@trustchex/react-native-sdk 1.490.1 → 1.492.0

package/lib/module/Shared/Libs/diagnosticPow.js

@@ -0,0 +1,45 @@
+"use strict";
+
+import { sha256 } from '@noble/hashes/sha2';
+import { Buffer } from 'buffer';
+
+/**
+ * Proof-of-work solver for the demo-diagnostics authenticity flow.
+ *
+ * No secret ships in the SDK. To upload a demo report, the SDK first mints a
+ * server-signed challenge token (`POST …/diagnostics/challenge`) and then finds
+ * a `solution` nonce such that `SHA256(challenge.solution)` has at least
+ * `difficulty` leading zero bits (hashcash-style). The server re-verifies the
+ * token signature (server-only key) and the PoW. See web-app diagnostic-pow.ts.
+ */
+
+const leadingZeroBits = bytes => {
+  let bits = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i];
+    if (b === 0) {
+      bits += 8;
+      continue;
+    }
+    // bits before the highest set bit in this byte (b is 1..255)
+    bits += Math.clz32(b) - 24;
+    break;
+  }
+  return bits;
+};
+
+/**
+ * Solve the PoW for a challenge. Returns the solution nonce as a string.
+ * Bounded by `maxIterations` so a pathological difficulty can't hang the app;
+ * returns null if unsolved within the bound.
+ */
+export const solvePow = (challenge, difficulty, maxIterations = 8_000_000) => {
+  for (let i = 0; i < maxIterations; i++) {
+    const solution = i.toString();
+    const digest = sha256(Buffer.from(`${challenge}.${solution}`, 'utf-8'));
+    if (leadingZeroBits(digest) >= difficulty) {
+      return solution;
+    }
+  }
+  return null;
+};

package/lib/module/Shared/Libs/sendDiagnosticReport.js

@@ -5,10 +5,12 @@
  *
  * This runs from the SDK's DEMO flow only, which is simulated client-side and
  * has no real verification session or account — so there's no session key to
- * encrypt with and nothing to authenticate against. The report is POSTed
- * unauthenticated to the global demo-diagnostics endpoint over HTTPS (encrypted
- * in transit); the backend encrypts the PII fields at rest. Internal developers
- * view and download the reports from a hidden dashboard page.
+ * encrypt with and no credential to authenticate with. Instead, authenticity is
+ * proven with a proof-of-work: the SDK mints a server-signed challenge token
+ * (no secret ships in the SDK), solves it, and submits the solution with the
+ * report over HTTPS. The backend verifies the token (server-only key) + PoW and
+ * encrypts the PII fields at rest. Internal developers view and download the
+ * reports from a hidden dashboard page.
  *
  * Uploaded payload (one JSON body):
  *  - non-PII technical metadata (platform, sdkVersion, documentType,
@@ -17,11 +19,10 @@
  *  - `scanDataJson`   — the scanned identity data (PII),
  *  - `images`         — the captured document/face images (base64, PII).
  */
-import 'react-native-get-random-values';
 import { diagnostics } from "./diagnostics.js";
 import { gatherDeviceDetails } from "./native-device-info.utils.js";
 import { buildDiagnosticReport } from "./diagnosticReport.js";
-import { signDiagnosticBody } from "./diagnosticAuth.js";
+import { solvePow } from "./diagnosticPow.js";
 import { logError } from "./debug.utils.js";
 const mimeToType = mime => mime === 'png' ? 'image/png' : 'image/jpeg';
 
@@ -80,23 +81,34 @@ export const sendDiagnosticReport = async params => {
       }))
     };
 
-    // Sign the EXACT body bytes so the backend can verify authenticity. Use
-    // fetch directly (httpClient doesn't expose custom headers / raw body).
-    const rawBody = JSON.stringify(payload);
-    const {
-      timestamp,
-      nonce,
-      signature
-    } = signDiagnosticBody(rawBody);
+    // Authenticity via proof of work: mint a server-signed challenge, solve it,
+    // and submit the solution. No secret ships in the SDK.
+    const challengeRes = await fetch(`${baseUrl}/api/app/mobile/diagnostics/challenge`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      }
+    });
+    if (!challengeRes.ok) {
+      return {
+        uploaded: false
+      };
+    }
+    const challenge = await challengeRes.json();
+    const solution = solvePow(challenge.challenge, challenge.difficulty);
+    if (!solution) {
+      return {
+        uploaded: false
+      };
+    }
     const response = await fetch(`${baseUrl}/api/app/mobile/diagnostics`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'X-Trustchex-Timestamp': timestamp,
-        'X-Trustchex-Nonce': nonce,
-        'X-Trustchex-Signature': signature
+        'X-Trustchex-Pow-Token': challenge.token,
+        'X-Trustchex-Pow-Solution': solution
       },
-      body: rawBody
+      body: JSON.stringify(payload)
     });
     return {
       uploaded: response.ok

package/lib/module/version.js

@@ -2,4 +2,4 @@
 
 // This file is auto-generated. Do not edit manually.
 // Version is synced from package.json during build.
-export const SDK_VERSION = '1.490.1';
+export const SDK_VERSION = '1.492.0';

package/lib/typescript/src/Shared/Libs/diagnosticPow.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Proof-of-work solver for the demo-diagnostics authenticity flow.
+ *
+ * No secret ships in the SDK. To upload a demo report, the SDK first mints a
+ * server-signed challenge token (`POST …/diagnostics/challenge`) and then finds
+ * a `solution` nonce such that `SHA256(challenge.solution)` has at least
+ * `difficulty` leading zero bits (hashcash-style). The server re-verifies the
+ * token signature (server-only key) and the PoW. See web-app diagnostic-pow.ts.
+ */
+export interface PowChallenge {
+    token: string;
+    challenge: string;
+    difficulty: number;
+    expiresAt: number;
+}
+/**
+ * Solve the PoW for a challenge. Returns the solution nonce as a string.
+ * Bounded by `maxIterations` so a pathological difficulty can't hang the app;
+ * returns null if unsolved within the bound.
+ */
+export declare const solvePow: (challenge: string, difficulty: number, maxIterations?: number) => string | null;
+//# sourceMappingURL=diagnosticPow.d.ts.map

package/lib/typescript/src/Shared/Libs/diagnosticPow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosticPow.d.ts","sourceRoot":"","sources":["../../../../../src/Shared/Libs/diagnosticPow.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GACnB,WAAW,MAAM,EACjB,YAAY,MAAM,EAClB,sBAAyB,KACxB,MAAM,GAAG,IASX,CAAC"}

package/lib/typescript/src/Shared/Libs/sendDiagnosticReport.d.ts

@@ -1,21 +1,3 @@
-/**
- * Assembles and uploads the support diagnostic report to the backend.
- *
- * This runs from the SDK's DEMO flow only, which is simulated client-side and
- * has no real verification session or account — so there's no session key to
- * encrypt with and nothing to authenticate against. The report is POSTed
- * unauthenticated to the global demo-diagnostics endpoint over HTTPS (encrypted
- * in transit); the backend encrypts the PII fields at rest. Internal developers
- * view and download the reports from a hidden dashboard page.
- *
- * Uploaded payload (one JSON body):
- *  - non-PII technical metadata (platform, sdkVersion, documentType,
- *    nfcErrorCode, paceFallbackReason, succeeded) for the list/filter,
- *  - `diagnosticsJson` — technical signals (device, camera, MRZ, NFC steps),
- *  - `scanDataJson`   — the scanned identity data (PII),
- *  - `images`         — the captured document/face images (base64, PII).
- */
-import 'react-native-get-random-values';
 import { type ScanDataForReport } from './diagnosticReport';
 export interface DiagnosticImage {
     /** Stable file name without extension, e.g. "mrz-side". */

package/lib/typescript/src/Shared/Libs/sendDiagnosticReport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sendDiagnosticReport.d.ts","sourceRoot":"","sources":["../../../../../src/Shared/Libs/sendDiagnosticReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,gCAAgC,CAAC;AAGxC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAI5B,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,oBAAoB,KAC3B,OAAO,CAAC,UAAU,CA6EpB,CAAC"}
+{"version":3,"file":"sendDiagnosticReport.d.ts","sourceRoot":"","sources":["../../../../../src/Shared/Libs/sendDiagnosticReport.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAI5B,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,oBAAoB,KAC3B,OAAO,CAAC,UAAU,CAsFpB,CAAC"}

package/lib/typescript/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const SDK_VERSION = "1.490.1";
+export declare const SDK_VERSION = "1.492.0";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trustchex/react-native-sdk",
-  "version": "1.490.1",
+  "version": "1.492.0",
   "description": "Trustchex mobile app react native SDK for android or ios devices",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

package/src/Shared/Libs/diagnosticPow.ts

@@ -0,0 +1,54 @@
+import { sha256 } from '@noble/hashes/sha2';
+import { Buffer } from 'buffer';
+
+/**
+ * Proof-of-work solver for the demo-diagnostics authenticity flow.
+ *
+ * No secret ships in the SDK. To upload a demo report, the SDK first mints a
+ * server-signed challenge token (`POST …/diagnostics/challenge`) and then finds
+ * a `solution` nonce such that `SHA256(challenge.solution)` has at least
+ * `difficulty` leading zero bits (hashcash-style). The server re-verifies the
+ * token signature (server-only key) and the PoW. See web-app diagnostic-pow.ts.
+ */
+
+export interface PowChallenge {
+  token: string;
+  challenge: string;
+  difficulty: number;
+  expiresAt: number;
+}
+
+const leadingZeroBits = (bytes: Uint8Array): number => {
+  let bits = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i];
+    if (b === 0) {
+      bits += 8;
+      continue;
+    }
+    // bits before the highest set bit in this byte (b is 1..255)
+    bits += Math.clz32(b) - 24;
+    break;
+  }
+  return bits;
+};
+
+/**
+ * Solve the PoW for a challenge. Returns the solution nonce as a string.
+ * Bounded by `maxIterations` so a pathological difficulty can't hang the app;
+ * returns null if unsolved within the bound.
+ */
+export const solvePow = (
+  challenge: string,
+  difficulty: number,
+  maxIterations = 8_000_000
+): string | null => {
+  for (let i = 0; i < maxIterations; i++) {
+    const solution = i.toString();
+    const digest = sha256(Buffer.from(`${challenge}.${solution}`, 'utf-8'));
+    if (leadingZeroBits(digest) >= difficulty) {
+      return solution;
+    }
+  }
+  return null;
+};

package/src/Shared/Libs/sendDiagnosticReport.ts

@@ -3,10 +3,12 @@
  *
  * This runs from the SDK's DEMO flow only, which is simulated client-side and
  * has no real verification session or account — so there's no session key to
- * encrypt with and nothing to authenticate against. The report is POSTed
- * unauthenticated to the global demo-diagnostics endpoint over HTTPS (encrypted
- * in transit); the backend encrypts the PII fields at rest. Internal developers
- * view and download the reports from a hidden dashboard page.
+ * encrypt with and no credential to authenticate with. Instead, authenticity is
+ * proven with a proof-of-work: the SDK mints a server-signed challenge token
+ * (no secret ships in the SDK), solves it, and submits the solution with the
+ * report over HTTPS. The backend verifies the token (server-only key) + PoW and
+ * encrypts the PII fields at rest. Internal developers view and download the
+ * reports from a hidden dashboard page.
  *
  * Uploaded payload (one JSON body):
  *  - non-PII technical metadata (platform, sdkVersion, documentType,
@@ -15,14 +17,13 @@
  *  - `scanDataJson`   — the scanned identity data (PII),
  *  - `images`         — the captured document/face images (base64, PII).
  */
-import 'react-native-get-random-values';
 import { diagnostics } from './diagnostics';
 import { gatherDeviceDetails } from './native-device-info.utils';
 import {
   buildDiagnosticReport,
   type ScanDataForReport,
 } from './diagnosticReport';
-import { signDiagnosticBody } from './diagnosticAuth';
+import { solvePow, type PowChallenge } from './diagnosticPow';
 import { logError } from './debug.utils';
 
 export interface DiagnosticImage {
@@ -110,20 +111,29 @@ export const sendDiagnosticReport = async (
         })),
     };
 
-    // Sign the EXACT body bytes so the backend can verify authenticity. Use
-    // fetch directly (httpClient doesn't expose custom headers / raw body).
-    const rawBody = JSON.stringify(payload);
-    const { timestamp, nonce, signature } = signDiagnosticBody(rawBody);
+    // Authenticity via proof of work: mint a server-signed challenge, solve it,
+    // and submit the solution. No secret ships in the SDK.
+    const challengeRes = await fetch(
+      `${baseUrl}/api/app/mobile/diagnostics/challenge`,
+      { method: 'POST', headers: { 'Content-Type': 'application/json' } }
+    );
+    if (!challengeRes.ok) {
+      return { uploaded: false };
+    }
+    const challenge = (await challengeRes.json()) as PowChallenge;
+    const solution = solvePow(challenge.challenge, challenge.difficulty);
+    if (!solution) {
+      return { uploaded: false };
+    }
 
     const response = await fetch(`${baseUrl}/api/app/mobile/diagnostics`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'X-Trustchex-Timestamp': timestamp,
-        'X-Trustchex-Nonce': nonce,
-        'X-Trustchex-Signature': signature,
+        'X-Trustchex-Pow-Token': challenge.token,
+        'X-Trustchex-Pow-Solution': solution,
       },
-      body: rawBody,
+      body: JSON.stringify(payload),
     });
 
     return { uploaded: response.ok };

package/src/version.ts

@@ -1,3 +1,3 @@
 // This file is auto-generated. Do not edit manually.
 // Version is synced from package.json during build.
-export const SDK_VERSION = '1.490.1';
+export const SDK_VERSION = '1.492.0';

package/lib/module/Shared/Libs/diagnosticAuth.js

@@ -1,36 +0,0 @@
-"use strict";
-
-import { Buffer } from 'buffer';
-import { hmac } from '@noble/hashes/hmac';
-import { sha256 } from '@noble/hashes/sha2';
-
-/**
- * Authenticity signing for the demo-diagnostics upload.
- *
- * Demo reports have no session/account to authenticate against, so the SDK signs
- * each upload with HMAC-SHA256 over `timestamp.nonce.rawBody` using a shared
- * secret. The backend recomputes and rejects mismatches and stale timestamps
- * (replay). The secret ships in the SDK, so it's an obfuscation barrier (paired
- * with server rate limiting), not a true secret — rotate via the env var on both
- * sides. MUST stay byte-for-byte in sync with web-app/src/lib/diagnostic-hmac.ts.
- */
-const SECRET = process.env.TRUSTCHEX_DIAGNOSTICS_SECRET ?? 'tcx-diag-v1-2f9c4a7e8b1d4f63a05e9c7b3d61f8a2';
-const randomNonce = () => {
-  // 16 random bytes as hex. crypto.getRandomValues is polyfilled by
-  // react-native-get-random-values (already imported in crypto.utils).
-  const bytes = new Uint8Array(16);
-  globalThis.crypto.getRandomValues(bytes);
-  return Buffer.from(bytes).toString('hex');
-};
-
-/** Sign a raw JSON body for the demo-diagnostics endpoint. */
-export const signDiagnosticBody = rawBody => {
-  const timestamp = Date.now().toString();
-  const nonce = randomNonce();
-  const mac = hmac(sha256, Buffer.from(SECRET, 'utf-8'), Buffer.from(`${timestamp}.${nonce}.${rawBody}`, 'utf-8'));
-  return {
-    timestamp,
-    nonce,
-    signature: Buffer.from(mac).toString('hex')
-  };
-};

package/lib/typescript/src/Shared/Libs/diagnosticAuth.d.ts

@@ -1,8 +0,0 @@
-export interface DiagnosticSignature {
-    timestamp: string;
-    nonce: string;
-    signature: string;
-}
-/** Sign a raw JSON body for the demo-diagnostics endpoint. */
-export declare const signDiagnosticBody: (rawBody: string) => DiagnosticSignature;
-//# sourceMappingURL=diagnosticAuth.d.ts.map

package/lib/typescript/src/Shared/Libs/diagnosticAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"diagnosticAuth.d.ts","sourceRoot":"","sources":["../../../../../src/Shared/Libs/diagnosticAuth.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAUD,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,mBAapD,CAAC"}

package/src/Shared/Libs/diagnosticAuth.ts

@@ -1,47 +0,0 @@
-import { Buffer } from 'buffer';
-import { hmac } from '@noble/hashes/hmac';
-import { sha256 } from '@noble/hashes/sha2';
-
-/**
- * Authenticity signing for the demo-diagnostics upload.
- *
- * Demo reports have no session/account to authenticate against, so the SDK signs
- * each upload with HMAC-SHA256 over `timestamp.nonce.rawBody` using a shared
- * secret. The backend recomputes and rejects mismatches and stale timestamps
- * (replay). The secret ships in the SDK, so it's an obfuscation barrier (paired
- * with server rate limiting), not a true secret — rotate via the env var on both
- * sides. MUST stay byte-for-byte in sync with web-app/src/lib/diagnostic-hmac.ts.
- */
-const SECRET =
-  process.env.TRUSTCHEX_DIAGNOSTICS_SECRET ??
-  'tcx-diag-v1-2f9c4a7e8b1d4f63a05e9c7b3d61f8a2';
-
-export interface DiagnosticSignature {
-  timestamp: string;
-  nonce: string;
-  signature: string;
-}
-
-const randomNonce = (): string => {
-  // 16 random bytes as hex. crypto.getRandomValues is polyfilled by
-  // react-native-get-random-values (already imported in crypto.utils).
-  const bytes = new Uint8Array(16);
-  globalThis.crypto.getRandomValues(bytes);
-  return Buffer.from(bytes).toString('hex');
-};
-
-/** Sign a raw JSON body for the demo-diagnostics endpoint. */
-export const signDiagnosticBody = (rawBody: string): DiagnosticSignature => {
-  const timestamp = Date.now().toString();
-  const nonce = randomNonce();
-  const mac = hmac(
-    sha256,
-    Buffer.from(SECRET, 'utf-8'),
-    Buffer.from(`${timestamp}.${nonce}.${rawBody}`, 'utf-8')
-  );
-  return {
-    timestamp,
-    nonce,
-    signature: Buffer.from(mac).toString('hex'),
-  };
-};