@trustchex/react-native-sdk 1.500.2 → 1.501.1

package/lib/module/Screens/Dynamic/IdentityDocumentScanningScreen.js

@@ -2,6 +2,7 @@
 
 import React, { useContext, useEffect, useState } from 'react';
 import { buildDocumentName } from "../../Shared/Libs/mrzTransliteration.js";
+import { isCountryAllowed } from "../../Shared/Libs/country-allow.js";
 import { normalizeFromMRZFields } from "../../Shared/Libs/documentDataNormalizer.js";
 import { Alert, SafeAreaView, StyleSheet, View } from 'react-native';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
@@ -64,16 +65,13 @@ const IdentityDocumentScanningScreen = () => {
       appContext.identificationInfo.scannedDocument.hologramImage = idFrontSideData?.hologramImage || passportData?.hologramImage;
       appContext.identificationInfo.scannedDocument.barcodeValue = idBackSideData?.barcodeValue;
       appContext.identificationInfo.scannedDocument.documentType = mrzFields.documentCode === 'I' ? 'ID' : mrzFields.documentCode === 'P' ? 'PASSPORT' : 'UNKNOWN';
-      if (allowedCountries && allowedCountries.length > 0) {
-        const countryCode = mrzFields.issuingState;
-        if (!allowedCountries.includes(countryCode)) {
-          // Workflow validation - user's document country not in allowed list
-          // Expected behavior, not a bug
-          Alert.alert(t('general.error'), t('general.countryNotAllowed'));
-          appContext.onError?.(t('general.countryNotAllowed'));
-          navigationManagerRef.current?.reset();
-          return;
-        }
+      if (!isCountryAllowed(mrzFields.issuingState, allowedCountries)) {
+        // Workflow validation - user's document country not in allowed list
+        // Expected behavior, not a bug
+        Alert.alert(t('general.error'), t('general.countryNotAllowed'));
+        appContext.onError?.(t('general.countryNotAllowed'));
+        navigationManagerRef.current?.reset();
+        return;
       }
       if (allowedDocumentTypes && allowedDocumentTypes.length > 0) {
         const documentCode = mrzFields.documentCode;

package/lib/module/Screens/Static/ResultScreen.js

@@ -67,7 +67,9 @@ const ResultScreen = () => {
     consent: false,
     document: false,
     media: false,
-    verbalConsentVideos: false
+    verbalConsentVideos: false,
+    address: false,
+    passiveAuth: false
   });
   const [shouldShowDemoData, setShouldShowDemoData] = useState(false);
   const [deviceIdentifier, setDeviceIdentifier] = useState('');
@@ -183,11 +185,55 @@ const ResultScreen = () => {
       encryptedData,
       nonce
     } = encryptWithAes(JSON.stringify(appContext.identificationInfo.consent), sessionKey);
-    await httpClient.post(`${apiUrl}/identifications/${identificationId}/consents`, {
+    const response = await httpClient.post(`${apiUrl}/identifications/${identificationId}/consents`, {
       encryptedData,
       nonce
     });
+    // MASAK 4/C(1)(e): the server risk-evaluates the technical data and may
+    // instruct us to terminate the process. Honor it by aborting the flow.
+    if (response?.terminate) {
+      throw Object.assign(new Error('session terminated'), {
+        sessionTerminated: true,
+        terminateReason: response.reason ?? undefined
+      });
+    }
   }, [apiUrl, appContext.identificationInfo.consent]);
+
+  // MASAK 4/C(1)(d): submit the captured address. The proof document image is
+  // uploaded separately as ADDRESS_PROOF_DOCUMENT media.
+  const submitIdentificationAddress = useCallback(async (identificationId, sessionKey) => {
+    const address = appContext.identificationInfo.address;
+    if (!address?.addressText) return;
+    const {
+      encryptedData,
+      nonce
+    } = encryptWithAes(JSON.stringify({
+      addressText: address.addressText,
+      fromChip: address.fromChip
+    }), sessionKey);
+    await httpClient.post(`${apiUrl}/identifications/${identificationId}/address`, {
+      encryptedData,
+      nonce
+    });
+  }, [apiUrl, appContext.identificationInfo.address]);
+
+  // MASAK 4/C(1)(b),(c): submit EF.SOD for server-side Passive Authentication
+  // (signature + CSCA chaining). Only when the eID step ran with passiveAuth.
+  const submitPassiveAuth = useCallback(async (identificationId, sessionKey) => {
+    const sd = appContext.identificationInfo.scannedDocument;
+    if (!sd?.paSodBase64) return;
+    const {
+      encryptedData,
+      nonce
+    } = encryptWithAes(JSON.stringify({
+      sodBase64: sd.paSodBase64,
+      integrityStatus: sd.paIntegrityStatus ?? null
+    }), sessionKey);
+    await httpClient.post(`${apiUrl}/identifications/${identificationId}/passive-auth`, {
+      encryptedData,
+      nonce
+    });
+  }, [apiUrl, appContext.identificationInfo.scannedDocument]);
   const submitIdentificationDocument = useCallback(async (identificationId, scannedDocument, sessionKey) => {
     if (!scannedDocument.mrzFields) {
       throw new Error('MRZ fields not found');
@@ -204,6 +250,8 @@ const ResultScreen = () => {
       gender: getGenderEnumType(rawMrzFields.sex),
       number: rawMrzFields.documentNumber,
       country: rawMrzFields.issuingState,
+      // Raw ICAO nationality (for the MASAK 4/C(3) risky-country block).
+      nationality: rawMrzFields.nationality,
       barcodeValue: scannedDocument.barcodeValue,
       personalNumber: rawMrzFields.personalNumber || rawMrzFields.optional1,
       birthDate: mrzUtils.convertMRZDateToISODate(rawMrzFields.birthDate),
@@ -280,6 +328,12 @@ const ResultScreen = () => {
       if (hologramImage && hologramImage !== '') {
         await writeTempImage('DOCUMENT_HOLOGRAM_IMAGE.jpg', hologramImage);
       }
+
+      // MASAK 4/C(1)(d): the address proof document, when captured.
+      const addressProof = appContext.identificationInfo.address?.proofImage;
+      if (addressProof && addressProof !== '') {
+        await writeTempImage('ADDRESS_PROOF_DOCUMENT.jpg', addressProof);
+      }
       if (livenessDetection) {
         for (const instruction of livenessDetection.instructions) {
           if (instruction.photo !== '') {
@@ -419,12 +473,20 @@ const ResultScreen = () => {
         completedSteps.current.consent = true;
       }
       setProgress(30);
+      if (!completedSteps.current.address && appContext.identificationInfo.address?.addressText) {
+        await runWithRetry(() => submitIdentificationAddress(identificationId, sessionKey));
+        completedSteps.current.address = true;
+      }
       if (!alreadyUploaded) {
         const scannedIdentityDocument = identificationInfo.scannedDocument;
         if (!completedSteps.current.document && scannedIdentityDocument && scannedIdentityDocument.documentType !== 'UNKNOWN') {
           await runWithRetry(() => submitIdentificationDocument(identificationId, scannedIdentityDocument, sessionKey));
           completedSteps.current.document = true;
         }
+        if (!completedSteps.current.passiveAuth && scannedIdentityDocument?.paSodBase64) {
+          await runWithRetry(() => submitPassiveAuth(identificationId, sessionKey));
+          completedSteps.current.passiveAuth = true;
+        }
         setProgress(40);
         if (!completedSteps.current.media) {
           const livenessDetection = identificationInfo.livenessDetection;
@@ -452,6 +514,15 @@ const ResultScreen = () => {
       setIsSubmitting(false);
       setProgress(0);
 
+      // MASAK 4/C(1)(e): the server terminated the session on a risk signal.
+      // This is terminal, not recoverable — surface it and stop, with no
+      // retry affordance (re-submitting can't change the decision).
+      if (error && typeof error === 'object' && error.sessionTerminated) {
+        appContext.onError?.(t('resultScreen.sessionTerminated'));
+        setSubmitFailed(true);
+        return;
+      }
+
       // Track verification failure
       const errorMessage = error instanceof Error ? error.message : 'Unknown error';
       trackError('VERIFICATION_SUBMISSION_FAILED', errorMessage, 'result_screen', 'critical', {
@@ -471,7 +542,7 @@ const ResultScreen = () => {
       appContext.onError?.(t('resultScreen.submissionFailed'));
       setSubmitFailed(true);
     }
-  }, [createIdentification, apiUrl, uploadIdentificationMedia, uploadVerbalConsentVideos, finishIdentification, submitIdentificationDocument, submitIdentificationConsent, t, appContext]);
+  }, [createIdentification, apiUrl, uploadIdentificationMedia, uploadVerbalConsentVideos, finishIdentification, submitIdentificationDocument, submitIdentificationConsent, submitIdentificationAddress, submitPassiveAuth, t, appContext]);
   useEffect(() => {
     if (appContext.identificationInfo && !appContext.isDemoSession && !appContext.isTestVideoSession && !hasSubmittedRef.current) {
       hasSubmittedRef.current = true;

package/lib/module/Shared/Components/EIDScanner.js

@@ -11,7 +11,8 @@ import { debugError } from "../Libs/debug.utils.js";
 import { eidReader } from "../EIDReader/eidReader.js";
 import NativeProgressBar from "./NativeProgressBar.js";
 import { buildDocumentName } from "../Libs/mrzTransliteration.js";
-import { normalizeFromMRZInfo } from "../Libs/documentDataNormalizer.js";
+import { normalizeFromMRZInfo, normalizeFromMRZFields } from "../Libs/documentDataNormalizer.js";
+import { compareChipToViz } from "../Libs/chipVizMatch.js";
 import { useTranslation } from 'react-i18next';
 import AppContext from "../Contexts/AppContext.js";
 import StyledButton from "./StyledButton.js";
@@ -34,6 +35,7 @@ const EIDScanner = ({
   dateOfBirth,
   dateOfExpiry,
   documentType,
+  vizMrzFields,
   onScanSuccess,
   isNFCSupported
 }) => {
@@ -216,6 +218,8 @@ const EIDScanner = ({
           } else {
             setProgressStage(t('eidScannerScreen.completing'));
           }
+        }, {
+          passiveAuth: !!appContext.currentWorkflowStep?.data?.passiveAuth
         });
         let watchdog;
         const watchdogPromise = new Promise((_, reject) => {
@@ -243,20 +247,62 @@ const EIDScanner = ({
           const scanDuration = Date.now() - startTime;
           const documentData = normalizeFromMRZInfo(passportData.mrz);
           const builtName = buildDocumentName(documentData.firstName, documentData.lastName, documentData.issuingCountry, passportData.dg11FirstName, passportData.dg11LastName);
+          // MASAK Tebliğ No. 32 Article 4/C(1)(b): the chip identity data must
+          // match the data printed on the passport. The printed/VIZ MRZ is the
+          // camera scan the EID step itself runs to obtain the BAC/PACE key,
+          // passed in as vizMrzFields (scannedDocument.mrzFields is only
+          // persisted AFTER the chip read, so it can't be used here). Fall back
+          // to a prior standalone OCR step's result (lastDocumentRead) if no
+          // vizMrzFields was supplied. Compare on raw MRZ ASCII names (builtName
+          // carries them before the display overwrite below) to avoid false
+          // mismatches from transliteration. The verdict is advisory on the
+          // client; the server re-derives the authoritative one.
+          const priorViz = appContext.lastDocumentRead;
+          const vizDocument = vizMrzFields ? normalizeFromMRZFields(vizMrzFields) : priorViz?.document;
+          const vizName = vizMrzFields ? {
+            first: vizDocument.firstName,
+            last: vizDocument.lastName
+          } : priorViz ? {
+            first: priorViz.name.rawFirst,
+            last: priorViz.name.rawLast
+          } : undefined;
+          const chipVizMatch = compareChipToViz(documentData, vizDocument, {
+            chipName: {
+              first: builtName.rawFirst,
+              last: builtName.rawLast
+            },
+            vizName
+          });
           const documentReadResult = {
             document: {
               ...documentData,
               firstName: builtName.displayFirst,
-              lastName: builtName.displayLast
+              lastName: builtName.displayLast,
+              // Address from DG11 where the chip provides it (e.g. Turkish eID);
+              // null for most passports. Pre-fills the address step (4/C(1)(d)).
+              address: passportData.dg11Address ?? null
             },
             name: builtName,
             face: {
               data: passportData.faceImage,
               mimeType: passportData.mimeType
-            }
+            },
+            chipVizMatch,
+            passiveAuth: passportData.passiveAuth ? {
+              integrityStatus: passportData.passiveAuth.integrity?.status ?? null,
+              sodBase64: passportData.passiveAuth.sodBase64,
+              error: passportData.passiveAuth.error
+            } : undefined
           };
           appContext.setLastDocumentRead?.(documentReadResult);
           appContext.onDocumentRead?.(documentReadResult);
+
+          // MASAK 4/C(1)(b): the chip↔VIZ verdict is computed and sent to the
+          // backend (via the document upload), which is the authoritative gate —
+          // the verification engine rejects on a non-MATCH when the step enforces
+          // it. The client neither blocks nor shows anything to the user; the
+          // check is invisible on-device by design.
+
           if (appContext.skipNfcResultScreen && onScanSuccess) {
             onScanSuccess(getFieldsFromMRZ(passportData.mrz, builtName), passportData.faceImage, passportData.mimeType);
           } else {
@@ -549,6 +595,16 @@ const EIDScanner = ({
                 }, {
                   label: t('eidScannerScreen.personalNumber'),
                   value: personalNumber
+                },
+                // MASAK 4/C(1)(d): address from the chip's DG11, when present.
+                {
+                  label: t('eidScannerScreen.address'),
+                  value: appContext.lastDocumentRead?.document.address ?? ''
+                },
+                // MASAK 4/C(1)(e): coarse device geolocation, when collected.
+                {
+                  label: t('eidScannerScreen.location'),
+                  value: appContext.identificationInfo?.consent?.geolocation ?? ''
                 }];
                 return fields.filter(f => f.value && f.value.trim().length > 0).map(f => /*#__PURE__*/_jsx(IDCardField, {
                   label: f.label,

package/lib/module/Shared/Components/NavigationManager.js

@@ -38,7 +38,8 @@ const NavigationManager = /*#__PURE__*/forwardRef(({
       IDENTITY_DOCUMENT_EID_SCAN: 'IdentityDocumentEIDScanningScreen',
       LIVENESS_CHECK: 'LivenessDetectionScreen',
       VERBAL_CONSENT: 'VerbalConsentScreen',
-      VIDEO_CALL: 'VideoCallScreen'
+      VIDEO_CALL: 'VideoCallScreen',
+      ADDRESS_CAPTURE: 'AddressCaptureScreen'
     },
     RESULT: 'ResultScreen'
   };
@@ -104,8 +105,11 @@ const NavigationManager = /*#__PURE__*/forwardRef(({
     if (nextStep.type === 'VERBAL_CONSENT') {
       return routes.DYNAMIC_ROUTES.VERBAL_CONSENT;
     }
+    if (nextStep.type === 'ADDRESS_CAPTURE') {
+      return routes.DYNAMIC_ROUTES.ADDRESS_CAPTURE;
+    }
     return routes.VERIFICATION_SESSION_CHECK;
-  }, [appContext, routes.VERIFICATION_SESSION_CHECK, routes.RESULT, routes.DYNAMIC_ROUTES.CONTRACT_ACCEPTANCE, routes.DYNAMIC_ROUTES.IDENTITY_DOCUMENT_SCAN, routes.DYNAMIC_ROUTES.IDENTITY_DOCUMENT_EID_SCAN, routes.DYNAMIC_ROUTES.LIVENESS_CHECK, routes.DYNAMIC_ROUTES.VIDEO_CALL, routes.DYNAMIC_ROUTES.VERBAL_CONSENT]);
+  }, [appContext, routes.VERIFICATION_SESSION_CHECK, routes.RESULT, routes.DYNAMIC_ROUTES.CONTRACT_ACCEPTANCE, routes.DYNAMIC_ROUTES.IDENTITY_DOCUMENT_SCAN, routes.DYNAMIC_ROUTES.IDENTITY_DOCUMENT_EID_SCAN, routes.DYNAMIC_ROUTES.LIVENESS_CHECK, routes.DYNAMIC_ROUTES.VIDEO_CALL, routes.DYNAMIC_ROUTES.VERBAL_CONSENT, routes.DYNAMIC_ROUTES.ADDRESS_CAPTURE]);
   const goToNextRoute = useCallback((outcome = 'success') => {
     const currentTime = Date.now();
     const minTimeBetweenNavigation = 1000;

package/lib/module/Shared/EIDReader/eidReader.js

@@ -8,6 +8,8 @@ import { isPACEUnsupportedError } from "./protocol/paceErrors.js";
 import { DG1File } from "./lds/icao/dg1File.js";
 import { DG2File } from "./lds/icao/dg2File.js";
 import { DG11File } from "./lds/icao/dg11File.js";
+import { parseSod } from "./passiveAuth/sodParser.js";
+import { checkIntegrity } from "./passiveAuth/integrity.js";
 import { Buffer } from 'buffer';
 import { InputStream } from "./java/inputStream.js";
 import { debugLog } from "../Libs/debug.utils.js";
@@ -376,7 +378,7 @@ function decodeOID(bytes) {
   }
   return components.join('.');
 }
-const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCallback) => {
+const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCallback, options) => {
   let progress = 0;
   const nfcManagerCardService = new NFCManagerCardService();
   const passportService = new EIDService(nfcManagerCardService, EIDService.NORMAL_MAX_TRANSCEIVE_LENGTH, EIDService.DEFAULT_MAX_BLOCKSIZE, false, true);
@@ -607,9 +609,10 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       progressCallback(progress);
     }
 
-    // Read DG11 (Additional Personal Data — printed name in UTF-8, optional)
+    // Read DG11 (Additional Personal Data — printed name + address in UTF-8, optional)
     let dg11FirstName = null;
     let dg11LastName = null;
+    let dg11Address = null;
     try {
       const dg11InputStream = passportService.getInputStream(EIDService.EF_DG11);
       await dg11InputStream.init();
@@ -617,6 +620,7 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       await dg11File.read();
       dg11FirstName = dg11File.getFirstName();
       dg11LastName = dg11File.getLastName();
+      dg11Address = dg11File.getAddress();
     } catch {
       // DG11 is optional — not all chips have it, and access may be denied
     }
@@ -670,6 +674,49 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       imageAsBase64 = converted.base64;
       mimeType = converted.mimeType;
     }
+
+    // Passive Authentication (ICAO 9303-11 §5.1) — opt-in. Read EF.SOD and the
+    // exact wire bytes of DG1/DG2 (via fresh streams so the parse flow above is
+    // untouched), recompute hashes on-device, and capture the raw SOD for
+    // server-side signature + CSCA chaining. Fully wrapped: any failure here
+    // leaves the read result intact (PA is reported as unavailable, not fatal).
+    let passiveAuth;
+    if (options?.passiveAuth) {
+      // The PA SOD/DG re-reads must NOT drive the visible progress bar — clear
+      // the DG2 byte-progress listener (else progress jumps backward to ~30–60
+      // during the small re-reads), and hold the bar at 95 for the PA pass.
+      InputStream.clearListeners();
+      progress = 95;
+      if (progressCallback) {
+        progressCallback(progress);
+      }
+      try {
+        const sodStream = passportService.getInputStream(EIDService.EF_SOD);
+        await sodStream.init();
+        const sodBytes = await sodStream.readAllBytes();
+        const rawDg = {};
+        for (const [dgNum, fid] of [[1, EIDService.EF_DG1], [2, EIDService.EF_DG2]]) {
+          try {
+            const s = passportService.getInputStream(fid);
+            await s.init();
+            rawDg[dgNum] = await s.readAllBytes();
+          } catch {
+            // DG re-read failed — it simply won't be integrity-checked.
+          }
+        }
+        const sod = parseSod(sodBytes);
+        passiveAuth = {
+          integrity: checkIntegrity(sod, rawDg),
+          sodBase64: Buffer.from(sodBytes).toString('base64')
+        };
+      } catch (paError) {
+        passiveAuth = {
+          integrity: null,
+          sodBase64: null,
+          error: paError instanceof Error ? paError.message : 'passive auth failed'
+        };
+      }
+    }
     progress = 100;
     if (progressCallback) {
       progressCallback(progress);
@@ -680,7 +727,9 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       faceImage: imageAsBase64,
       mimeType: mimeType,
       dg11FirstName,
-      dg11LastName
+      dg11LastName,
+      dg11Address,
+      passiveAuth
     };
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);

package/lib/module/Shared/EIDReader/java/inputStream.js

@@ -136,4 +136,10 @@ export class InputStream {
   static onRead(listener) {
     InputStream.listeners.push(listener);
   }
+
+  /** Remove all progress listeners (e.g. before post-read passes that must not
+   *  drive the visible progress bar, like the Passive Auth SOD/DG re-reads). */
+  static clearListeners() {
+    InputStream.listeners = [];
+  }
 }

package/lib/module/Shared/EIDReader/lds/icao/dg11File.js

@@ -7,21 +7,26 @@ import { DataGroup } from "../dataGroup.js";
 /**
  * DG11 — Additional Personal Data (ICAO 9303-10 §4.6.6).
  *
- * We only extract tag 0x5F0E (Name of Holder), which contains the full name
- * exactly as printed on the document, in UTF-8, using the same `<<` primary/
- * secondary delimiter as the MRZ (but with native Unicode characters).
+ * We extract:
+ *  - tag 0x5F0E (Name of Holder) — full name as printed, UTF-8, `<<` primary/
+ *    secondary delimiter like the MRZ but with native Unicode.
+ *    Example: "ÖZTÜRK<<GÖKHAN MEHMET" → lastName="ÖZTÜRK", firstName="GÖKHAN MEHMET"
+ *  - tag 0x5F42 (Permanent Address) — the holder's address as printed/stored,
+ *    free-form, components delimited by `<` (used for MASAK 4/C(1)(d) address
+ *    pre-fill where the chip provides it; e.g. Turkish eID).
  *
- * Example: "ÖZTÜRK<<GÖKHAN MEHMET" → lastName="ÖZTÜRK", firstName="GÖKHAN MEHMET"
- *
- * The file is optional on the chip — if absent or unreadable we return null
- * so the caller can fall back to reverse transliteration.
+ * Every field is optional on the chip — absent fields stay null so the caller
+ * can fall back (reverse transliteration for the name, manual entry for the
+ * address).
  */
 export class DG11File extends DataGroup {
   static DG11_TAG = 0x6b;
   static TAG_LIST_TAG = 0x5c;
   static NAME_OF_HOLDER_TAG = 0x5f0e;
+  static PERMANENT_ADDRESS_TAG = 0x5f42;
   firstName = null;
   lastName = null;
+  address = null;
   constructor(is) {
     super(DG11File.DG11_TAG, is);
   }
@@ -35,26 +40,61 @@ export class DG11File extends DataGroup {
   getLastName() {
     return this.lastName;
   }
+
+  /** Returns the permanent address from DG11, or null if not present. */
+  getAddress() {
+    return this.address;
+  }
   async read() {
     await super.readObject();
   }
   async readContent(inputStream) {
     const tlvIn = inputStream instanceof TLVInputStream ? inputStream : new TLVInputStream(inputStream);
 
-    // Skip the tag list (0x5C) — we only care about 0x5F0E
-    // The tag list tells us which optional tags are present; we probe directly.
-    try {
-      await tlvIn.skipToTag(DG11File.NAME_OF_HOLDER_TAG);
-    } catch {
-      // Tag not present in this chip's DG11
-      return;
+    // Iterate the DG11 TLV structure once, capturing the tags we care about and
+    // skipping the rest (incl. the 0x5C tag list). A single forward scan handles
+    // any field ordering and lets us read name AND address in one pass.
+    while (true) {
+      let tag;
+      try {
+        tag = await tlvIn.readTag();
+      } catch {
+        break; // end of data
+      }
+      if (tag < 0) break;
+      let length;
+      try {
+        length = await tlvIn.readLength();
+      } catch {
+        break;
+      }
+      if ((tag === DG11File.NAME_OF_HOLDER_TAG || tag === DG11File.PERMANENT_ADDRESS_TAG) && length > 0) {
+        // readValue keeps the TLV stream's value-byte accounting in sync so the
+        // next readTag starts cleanly — important now that we read multiple tags.
+        const value = await tlvIn.readValue();
+        const text = Buffer.from(Uint8Array.from(value)).toString('utf8');
+        if (tag === DG11File.NAME_OF_HOLDER_TAG) {
+          this.parseName(text.trim());
+        } else {
+          this.address = this.parseAddress(text);
+        }
+      } else if (length > 0) {
+        // Tag we don't use (incl. the 0x5C tag list) — skip its value.
+        await tlvIn.skip(length);
+      }
     }
-    const length = await tlvIn.readLength();
-    if (length <= 0) return;
-    const bytes = new Uint8Array(length);
-    await inputStream.readBytesWithOffset(bytes, 0, length);
-    const nameString = Buffer.from(bytes).toString('utf8').trim();
-    this.parseName(nameString);
+  }
+
+  /**
+   * Normalize a DG11 permanent-address value. Components are delimited by `<`
+   * (single = field separator, double = stronger break); convert to a single
+   * comma-separated line, dropping filler.
+   */
+  parseAddress(raw) {
+    const cleaned = raw.replace(/<{2,}/g, '<') // collapse multi-filler to one separator
+    .split('<').map(part => part.trim()).filter(part => part.length > 0);
+    if (cleaned.length === 0) return null;
+    return cleaned.join(', ');
   }
   writeContent() {
     // Write not needed for reading

package/lib/module/Shared/EIDReader/passiveAuth/der.js

@@ -0,0 +1,93 @@
+"use strict";
+
+/**
+ * Minimal DER (ASN.1) reader for Passive Authentication parsing (ICAO 9303-11
+ * §5.1). Purpose-built and dependency-free so the EF.SOD / LDSSecurityObject
+ * parse is fully unit-testable offline. Only the constructs PA needs are
+ * supported: SEQUENCE, SET, INTEGER, OCTET STRING, OID, and tagged wrappers.
+ */
+
+/** Read the TLV node starting at `offset` in `buf`. */
+export function readNode(buf, offset) {
+  const start = offset;
+  let i = offset;
+  if (i >= buf.length) throw new Error('DER: unexpected end of input (tag)');
+  const tag = buf[i++];
+  // High-tag-number form (tag & 0x1f === 0x1f) — consume continuation bytes.
+  let tagNumber = tag & 0x1f;
+  if (tagNumber === 0x1f) {
+    tagNumber = 0;
+    let b;
+    do {
+      if (i >= buf.length) throw new Error('DER: unexpected end of input (tag#)');
+      b = buf[i++];
+      tagNumber = tagNumber << 7 | b & 0x7f;
+    } while ((b & 0x80) === 0x80);
+  }
+  if (i >= buf.length) throw new Error('DER: unexpected end of input (length)');
+  let length = buf[i++];
+  if (length & 0x80) {
+    const numBytes = length & 0x7f;
+    if (numBytes === 0) throw new Error('DER: indefinite length not supported');
+    length = 0;
+    for (let n = 0; n < numBytes; n++) {
+      if (i >= buf.length) throw new Error('DER: unexpected end of input (len bytes)');
+      length = length << 8 | buf[i++];
+    }
+  }
+  const contentStart = i;
+  const end = contentStart + length;
+  if (end > buf.length) throw new Error('DER: content exceeds buffer');
+  return {
+    tag,
+    tagNumber,
+    constructed: (tag & 0x20) === 0x20,
+    content: buf.subarray(contentStart, end),
+    start,
+    end
+  };
+}
+
+/** Read all immediate child TLVs of a constructed node's content. */
+export function readChildren(content) {
+  const out = [];
+  let offset = 0;
+  while (offset < content.length) {
+    const node = readNode(content, offset);
+    out.push(node);
+    offset = node.end;
+  }
+  return out;
+}
+
+/** Decode an OID node's content to dotted-decimal string. */
+export function decodeOid(content) {
+  if (content.length === 0) return '';
+  const parts = [];
+  const first = content[0];
+  parts.push(Math.floor(first / 40), first % 40);
+  let value = 0;
+  for (let i = 1; i < content.length; i++) {
+    const b = content[i];
+    value = value << 7 | b & 0x7f;
+    if ((b & 0x80) === 0) {
+      parts.push(value);
+      value = 0;
+    }
+  }
+  return parts.join('.');
+}
+
+/** Decode an INTEGER node's content to a JS number (small values only). */
+export function decodeInteger(content) {
+  let value = 0;
+  for (const b of content) value = value * 256 + b;
+  return value;
+}
+
+/** Lowercase hex string for a byte array. */
+export function toHex(bytes) {
+  let s = '';
+  for (const b of bytes) s += b.toString(16).padStart(2, '0');
+  return s;
+}