pipwave-ekyc-uikit 3.1.2-beta.1 → 3.1.2-beta.2

package/.env.production

@@ -1,3 +1,3 @@
 FACE_MODEL=https://assets.pipwave.com/ekyc/sdk/face-models
-CARD_MODEL=https://assets.pipwave.com/ekyc/sdk/card-models
+CARD_MODEL=https://staging-assets.pipwave.com/ekyc/sdk/card-models
 ORT=https://staging-assets.pipwave.com/ekyc/sdk/ort

package/code-review-sc-341281.md

@@ -0,0 +1,99 @@
+# Code Review — `hotfix-teojunjie-sc-341281-card-detection-csp`
+
+**Base:** `origin/master`
+**Scope:** card-detection CSP fix + worker→main-thread inference migration
+
+## Summary
+
+The branch does a solid job of the core migration: it moves ONNX inference off a
+cross-origin Worker (which Chromium refuses to construct) onto the main thread, adds a
+graceful manual-capture fallback, and introduces real unit tests for the box-decode math
+and the load lifecycle. The lifecycle/generation guarding in `src/plugins/card-detection.ts`
+is careful and well-tested. However, there are two blocking issues for anything targeting
+production, plus a few things worth addressing.
+
+---
+
+## 🔴 Blocking
+
+### 1. Production config points at staging infrastructure
+
+`.env.production` (lines 2–3) was changed from `assets.pipwave.com` to
+`staging-assets.pipwave.com` for both `CARD_MODEL` and `ORT` (face-models left on prod):
+
+```
+CARD_MODEL=https://staging-assets.pipwave.com/ekyc/sdk/card-models
+ORT=https://staging-assets.pipwave.com/ekyc/sdk/ort
+```
+
+Worse, the committed `dist/pw-bundle.js` — which is the package `main` and the actual
+shipped artifact — has these **staging URLs baked in** (verified: `grep` finds
+`staging-assets.pipwave.com/ekyc/sdk/{card-models,ort}` in the bundle, while face-models is
+still prod). A production release would pull the model + ORT runtime from staging. Combined
+with the `3.1.2-beta.1` version tag, this branch reads as not-yet-final. **Revert both to
+`assets.pipwave.com` and rebuild the bundle before merge.**
+
+### 2. `new Function(...import())` requires CSP `unsafe-eval` — on a CSP-fix branch
+
+`src/plugins/card-detection.inference.ts:94` loads ORT via:
+
+```ts
+const dynamicImport = new Function("specifier", "return import(specifier)") as ...
+```
+
+This is present in the shipped bundle. The `new Function` constructor requires
+`script-src 'unsafe-eval'` in the **merchant's** CSP. This ticket exists precisely because
+of strict-CSP merchants, and strict merchants very commonly block `unsafe-eval`. On those
+sites this throws at the `ort-import` stage → classified retryable → 2 useless retries →
+falls back to manual capture. So it degrades gracefully, but detection will be *unavailable
+exactly on the sites this fix targets*, trading the Worker-construction CSP block for an
+`unsafe-eval` CSP block.
+
+The comment explains *why* (`"module": "commonjs"` makes tsc rewrite `import()` →
+`require()` before webpack sees it — confirmed in `tsconfig.json`). The cleaner fix is to
+let webpack emit a genuine dynamic `import()` (e.g. isolate this file with
+`module: "esnext"`/`"es2020"`, or use webpack `output.module` + a magic-comment import)
+rather than `new Function`. At minimum, **confirm the target merchants allow `unsafe-eval`**
+before relying on this path — otherwise the CSP fix doesn't actually land where it's needed.
+
+---
+
+## 🟡 Medium
+
+### 3. Test suite can't run on the project's Node
+
+`package.json` sets `"test": "vitest run"` with `vitest ^4.1.9`, which requires
+Node ≥20.19/22.12. This machine runs Node 16.20.2, and `npx vitest run` fails at startup
+(`node:util` has no `styleText` export). There's no `engines` field, no `.nvmrc`, and no CI.
+The new tests are good but currently unrunnable for anyone on the repo's Node. Either pin
+Node (`engines` + `.nvmrc`) or downgrade vitest to a Node-16-compatible line.
+
+---
+
+## 🟢 Minor / nits
+
+- **Dead classification branches** in `src/plugins/detection-failure.ts:5`: `importScripts`
+  (worker-only, no longer reachable from the main-thread engine) and `warmup` (warmup errors
+  are swallowed in `card-detection.inference.ts:124-128`, so they never reach
+  `classifyFailure`). Harmless, but stale now.
+- **Retry has no in-progress feedback**: the Retry callback in `_showScannerUnavailableDialog`
+  (`card-camera.ts:585`) removes the overlay, then awaits `reloadModel()` (which itself can
+  back off up to several seconds) with no spinner. User sees the manual-capture UI with no
+  indication a retry is running.
+- **Manual capture skips the success tick**: `triggerManualCapture` (`card-camera.ts:603`)
+  dispatches `captureImage` but doesn't call `showCaptureTick()` like the auto path does —
+  minor UX inconsistency.
+- **Stale worker-era comments** in `card-detection.inference.ts:11,39` ("previously sent to
+  the worker as `wasmDir`", "Ported unchanged from the former worker's onmessage handler").
+  Fine as history, slightly noisy.
+
+---
+
+## What's good
+
+- Load-generation guarding (`_loadGeneration`) correctly handles dispose/reload racing an
+  in-flight `init()`, and the tests in `card-detection.test.ts` exercise exactly those races
+  (late-resolving init gets re-disposed, results dropped after dispose/stop).
+- The stale-detection drain (`AUTO_CAPTURE_STALE_MS`) is a thoughtful fix for slow
+  single-thread devices where the border debounce lags the real card state.
+- Extracting `decodeBestBox` as a pure function with unit coverage is the right call.