<boolean>`
+
+Check if camera is granted.
+
+```typescript
+const hasCamera = await PermissionManager.hasCamera();
+```
+
+#### `hasMicrophone(): Promise<boolean>`
+
+Check if microphone is granted.
+
+```typescript
+const hasMicrophone = await PermissionManager.hasMicrophone();
+```
+
+#### `hasNFC(): Promise<boolean>`
+
+Check if NFC is granted.
+
+```typescript
+const hasNFC = await PermissionManager.hasNFC();
+```
+
+## Common Patterns
+
+### Pattern 1: Video Call Setup (Camera + Microphone)
+
+```typescript
+import PermissionManager from '../../Shared/Libs/permissions.utils';
+
+async function initializeVideoCall() {
+  const hasBothPermissions =
+    await PermissionManager.requestCameraAndMicrophone();
+
+  if (!hasBothPermissions) {
+    setConnectionState('permissions_denied');
+    return;
+  }
+
+  // Proceed with video call initialization
+  const stream = await service.initialize();
+  setLocalStream(stream);
+}
+```
+
+### Pattern 2: Document Verification (NFC)
+
+```typescript
+const hasNFC = await PermissionManager.requestNFC();
+
+if (!hasNFC) {
+  showError('NFC access required to read document');
+  return;
+}
+
+const result = await readNFCChip();
+```
+
+### Pattern 3: Check Before Requesting
+
+```typescript
+// First check if permission is already granted
+const alreadyHasCamera = await PermissionManager.checkPermission('camera');
+
+if (alreadyHasCamera) {
+  // Skip request dialog
+  startCamera();
+} else {
+  // Request permission (shows OS dialog)
+  const granted = await PermissionManager.requestCamera();
+  if (granted) {
+    startCamera();
+  } else {
+    showErrorMessage('Camera access required');
+  }
+}
+```
+
+## Platform Implementation Details
+
+### iOS
+
+Uses the `react-native-permissions` library with `RNPermissions` module.
+
+**Permissions layout location**: `ios/App.xcodeproj/Info.plist`
+
+Required Info.plist keys:
+
+- `NSCameraUsageDescription` — Camera access explanation
+- `NSMicrophoneUsageDescription` — Microphone access explanation
+- `NFCReaderUsageDescription` — NFC access explanation
+
+### Android
+
+Uses built-in `PermissionsAndroid` from React Native core.
+
+**Permissions manifest location**: `android/app/src/main/AndroidManifest.xml`
+
+Required manifest permissions:
+
+- `android.permission.CAMERA` — Camera access
+- `android.permission.RECORD_AUDIO` — Microphone access
+- `android.permission.NFC` — NFC chip reading
+
+## Error Handling
+
+The PermissionManager handles errors internally and logs them using the debug utility. All methods return clear boolean or Map results so you can check status directly:
+
+```typescript
+const granted = await PermissionManager.requestCamera();
+
+// Simple check
+if (!granted) {
+  // Handle permission denied
+}
+```
+
+## Best Practices
+
+1. ✅ **Use convenience methods** — `requestCameraAndMicrophone()` instead of manually requesting both
+2. ✅ **Request at the right time** — Request permissions when the feature is about to be used
+3. ✅ **Check before requesting** — Use `checkPermission()` if you want to skip the OS dialog
+4. ✅ **Handle denial gracefully** — Always provide clear error messages when permissions are denied
+5. ✅ **Use the centralized manager** — Never import React Native permissions directly; always use PermissionManager
+
+## Troubleshooting
+
+### Permission request dialog not appearing
+
+- Check that you're using `request*` methods, not `check*` methods
+- Verify the permission is in the app's manifest (Android) or Info.plist (iOS)
+- Test on a device where the permission hasn't been granted yet
+
+### Camera/Microphone not working after permission granted
+
+- Check that you're handling successful permission grant and initializing the feature
+- Verify other features aren't holding exclusive access to the device
+
+### NFC not working on iOS
+
+- Ensure `NFCReaderUsageDescription` is set in Info.plist
+- The app must be signed with proper entitlements for NFC
+- NFC requires iPhone XS or later
+
+## Related Files
+
+- `src/Screens/Dynamic/VideoCallScreen.tsx` — Example usage with video calls
+- `src/Shared/Libs/index.ts` — Exported for easy importing
+- `src/Shared/Libs/debug.utils.ts` — Used internally for debug logging

package/src/Shared/Libs/analytics.utils.ts

@@ -289,6 +289,10 @@ const STEP_EVENT_MAP: Record<
     started: AnalyticsEventName.LIVENESS_CHECK_STARTED,
     completed: AnalyticsEventName.LIVENESS_CHECK_COMPLETED,
   },
+  verbal_consent: {
+    started: AnalyticsEventName.VERBAL_CONSENT_VIDEO_STARTED,
+    completed: AnalyticsEventName.VERBAL_CONSENT_VIDEO_COMPLETED,
+  },
   video_call: {
     started: AnalyticsEventName.VIDEO_CALL_STARTED,
     completed: AnalyticsEventName.VIDEO_CALL_COMPLETED,