@trustchex/react-native-sdk 1.500.1 → 1.501.0

package/src/Shared/Components/EIDScanner.tsx

@@ -20,7 +20,11 @@ import NativeProgressBar from './NativeProgressBar';
 import type { MRZFields } from '../Types/mrzFields';
 import { buildDocumentName } from '../Libs/mrzTransliteration';
 import type { DocumentName } from '../Types/documentReadResult';
-import { normalizeFromMRZInfo } from '../Libs/documentDataNormalizer';
+import {
+  normalizeFromMRZInfo,
+  normalizeFromMRZFields,
+} from '../Libs/documentDataNormalizer';
+import { compareChipToViz } from '../Libs/chipVizMatch';
 import { useTranslation } from 'react-i18next';
 import AppContext from '../Contexts/AppContext';
 import StyledButton from './StyledButton';
@@ -47,6 +51,12 @@ interface eIDScannerProps {
   dateOfBirth: string;
   dateOfExpiry: string;
   documentType?: string;
+  /**
+   * The printed/VIZ MRZ scanned by the EID step's own camera, used to verify
+   * the chip data matches the printed page (MASAK 4/C(1)(b)). Supplied directly
+   * because scannedDocument.mrzFields is only persisted after the chip read.
+   */
+  vizMrzFields?: MRZFields;
   onScanSuccess?: (
     mrzInfo: MRZFields,
     faceImage: string,
@@ -60,6 +70,7 @@ const EIDScanner = ({
   dateOfBirth,
   dateOfExpiry,
   documentType,
+  vizMrzFields,
   onScanSuccess,
   isNFCSupported,
 }: eIDScannerProps) => {
@@ -296,7 +307,8 @@ const EIDScanner = ({
             } else {
               setProgressStage(t('eidScannerScreen.completing'));
             }
-          }
+          },
+          { passiveAuth: !!appContext.currentWorkflowStep?.data?.passiveAuth }
         );
         let watchdog: ReturnType<typeof setTimeout> | undefined;
         const watchdogPromise = new Promise<never>((_, reject) => {
@@ -332,21 +344,63 @@ const EIDScanner = ({
             passportData.dg11FirstName,
             passportData.dg11LastName
           );
+          // MASAK Tebliğ No. 32 Article 4/C(1)(b): the chip identity data must
+          // match the data printed on the passport. The printed/VIZ MRZ is the
+          // camera scan the EID step itself runs to obtain the BAC/PACE key,
+          // passed in as vizMrzFields (scannedDocument.mrzFields is only
+          // persisted AFTER the chip read, so it can't be used here). Fall back
+          // to a prior standalone OCR step's result (lastDocumentRead) if no
+          // vizMrzFields was supplied. Compare on raw MRZ ASCII names (builtName
+          // carries them before the display overwrite below) to avoid false
+          // mismatches from transliteration. The verdict is advisory on the
+          // client; the server re-derives the authoritative one.
+          const priorViz = appContext.lastDocumentRead;
+          const vizDocument = vizMrzFields
+            ? normalizeFromMRZFields(vizMrzFields)
+            : priorViz?.document;
+          const vizName = vizMrzFields
+            ? { first: vizDocument!.firstName, last: vizDocument!.lastName }
+            : priorViz
+              ? { first: priorViz.name.rawFirst, last: priorViz.name.rawLast }
+              : undefined;
+          const chipVizMatch = compareChipToViz(documentData, vizDocument, {
+            chipName: { first: builtName.rawFirst, last: builtName.rawLast },
+            vizName,
+          });
+
           const documentReadResult = {
             document: {
               ...documentData,
               firstName: builtName.displayFirst,
               lastName: builtName.displayLast,
+              // Address from DG11 where the chip provides it (e.g. Turkish eID);
+              // null for most passports. Pre-fills the address step (4/C(1)(d)).
+              address: passportData.dg11Address ?? null,
             },
             name: builtName,
             face: {
               data: passportData.faceImage,
               mimeType: passportData.mimeType,
             },
+            chipVizMatch,
+            passiveAuth: passportData.passiveAuth
+              ? {
+                  integrityStatus:
+                    passportData.passiveAuth.integrity?.status ?? null,
+                  sodBase64: passportData.passiveAuth.sodBase64,
+                  error: passportData.passiveAuth.error,
+                }
+              : undefined,
           };
           appContext.setLastDocumentRead?.(documentReadResult);
           appContext.onDocumentRead?.(documentReadResult);
 
+          // MASAK 4/C(1)(b): the chip↔VIZ verdict is computed and sent to the
+          // backend (via the document upload), which is the authoritative gate —
+          // the verification engine rejects on a non-MATCH when the step enforces
+          // it. The client neither blocks nor shows anything to the user; the
+          // check is invisible on-device by design.
+
           if (appContext.skipNfcResultScreen && onScanSuccess) {
             onScanSuccess(
               getFieldsFromMRZ(passportData.mrz, builtName),
@@ -775,6 +829,19 @@ const EIDScanner = ({
                           label: t('eidScannerScreen.personalNumber'),
                           value: personalNumber,
                         },
+                        // MASAK 4/C(1)(d): address from the chip's DG11, when present.
+                        {
+                          label: t('eidScannerScreen.address'),
+                          value:
+                            appContext.lastDocumentRead?.document.address ?? '',
+                        },
+                        // MASAK 4/C(1)(e): coarse device geolocation, when collected.
+                        {
+                          label: t('eidScannerScreen.location'),
+                          value:
+                            appContext.identificationInfo?.consent
+                              ?.geolocation ?? '',
+                        },
                       ];
 
                       return fields

package/src/Shared/Components/NavigationManager.tsx

@@ -53,6 +53,7 @@ const NavigationManager = forwardRef(
         LIVENESS_CHECK: 'LivenessDetectionScreen',
         VERBAL_CONSENT: 'VerbalConsentScreen',
         VIDEO_CALL: 'VideoCallScreen',
+        ADDRESS_CAPTURE: 'AddressCaptureScreen',
       },
       RESULT: 'ResultScreen',
     };
@@ -146,6 +147,10 @@ const NavigationManager = forwardRef(
           return routes.DYNAMIC_ROUTES.VERBAL_CONSENT;
         }
 
+        if (nextStep.type === 'ADDRESS_CAPTURE') {
+          return routes.DYNAMIC_ROUTES.ADDRESS_CAPTURE;
+        }
+
         return routes.VERIFICATION_SESSION_CHECK;
       },
       [
@@ -158,6 +163,7 @@ const NavigationManager = forwardRef(
         routes.DYNAMIC_ROUTES.LIVENESS_CHECK,
         routes.DYNAMIC_ROUTES.VIDEO_CALL,
         routes.DYNAMIC_ROUTES.VERBAL_CONSENT,
+        routes.DYNAMIC_ROUTES.ADDRESS_CAPTURE,
       ]
     );
 

package/src/Shared/EIDReader/eidReader.ts

@@ -6,6 +6,8 @@ import { isPACEUnsupportedError } from './protocol/paceErrors';
 import { DG1File } from './lds/icao/dg1File';
 import { DG2File } from './lds/icao/dg2File';
 import { DG11File } from './lds/icao/dg11File';
+import { parseSod } from './passiveAuth/sodParser';
+import { checkIntegrity } from './passiveAuth/integrity';
 import { FaceImageInfo } from './lds/iso19794/faceImageInfo';
 import { Buffer } from 'buffer';
 import { MRZInfo } from './lds/icao/mrzInfo';
@@ -407,7 +409,8 @@ const eidReader = async (
   documentNumber: string,
   dateOfBirth: string,
   dateOfExpiry: string,
-  progressCallback?: (progress: number) => void
+  progressCallback?: (progress: number) => void,
+  options?: { passiveAuth?: boolean }
 ): Promise<
   | {
       mrz?: MRZInfo;
@@ -415,6 +418,17 @@ const eidReader = async (
       mimeType: string;
       dg11FirstName: string | null;
       dg11LastName: string | null;
+      dg11Address: string | null;
+      /**
+       * Passive Authentication result (ICAO 9303-11 §5.1), present only when
+       * options.passiveAuth was set. `integrity` is the on-device DG-hash check;
+       * `sodBase64` is the raw EF.SOD for server-side signature + CSCA chaining.
+       */
+      passiveAuth?: {
+        integrity: import('./passiveAuth/integrity').IntegrityReport | null;
+        sodBase64: string | null;
+        error?: string;
+      };
     }
   | undefined
 > => {
@@ -704,9 +718,10 @@ const eidReader = async (
       progressCallback(progress);
     }
 
-    // Read DG11 (Additional Personal Data — printed name in UTF-8, optional)
+    // Read DG11 (Additional Personal Data — printed name + address in UTF-8, optional)
     let dg11FirstName: string | null = null;
     let dg11LastName: string | null = null;
+    let dg11Address: string | null = null;
     try {
       const dg11InputStream = passportService.getInputStream(
         EIDService.EF_DG11
@@ -716,6 +731,7 @@ const eidReader = async (
       await dg11File.read();
       dg11FirstName = dg11File.getFirstName();
       dg11LastName = dg11File.getLastName();
+      dg11Address = dg11File.getAddress();
     } catch {
       // DG11 is optional — not all chips have it, and access may be denied
     }
@@ -771,6 +787,61 @@ const eidReader = async (
       mimeType = converted.mimeType;
     }
 
+    // Passive Authentication (ICAO 9303-11 §5.1) — opt-in. Read EF.SOD and the
+    // exact wire bytes of DG1/DG2 (via fresh streams so the parse flow above is
+    // untouched), recompute hashes on-device, and capture the raw SOD for
+    // server-side signature + CSCA chaining. Fully wrapped: any failure here
+    // leaves the read result intact (PA is reported as unavailable, not fatal).
+    let passiveAuth:
+      | {
+          integrity: ReturnType<typeof checkIntegrity> | null;
+          sodBase64: string | null;
+          error?: string;
+        }
+      | undefined;
+    if (options?.passiveAuth) {
+      // The PA SOD/DG re-reads must NOT drive the visible progress bar — clear
+      // the DG2 byte-progress listener (else progress jumps backward to ~30–60
+      // during the small re-reads), and hold the bar at 95 for the PA pass.
+      InputStream.clearListeners();
+      progress = 95;
+      if (progressCallback) {
+        progressCallback(progress);
+      }
+      try {
+        const sodStream = passportService.getInputStream(EIDService.EF_SOD);
+        await sodStream.init();
+        const sodBytes = await sodStream.readAllBytes();
+
+        const rawDg: Record<number, Uint8Array> = {};
+        for (const [dgNum, fid] of [
+          [1, EIDService.EF_DG1],
+          [2, EIDService.EF_DG2],
+        ] as const) {
+          try {
+            const s = passportService.getInputStream(fid);
+            await s.init();
+            rawDg[dgNum] = await s.readAllBytes();
+          } catch {
+            // DG re-read failed — it simply won't be integrity-checked.
+          }
+        }
+
+        const sod = parseSod(sodBytes);
+        passiveAuth = {
+          integrity: checkIntegrity(sod, rawDg),
+          sodBase64: Buffer.from(sodBytes).toString('base64'),
+        };
+      } catch (paError) {
+        passiveAuth = {
+          integrity: null,
+          sodBase64: null,
+          error:
+            paError instanceof Error ? paError.message : 'passive auth failed',
+        };
+      }
+    }
+
     progress = 100;
     if (progressCallback) {
       progressCallback(progress);
@@ -783,6 +854,8 @@ const eidReader = async (
       mimeType: mimeType,
       dg11FirstName,
       dg11LastName,
+      dg11Address,
+      passiveAuth,
     };
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);

package/src/Shared/EIDReader/java/inputStream.ts

@@ -183,4 +183,10 @@ export abstract class InputStream {
   ) {
     InputStream.listeners.push(listener);
   }
+
+  /** Remove all progress listeners (e.g. before post-read passes that must not
+   *  drive the visible progress bar, like the Passive Auth SOD/DG re-reads). */
+  static clearListeners() {
+    InputStream.listeners = [];
+  }
 }

package/src/Shared/EIDReader/lds/icao/dg11File.ts

@@ -6,22 +6,27 @@ import { DataGroup } from '../dataGroup';
 /**
  * DG11 — Additional Personal Data (ICAO 9303-10 §4.6.6).
  *
- * We only extract tag 0x5F0E (Name of Holder), which contains the full name
- * exactly as printed on the document, in UTF-8, using the same `<<` primary/
- * secondary delimiter as the MRZ (but with native Unicode characters).
+ * We extract:
+ *  - tag 0x5F0E (Name of Holder) — full name as printed, UTF-8, `<<` primary/
+ *    secondary delimiter like the MRZ but with native Unicode.
+ *    Example: "ÖZTÜRK<<GÖKHAN MEHMET" → lastName="ÖZTÜRK", firstName="GÖKHAN MEHMET"
+ *  - tag 0x5F42 (Permanent Address) — the holder's address as printed/stored,
+ *    free-form, components delimited by `<` (used for MASAK 4/C(1)(d) address
+ *    pre-fill where the chip provides it; e.g. Turkish eID).
  *
- * Example: "ÖZTÜRK<<GÖKHAN MEHMET" → lastName="ÖZTÜRK", firstName="GÖKHAN MEHMET"
- *
- * The file is optional on the chip — if absent or unreadable we return null
- * so the caller can fall back to reverse transliteration.
+ * Every field is optional on the chip — absent fields stay null so the caller
+ * can fall back (reverse transliteration for the name, manual entry for the
+ * address).
  */
 export class DG11File extends DataGroup {
   private static readonly DG11_TAG = 0x6b;
   private static readonly TAG_LIST_TAG = 0x5c;
   private static readonly NAME_OF_HOLDER_TAG = 0x5f0e;
+  private static readonly PERMANENT_ADDRESS_TAG = 0x5f42;
 
   private firstName: string | null = null;
   private lastName: string | null = null;
+  private address: string | null = null;
 
   constructor(is?: InputStream) {
     super(DG11File.DG11_TAG, is);
@@ -37,6 +42,11 @@ export class DG11File extends DataGroup {
     return this.lastName;
   }
 
+  /** Returns the permanent address from DG11, or null if not present. */
+  getAddress(): string | null {
+    return this.address;
+  }
+
   async read(): Promise<void> {
     await super.readObject();
   }
@@ -47,23 +57,59 @@ export class DG11File extends DataGroup {
         ? inputStream
         : new TLVInputStream(inputStream);
 
-    // Skip the tag list (0x5C) — we only care about 0x5F0E
-    // The tag list tells us which optional tags are present; we probe directly.
-    try {
-      await tlvIn.skipToTag(DG11File.NAME_OF_HOLDER_TAG);
-    } catch {
-      // Tag not present in this chip's DG11
-      return;
+    // Iterate the DG11 TLV structure once, capturing the tags we care about and
+    // skipping the rest (incl. the 0x5C tag list). A single forward scan handles
+    // any field ordering and lets us read name AND address in one pass.
+    while (true) {
+      let tag: number;
+      try {
+        tag = await tlvIn.readTag();
+      } catch {
+        break; // end of data
+      }
+      if (tag < 0) break;
+
+      let length: number;
+      try {
+        length = await tlvIn.readLength();
+      } catch {
+        break;
+      }
+
+      if (
+        (tag === DG11File.NAME_OF_HOLDER_TAG ||
+          tag === DG11File.PERMANENT_ADDRESS_TAG) &&
+        length > 0
+      ) {
+        // readValue keeps the TLV stream's value-byte accounting in sync so the
+        // next readTag starts cleanly — important now that we read multiple tags.
+        const value = await tlvIn.readValue();
+        const text = Buffer.from(Uint8Array.from(value)).toString('utf8');
+        if (tag === DG11File.NAME_OF_HOLDER_TAG) {
+          this.parseName(text.trim());
+        } else {
+          this.address = this.parseAddress(text);
+        }
+      } else if (length > 0) {
+        // Tag we don't use (incl. the 0x5C tag list) — skip its value.
+        await tlvIn.skip(length);
+      }
     }
+  }
 
-    const length = await tlvIn.readLength();
-    if (length <= 0) return;
-
-    const bytes = new Uint8Array(length);
-    await inputStream.readBytesWithOffset(bytes, 0, length);
-
-    const nameString = Buffer.from(bytes).toString('utf8').trim();
-    this.parseName(nameString);
+  /**
+   * Normalize a DG11 permanent-address value. Components are delimited by `<`
+   * (single = field separator, double = stronger break); convert to a single
+   * comma-separated line, dropping filler.
+   */
+  private parseAddress(raw: string): string | null {
+    const cleaned = raw
+      .replace(/<{2,}/g, '<') // collapse multi-filler to one separator
+      .split('<')
+      .map((part) => part.trim())
+      .filter((part) => part.length > 0);
+    if (cleaned.length === 0) return null;
+    return cleaned.join(', ');
   }
 
   protected writeContent(): void {

package/src/Shared/EIDReader/passiveAuth/der.ts

@@ -0,0 +1,110 @@
+/**
+ * Minimal DER (ASN.1) reader for Passive Authentication parsing (ICAO 9303-11
+ * §5.1). Purpose-built and dependency-free so the EF.SOD / LDSSecurityObject
+ * parse is fully unit-testable offline. Only the constructs PA needs are
+ * supported: SEQUENCE, SET, INTEGER, OCTET STRING, OID, and tagged wrappers.
+ */
+
+export interface DerNode {
+  /** Raw first tag byte (class + constructed bit + number for low tags). */
+  tag: number;
+  /** Tag number with class/constructed bits masked off (low-tag form only). */
+  tagNumber: number;
+  /** True if the constructed bit (0x20) is set. */
+  constructed: boolean;
+  /** Value bytes (content octets), excluding tag and length. */
+  content: Uint8Array;
+  /** Offset of this node's first tag byte within the parent buffer. */
+  start: number;
+  /** Offset just past this node's content (start of the next sibling). */
+  end: number;
+}
+
+/** Read the TLV node starting at `offset` in `buf`. */
+export function readNode(buf: Uint8Array, offset: number): DerNode {
+  const start = offset;
+  let i = offset;
+  if (i >= buf.length) throw new Error('DER: unexpected end of input (tag)');
+
+  const tag = buf[i++];
+  // High-tag-number form (tag & 0x1f === 0x1f) — consume continuation bytes.
+  let tagNumber = tag & 0x1f;
+  if (tagNumber === 0x1f) {
+    tagNumber = 0;
+    let b: number;
+    do {
+      if (i >= buf.length) throw new Error('DER: unexpected end of input (tag#)');
+      b = buf[i++];
+      tagNumber = (tagNumber << 7) | (b & 0x7f);
+    } while ((b & 0x80) === 0x80);
+  }
+
+  if (i >= buf.length) throw new Error('DER: unexpected end of input (length)');
+  let length = buf[i++];
+  if (length & 0x80) {
+    const numBytes = length & 0x7f;
+    if (numBytes === 0) throw new Error('DER: indefinite length not supported');
+    length = 0;
+    for (let n = 0; n < numBytes; n++) {
+      if (i >= buf.length) throw new Error('DER: unexpected end of input (len bytes)');
+      length = (length << 8) | buf[i++];
+    }
+  }
+
+  const contentStart = i;
+  const end = contentStart + length;
+  if (end > buf.length) throw new Error('DER: content exceeds buffer');
+
+  return {
+    tag,
+    tagNumber,
+    constructed: (tag & 0x20) === 0x20,
+    content: buf.subarray(contentStart, end),
+    start,
+    end,
+  };
+}
+
+/** Read all immediate child TLVs of a constructed node's content. */
+export function readChildren(content: Uint8Array): DerNode[] {
+  const out: DerNode[] = [];
+  let offset = 0;
+  while (offset < content.length) {
+    const node = readNode(content, offset);
+    out.push(node);
+    offset = node.end;
+  }
+  return out;
+}
+
+/** Decode an OID node's content to dotted-decimal string. */
+export function decodeOid(content: Uint8Array): string {
+  if (content.length === 0) return '';
+  const parts: number[] = [];
+  const first = content[0];
+  parts.push(Math.floor(first / 40), first % 40);
+  let value = 0;
+  for (let i = 1; i < content.length; i++) {
+    const b = content[i];
+    value = (value << 7) | (b & 0x7f);
+    if ((b & 0x80) === 0) {
+      parts.push(value);
+      value = 0;
+    }
+  }
+  return parts.join('.');
+}
+
+/** Decode an INTEGER node's content to a JS number (small values only). */
+export function decodeInteger(content: Uint8Array): number {
+  let value = 0;
+  for (const b of content) value = value * 256 + b;
+  return value;
+}
+
+/** Lowercase hex string for a byte array. */
+export function toHex(bytes: Uint8Array): string {
+  let s = '';
+  for (const b of bytes) s += b.toString(16).padStart(2, '0');
+  return s;
+}

package/src/Shared/EIDReader/passiveAuth/integrity.ts

@@ -0,0 +1,97 @@
+import { sha1 } from '@noble/hashes/sha1';
+import { sha256, sha224 } from '@noble/hashes/sha256';
+import { sha512, sha384 } from '@noble/hashes/sha512';
+import { toHex } from './der';
+import type { SodSecurityObject } from './sodParser';
+
+/**
+ * On-device Passive Authentication integrity check (ICAO 9303-11 §5.1, step 3).
+ * Recompute the hash of each raw data-group the chip returned and compare it to
+ * the hash the issuer signed into EF.SOD. A mismatch means the data was altered
+ * after signing → TAMPERED. This runs offline, with no trust store; SOD
+ * signature + CSCA chaining is verified server-side.
+ */
+
+export type IntegrityStatus = 'MATCH' | 'TAMPERED' | 'INCOMPLETE';
+
+export interface DgIntegrityResult {
+  dataGroup: number;
+  expectedHash: string;
+  actualHash: string;
+  matched: boolean;
+}
+
+export interface IntegrityReport {
+  status: IntegrityStatus;
+  digestAlgorithm: string;
+  /** Per-DG comparison for the data groups we actually read. */
+  results: DgIntegrityResult[];
+  /** DG numbers present in the SOD that we did not read (cannot verify). */
+  unverified: number[];
+}
+
+function digest(algorithm: string, data: Uint8Array): Uint8Array {
+  switch (algorithm) {
+    case 'SHA-1':
+      return sha1(data);
+    case 'SHA-224':
+      return sha224(data);
+    case 'SHA-256':
+      return sha256(data);
+    case 'SHA-384':
+      return sha384(data);
+    case 'SHA-512':
+      return sha512(data);
+    default:
+      throw new Error(`Unsupported digest algorithm: ${algorithm}`);
+  }
+}
+
+/**
+ * Compare the raw bytes of each read data group against the SOD's hash list.
+ *
+ * @param sod          parsed LDSSecurityObject (digest alg + per-DG hashes)
+ * @param rawDataGroups map of DG number → exact wire bytes read from the chip
+ */
+export function checkIntegrity(
+  sod: SodSecurityObject,
+  rawDataGroups: Record<number, Uint8Array>
+): IntegrityReport {
+  const results: DgIntegrityResult[] = [];
+
+  for (const [dgStr, bytes] of Object.entries(rawDataGroups)) {
+    const dg = Number(dgStr);
+    const expectedHash = sod.dataGroupHashes[dg];
+    if (!expectedHash) continue; // DG not listed in SOD — nothing to compare
+    const actualHash = toHex(digest(sod.digestAlgorithm, bytes));
+    results.push({
+      dataGroup: dg,
+      expectedHash: expectedHash.toLowerCase(),
+      actualHash,
+      matched: actualHash === expectedHash.toLowerCase(),
+    });
+  }
+
+  // DG hashes present in the SOD that we did not read → cannot verify those.
+  const readDgs = new Set(Object.keys(rawDataGroups).map(Number));
+  const unverified = Object.keys(sod.dataGroupHashes)
+    .map(Number)
+    .filter((dg) => !readDgs.has(dg))
+    .sort((a, b) => a - b);
+
+  let status: IntegrityStatus;
+  if (results.some((r) => !r.matched)) {
+    status = 'TAMPERED';
+  } else if (results.length === 0) {
+    status = 'INCOMPLETE';
+  } else {
+    status = 'MATCH';
+  }
+
+  return {
+    status,
+    digestAlgorithm: sod.digestAlgorithm,
+    results,
+    unverified,
+  };
+}