@trustchex/react-native-sdk 1.475.1 → 1.481.1

package/src/Shared/EIDReader/eidReader.ts

@@ -8,6 +8,34 @@ import { FaceImageInfo } from './lds/iso19794/faceImageInfo';
 import { Buffer } from 'buffer';
 import { MRZInfo } from './lds/icao/mrzInfo';
 import { InputStream } from './java/inputStream';
+import { debugLog } from '../Libs/debug.utils';
+import { diagnostics } from '../Libs/diagnostics';
+
+/**
+ * Extract an APDU status word (hex, e.g. "6982") from an error message if the
+ * protocol layer included one. Returns undefined when none is present. Kept
+ * deliberately loose — the protocol senders embed "SW=...." / "(6982)" forms.
+ */
+const extractStatusWord = (msg: string): string | undefined => {
+  const m = msg.match(/\b(?:SW[:= ]?)?([0-9a-fA-F]{4})\b/);
+  return m ? m[1].toUpperCase() : undefined;
+};
+
+/** Categorise an NFC error message into a coarse, non-PII bucket. */
+const categorizeNfcError = (msg: string): string => {
+  const m = msg.toLowerCase();
+  if (m.includes('cancel')) return 'user_cancelled';
+  if (m.includes('lost') || m.includes('steady')) return 'tag_lost';
+  if (m.includes('timeout')) return 'timeout';
+  if (m.includes('not supported') || m.includes('unsupported')) {
+    return 'unsupported';
+  }
+  if (m.includes('not enabled') || m.includes('disabled')) return 'not_enabled';
+  if (m.includes('auth') || m.includes('mutual') || m.includes('security')) {
+    return 'auth_failed';
+  }
+  return 'reading_error';
+};
 
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
@@ -161,14 +189,15 @@ function convertJP2IfNeeded(
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 
-  console.debug('[EID] Face image is JP2, attempting conversion…');
+  debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
     const { JpxImage } = require('jpeg2000');
     const jpx = new JpxImage();
     jpx.parse(imageBuffer);
     const tile = jpx.tiles[0];
-    console.debug(
+    debugLog(
+      'EID',
       `[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`
     );
     const pngBytes = pixelsToPng(
@@ -178,12 +207,13 @@ function convertJP2IfNeeded(
       jpx.componentsCount
     );
     const pngBase64 = Buffer.from(pngBytes).toString('base64');
-    console.debug(
+    debugLog(
+      'EID',
       `[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`
     );
     return { base64: pngBase64, mimeType: 'image/png' };
   } catch (err) {
-    console.debug('[EID] JP2 conversion failed:', err);
+    debugLog('EID', '[EID] JP2 conversion failed:', err);
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 }
@@ -304,8 +334,40 @@ const eidReader = async (
     true
   );
 
+  // Structured NFC diagnostics: record each step's outcome + timing + APDU SW
+  // into the session collector so the result screen can surface device-specific
+  // read failures. Best-effort and side-effect-only — never alters the flow.
+  diagnostics.nfcAttemptStarted();
+  const stepTimer = () => {
+    const t0 = Date.now();
+    return (step: string, ok: boolean, error?: unknown) => {
+      const msg = error instanceof Error ? error.message : error ? String(error) : undefined;
+      // Store only the APDU status word and a COARSE category — never the raw
+      // error text, which could in theory embed field/PII values. The SW + step
+      // name + category carry all the actionable signal.
+      diagnostics.nfcStep({
+        step,
+        ok,
+        ms: Date.now() - t0,
+        sw: msg ? extractStatusWord(msg) : undefined,
+        error: msg ? categorizeNfcError(msg) : undefined,
+      });
+    };
+  };
+
   try {
-    await passportService.open();
+    {
+      const done = stepTimer();
+      try {
+        await passportService.open();
+        // Reaching open() without throwing means the chip powered on / was seen.
+        diagnostics.nfcChipDetected();
+        done('open', true);
+      } catch (e) {
+        done('open', false, e);
+        throw e;
+      }
+    }
 
     progress = 1;
     if (progressCallback) {
@@ -317,14 +379,20 @@ const eidReader = async (
     // regardless of which application the chip activates on power-on.
     let hasPACESucceeded = false;
 
-    try {
-      await passportService.sendSelectMF();
-      console.debug('[EID] SELECT MF OK');
-    } catch (mfErr) {
-      const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
-      console.debug(
-        `[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`
-      );
+    {
+      const done = stepTimer();
+      try {
+        await passportService.sendSelectMF();
+        done('selectMF', true);
+        debugLog('EID', '[EID] SELECT MF OK');
+      } catch (mfErr) {
+        done('selectMF', false, mfErr);
+        const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
+        debugLog(
+          'EID',
+          `[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`
+        );
+      }
     }
 
     progress = 2;
@@ -335,26 +403,33 @@ const eidReader = async (
     // Read EF.CardAccess — kept in a separate try/catch so we can distinguish
     // "file read failure" from "PACE protocol failure" in the logs.
     let cardAccessBuf: Buffer | null = null;
-    try {
-      const cardAccessStream = passportService.getInputStream(
-        EIDService.EF_CARD_ACCESS
-      );
-      await cardAccessStream.init();
-      const cardAccessLen = cardAccessStream.getLength();
-      const buf = Buffer.alloc(cardAccessLen);
-      for (let i = 0; i < cardAccessLen; i++) {
-        buf[i] = await cardAccessStream.read();
+    {
+      const done = stepTimer();
+      try {
+        const cardAccessStream = passportService.getInputStream(
+          EIDService.EF_CARD_ACCESS
+        );
+        await cardAccessStream.init();
+        const cardAccessLen = cardAccessStream.getLength();
+        const buf = Buffer.alloc(cardAccessLen);
+        for (let i = 0; i < cardAccessLen; i++) {
+          buf[i] = await cardAccessStream.read();
+        }
+        cardAccessBuf = buf;
+        done('readCardAccess', true);
+        debugLog(
+          'EID',
+          `[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`
+        );
+      } catch (readErr) {
+        done('readCardAccess', false, readErr);
+        const readMsg =
+          readErr instanceof Error ? readErr.message : String(readErr);
+        debugLog(
+          'EID',
+          `[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`
+        );
       }
-      cardAccessBuf = buf;
-      console.debug(
-        `[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`
-      );
-    } catch (readErr) {
-      const readMsg =
-        readErr instanceof Error ? readErr.message : String(readErr);
-      console.debug(
-        `[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`
-      );
     }
 
     progress = 3;
@@ -363,14 +438,21 @@ const eidReader = async (
     }
 
     // If EF.CardAccess was read successfully, attempt PACE.
+    if (cardAccessBuf === null) {
+      // EF.CardAccess unreadable (the readCardAccess step already recorded the
+      // failure/SW) → PACE can't be attempted; BAC will be used.
+      diagnostics.nfcPaceFellBackToBac('no_card_access');
+    }
     if (cardAccessBuf !== null) {
       try {
         const paceInfo = parsePACEInfoFromCardAccess(cardAccessBuf);
 
         if (paceInfo) {
-          console.debug(
+          debugLog(
+            'EID',
             `[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`
           );
+          diagnostics.nfcSetAuth('PACE', paceInfo.oid);
           // PACE is available - derive key from MRZ and perform PACE
           const bacKey = new BACKey(documentNumber, dateOfBirth, dateOfExpiry);
           const paceKey = PACEKeySpec.createMRZKey(bacKey.getKeySeedForPACE());
@@ -380,28 +462,39 @@ const eidReader = async (
             progressCallback(progress);
           }
 
-          await passportService.doPACE(
-            paceKey,
-            paceInfo.oid,
-            paceInfo.parameterId,
-            progressCallback
-          );
-          hasPACESucceeded = true;
-          console.debug('[EID] PACE succeeded');
+          const done = stepTimer();
+          try {
+            await passportService.doPACE(
+              paceKey,
+              paceInfo.oid,
+              paceInfo.parameterId,
+              progressCallback
+            );
+            hasPACESucceeded = true;
+            done('paceAuth', true);
+            debugLog('EID', '[EID] PACE succeeded');
+          } catch (paceErr) {
+            done('paceAuth', false, paceErr);
+            throw paceErr;
+          }
         } else {
-          console.debug(
+          diagnostics.nfcPaceFellBackToBac('no_pace_info');
+          debugLog(
+            'EID',
             '[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC'
           );
         }
       } catch (paceError) {
         // PACE protocol exchange failed — fall back to BAC
+        diagnostics.nfcPaceFellBackToBac('pace_failed');
         const msg =
           paceError instanceof Error ? paceError.message : String(paceError);
-        console.debug(
+        debugLog(
+          'EID',
           `[EID] PACE protocol failed (${msg}), falling back to BAC`
         );
         if (paceError instanceof Error && paceError.stack) {
-          console.debug('[EID] PACE error stack:', paceError.stack);
+          debugLog('EID', '[EID] PACE error stack:', paceError.stack);
         }
       }
     }
@@ -412,7 +505,16 @@ const eidReader = async (
     }
 
     // Select Applet for MRTD
-    await passportService.sendSelectApplet(hasPACESucceeded);
+    {
+      const done = stepTimer();
+      try {
+        await passportService.sendSelectApplet(hasPACESucceeded);
+        done('selectApplet', true);
+      } catch (e) {
+        done('selectApplet', false, e);
+        throw e;
+      }
+    }
 
     progress = 10;
     if (progressCallback) {
@@ -427,8 +529,16 @@ const eidReader = async (
         await efComStream.read();
       } catch (error) {
         // EF_COM not available -> try to do BAC
+        diagnostics.nfcSetAuth('BAC');
         const bacKey = new BACKey(documentNumber, dateOfBirth, dateOfExpiry);
-        await passportService.doBAC(bacKey);
+        const done = stepTimer();
+        try {
+          await passportService.doBAC(bacKey);
+          done('bacAuth', true);
+        } catch (e) {
+          done('bacAuth', false, e);
+          throw e;
+        }
       }
     }
 
@@ -438,10 +548,18 @@ const eidReader = async (
     }
 
     // Read DG1 (MRZ Info)
-    const dg1InputStream = passportService.getInputStream(EIDService.EF_DG1);
-    await dg1InputStream.init();
-    const dg1File = new DG1File(undefined, dg1InputStream);
-    const mrzInfo = await dg1File.getMRZInfo();
+    const dg1Done = stepTimer();
+    let mrzInfo: MRZInfo;
+    try {
+      const dg1InputStream = passportService.getInputStream(EIDService.EF_DG1);
+      await dg1InputStream.init();
+      const dg1File = new DG1File(undefined, dg1InputStream);
+      mrzInfo = await dg1File.getMRZInfo();
+      dg1Done('readDG1', true);
+    } catch (e) {
+      dg1Done('readDG1', false, e);
+      throw e;
+    }
 
     progress = 30;
     if (progressCallback) {
@@ -449,6 +567,7 @@ const eidReader = async (
     }
 
     // Read DG2 (Face Image)
+    const dg2Done = stepTimer();
     const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
     await dg2InputStream.init();
     InputStream.onRead((totalBytesRead, fileLength) => {
@@ -462,7 +581,14 @@ const eidReader = async (
     let mimeType = '';
 
     const allFaceImageInfos: FaceImageInfo[] = [];
-    const faceInfos = await dg2File.getFaceInfos();
+    let faceInfos;
+    try {
+      faceInfos = await dg2File.getFaceInfos();
+      dg2Done('readDG2', true);
+    } catch (e) {
+      dg2Done('readDG2', false, e);
+      throw e;
+    }
     for (let faceInfo of faceInfos) {
       allFaceImageInfos.push(...faceInfo.getFaceImageInfos());
     }
@@ -484,13 +610,16 @@ const eidReader = async (
       progressCallback(progress);
     }
 
+    diagnostics.nfcResult(true);
     return {
       mrz: mrzInfo,
       faceImage: imageAsBase64,
       mimeType: mimeType,
     };
   } catch (error) {
-    console.debug('Error reading passport data', error);
+    const msg = error instanceof Error ? error.message : String(error);
+    diagnostics.nfcResult(false, categorizeNfcError(msg));
+    debugLog('EID', 'Error reading passport data', error);
   } finally {
     await passportService.close();
   }

package/src/Shared/Libs/MRZ_KNOWN_ISSUES.md

@@ -56,6 +56,40 @@ primary safeguard. A single noisy frame is not trusted; the consensus is.
 
 ---
 
+## 2a. Turkish e-ID document numbers: leading serial LETTER must be preserved
+
+**Issue.** Turkish identity cards put a **serial letter** at the start of the
+9-char document number (e.g. `A53032352`, `A49M38410`). Empirically — verified
+against real cards — **Türkiye computes the document-number check digit over the
+number with the LEADING letter EXCLUDED** (interior letters are kept), which
+diverges from strict ICAO 9303 (where `A`=10 is weighted in). So a genuine card
+`A53032352` (printed check digit `5`) **fails** the strict ICAO check (which
+wants `7`), even though the card is valid — `icaoCheckDigit("53032352") === "5"`.
+The TD1 **composite** on these cards is likewise non-standard (no interpretation
+of the leading letter reproduces it), so it is **not** a reliable anchor.
+
+**Why it matters.** The leading letter is **real** and **must be preserved**: the
+**NFC eID chip derives its BAC/PACE access key from the document number exactly
+as stored** (with the letter). Rewriting `A53032352`→`453032352` — as the
+ambiguous-char recovery would, to satisfy strict ICAO — makes the **chip read
+FAIL**. (The OCR-B `4` glyph closely resembles `A`, which is why the recovery
+used to "correct" it.)
+
+**Mitigation.** `acceptsTurkishLetterPrefix` (in `mrz.utils.ts`; ported to
+`mrz_utils.dart`) accepts a TUR TD1 whose only failing checks are
+document-number/composite **when** the document number starts with a letter
+**and** `icaoCheckDigit(documentNumber.slice(1))` matches the printed
+document-number check digit. The parse is then accepted **as-is**, preserving the
+letter; the composite is deliberately not required. The subsequent **NFC read is
+the authoritative confirmation** — it only succeeds with the correct
+(letter-preserving) number. Contrast `A49M38410`, whose letters validate under
+*standard* ICAO and so are kept by the normal path.
+
+Covered by the "Turkish e-ID … leading serial LETTER" tests in
+`mrz.ambiguous.test.ts` (RN) and `mrz_ambiguous_test.dart` (Flutter).
+
+---
+
 ## 3. Filler-letter normalisation is conservative in name fields (by design)
 
 **Issue.** The `<` filler is frequently OCR'd as a letter (`K`, and under glare
@@ -84,6 +118,13 @@ Covered by the "real letters in names are not eaten" tests in `mrz.utils.test.ts
   30–44-char MRZ line below that floor, so the native pipeline **crops to the
   on-screen scan frame and upscales + grayscale/contrast-enhances** before OCR.
   The MRZ band must be reasonably filled within the on-screen guide.
+  - Two distinct regions exist in the native code (don't confuse them):
+    the **MRZ-OCR crop** (`buildScanFrameRoiImage`: top 25% / bottom 12% / sides
+    4%, upscaled ≤2.5× to ≤2200px, grayscale, contrast 1.6×) and the
+    **brightness-sampling region** (the on-screen guide: 36% / 36% / 5%). Both are
+    the same on iOS and Android. The diagnostic report records the measured MRZ
+    band pixel height so you can tell when a device leaves the band below the
+    ~16 px/char floor.
 - **Glare / lamination.** Heavy glare on a glossy laminated card still degrades
   OCR; the enhancement helps but does not eliminate it. Steadying the card and
   reducing direct glare improves convergence.

package/src/Shared/Libs/SignalingClient.ts

@@ -1,4 +1,5 @@
 import EventSource, { type EventSourceListener } from 'react-native-sse';
+import { debugLog } from './debug.utils';
 
 export type SignalingMessageType =
   | 'offer'
@@ -51,7 +52,7 @@ export class SignalingClient {
     }
     const url = `${this.baseUrl}/api/app/mobile/video-sessions/${this.sessionId}/signaling/stream?${urlParams.toString()}`;
 
-    console.log('[SignalingClient] Connecting to SSE:', url);
+    debugLog('SignalingClient', '[SignalingClient] Connecting to SSE:', url);
 
     this.eventSource = new EventSource(url, {
       pollingInterval: 0, // 0 means default/no polling if SSE is real
@@ -59,7 +60,7 @@ export class SignalingClient {
 
     const listener: EventSourceListener = (event) => {
       if (event.type === 'open') {
-        console.log('[SignalingClient] Connected');
+        debugLog('SignalingClient', '[SignalingClient] Connected');
         this.onConnected?.();
       } else if (event.type === 'error') {
         console.error(
@@ -108,8 +109,8 @@ export class SignalingClient {
     };
 
     // Ping handler - server sends pings to keep connection alive
-    const pingListener = (event: any) => {
-      console.log('[SignalingClient] Received ping');
+    const pingListener = (_event: any) => {
+      debugLog('SignalingClient', '[SignalingClient] Received ping');
       // Just acknowledge by doing nothing, server-side heartbeat keeps connection alive
     };
 
@@ -117,7 +118,11 @@ export class SignalingClient {
     const sessionEndedListener = (event: any) => {
       try {
         const data = JSON.parse(event.data || '{}');
-        console.log('[SignalingClient] Session ended:', data.state);
+        debugLog(
+          'SignalingClient',
+          '[SignalingClient] Session ended:',
+          data.state
+        );
         if (this.onSessionEnded) {
           this.onSessionEnded(data.state);
         }

package/src/Shared/Libs/crypto.utils.ts

@@ -3,21 +3,56 @@ import { Buffer } from 'buffer';
 import { gcm } from '@noble/ciphers/aes';
 import { randomBytes } from '@noble/ciphers/webcrypto';
 import { secp256k1 } from '@noble/curves/secp256k1';
-import httpClient from './http-client';
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha2';
+import httpClient, { setSessionToken } from './http-client';
+
+// Must stay byte-for-byte identical to the backend derivation
+// (web-app/src/lib/crypto-utils.ts).
+const SESSION_KEY_KDF_INFO = 'trustchex-session-key-v2';
+const SESSION_KEY_KDF_VERSION = 2;
+
+type AuthResponse = {
+  serverPublicKey: string;
+  kdfVersion?: number;
+  sessionToken?: string;
+};
 
 const getSessionKey = async (apiUrl: string, sessionId: string) => {
   const clientPrivateKey = secp256k1.utils.randomPrivateKey();
   const clientPublicKey = secp256k1.getPublicKey(clientPrivateKey);
   const serverResponse = await httpClient.post<
-    { serverPublicKey: string },
-    { clientPublicKey: string }
+    AuthResponse,
+    { clientPublicKey: string; kdfVersion: number }
   >(`${apiUrl}/verification-sessions/${sessionId}/auth`, {
     clientPublicKey: Buffer.from(clientPublicKey).toString('hex'),
+    kdfVersion: SESSION_KEY_KDF_VERSION,
   });
+
+  if (serverResponse.sessionToken) {
+    setSessionToken(serverResponse.sessionToken);
+  }
+
   const sharedKey = secp256k1.getSharedSecret(
     clientPrivateKey,
     Buffer.from(serverResponse.serverPublicKey, 'hex').toString('hex')
   );
+
+  // The server echoes the kdfVersion it actually used; older backends don't
+  // send the field and derive the legacy key.
+  if (serverResponse.kdfVersion === SESSION_KEY_KDF_VERSION) {
+    // sharedKey is a compressed secp256k1 point; byte 0 is the 0x02/0x03
+    // parity prefix and carries no secret entropy.
+    const derived = hkdf(
+      sha256,
+      Buffer.from(sharedKey).subarray(1),
+      Buffer.from(sessionId, 'utf-8'),
+      SESSION_KEY_KDF_INFO,
+      32
+    );
+    return Buffer.from(derived).toString('hex');
+  }
+
   const sessionKey = (
     Buffer.from(new Date().getUTCDate().toString(), 'utf-8').toString('hex') +
     Buffer.from(sharedKey).toString('hex')
@@ -27,7 +62,9 @@ const getSessionKey = async (apiUrl: string, sessionId: string) => {
 };
 
 const encryptWithAes = (data: string, key: string) => {
-  const nonce = randomBytes(32);
+  // Standard 96-bit GCM IV; the backend reads the nonce from the payload, so
+  // this stays compatible with servers that previously saw 32-byte nonces.
+  const nonce = randomBytes(12);
   const dataBytes = Buffer.from(data, 'utf-8');
   const aes = gcm(Buffer.from(key, 'hex'), nonce);
   const ciphertext = aes.encrypt(dataBytes);

package/src/Shared/Libs/deeplink.utils.ts

@@ -1,9 +1,29 @@
-import { debugLog } from './debug.utils';
+import { debugLog, logWarn } from './debug.utils';
+
+// Hostname (optionally with port) — rejects paths, credentials, and other
+// URL components smuggled into the app-url segment.
+const HOST_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9.-]*(:\d{1,5})?$/;
+
+const getUrlScheme = (url: string): string => {
+  const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+  return match ? match[1].toLowerCase() : '';
+};
+
+// The SDK uploads identity documents and biometrics to the derived baseUrl, so
+// cleartext destinations are only allowed in development builds.
+const isAllowedScheme = (scheme: string): boolean => {
+  return scheme === 'https' || (__DEV__ && scheme === 'http');
+};
+
+export const getUrlHost = (url: string): string => {
+  const withoutScheme = url.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
+  return (withoutScheme.split('/')[0] ?? '').toLowerCase();
+};
 
 const handleDeepLink = ({ url }: { url: string }) => {
   debugLog('handleDeepLink', 'Received URL:', url);
-  const isHttps = url.includes('https');
-  const route = url.replace(/http(s)?(:)?(\/\/)?/g, '');
+  const scheme = getUrlScheme(url);
+  const route = scheme ? url.slice(`${scheme}://`.length) : url;
   const segments = route.split('/');
   debugLog('handleDeepLink', 'Parsed segments:', segments);
   let baseUrl = '';
@@ -17,16 +37,28 @@ const handleDeepLink = ({ url }: { url: string }) => {
       sessionId = segments[i + 1] ?? '';
       debugLog('handleDeepLink', 'Found sessionId:', sessionId);
     } else if (segments[i] === 'app-url') {
-      baseUrl = `${isHttps ? 'https' : 'http'}://${segments[i + 1]}`;
+      const host = segments[i + 1] ?? '';
+      if (!HOST_PATTERN.test(host)) {
+        logWarn('handleDeepLink', 'Rejected invalid app-url host');
+        continue;
+      }
+      const hostScheme = scheme === 'http' ? 'http' : 'https';
+      if (!isAllowedScheme(hostScheme)) {
+        logWarn('handleDeepLink', 'Rejected non-HTTPS app-url');
+        continue;
+      }
+      baseUrl = `${hostScheme}://${host}`;
       debugLog('handleDeepLink', 'Found baseUrl:', baseUrl);
     }
   }
 
   // If no app-url segment found, derive baseUrl from the URL itself
   if (!baseUrl && sessionId) {
-    const match = url.match(/^(https?:\/\/[^/]+)/);
-    if (match) {
-      baseUrl = match[1];
+    const match = url.match(/^(https?):\/\/([^/]+)/);
+    if (match && isAllowedScheme(match[1].toLowerCase())) {
+      baseUrl = `${match[1].toLowerCase()}://${match[2]}`;
+    } else if (match) {
+      logWarn('handleDeepLink', 'Rejected non-HTTPS deep link URL');
     }
   }