@trustchex/react-native-sdk 1.475.1 → 1.481.1

package/lib/module/Shared/EIDReader/eidReader.js

@@ -8,6 +8,34 @@ import { DG1File } from "./lds/icao/dg1File.js";
 import { DG2File } from "./lds/icao/dg2File.js";
 import { Buffer } from 'buffer';
 import { InputStream } from "./java/inputStream.js";
+import { debugLog } from "../Libs/debug.utils.js";
+import { diagnostics } from "../Libs/diagnostics.js";
+
+/**
+ * Extract an APDU status word (hex, e.g. "6982") from an error message if the
+ * protocol layer included one. Returns undefined when none is present. Kept
+ * deliberately loose — the protocol senders embed "SW=...." / "(6982)" forms.
+ */
+const extractStatusWord = msg => {
+  const m = msg.match(/\b(?:SW[:= ]?)?([0-9a-fA-F]{4})\b/);
+  return m ? m[1].toUpperCase() : undefined;
+};
+
+/** Categorise an NFC error message into a coarse, non-PII bucket. */
+const categorizeNfcError = msg => {
+  const m = msg.toLowerCase();
+  if (m.includes('cancel')) return 'user_cancelled';
+  if (m.includes('lost') || m.includes('steady')) return 'tag_lost';
+  if (m.includes('timeout')) return 'timeout';
+  if (m.includes('not supported') || m.includes('unsupported')) {
+    return 'unsupported';
+  }
+  if (m.includes('not enabled') || m.includes('disabled')) return 'not_enabled';
+  if (m.includes('auth') || m.includes('mutual') || m.includes('security')) {
+    return 'auth_failed';
+  }
+  return 'reading_error';
+};
 
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
@@ -147,7 +175,7 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
       mimeType
     };
   }
-  console.debug('[EID] Face image is JP2, attempting conversion…');
+  debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
     const {
@@ -156,16 +184,16 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
     const jpx = new JpxImage();
     jpx.parse(imageBuffer);
     const tile = jpx.tiles[0];
-    console.debug(`[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`);
+    debugLog('EID', `[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`);
     const pngBytes = pixelsToPng(tile.items, tile.width, tile.height, jpx.componentsCount);
     const pngBase64 = Buffer.from(pngBytes).toString('base64');
-    console.debug(`[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`);
+    debugLog('EID', `[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`);
     return {
       base64: pngBase64,
       mimeType: 'image/png'
     };
   } catch (err) {
-    console.debug('[EID] JP2 conversion failed:', err);
+    debugLog('EID', '[EID] JP2 conversion failed:', err);
     return {
       base64: imageBuffer.toString('base64'),
       mimeType
@@ -274,8 +302,40 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
   let progress = 0;
   const nfcManagerCardService = new NFCManagerCardService();
   const passportService = new EIDService(nfcManagerCardService, EIDService.NORMAL_MAX_TRANSCEIVE_LENGTH, EIDService.DEFAULT_MAX_BLOCKSIZE, false, true);
+
+  // Structured NFC diagnostics: record each step's outcome + timing + APDU SW
+  // into the session collector so the result screen can surface device-specific
+  // read failures. Best-effort and side-effect-only — never alters the flow.
+  diagnostics.nfcAttemptStarted();
+  const stepTimer = () => {
+    const t0 = Date.now();
+    return (step, ok, error) => {
+      const msg = error instanceof Error ? error.message : error ? String(error) : undefined;
+      // Store only the APDU status word and a COARSE category — never the raw
+      // error text, which could in theory embed field/PII values. The SW + step
+      // name + category carry all the actionable signal.
+      diagnostics.nfcStep({
+        step,
+        ok,
+        ms: Date.now() - t0,
+        sw: msg ? extractStatusWord(msg) : undefined,
+        error: msg ? categorizeNfcError(msg) : undefined
+      });
+    };
+  };
   try {
-    await passportService.open();
+    {
+      const done = stepTimer();
+      try {
+        await passportService.open();
+        // Reaching open() without throwing means the chip powered on / was seen.
+        diagnostics.nfcChipDetected();
+        done('open', true);
+      } catch (e) {
+        done('open', false, e);
+        throw e;
+      }
+    }
     progress = 1;
     if (progressCallback) {
       progressCallback(progress);
@@ -285,12 +345,17 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     // Explicitly SELECT MF first so the SFI=0x1C context is correct,
     // regardless of which application the chip activates on power-on.
     let hasPACESucceeded = false;
-    try {
-      await passportService.sendSelectMF();
-      console.debug('[EID] SELECT MF OK');
-    } catch (mfErr) {
-      const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
-      console.debug(`[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`);
+    {
+      const done = stepTimer();
+      try {
+        await passportService.sendSelectMF();
+        done('selectMF', true);
+        debugLog('EID', '[EID] SELECT MF OK');
+      } catch (mfErr) {
+        done('selectMF', false, mfErr);
+        const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
+        debugLog('EID', `[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`);
+      }
     }
     progress = 2;
     if (progressCallback) {
@@ -300,19 +365,24 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     // Read EF.CardAccess — kept in a separate try/catch so we can distinguish
     // "file read failure" from "PACE protocol failure" in the logs.
     let cardAccessBuf = null;
-    try {
-      const cardAccessStream = passportService.getInputStream(EIDService.EF_CARD_ACCESS);
-      await cardAccessStream.init();
-      const cardAccessLen = cardAccessStream.getLength();
-      const buf = Buffer.alloc(cardAccessLen);
-      for (let i = 0; i < cardAccessLen; i++) {
-        buf[i] = await cardAccessStream.read();
+    {
+      const done = stepTimer();
+      try {
+        const cardAccessStream = passportService.getInputStream(EIDService.EF_CARD_ACCESS);
+        await cardAccessStream.init();
+        const cardAccessLen = cardAccessStream.getLength();
+        const buf = Buffer.alloc(cardAccessLen);
+        for (let i = 0; i < cardAccessLen; i++) {
+          buf[i] = await cardAccessStream.read();
+        }
+        cardAccessBuf = buf;
+        done('readCardAccess', true);
+        debugLog('EID', `[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`);
+      } catch (readErr) {
+        done('readCardAccess', false, readErr);
+        const readMsg = readErr instanceof Error ? readErr.message : String(readErr);
+        debugLog('EID', `[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`);
       }
-      cardAccessBuf = buf;
-      console.debug(`[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`);
-    } catch (readErr) {
-      const readMsg = readErr instanceof Error ? readErr.message : String(readErr);
-      console.debug(`[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`);
     }
     progress = 3;
     if (progressCallback) {
@@ -320,11 +390,17 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     }
 
     // If EF.CardAccess was read successfully, attempt PACE.
+    if (cardAccessBuf === null) {
+      // EF.CardAccess unreadable (the readCardAccess step already recorded the
+      // failure/SW) → PACE can't be attempted; BAC will be used.
+      diagnostics.nfcPaceFellBackToBac('no_card_access');
+    }
     if (cardAccessBuf !== null) {
       try {
         const paceInfo = parsePACEInfoFromCardAccess(cardAccessBuf);
         if (paceInfo) {
-          console.debug(`[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`);
+          debugLog('EID', `[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`);
+          diagnostics.nfcSetAuth('PACE', paceInfo.oid);
           // PACE is available - derive key from MRZ and perform PACE
           const bacKey = new BACKey(documentNumber, dateOfBirth, dateOfExpiry);
           const paceKey = PACEKeySpec.createMRZKey(bacKey.getKeySeedForPACE());
@@ -332,18 +408,27 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
           if (progressCallback) {
             progressCallback(progress);
           }
-          await passportService.doPACE(paceKey, paceInfo.oid, paceInfo.parameterId, progressCallback);
-          hasPACESucceeded = true;
-          console.debug('[EID] PACE succeeded');
+          const done = stepTimer();
+          try {
+            await passportService.doPACE(paceKey, paceInfo.oid, paceInfo.parameterId, progressCallback);
+            hasPACESucceeded = true;
+            done('paceAuth', true);
+            debugLog('EID', '[EID] PACE succeeded');
+          } catch (paceErr) {
+            done('paceAuth', false, paceErr);
+            throw paceErr;
+          }
         } else {
-          console.debug('[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC');
+          diagnostics.nfcPaceFellBackToBac('no_pace_info');
+          debugLog('EID', '[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC');
         }
       } catch (paceError) {
         // PACE protocol exchange failed — fall back to BAC
+        diagnostics.nfcPaceFellBackToBac('pace_failed');
         const msg = paceError instanceof Error ? paceError.message : String(paceError);
-        console.debug(`[EID] PACE protocol failed (${msg}), falling back to BAC`);
+        debugLog('EID', `[EID] PACE protocol failed (${msg}), falling back to BAC`);
         if (paceError instanceof Error && paceError.stack) {
-          console.debug('[EID] PACE error stack:', paceError.stack);
+          debugLog('EID', '[EID] PACE error stack:', paceError.stack);
         }
       }
     }
@@ -353,7 +438,16 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     }
 
     // Select Applet for MRTD
-    await passportService.sendSelectApplet(hasPACESucceeded);
+    {
+      const done = stepTimer();
+      try {
+        await passportService.sendSelectApplet(hasPACESucceeded);
+        done('selectApplet', true);
+      } catch (e) {
+        done('selectApplet', false, e);
+        throw e;
+      }
+    }
     progress = 10;
     if (progressCallback) {
       progressCallback(progress);
@@ -366,8 +460,16 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
         await efComStream.read();
       } catch (error) {
         // EF_COM not available -> try to do BAC
+        diagnostics.nfcSetAuth('BAC');
         const bacKey = new BACKey(documentNumber, dateOfBirth, dateOfExpiry);
-        await passportService.doBAC(bacKey);
+        const done = stepTimer();
+        try {
+          await passportService.doBAC(bacKey);
+          done('bacAuth', true);
+        } catch (e) {
+          done('bacAuth', false, e);
+          throw e;
+        }
       }
     }
     progress = 20;
@@ -376,16 +478,25 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     }
 
     // Read DG1 (MRZ Info)
-    const dg1InputStream = passportService.getInputStream(EIDService.EF_DG1);
-    await dg1InputStream.init();
-    const dg1File = new DG1File(undefined, dg1InputStream);
-    const mrzInfo = await dg1File.getMRZInfo();
+    const dg1Done = stepTimer();
+    let mrzInfo;
+    try {
+      const dg1InputStream = passportService.getInputStream(EIDService.EF_DG1);
+      await dg1InputStream.init();
+      const dg1File = new DG1File(undefined, dg1InputStream);
+      mrzInfo = await dg1File.getMRZInfo();
+      dg1Done('readDG1', true);
+    } catch (e) {
+      dg1Done('readDG1', false, e);
+      throw e;
+    }
     progress = 30;
     if (progressCallback) {
       progressCallback(progress);
     }
 
     // Read DG2 (Face Image)
+    const dg2Done = stepTimer();
     const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
     await dg2InputStream.init();
     InputStream.onRead((totalBytesRead, fileLength) => {
@@ -398,7 +509,14 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     let imageAsBase64 = '';
     let mimeType = '';
     const allFaceImageInfos = [];
-    const faceInfos = await dg2File.getFaceInfos();
+    let faceInfos;
+    try {
+      faceInfos = await dg2File.getFaceInfos();
+      dg2Done('readDG2', true);
+    } catch (e) {
+      dg2Done('readDG2', false, e);
+      throw e;
+    }
     for (let faceInfo of faceInfos) {
       allFaceImageInfos.push(...faceInfo.getFaceImageInfos());
     }
@@ -417,13 +535,16 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     if (progressCallback) {
       progressCallback(progress);
     }
+    diagnostics.nfcResult(true);
     return {
       mrz: mrzInfo,
       faceImage: imageAsBase64,
       mimeType: mimeType
     };
   } catch (error) {
-    console.debug('Error reading passport data', error);
+    const msg = error instanceof Error ? error.message : String(error);
+    diagnostics.nfcResult(false, categorizeNfcError(msg));
+    debugLog('EID', 'Error reading passport data', error);
   } finally {
     await passportService.close();
   }

package/lib/module/Shared/Libs/MRZ_KNOWN_ISSUES.md

@@ -56,6 +56,40 @@ primary safeguard. A single noisy frame is not trusted; the consensus is.
 
 ---
 
+## 2a. Turkish e-ID document numbers: leading serial LETTER must be preserved
+
+**Issue.** Turkish identity cards put a **serial letter** at the start of the
+9-char document number (e.g. `A53032352`, `A49M38410`). Empirically — verified
+against real cards — **Türkiye computes the document-number check digit over the
+number with the LEADING letter EXCLUDED** (interior letters are kept), which
+diverges from strict ICAO 9303 (where `A`=10 is weighted in). So a genuine card
+`A53032352` (printed check digit `5`) **fails** the strict ICAO check (which
+wants `7`), even though the card is valid — `icaoCheckDigit("53032352") === "5"`.
+The TD1 **composite** on these cards is likewise non-standard (no interpretation
+of the leading letter reproduces it), so it is **not** a reliable anchor.
+
+**Why it matters.** The leading letter is **real** and **must be preserved**: the
+**NFC eID chip derives its BAC/PACE access key from the document number exactly
+as stored** (with the letter). Rewriting `A53032352`→`453032352` — as the
+ambiguous-char recovery would, to satisfy strict ICAO — makes the **chip read
+FAIL**. (The OCR-B `4` glyph closely resembles `A`, which is why the recovery
+used to "correct" it.)
+
+**Mitigation.** `acceptsTurkishLetterPrefix` (in `mrz.utils.ts`; ported to
+`mrz_utils.dart`) accepts a TUR TD1 whose only failing checks are
+document-number/composite **when** the document number starts with a letter
+**and** `icaoCheckDigit(documentNumber.slice(1))` matches the printed
+document-number check digit. The parse is then accepted **as-is**, preserving the
+letter; the composite is deliberately not required. The subsequent **NFC read is
+the authoritative confirmation** — it only succeeds with the correct
+(letter-preserving) number. Contrast `A49M38410`, whose letters validate under
+*standard* ICAO and so are kept by the normal path.
+
+Covered by the "Turkish e-ID … leading serial LETTER" tests in
+`mrz.ambiguous.test.ts` (RN) and `mrz_ambiguous_test.dart` (Flutter).
+
+---
+
 ## 3. Filler-letter normalisation is conservative in name fields (by design)
 
 **Issue.** The `<` filler is frequently OCR'd as a letter (`K`, and under glare
@@ -84,6 +118,13 @@ Covered by the "real letters in names are not eaten" tests in `mrz.utils.test.ts
   30–44-char MRZ line below that floor, so the native pipeline **crops to the
   on-screen scan frame and upscales + grayscale/contrast-enhances** before OCR.
   The MRZ band must be reasonably filled within the on-screen guide.
+  - Two distinct regions exist in the native code (don't confuse them):
+    the **MRZ-OCR crop** (`buildScanFrameRoiImage`: top 25% / bottom 12% / sides
+    4%, upscaled ≤2.5× to ≤2200px, grayscale, contrast 1.6×) and the
+    **brightness-sampling region** (the on-screen guide: 36% / 36% / 5%). Both are
+    the same on iOS and Android. The diagnostic report records the measured MRZ
+    band pixel height so you can tell when a device leaves the band below the
+    ~16 px/char floor.
 - **Glare / lamination.** Heavy glare on a glossy laminated card still degrades
   OCR; the enhancement helps but does not eliminate it. Steadying the card and
   reducing direct glare improves convergence.

package/lib/module/Shared/Libs/SignalingClient.js

@@ -1,6 +1,7 @@
 "use strict";
 
 import EventSource from 'react-native-sse';
+import { debugLog } from "./debug.utils.js";
 export class SignalingClient {
   eventSource = null;
   constructor(baseUrl, sessionId, onMessage, identificationId, onSessionEnded) {
@@ -19,13 +20,13 @@ export class SignalingClient {
       urlParams.append('identificationId', this.identificationId);
     }
     const url = `${this.baseUrl}/api/app/mobile/video-sessions/${this.sessionId}/signaling/stream?${urlParams.toString()}`;
-    console.log('[SignalingClient] Connecting to SSE:', url);
+    debugLog('SignalingClient', '[SignalingClient] Connecting to SSE:', url);
     this.eventSource = new EventSource(url, {
       pollingInterval: 0 // 0 means default/no polling if SSE is real
     });
     const listener = event => {
       if (event.type === 'open') {
-        console.log('[SignalingClient] Connected');
+        debugLog('SignalingClient', '[SignalingClient] Connected');
         this.onConnected?.();
       } else if (event.type === 'error') {
         console.error('[SignalingClient] Connection error:', JSON.stringify(event, null, 2));
@@ -64,8 +65,8 @@ export class SignalingClient {
     };
 
     // Ping handler - server sends pings to keep connection alive
-    const pingListener = event => {
-      console.log('[SignalingClient] Received ping');
+    const pingListener = _event => {
+      debugLog('SignalingClient', '[SignalingClient] Received ping');
       // Just acknowledge by doing nothing, server-side heartbeat keeps connection alive
     };
 
@@ -73,7 +74,7 @@ export class SignalingClient {
     const sessionEndedListener = event => {
       try {
         const data = JSON.parse(event.data || '{}');
-        console.log('[SignalingClient] Session ended:', data.state);
+        debugLog('SignalingClient', '[SignalingClient] Session ended:', data.state);
         if (this.onSessionEnded) {
           this.onSessionEnded(data.state);
         }

package/lib/module/Shared/Libs/crypto.utils.js

@@ -5,19 +5,41 @@ import { Buffer } from 'buffer';
 import { gcm } from '@noble/ciphers/aes';
 import { randomBytes } from '@noble/ciphers/webcrypto';
 import { secp256k1 } from '@noble/curves/secp256k1';
-import httpClient from "./http-client.js";
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha2';
+import httpClient, { setSessionToken } from "./http-client.js";
+
+// Must stay byte-for-byte identical to the backend derivation
+// (web-app/src/lib/crypto-utils.ts).
+const SESSION_KEY_KDF_INFO = 'trustchex-session-key-v2';
+const SESSION_KEY_KDF_VERSION = 2;
 const getSessionKey = async (apiUrl, sessionId) => {
   const clientPrivateKey = secp256k1.utils.randomPrivateKey();
   const clientPublicKey = secp256k1.getPublicKey(clientPrivateKey);
   const serverResponse = await httpClient.post(`${apiUrl}/verification-sessions/${sessionId}/auth`, {
-    clientPublicKey: Buffer.from(clientPublicKey).toString('hex')
+    clientPublicKey: Buffer.from(clientPublicKey).toString('hex'),
+    kdfVersion: SESSION_KEY_KDF_VERSION
   });
+  if (serverResponse.sessionToken) {
+    setSessionToken(serverResponse.sessionToken);
+  }
   const sharedKey = secp256k1.getSharedSecret(clientPrivateKey, Buffer.from(serverResponse.serverPublicKey, 'hex').toString('hex'));
+
+  // The server echoes the kdfVersion it actually used; older backends don't
+  // send the field and derive the legacy key.
+  if (serverResponse.kdfVersion === SESSION_KEY_KDF_VERSION) {
+    // sharedKey is a compressed secp256k1 point; byte 0 is the 0x02/0x03
+    // parity prefix and carries no secret entropy.
+    const derived = hkdf(sha256, Buffer.from(sharedKey).subarray(1), Buffer.from(sessionId, 'utf-8'), SESSION_KEY_KDF_INFO, 32);
+    return Buffer.from(derived).toString('hex');
+  }
   const sessionKey = (Buffer.from(new Date().getUTCDate().toString(), 'utf-8').toString('hex') + Buffer.from(sharedKey).toString('hex')).substring(0, 32);
   return sessionKey;
 };
 const encryptWithAes = (data, key) => {
-  const nonce = randomBytes(32);
+  // Standard 96-bit GCM IV; the backend reads the nonce from the payload, so
+  // this stays compatible with servers that previously saw 32-byte nonces.
+  const nonce = randomBytes(12);
   const dataBytes = Buffer.from(data, 'utf-8');
   const aes = gcm(Buffer.from(key, 'hex'), nonce);
   const ciphertext = aes.encrypt(dataBytes);

package/lib/module/Shared/Libs/deeplink.utils.js

@@ -1,12 +1,30 @@
 "use strict";
 
-import { debugLog } from "./debug.utils.js";
+import { debugLog, logWarn } from "./debug.utils.js";
+
+// Hostname (optionally with port) — rejects paths, credentials, and other
+// URL components smuggled into the app-url segment.
+const HOST_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9.-]*(:\d{1,5})?$/;
+const getUrlScheme = url => {
+  const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+  return match ? match[1].toLowerCase() : '';
+};
+
+// The SDK uploads identity documents and biometrics to the derived baseUrl, so
+// cleartext destinations are only allowed in development builds.
+const isAllowedScheme = scheme => {
+  return scheme === 'https' || __DEV__ && scheme === 'http';
+};
+export const getUrlHost = url => {
+  const withoutScheme = url.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
+  return (withoutScheme.split('/')[0] ?? '').toLowerCase();
+};
 const handleDeepLink = ({
   url
 }) => {
   debugLog('handleDeepLink', 'Received URL:', url);
-  const isHttps = url.includes('https');
-  const route = url.replace(/http(s)?(:)?(\/\/)?/g, '');
+  const scheme = getUrlScheme(url);
+  const route = scheme ? url.slice(`${scheme}://`.length) : url;
   const segments = route.split('/');
   debugLog('handleDeepLink', 'Parsed segments:', segments);
   let baseUrl = '';
@@ -16,16 +34,28 @@ const handleDeepLink = ({
       sessionId = segments[i + 1] ?? '';
       debugLog('handleDeepLink', 'Found sessionId:', sessionId);
     } else if (segments[i] === 'app-url') {
-      baseUrl = `${isHttps ? 'https' : 'http'}://${segments[i + 1]}`;
+      const host = segments[i + 1] ?? '';
+      if (!HOST_PATTERN.test(host)) {
+        logWarn('handleDeepLink', 'Rejected invalid app-url host');
+        continue;
+      }
+      const hostScheme = scheme === 'http' ? 'http' : 'https';
+      if (!isAllowedScheme(hostScheme)) {
+        logWarn('handleDeepLink', 'Rejected non-HTTPS app-url');
+        continue;
+      }
+      baseUrl = `${hostScheme}://${host}`;
       debugLog('handleDeepLink', 'Found baseUrl:', baseUrl);
     }
   }
 
   // If no app-url segment found, derive baseUrl from the URL itself
   if (!baseUrl && sessionId) {
-    const match = url.match(/^(https?:\/\/[^/]+)/);
-    if (match) {
-      baseUrl = match[1];
+    const match = url.match(/^(https?):\/\/([^/]+)/);
+    if (match && isAllowedScheme(match[1].toLowerCase())) {
+      baseUrl = `${match[1].toLowerCase()}://${match[2]}`;
+    } else if (match) {
+      logWarn('handleDeepLink', 'Rejected non-HTTPS deep link URL');
     }
   }
   debugLog('handleDeepLink', 'Returning:', {

package/lib/module/Shared/Libs/diagnosticReport.js

@@ -0,0 +1,133 @@
+"use strict";
+
+/**
+ * Builds the support diagnostic report from a scan session.
+ *
+ * Produces three things the result screen turns into a reviewable email:
+ *  - `diagnostics.json`  — technical signals (device, camera, MRZ, NFC steps).
+ *  - `scan-data.json`    — the scanned identity data + raw MRZ (PII; the user
+ *                          reviews it in the draft and chooses to send).
+ *  - a short, size-bounded plain-text BODY summary that always fits an email.
+ *
+ * The full detail lives in the JSON attachments; the email body is intentionally
+ * compact so the draft opens reliably on every mail client.
+ */
+
+/** ICAO 9303 7-3-1 weighted check digit (local copy; mirrors mrz.utils). */
+const icaoCheckDigit = str => {
+  const weights = [7, 3, 1];
+  let sum = 0;
+  for (let i = 0; i < str.length; i++) {
+    const c = str[i];
+    const v = c === '<' ? 0 : c >= '0' && c <= '9' ? c.charCodeAt(0) - 48 : c.charCodeAt(0) - 55;
+    sum = (sum + weights[i % 3] * v) % 10;
+  }
+  return String(sum);
+};
+/** Compute per-field check-digit pass/fail for a TD1 MRZ (best-effort). */
+const computeTd1CheckDigits = mrzText => {
+  if (!mrzText) return undefined;
+  const lines = mrzText.split('\n').map(l => l.trim()).filter(Boolean);
+  if (lines.length < 2 || lines[0].length < 30 || lines[1].length < 30) {
+    return undefined; // only TD1 handled here; other formats omitted from summary
+  }
+  const l1 = lines[0];
+  const l2 = lines[1];
+  const result = {};
+  const check = (data, printed) => icaoCheckDigit(data) === printed ? 'pass' : 'fail';
+
+  // Turkish convention: a doc number may carry a leading serial LETTER, and the
+  // doc-number check digit is computed over the DIGITS ONLY (letter dropped).
+  // The TD1 composite then also diverges from strict ICAO for such cards (no
+  // interpretation of the letter reproduces it). To avoid reporting a misleading
+  // "fail" on a card the SDK legitimately accepted, detect the letter-prefix and
+  // treat both the doc-number and composite as validated under that convention.
+  const docData = l1.slice(5, 14);
+  const docPrinted = l1[14];
+  const hasLetterPrefix = /^[A-Z]/.test(docData);
+  const strictDocOk = icaoCheckDigit(docData) === docPrinted;
+  const turkishDocOk = hasLetterPrefix && icaoCheckDigit(docData.slice(1)) === docPrinted;
+  const docOk = strictDocOk || turkishDocOk;
+  result.documentNumber = docOk ? 'pass' : 'fail';
+  result.birthDate = check(l2.slice(0, 6), l2[6]);
+  result.expiry = check(l2.slice(8, 14), l2[14]);
+  const composite = l1.slice(5, 30) + l2.slice(0, 7) + l2.slice(8, 15) + l2.slice(18, 29);
+  const compStrict = check(composite, l2[29]);
+  // If the strict composite fails ONLY because of the Turkish letter-prefix
+  // doc number (which itself passed under the digits-only rule), don't surface a
+  // misleading failure — the SDK accepts these cards.
+  result.composite = compStrict === 'fail' && hasLetterPrefix && docOk ? 'pass' : compStrict;
+  // The Turkish convention was the deciding factor only when strict ICAO would
+  // have failed the doc number but the digits-only rule passes it.
+  const turkishLetterPrefix = !strictDocOk && turkishDocOk;
+  return {
+    checkDigits: result,
+    turkishLetterPrefix
+  };
+};
+const MAX_BODY_BYTES = 4096;
+const yesNo = b => b ? 'yes' : 'no';
+
+/** Assemble the full report bundle. Pure — no I/O, no native calls. */
+export const buildDiagnosticReport = params => {
+  const {
+    diag,
+    device,
+    scan,
+    sdkVersion,
+    sessionId
+  } = params;
+  const computed = computeTd1CheckDigits(scan.mrzText);
+  const checkDigits = diag.mrz.checkDigits ?? computed?.checkDigits;
+  // Set the Turkish-letter-prefix flag from the final accepted MRZ (the collector
+  // can't know it during scanning; the report does, from the MRZ text).
+  const turkishLetterPrefixApplied = diag.mrz.turkishLetterPrefixApplied || computed?.turkishLetterPrefix === true;
+
+  // --- diagnostics.json (technical, low-PII) ---
+  const diagnosticsObj = {
+    schemaVersion: diag.schemaVersion,
+    generatedAt: diag.generatedAt,
+    sessionId: sessionId ?? null,
+    sdk: {
+      platform: device.platform,
+      sdkVersion,
+      buildNumber: device.buildNumber
+    },
+    device,
+    scan: {
+      documentType: scan.documentType ?? diag.documentType ?? null,
+      dataSource: scan.dataSource ?? diag.dataSource ?? null,
+      totalDurationMs: diag.totalDurationMs,
+      camera: diag.camera
+    },
+    mrz: {
+      ...diag.mrz,
+      checkDigits: checkDigits ?? null,
+      turkishLetterPrefixApplied
+    },
+    nfc: diag.nfc,
+    errors: diag.errors
+  };
+
+  // --- scan-data.json (PII; user reviews before sending) ---
+  const scanDataObj = {
+    documentType: scan.documentType ?? diag.documentType ?? null,
+    dataSource: scan.dataSource ?? diag.dataSource ?? null,
+    mrzText: scan.mrzText ?? null,
+    fields: scan.mrzFields ?? null,
+    barcodeValue: scan.barcodeValue ?? null
+  };
+
+  // --- compact email body (always under MAX_BODY_BYTES) ---
+  const nfc = diag.nfc;
+  const nfcLine = nfc.attempted ? `${nfc.authProtocol}${nfc.paceFellBackToBac ? '→BAC' : ''} · ${nfc.succeeded ? 'success' : `failed at ${nfc.failureStep ?? '?'} (${nfc.errorCategory ?? 'error'})`}` : 'not attempted';
+  const checksLine = checkDigits ? Object.entries(checkDigits).map(([k, v]) => `${k}:${v}`).join(' ') : 'n/a';
+  const body = ['TRUSTCHEX SCAN REPORT', `Device: ${device.brand} ${device.model} · ${device.systemName} ${device.systemVersion}${device.apiLevel ? ` (API ${device.apiLevel})` : ''}`, `SDK: ${sdkVersion} (build ${device.buildNumber}) · ${device.manufacturer} · ${device.deviceId}`, `Document: ${scanDataObj.documentType ?? 'unknown'} · source: ${scanDataObj.dataSource ?? 'unknown'}`, `MRZ: ${diag.mrz.reachedStable ? 'stable' : 'NOT stable'} after ${diag.mrz.framesProcessed} frames · checks: ${checksLine}`, `Camera: ${diag.camera.frames} frames · brightness ${diag.camera.avgBrightness} (low:${yesNo(diag.camera.hadLowBrightness)} blur:${yesNo(diag.camera.hadBlurryFrames)})`, `NFC: ${nfcLine}`, sessionId ? `Session: ${sessionId}` : '', '', 'Describe the issue here:', '', '', '— Full diagnostics and document images are attached. Please review before sending; do not edit the attachments. —'].filter(Boolean).join('\n');
+  const subject = `Trustchex scan report — ${scanDataObj.documentType ?? 'doc'} — ${device.brand} ${device.model} — v${sdkVersion}${sessionId ? ` — ${sessionId}` : ''}`;
+  return {
+    diagnosticsJson: JSON.stringify(diagnosticsObj, null, 2),
+    scanDataJson: JSON.stringify(scanDataObj, null, 2),
+    body: body.length > MAX_BODY_BYTES ? body.slice(0, MAX_BODY_BYTES - 1) + '…' : body,
+    subject
+  };
+};