@virex-tech/paywallo-sdk 1.4.1 → 1.5.2

package/ios/PaywalloDevice.m

@@ -0,0 +1,8 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(PaywalloDevice, NSObject)
+
+RCT_EXTERN_METHOD(getDeviceInfo:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+@end

package/ios/PaywalloDevice.swift

@@ -0,0 +1,91 @@
+import Foundation
+import UIKit
+import CoreTelephony
+
+@objc(PaywalloDevice)
+class PaywalloDevice: NSObject {
+
+  // requiresMainQueueSetup = true so UIDevice properties are read on the main thread
+  @objc static func requiresMainQueueSetup() -> Bool { return true }
+
+  // MARK: - Get Device Info
+
+  @objc
+  func getDeviceInfo(
+    _ resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    // UIDevice properties are MainActor — must be read on the main thread
+    DispatchQueue.main.async {
+      let device = UIDevice.current
+      let processInfo = ProcessInfo.processInfo
+      let bundle = Bundle.main
+      let info = bundle.infoDictionary
+
+      let deviceId = device.identifierForVendor?.uuidString ?? ""
+      let model = device.model
+      let systemVersion = device.systemVersion
+      let systemName = device.systemName
+      let appVersion = info?["CFBundleShortVersionString"] as? String ?? "unknown"
+      let buildNumber = info?["CFBundleVersion"] as? String ?? "unknown"
+      let bundleId = bundle.bundleIdentifier ?? "unknown"
+      let totalRam = NSNumber(value: processInfo.physicalMemory)
+
+      // Disk stats — off main thread safe but called here for simplicity
+      var totalDisk: NSNumber = 0
+      var freeDisk: NSNumber = 0
+      do {
+        let attrs = try FileManager.default.attributesOfFileSystem(forPath: NSHomeDirectory())
+        if let size = attrs[.systemSize] as? NSNumber { totalDisk = size }
+        if let free = attrs[.systemFreeSize] as? NSNumber { freeDisk = free }
+      } catch {
+        // fallback stays 0
+      }
+
+      // Model identifier (sysctl — safe on any thread)
+      let modelId = self.getModelIdentifier()
+
+      // Carrier: CTTelephonyNetworkInfo is deprecated in iOS 16+ but still functional.
+      // Using conditional to suppress warning; no replacement API exists for carrier name.
+      var carrier = "unknown"
+      let networkInfo = CTTelephonyNetworkInfo()
+      if let providers = networkInfo.serviceSubscriberCellularProviders,
+         let first = providers.values.first,
+         let name = first.carrierName
+      {
+        carrier = name
+      }
+
+      let result: NSDictionary = [
+        "deviceId": deviceId,
+        "model": model,
+        "modelId": modelId,
+        "systemVersion": systemVersion,
+        "appVersion": appVersion,
+        "buildNumber": buildNumber,
+        "bundleId": bundleId,
+        "brand": "Apple",
+        "systemName": systemName,
+        "totalDisk": totalDisk,
+        "freeDisk": freeDisk,
+        "totalRam": totalRam,
+        "carrier": carrier,
+        "idfv": deviceId,
+        "installerPackage": NSNull(),
+      ]
+
+      resolve(result)
+    }
+  }
+
+  // MARK: - Helpers
+
+  private func getModelIdentifier() -> String {
+    var size = 0
+    sysctlbyname("hw.machine", nil, &size, nil, 0)
+    guard size > 0 else { return "unknown" }
+    var machine = [CChar](repeating: 0, count: size)
+    sysctlbyname("hw.machine", &machine, &size, nil, 0)
+    return String(cString: machine)
+  }
+}

package/ios/PaywalloFBBridge.swift

@@ -1,4 +1,6 @@
 import Foundation
+
+#if canImport(FBSDKCoreKit)
 import FBSDKCoreKit
 
 @objc(PaywalloFBBridge)
@@ -75,3 +77,52 @@ class PaywalloFBBridge: NSObject {
     return false
   }
 }
+
+#else
+
+// Stub: FBSDKCoreKit not available — all methods are no-ops
+@objc(PaywalloFBBridge)
+class PaywalloFBBridge: NSObject {
+
+  @objc
+  func getAnonymousID(
+    _ resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    resolve(nil)
+  }
+
+  @objc
+  func logEvent(
+    _ name: String,
+    params: NSDictionary,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    resolve(nil)
+  }
+
+  @objc
+  func logPurchase(
+    _ amount: Double,
+    currency: String,
+    params: NSDictionary,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    resolve(nil)
+  }
+
+  @objc
+  func setUserID(_ userId: String) {}
+
+  @objc
+  func flush() {}
+
+  @objc
+  static func requiresMainQueueSetup() -> Bool {
+    return false
+  }
+}
+
+#endif

package/ios/PaywalloStorage.m

@@ -0,0 +1,35 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(PaywalloStorage, NSObject)
+
+RCT_EXTERN_METHOD(secureGet:(NSString *)key
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureSet:(NSString *)key
+                  value:(NSString *)value
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(secureRemove:(NSString *)key
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(legacySecureGet:(NSString *)legacyService
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(get:(NSString *)key
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(set:(NSString *)key
+                  value:(NSString *)value
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(remove:(NSString *)key
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+@end

package/ios/PaywalloStorage.swift

@@ -0,0 +1,171 @@
+import Foundation
+import Security
+
+@objc(PaywalloStorage)
+class PaywalloStorage: NSObject {
+
+  private let service = "com.paywallo.sdk"
+  // Serial queue keeps Keychain ops off the main thread and serialized
+  private let keychainQueue = DispatchQueue(label: "com.paywallo.sdk.keychain", qos: .userInitiated)
+
+  // MARK: - Secure Storage (Keychain)
+
+  @objc
+  func secureGet(
+    _ key: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    keychainQueue.async {
+      // kSecAttrAccessible must NOT be included in CopyMatching queries —
+      // it is an attribute filter and causes errSecItemNotFound when the
+      // stored item's accessibility differs from the queried value.
+      let query: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: self.service,
+        kSecAttrAccount as String: key,
+        kSecReturnData as String: true,
+        kSecMatchLimit as String: kSecMatchLimitOne,
+      ]
+
+      var item: CFTypeRef?
+      let status = SecItemCopyMatching(query as CFDictionary, &item)
+
+      if status == errSecSuccess,
+         let data = item as? Data,
+         let value = String(data: data, encoding: .utf8)
+      {
+        resolve(value)
+      } else {
+        resolve(nil)
+      }
+    }
+  }
+
+  @objc
+  func secureSet(
+    _ key: String,
+    value: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    guard let data = value.data(using: .utf8) else {
+      resolve(false)
+      return
+    }
+
+    keychainQueue.async {
+      let query: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: self.service,
+        kSecAttrAccount as String: key,
+      ]
+
+      let attributes: [String: Any] = [
+        kSecValueData as String: data,
+        kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
+      ]
+
+      let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+
+      if updateStatus == errSecItemNotFound {
+        var addQuery = query
+        addQuery[kSecValueData as String] = data
+        addQuery[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        resolve(addStatus == errSecSuccess)
+      } else {
+        resolve(updateStatus == errSecSuccess)
+      }
+    }
+  }
+
+  @objc
+  func secureRemove(
+    _ key: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    keychainQueue.async {
+      let query: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: self.service,
+        kSecAttrAccount as String: key,
+      ]
+
+      SecItemDelete(query as CFDictionary)
+      resolve(true)
+    }
+  }
+
+  // MARK: - Legacy Migration (SDK ≤1.5.0 → ≥1.5.2)
+  // react-native-keychain stored: service="com.paywallo.sdk.{key}", account="panel"
+  // This read-only helper is called once during migration and never written to.
+
+  @objc
+  func legacySecureGet(
+    _ legacyService: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    keychainQueue.async {
+      let query: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: legacyService,
+        kSecAttrAccount as String: "panel",
+        kSecReturnData as String: true,
+        kSecMatchLimit as String: kSecMatchLimitOne,
+      ]
+
+      var item: CFTypeRef?
+      let status = SecItemCopyMatching(query as CFDictionary, &item)
+
+      if status == errSecSuccess,
+         let data = item as? Data,
+         let value = String(data: data, encoding: .utf8)
+      {
+        resolve(value)
+      } else {
+        resolve(nil)
+      }
+    }
+  }
+
+  // MARK: - Regular Storage (UserDefaults)
+
+  @objc
+  func get(
+    _ key: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    let value = UserDefaults.standard.string(forKey: key)
+    resolve(value)
+  }
+
+  @objc
+  func set(
+    _ key: String,
+    value: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    UserDefaults.standard.set(value, forKey: key)
+    resolve(true)
+  }
+
+  @objc
+  func remove(
+    _ key: String,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    UserDefaults.standard.removeObject(forKey: key)
+    resolve(true)
+  }
+
+  @objc
+  static func requiresMainQueueSetup() -> Bool {
+    return false
+  }
+}

package/ios/PaywalloStoreKit.swift

@@ -23,7 +23,9 @@ class PaywalloStoreKit: NSObject {
       for await result in Transaction.updates {
         guard let _ = self else { return }
         if case .verified(let transaction) = result {
+          #if DEBUG
           print("[Paywallo:StoreKit] Transaction update: \(transaction.productID) status=\(transaction.revocationDate != nil ? "revoked" : "active") id=\(transaction.id)")
+          #endif
           await transaction.finish()
         }
       }
@@ -38,7 +40,11 @@ class PaywalloStoreKit: NSObject {
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock
   ) {
-    Task {
+    Task { [weak self] in
+      guard let self else {
+        reject("MODULE_DEALLOCATED", "Module was deallocated", nil)
+        return
+      }
       do {
         let products = try await Product.products(for: Set(productIds))
         let result = products.map { self.productToDict($0) }
@@ -58,18 +64,26 @@ class PaywalloStoreKit: NSObject {
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock
   ) {
-    Task {
+    Task { [weak self] in
+      guard self != nil else {
+        reject("MODULE_DEALLOCATED", "Module was deallocated", nil)
+        return
+      }
       do {
         var clearedCount = 0
         for await result in Transaction.unfinished {
           if case .verified(let tx) = result {
+            #if DEBUG
             print("[Paywallo:StoreKit] Clearing unfinished tx: \(tx.productID) id=\(tx.id)")
+            #endif
             await tx.finish()
             clearedCount += 1
           }
         }
         if clearedCount > 0 {
+          #if DEBUG
           print("[Paywallo:StoreKit] Cleared \(clearedCount) unfinished transaction(s)")
+          #endif
         }
 
         let products = try await Product.products(for: [productId])

package/ios/PaywalloWebView.m

@@ -190,6 +190,26 @@
         return;
     }
 
+    // Allow HTTPS, about: (initial blank), and schemes that must be handed off to the OS
+    // (mailto, App Store). Block everything else — including plain HTTP, javascript:,
+    // data:, and blob: — to prevent mixed-content and injection attacks.
+    NSString *scheme = url.scheme.lowercaseString;
+    NSSet<NSString *> *allowedSchemes = [NSSet setWithObjects:
+        @"https", @"about", @"mailto", @"itms-apps", @"itms-services", nil];
+    if (scheme && ![allowedSchemes containsObject:scheme]) {
+        decisionHandler(WKNavigationActionPolicyCancel);
+        return;
+    }
+
+    // mailto: and App Store links must be opened by the OS, not loaded inside the WebView.
+    if ([scheme isEqualToString:@"mailto"] ||
+        [scheme isEqualToString:@"itms-apps"] ||
+        [scheme isEqualToString:@"itms-services"]) {
+        [[UIApplication sharedApplication] openURL:url options:@{} completionHandler:nil];
+        decisionHandler(WKNavigationActionPolicyCancel);
+        return;
+    }
+
     decisionHandler(WKNavigationActionPolicyAllow);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virex-tech/paywallo-sdk",
-  "version": "1.4.1",
+  "version": "1.5.2",
   "description": "SDK React Native para integração com Paywallo - Paywalls, Subscriptions e Analytics",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -18,7 +18,8 @@
     "ios",
     "android",
     "PaywalloSdk.podspec",
-    "react-native.config.js"
+    "react-native.config.js",
+    "LICENSE"
   ],
   "react-native": "./dist/index.mjs",
   "scripts": {
@@ -60,20 +61,20 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "dependencies": {
-    "@react-native-async-storage/async-storage": ">=1.0.0",
-    "expo-application": ">=5.0.0",
-    "expo-tracking-transparency": ">=0.5.0",
-    "react-native-device-info": ">=10.0.0",
-    "react-native-keychain": "^10.0.0"
-  },
   "peerDependencies": {
-    "react": ">=18.0.0 || >=19.0.0",
-    "react-native": ">=0.72.0"
+    "expo-tracking-transparency": "*",
+    "react": "*",
+    "react-native": "*"
+  },
+  "peerDependenciesMeta": {
+    "expo-tracking-transparency": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "@types/react": "^19.0.0",
+    "@vitest/coverage-v8": "^4.1.4",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-simple-import-sort": "^12.0.0",