@trustchex/react-native-sdk 1.475.1 → 1.478.7

package/lib/module/Shared/EIDReader/eidReader.js

@@ -8,6 +8,7 @@ import { DG1File } from "./lds/icao/dg1File.js";
 import { DG2File } from "./lds/icao/dg2File.js";
 import { Buffer } from 'buffer';
 import { InputStream } from "./java/inputStream.js";
+import { debugLog } from "../Libs/debug.utils.js";
 
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
@@ -147,7 +148,7 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
       mimeType
     };
   }
-  console.debug('[EID] Face image is JP2, attempting conversion…');
+  debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
     const {
@@ -156,16 +157,16 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
     const jpx = new JpxImage();
     jpx.parse(imageBuffer);
     const tile = jpx.tiles[0];
-    console.debug(`[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`);
+    debugLog('EID', `[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`);
     const pngBytes = pixelsToPng(tile.items, tile.width, tile.height, jpx.componentsCount);
     const pngBase64 = Buffer.from(pngBytes).toString('base64');
-    console.debug(`[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`);
+    debugLog('EID', `[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`);
     return {
       base64: pngBase64,
       mimeType: 'image/png'
     };
   } catch (err) {
-    console.debug('[EID] JP2 conversion failed:', err);
+    debugLog('EID', '[EID] JP2 conversion failed:', err);
     return {
       base64: imageBuffer.toString('base64'),
       mimeType
@@ -287,10 +288,10 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     let hasPACESucceeded = false;
     try {
       await passportService.sendSelectMF();
-      console.debug('[EID] SELECT MF OK');
+      debugLog('EID', '[EID] SELECT MF OK');
     } catch (mfErr) {
       const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
-      console.debug(`[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`);
+      debugLog('EID', `[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`);
     }
     progress = 2;
     if (progressCallback) {
@@ -309,10 +310,10 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
         buf[i] = await cardAccessStream.read();
       }
       cardAccessBuf = buf;
-      console.debug(`[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`);
+      debugLog('EID', `[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`);
     } catch (readErr) {
       const readMsg = readErr instanceof Error ? readErr.message : String(readErr);
-      console.debug(`[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`);
+      debugLog('EID', `[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`);
     }
     progress = 3;
     if (progressCallback) {
@@ -324,7 +325,7 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       try {
         const paceInfo = parsePACEInfoFromCardAccess(cardAccessBuf);
         if (paceInfo) {
-          console.debug(`[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`);
+          debugLog('EID', `[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`);
           // PACE is available - derive key from MRZ and perform PACE
           const bacKey = new BACKey(documentNumber, dateOfBirth, dateOfExpiry);
           const paceKey = PACEKeySpec.createMRZKey(bacKey.getKeySeedForPACE());
@@ -334,16 +335,16 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
           }
           await passportService.doPACE(paceKey, paceInfo.oid, paceInfo.parameterId, progressCallback);
           hasPACESucceeded = true;
-          console.debug('[EID] PACE succeeded');
+          debugLog('EID', '[EID] PACE succeeded');
         } else {
-          console.debug('[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC');
+          debugLog('EID', '[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC');
         }
       } catch (paceError) {
         // PACE protocol exchange failed — fall back to BAC
         const msg = paceError instanceof Error ? paceError.message : String(paceError);
-        console.debug(`[EID] PACE protocol failed (${msg}), falling back to BAC`);
+        debugLog('EID', `[EID] PACE protocol failed (${msg}), falling back to BAC`);
         if (paceError instanceof Error && paceError.stack) {
-          console.debug('[EID] PACE error stack:', paceError.stack);
+          debugLog('EID', '[EID] PACE error stack:', paceError.stack);
         }
       }
     }
@@ -423,7 +424,7 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       mimeType: mimeType
     };
   } catch (error) {
-    console.debug('Error reading passport data', error);
+    debugLog('EID', 'Error reading passport data', error);
   } finally {
     await passportService.close();
   }

package/lib/module/Shared/Libs/MRZ_KNOWN_ISSUES.md

@@ -56,6 +56,40 @@ primary safeguard. A single noisy frame is not trusted; the consensus is.
 
 ---
 
+## 2a. Turkish e-ID document numbers: leading serial LETTER must be preserved
+
+**Issue.** Turkish identity cards put a **serial letter** at the start of the
+9-char document number (e.g. `A53032352`, `A49M38410`). Empirically — verified
+against real cards — **Türkiye computes the document-number check digit over the
+number with the LEADING letter EXCLUDED** (interior letters are kept), which
+diverges from strict ICAO 9303 (where `A`=10 is weighted in). So a genuine card
+`A53032352` (printed check digit `5`) **fails** the strict ICAO check (which
+wants `7`), even though the card is valid — `icaoCheckDigit("53032352") === "5"`.
+The TD1 **composite** on these cards is likewise non-standard (no interpretation
+of the leading letter reproduces it), so it is **not** a reliable anchor.
+
+**Why it matters.** The leading letter is **real** and **must be preserved**: the
+**NFC eID chip derives its BAC/PACE access key from the document number exactly
+as stored** (with the letter). Rewriting `A53032352`→`453032352` — as the
+ambiguous-char recovery would, to satisfy strict ICAO — makes the **chip read
+FAIL**. (The OCR-B `4` glyph closely resembles `A`, which is why the recovery
+used to "correct" it.)
+
+**Mitigation.** `acceptsTurkishLetterPrefix` (in `mrz.utils.ts`; ported to
+`mrz_utils.dart`) accepts a TUR TD1 whose only failing checks are
+document-number/composite **when** the document number starts with a letter
+**and** `icaoCheckDigit(documentNumber.slice(1))` matches the printed
+document-number check digit. The parse is then accepted **as-is**, preserving the
+letter; the composite is deliberately not required. The subsequent **NFC read is
+the authoritative confirmation** — it only succeeds with the correct
+(letter-preserving) number. Contrast `A49M38410`, whose letters validate under
+*standard* ICAO and so are kept by the normal path.
+
+Covered by the "Turkish e-ID … leading serial LETTER" tests in
+`mrz.ambiguous.test.ts` (RN) and `mrz_ambiguous_test.dart` (Flutter).
+
+---
+
 ## 3. Filler-letter normalisation is conservative in name fields (by design)
 
 **Issue.** The `<` filler is frequently OCR'd as a letter (`K`, and under glare

package/lib/module/Shared/Libs/SignalingClient.js

@@ -1,6 +1,7 @@
 "use strict";
 
 import EventSource from 'react-native-sse';
+import { debugLog } from "./debug.utils.js";
 export class SignalingClient {
   eventSource = null;
   constructor(baseUrl, sessionId, onMessage, identificationId, onSessionEnded) {
@@ -19,13 +20,13 @@ export class SignalingClient {
       urlParams.append('identificationId', this.identificationId);
     }
     const url = `${this.baseUrl}/api/app/mobile/video-sessions/${this.sessionId}/signaling/stream?${urlParams.toString()}`;
-    console.log('[SignalingClient] Connecting to SSE:', url);
+    debugLog('SignalingClient', '[SignalingClient] Connecting to SSE:', url);
     this.eventSource = new EventSource(url, {
       pollingInterval: 0 // 0 means default/no polling if SSE is real
     });
     const listener = event => {
       if (event.type === 'open') {
-        console.log('[SignalingClient] Connected');
+        debugLog('SignalingClient', '[SignalingClient] Connected');
         this.onConnected?.();
       } else if (event.type === 'error') {
         console.error('[SignalingClient] Connection error:', JSON.stringify(event, null, 2));
@@ -64,8 +65,8 @@ export class SignalingClient {
     };
 
     // Ping handler - server sends pings to keep connection alive
-    const pingListener = event => {
-      console.log('[SignalingClient] Received ping');
+    const pingListener = _event => {
+      debugLog('SignalingClient', '[SignalingClient] Received ping');
       // Just acknowledge by doing nothing, server-side heartbeat keeps connection alive
     };
 
@@ -73,7 +74,7 @@ export class SignalingClient {
     const sessionEndedListener = event => {
       try {
         const data = JSON.parse(event.data || '{}');
-        console.log('[SignalingClient] Session ended:', data.state);
+        debugLog('SignalingClient', '[SignalingClient] Session ended:', data.state);
         if (this.onSessionEnded) {
           this.onSessionEnded(data.state);
         }

package/lib/module/Shared/Libs/crypto.utils.js

@@ -5,19 +5,41 @@ import { Buffer } from 'buffer';
 import { gcm } from '@noble/ciphers/aes';
 import { randomBytes } from '@noble/ciphers/webcrypto';
 import { secp256k1 } from '@noble/curves/secp256k1';
-import httpClient from "./http-client.js";
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha2';
+import httpClient, { setSessionToken } from "./http-client.js";
+
+// Must stay byte-for-byte identical to the backend derivation
+// (web-app/src/lib/crypto-utils.ts).
+const SESSION_KEY_KDF_INFO = 'trustchex-session-key-v2';
+const SESSION_KEY_KDF_VERSION = 2;
 const getSessionKey = async (apiUrl, sessionId) => {
   const clientPrivateKey = secp256k1.utils.randomPrivateKey();
   const clientPublicKey = secp256k1.getPublicKey(clientPrivateKey);
   const serverResponse = await httpClient.post(`${apiUrl}/verification-sessions/${sessionId}/auth`, {
-    clientPublicKey: Buffer.from(clientPublicKey).toString('hex')
+    clientPublicKey: Buffer.from(clientPublicKey).toString('hex'),
+    kdfVersion: SESSION_KEY_KDF_VERSION
   });
+  if (serverResponse.sessionToken) {
+    setSessionToken(serverResponse.sessionToken);
+  }
   const sharedKey = secp256k1.getSharedSecret(clientPrivateKey, Buffer.from(serverResponse.serverPublicKey, 'hex').toString('hex'));
+
+  // The server echoes the kdfVersion it actually used; older backends don't
+  // send the field and derive the legacy key.
+  if (serverResponse.kdfVersion === SESSION_KEY_KDF_VERSION) {
+    // sharedKey is a compressed secp256k1 point; byte 0 is the 0x02/0x03
+    // parity prefix and carries no secret entropy.
+    const derived = hkdf(sha256, Buffer.from(sharedKey).subarray(1), Buffer.from(sessionId, 'utf-8'), SESSION_KEY_KDF_INFO, 32);
+    return Buffer.from(derived).toString('hex');
+  }
   const sessionKey = (Buffer.from(new Date().getUTCDate().toString(), 'utf-8').toString('hex') + Buffer.from(sharedKey).toString('hex')).substring(0, 32);
   return sessionKey;
 };
 const encryptWithAes = (data, key) => {
-  const nonce = randomBytes(32);
+  // Standard 96-bit GCM IV; the backend reads the nonce from the payload, so
+  // this stays compatible with servers that previously saw 32-byte nonces.
+  const nonce = randomBytes(12);
   const dataBytes = Buffer.from(data, 'utf-8');
   const aes = gcm(Buffer.from(key, 'hex'), nonce);
   const ciphertext = aes.encrypt(dataBytes);

package/lib/module/Shared/Libs/deeplink.utils.js

@@ -1,12 +1,30 @@
 "use strict";
 
-import { debugLog } from "./debug.utils.js";
+import { debugLog, logWarn } from "./debug.utils.js";
+
+// Hostname (optionally with port) — rejects paths, credentials, and other
+// URL components smuggled into the app-url segment.
+const HOST_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9.-]*(:\d{1,5})?$/;
+const getUrlScheme = url => {
+  const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+  return match ? match[1].toLowerCase() : '';
+};
+
+// The SDK uploads identity documents and biometrics to the derived baseUrl, so
+// cleartext destinations are only allowed in development builds.
+const isAllowedScheme = scheme => {
+  return scheme === 'https' || __DEV__ && scheme === 'http';
+};
+export const getUrlHost = url => {
+  const withoutScheme = url.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
+  return (withoutScheme.split('/')[0] ?? '').toLowerCase();
+};
 const handleDeepLink = ({
   url
 }) => {
   debugLog('handleDeepLink', 'Received URL:', url);
-  const isHttps = url.includes('https');
-  const route = url.replace(/http(s)?(:)?(\/\/)?/g, '');
+  const scheme = getUrlScheme(url);
+  const route = scheme ? url.slice(`${scheme}://`.length) : url;
   const segments = route.split('/');
   debugLog('handleDeepLink', 'Parsed segments:', segments);
   let baseUrl = '';
@@ -16,16 +34,28 @@ const handleDeepLink = ({
       sessionId = segments[i + 1] ?? '';
       debugLog('handleDeepLink', 'Found sessionId:', sessionId);
     } else if (segments[i] === 'app-url') {
-      baseUrl = `${isHttps ? 'https' : 'http'}://${segments[i + 1]}`;
+      const host = segments[i + 1] ?? '';
+      if (!HOST_PATTERN.test(host)) {
+        logWarn('handleDeepLink', 'Rejected invalid app-url host');
+        continue;
+      }
+      const hostScheme = scheme === 'http' ? 'http' : 'https';
+      if (!isAllowedScheme(hostScheme)) {
+        logWarn('handleDeepLink', 'Rejected non-HTTPS app-url');
+        continue;
+      }
+      baseUrl = `${hostScheme}://${host}`;
       debugLog('handleDeepLink', 'Found baseUrl:', baseUrl);
     }
   }
 
   // If no app-url segment found, derive baseUrl from the URL itself
   if (!baseUrl && sessionId) {
-    const match = url.match(/^(https?:\/\/[^/]+)/);
-    if (match) {
-      baseUrl = match[1];
+    const match = url.match(/^(https?):\/\/([^/]+)/);
+    if (match && isAllowedScheme(match[1].toLowerCase())) {
+      baseUrl = `${match[1].toLowerCase()}://${match[2]}`;
+    } else if (match) {
+      logWarn('handleDeepLink', 'Rejected non-HTTPS deep link URL');
     }
   }
   debugLog('handleDeepLink', 'Returning:', {

package/lib/module/Shared/Libs/http-client.js

@@ -1,6 +1,7 @@
 "use strict";
 
 import { trackApiCall, trackError } from "./analytics.utils.js";
+import { debugLog } from "./debug.utils.js";
 export class HttpClientError extends Error {
   constructor(message) {
     super(message);
@@ -36,6 +37,15 @@ export class InternalServerError extends HttpClientError {
     super(message ?? 'Internal server error');
   }
 }
+
+// Short-lived per-verification token issued by the backend during the session
+// key exchange; sent on every subsequent call. Older backends don't issue one,
+// in which case requests go out without the header (backwards compatible).
+let sessionToken = null;
+export const setSessionToken = token => {
+  sessionToken = token;
+};
+export const getSessionToken = () => sessionToken;
 const request = async (httpMethod, url, body, simulatedResponse) => {
   if (simulatedResponse) {
     return new Promise(resolve => {
@@ -47,30 +57,33 @@ const request = async (httpMethod, url, body, simulatedResponse) => {
   const startTime = Date.now();
   let statusCode = 0;
   let success = false;
-  console.log(`[HTTP] ${httpMethod} ${url}`);
+  debugLog('HTTP', `${httpMethod} ${url}`);
   if (body) {
-    console.log('[HTTP] Request body:', JSON.stringify(body).substring(0, 200) + '...');
+    debugLog('HTTP', 'Request body:', JSON.stringify(body).substring(0, 200) + '...');
   }
   try {
     const response = await fetch(url, {
       method: httpMethod,
       headers: {
-        'Content-Type': 'application/json'
+        'Content-Type': 'application/json',
+        ...(sessionToken ? {
+          'X-Session-Token': sessionToken
+        } : {})
       },
       body: body ? JSON.stringify(body) : undefined
     });
     statusCode = response.status;
     success = response.ok;
-    console.log(`[HTTP] Response status: ${statusCode} ${response.ok ? '✓' : '✗'}`);
+    debugLog('HTTP', `Response status: ${statusCode} ${response.ok ? '✓' : '✗'}`);
     let responseJson = null;
     try {
       responseJson = await response.json();
       if (responseJson) {
-        console.log('[HTTP] Response body:', JSON.stringify(responseJson).substring(0, 200) + '...');
+        debugLog('HTTP', 'Response body:', JSON.stringify(responseJson).substring(0, 200) + '...');
       }
     } catch (error) {
       // Invalid JSON response
-      console.log('[HTTP] Response body: (non-JSON)');
+      debugLog('HTTP', 'Response body: (non-JSON)');
     }
 
     // Track API call performance (non-blocking)