react-native-dev-guard 0.0.1 → 1.0.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 arsarsars1
+Copyright (c) 2026 DevGuard UK
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,85 +1,231 @@
 # React Native DevGuard
 
-Remote licensing and application protection for React Native. HMAC signing and GZip telemetry run in a compiled native C++ module.
+<p align="center">
+  <a href="https://devguard.uk"><img src="https://img.shields.io/badge/website-devguard.uk-6C47FF?style=flat-square" alt="Website" /></a>
+  <img src="https://img.shields.io/badge/platforms-iOS%20%7C%20Android-2D7DD2?style=flat-square" alt="Platforms" />
+  <img src="https://img.shields.io/badge/license-MIT-3CB371?style=flat-square" alt="License" />
+</p>
 
-## Features
+**Protect your apps. Get paid.** DevGuard is a remote licensing and application-protection layer for React Native. Remotely **lock, warn, wipe, and monitor** your published apps from the DevGuard dashboard — ideal for agencies and developers who need to enforce payment terms or revoke access to client deliverables. Security-critical operations (HMAC signing, the shared secret, GZip telemetry) run inside a compiled **Native C++ module** so your keys never sit in plain JavaScript.
 
-- Glassmorphic lock screen
-- Native HMAC signing (C++ black box)
-- GZip tunnel (`v1-gzip`) for compact telemetry
-- Heartbeat and lifecycle sync policies
-- Hardware fingerprinting and emulator blocking
-- Nonce-based remote wipe
-- Privacy-gated advanced telemetry (RAM, storage, battery)
+> 👉 **Create your free account and grab your keys at [devguard.uk](https://devguard.uk).**
+> You'll need a **Project ID** and a **Master Secret** to initialize the SDK.
 
-## Requirements
+## 📱 How it looks
 
-- React Native 0.85.x (tested on 0.85.3)
-- React 19.2.x
-- iOS 15.1+ · Android minSdk 24
+The Lock Screen, warning toast, and diagnostics overlay are all **built in** — you don't build any UI. DevGuard renders the right screen automatically based on the status returned by your dashboard.
 
-## Installation
+<table>
+  <tr>
+    <td align="center" width="33%"><img src="screenshots/welcome-screen.png" width="240" alt="Active and protected app" /></td>
+    <td align="center" width="33%"><img src="screenshots/payment-reminder.png" width="240" alt="In-app warning toast" /></td>
+    <td align="center" width="33%"><img src="screenshots/access-suspended.png" width="240" alt="Access suspended lock screen" /></td>
+  </tr>
+  <tr>
+    <td align="center"><b>Active &amp; Protected</b><br/>Your app runs normally · <code>ACTIVE</code></td>
+    <td align="center"><b>In-App Warning</b><br/>Non-blocking toast (e.g. payment reminder) · <code>WARNING</code></td>
+    <td align="center"><b>Access Suspended</b><br/>Automatic Lock Screen with your support contacts · <code>LOCKED</code></td>
+  </tr>
+</table>
+
+## ✨ Features
+
+- **Glassmorphic Lock Screen**: Premium, built-in UI that blocks access instantly — with your WhatsApp / Email / Call support buttons and an optional unlock-key entry.
+- **Native Security**: HMAC signing and the shared secret are handled in compiled C++ to prevent secret extraction.
+- **GZip Tunneling**: Compact telemetry payloads for minimum data usage.
+- **Remote Config**: Access server-defined JSON settings via the `response` object.
+- **Heartbeat & Sync**: Automated background pings (with `lifecycleSync` / `syncPolicy` support) to keep license status fresh.
+- **Hardware Fingerprinting**: Robust device identity that survives app re-installs.
+- **Emulator Blocking**: When the project enables `blockEmulators`, the SDK locks on emulators/simulators automatically.
+- **Hardened Remote Wipe**: Nonce-based remote wipe clears the response cache, usage logs, local diagnostic vault, and stored device-user identity.
+- **Privacy-Gated Telemetry**: Advanced metrics (RAM, storage, battery, network) are only collected after the server enables `advancedTelemetry`.
+
+## 🚀 Getting Started
+
+### 1. Create your DevGuard account
+
+1. Sign up at **[devguard.uk](https://devguard.uk)**.
+2. Create a **Project** in the dashboard.
+3. Copy your **Project ID** and **Master Secret** (Settings → Master Secret). You'll pass both to the SDK below.
+
+### 2. Install
 
 ```bash
 npm install react-native-dev-guard react-native-device-info react-native-keychain @react-native-async-storage/async-storage
-npx pod-install
+# or
+yarn add react-native-dev-guard react-native-device-info react-native-keychain @react-native-async-storage/async-storage
 ```
 
-## Quick start
+`@react-native-async-storage/async-storage` is required by the bundled Vault Logger (local diagnostics). Use **v3.x** with React Native 0.85+; run `npx pod-install` after adding it on iOS.
+
+### 3. Native setup
+
+#### Requirements
+- **React Native** `0.85.x` (tested on `0.85.3`)
+- **React** `19.2.x`
+- **iOS** 15.1+ · **Android** minSdk 24
+
+#### iOS
+1. Open `ios/Podfile` and ensure your target meets React Native's minimum iOS version (`min_ios_version_supported`, currently 15.1).
+2. Run `npx pod-install`.
+
+#### Android
+Ensure your app `minSdkVersion` is at least **24** (matches the RN 0.85 template).
+
+### 4. Protect your app
+
+Wrap your application root with `DevGuardProvider`. That's it — once the status returned by your dashboard is `LOCKED`, the Lock Screen appears automatically.
 
 ```tsx
 import React from 'react';
 import { DevGuardProvider } from 'react-native-dev-guard';
 
-const App = () => (
-  <DevGuardProvider
-    projectId="your_project_id"
-    secret="YOUR_MASTER_SECRET"
-    autoProtect={true}
-    failSafe="open"
-  >
-    <MainApp />
-  </DevGuardProvider>
-);
+const App = () => {
+  return (
+    <DevGuardProvider
+      projectId="your_project_id"   // From the DevGuard dashboard
+      secret="YOUR_MASTER_SECRET"   // Settings → Master Secret
+      autoProtect={true}            // Auto-show the Lock Screen when LOCKED
+      failSafe="open"               // 'open' or 'closed' (offline behavior, no cache)
+    >
+      <MainApp />
+    </DevGuardProvider>
+  );
+};
+
+export default App;
 ```
 
-### Access status in components
+## 🧭 Status lifecycle
+
+DevGuard syncs on app launch, on foreground/background, and on a server-defined heartbeat. The current `status` drives what the user sees:
+
+| Status | Meaning | What the user sees |
+| --- | --- | --- |
+| `ACTIVE` | Valid license / access granted. | Your app, running normally. |
+| `WARNING` | App still works, but a notice is shown. | A non-blocking toast (e.g. *"Payment reminder"*). |
+| `LOCKED` | Access revoked by you. | The built-in **Lock Screen** (when `autoProtect`). |
+| `EXPIRED` | License expired. | Treated as locked. |
+| `PENDING` | Initial state before the first successful sync (`failSafe: open`). | Your app (optimistic). |
+| `ERROR` | Sync failed. | Depends on `failSafe` (see below). |
+
+## 🪝 API
+
+### `<DevGuardProvider>` props
+
+| Prop | Type | Default | Description |
+| --- | --- | --- | --- |
+| `projectId` | `string` | **required** | Your DevGuard project ID. |
+| `secret` | `string` | — | Your account **Master Secret** (Settings → Master Secret), used to authenticate requests. |
+| `autoProtect` | `boolean` | `true` | Automatically render the built-in Lock Screen when status is `LOCKED` / `EXPIRED`. |
+| `failSafe` | `'open' \| 'closed'` | `'open'` | Behavior when the server is unreachable and no cache exists. `open` keeps the app usable; `closed` locks it. |
+| `apiKey` | `string` | — | **Deprecated** alias for `secret`. |
+
+### `useDevGuard()`
 
 ```tsx
 import { useDevGuard } from 'react-native-dev-guard';
 
 const MyComponent = () => {
   const { status, response, isLocked, verify } = useDevGuard();
-  return <Text>Status: {status}</Text>;
+
+  return (
+    <View>
+      <Text>Status: {status}</Text>
+      {response?.betaFeatures?.showBetaFeature && <BetaComponent />}
+    </View>
+  );
 };
 ```
 
-## Configuration
+| Field | Type | Description |
+| --- | --- | --- |
+| `status` | `GuardStatus` | `ACTIVE` · `WARNING` · `LOCKED` · `EXPIRED` · `PENDING` · `ERROR`. |
+| `isLocked` | `boolean` | `true` when status is `LOCKED` or `EXPIRED`. |
+| `response` | `GuardResponse \| null` | Full server response (messages, contacts, `config`, `betaFeatures`, etc.). |
+| `verify` | `(force?: boolean) => Promise<void>` | Manually trigger a license sync. |
+| `unlock` | `(key: string) => Promise<boolean>` | Submit an unlock key; resolves `true` on success. |
+| `setDeviceUser` | `(username?, email?, phone?, customData?) => Promise<void>` | Register the signed-in app user so they appear in the Developer Portal. |
+
+### Track app users in the Developer Portal
 
-| Prop | Description |
-|------|-------------|
-| `projectId` | Your DevGuard project ID |
-| `secret` | Master Secret from portal settings |
-| `autoProtect` | Show lock screen when status is LOCKED (default `true`) |
-| `failSafe` | `'open'` (default) or `'closed'` when offline with no cache |
+When someone signs in or registers in your app, pass their profile to DevGuard. You'll then be able to see **how many users are using your application** in the **Developer Portal** — total user count, recent activity, and basic profile fields (username, email, phone, and any custom metadata you attach).
+
+Call this after login or registration (all parameters are optional):
+
+```tsx
+const { setDeviceUser } = useDevGuard();
+
+await setDeviceUser(
+  'jane_doe',           // username
+  'jane@example.com',   // email
+  '+15551234567',       // phone
+  { plan: 'pro' }       // any custom data
+);
+```
+
+Open **Developer Portal → Users** to view your app's user base and engagement.
 
 ### Manual verification
 
+Force a sync after a meaningful event (e.g. login or payment):
+
 ```tsx
 const { verify } = useDevGuard();
-await verify(true); // force sync
+await verify(true); // true forces a sync regardless of policy
 ```
 
-### Diagnostic overlay
+### Unlock with a key
+
+The built-in Lock Screen already includes an **"Enter Unlock Key"** flow, so most apps never call this directly — but it's available if you want a custom UI:
+
+```tsx
+const { unlock } = useDevGuard();
+const ok = await unlock('USER-ENTERED-KEY');
+```
+
+## 🐞 Diagnostic Overlay & Vault Logger
+
+DevGuard includes an integrated diagnostic UI (the Bug Icon) and a local Vault Logger for advanced debugging without rebuilding your app.
+
+### Vault Logger
+The SDK bundles `react-native-vault-logger`. By default, it automatically captures fatal JS errors and usage info, saving them securely to local storage using **per-device keys** derived from the hardware `deviceId` at init (no static secret in source).
+You can manually log data to the Info Vault:
+```tsx
+import { DevGuardLogger } from 'react-native-dev-guard/src/services/DevGuardLogger';
+
+DevGuardLogger.info('User completed onboarding', { userId: 123 });
+```
+
+### The Bug Icon (Diagnostic Overlay)
+To view telemetry and logs directly inside the running app without connecting a debugger:
+1. Go to your DevGuard Admin Control Center.
+2. Ensure you have configured a **6-digit Diagnostic Passcode**.
+3. Under the project settings, toggle on **Enable Diagnostic Logs (Beta Feature)** for the desired devices.
+4. A floating **🐛 Bug Icon** will appear in your app.
+5. Tap it and enter your Passcode to view device telemetry and access diagnostic vaults.
+
+## ⚙️ Configuration
+
+### Fail-Safe Modes
+- **`open` (Default)**: If the server is unreachable and no cache exists, the app remains accessible.
+- **`closed`**: The app will lock until a successful status is fetched.
+
+## 🔐 Security Best Practices
+
+1. **Release builds**: Use `javascript-obfuscator` or similar tools for your JS bundle.
+2. **Hermes**: Ensure Hermes is enabled in your `app/build.gradle` and `Podfile` to benefit from bytecode pre-compilation.
+3. **ProGuard**: Use the included ProGuard rules to protect the native C++ library.
 
-Enable **Diagnostic Logs** in your DevGuard project settings and set a 6-digit passcode. A bug icon appears in-app for authorized debugging.
+## 💬 Support & Contact
 
-## Security
+- 🌐 **Website / register:** [devguard.uk](https://devguard.uk)
+- 📧 **Email:** [contact@devguard.uk](mailto:contact@devguard.uk)
+- 🐛 **Issues:** [GitHub Issues](https://github.com/DevGuard-uk/react-native-dev-guard/issues)
 
-- Obfuscate your JS bundle in production
-- Enable Hermes and ProGuard (see `example/android/app/proguard-rules.pro`)
-- Never commit your Master Secret to source control
+## 📄 License
 
-## License
+MIT © [DevGuard](https://devguard.uk)
 
-MIT — see [LICENSE](LICENSE).
+---
+*Secure by Design. Managed by You.*

package/android/src/main/cpp/devguard-lib.cpp

@@ -1,5 +1,4 @@
 #include <jni.h>
-#include <string>
 #include "devguard_core.h"
 
 extern "C" JNIEXPORT jstring JNICALL
@@ -8,14 +7,10 @@ Java_com_devguard_DevGuardModule_generateSignatureNative(
         jobject /* this */,
         jstring projectId,
         jlong timestamp) {
-    
     const char *project_id_c = env->GetStringUTFChars(projectId, 0);
     char output[65];
-    
-    generate_signature(project_id_c, (long long)timestamp, output);
-    
+    dg_x9(project_id_c, (long long)timestamp, output);
     env->ReleaseStringUTFChars(projectId, project_id_c);
-    
     return env->NewStringUTF(output);
 }
 
@@ -25,14 +20,20 @@ Java_com_devguard_DevGuardModule_verifyResponseNative(
         jobject /* this */,
         jstring responseBody,
         jstring signature) {
-    
     const char *response_body_c = env->GetStringUTFChars(responseBody, 0);
     const char *signature_c = env->GetStringUTFChars(signature, 0);
-    
-    int result = verify_response(response_body_c, signature_c);
-    
+    int result = dg_v2(response_body_c, signature_c);
     env->ReleaseStringUTFChars(responseBody, response_body_c);
     env->ReleaseStringUTFChars(signature, signature_c);
-    
     return result == 1 ? JNI_TRUE : JNI_FALSE;
 }
+
+extern "C" JNIEXPORT jint JNICALL
+Java_com_devguard_DevGuardModule_evaluatePolicyNative(
+        JNIEnv* env,
+        jobject /* this */,
+        jint blockEmulators,
+        jint isPhysical,
+        jint isCompromised) {
+    return dg_e1(blockEmulators, isPhysical, isCompromised);
+}

package/android/src/main/java/com/devguard/DevGuardModule.kt

@@ -17,6 +17,7 @@ class DevGuardModule(reactContext: ReactApplicationContext) : ReactContextBaseJa
 
     private external fun generateSignatureNative(projectId: String, timestamp: Long): String
     private external fun verifyResponseNative(responseBody: String, signature: String): Boolean
+    private external fun evaluatePolicyNative(blockEmulators: Int, isPhysical: Int, isCompromised: Int): Int
 
     @ReactMethod
     fun generateSignature(projectId: String, timestamp: Double, promise: Promise) {
@@ -37,4 +38,18 @@ class DevGuardModule(reactContext: ReactApplicationContext) : ReactContextBaseJa
             promise.reject("DEVGUARD_ERROR", "Failed to verify response", e)
         }
     }
+
+    @ReactMethod
+    fun evaluatePolicy(blockEmulators: Boolean, isPhysical: Boolean, isCompromised: Boolean, promise: Promise) {
+        try {
+            val code = evaluatePolicyNative(
+                if (blockEmulators) 1 else 0,
+                if (isPhysical) 1 else 0,
+                if (isCompromised) 1 else 0,
+            )
+            promise.resolve(code)
+        } catch (e: Exception) {
+            promise.reject("DEVGUARD_ERROR", "Failed to evaluate policy", e)
+        }
+    }
 }

package/cpp/devguard_core.c

@@ -180,7 +180,7 @@ static void _token_scramble(const char* input, char* output, size_t len) {
     }
 }
 
-DEVGUARD_EXPORT void generate_signature(const char* project_id, long long timestamp, char* output) {
+DEVGUARD_EXPORT void dg_x9(const char* project_id, long long timestamp, char* output) {
     // Validate project_id length to prevent buffer truncation
     size_t pid_len = strlen(project_id);
     if (pid_len == 0 || pid_len > 200) {
@@ -206,7 +206,7 @@ DEVGUARD_EXPORT void generate_signature(const char* project_id, long long timest
     output[64] = '\0';
 }
 
-DEVGUARD_EXPORT int verify_response(const char* response_body, const char* signature) {
+DEVGUARD_EXPORT int dg_v2(const char* response_body, const char* signature) {
     char secret_key[64];
     _reconstruct_key(secret_key);
 
@@ -226,14 +226,92 @@ DEVGUARD_EXPORT int verify_response(const char* response_body, const char* signa
 }
 
 // Secure token scrambling for in-memory protection
-DEVGUARD_EXPORT void secure_save_token(const char* token, char* output) {
+DEVGUARD_EXPORT void dg_s3(const char* token, char* output) {
     size_t len = strlen(token);
     _token_scramble(token, output, len);
     output[len] = '\0';
 }
 
-DEVGUARD_EXPORT void secure_get_token(const char* scrambled, char* output) {
+DEVGUARD_EXPORT void dg_g4(const char* scrambled, char* output) {
     size_t len = strlen(scrambled);
     _token_scramble(scrambled, output, len);
     output[len] = '\0';
 }
+
+// SHA-256 hex digest of an arbitrary UTF-8 string (license keys, fingerprints).
+static void _hash_sha256_hex(const char* input, char* output) {
+    if (input == NULL || output == NULL) {
+        if (output) output[0] = '\0';
+        return;
+    }
+
+    uint8_t hash[32];
+    SHA256_CTX ctx;
+    sha256_init(&ctx);
+    sha256_update(&ctx, (const uint8_t*)input, strlen(input));
+    sha256_final(&ctx, hash);
+
+    for (int i = 0; i < 32; i++) {
+        sprintf(output + (i * 2), "%02x", hash[i]);
+    }
+    output[64] = '\0';
+}
+
+// Symmetric XOR transform. output must hold at least input_len bytes.
+DEVGUARD_EXPORT void dg_h5(const char* input, char* output) {
+    _hash_sha256_hex(input, output);
+}
+
+DEVGUARD_EXPORT void dg_x6(
+    const char* input,
+    size_t input_len,
+    const char* key,
+    size_t key_len,
+    char* output
+) {
+    if (input == NULL || key == NULL || output == NULL || key_len == 0) {
+        return;
+    }
+
+    for (size_t i = 0; i < input_len; i++) {
+        output[i] = input[i] ^ key[i % key_len];
+    }
+}
+
+// Derive a 64-char hex key from passcode + salt (usage log encryption).
+DEVGUARD_EXPORT void dg_d7(const char* passcode, const char* salt, char* output) {
+    char combined[512];
+    snprintf(combined, sizeof(combined), "%s_%s",
+             passcode != NULL ? passcode : "secure_default",
+             salt != NULL ? salt : "salt");
+    _hash_sha256_hex(combined, output);
+}
+
+#if defined(__APPLE__)
+#include <sys/sysctl.h>
+
+// Returns total RAM in megabytes on Apple platforms, or -1 on failure.
+DEVGUARD_EXPORT int dg_r8(void) {
+    int64_t mem = 0;
+    size_t len = sizeof(mem);
+    if (sysctlbyname("hw.memsize", &mem, &len, NULL, 0) != 0) {
+        return -1;
+    }
+    return (int)(mem / (1024 * 1024));
+}
+#else
+DEVGUARD_EXPORT int dg_r8(void) {
+    return -1;
+}
+#endif
+
+// Policy gate: 0=allow, 1=emulator block, 2=compromised device block
+DEVGUARD_EXPORT int dg_e1(int block_emulators, int is_physical, int is_compromised) {
+    if (is_compromised) {
+        return 2;
+    }
+    if (block_emulators && !is_physical) {
+        return 1;
+    }
+    return 0;
+}

package/cpp/devguard_core.h

@@ -14,19 +14,21 @@
 extern "C" {
 #endif
 
-// Generates an HMAC-SHA256 signature for a given project ID and timestamp.
-// The secret key is embedded inside the compiled binary.
-// output must be a buffer of at least 65 bytes (64 hex characters + null terminator).
-DEVGUARD_EXPORT void generate_signature(const char* project_id, long long timestamp, char* output);
-
-// Verifies a server response signature against the response body.
-// Returns 1 if valid, 0 if invalid.
-DEVGUARD_EXPORT int verify_response(const char* response_body, const char* signature);
-
-// Secure token scrambling for in-memory protection.
-// output must be a buffer of at least the length of token + 1.
-DEVGUARD_EXPORT void secure_save_token(const char* token, char* output);
-DEVGUARD_EXPORT void secure_get_token(const char* scrambled, char* output);
+DEVGUARD_EXPORT void dg_x9(const char* project_id, long long timestamp, char* output);
+DEVGUARD_EXPORT int dg_v2(const char* response_body, const char* signature);
+DEVGUARD_EXPORT void dg_s3(const char* token, char* output);
+DEVGUARD_EXPORT void dg_g4(const char* scrambled, char* output);
+DEVGUARD_EXPORT void dg_h5(const char* input, char* output);
+DEVGUARD_EXPORT void dg_x6(
+    const char* input,
+    size_t input_len,
+    const char* key,
+    size_t key_len,
+    char* output
+);
+DEVGUARD_EXPORT void dg_d7(const char* passcode, const char* salt, char* output);
+DEVGUARD_EXPORT int dg_r8(void);
+DEVGUARD_EXPORT int dg_e1(int block_emulators, int is_physical, int is_compromised);
 
 #ifdef __cplusplus
 }

package/ios/DevGuard.mm

@@ -13,10 +13,8 @@ RCT_EXPORT_METHOD(generateSignature:(NSString *)projectId
     @try {
         const char *project_id_c = [projectId UTF8String];
         long long timestamp_val = [timestamp longLongValue];
-        
         char output[65];
-        generate_signature(project_id_c, timestamp_val, output);
-        
+        dg_x9(project_id_c, timestamp_val, output);
         NSString *result = [NSString stringWithUTF8String:output];
         resolve(result);
     } @catch (NSException *exception) {
@@ -32,13 +30,29 @@ RCT_EXPORT_METHOD(verifyResponse:(NSString *)responseBody
     @try {
         const char *response_body_c = [responseBody UTF8String];
         const char *signature_c = [signature UTF8String];
-        
-        int isValid = verify_response(response_body_c, signature_c);
-        
+        int isValid = dg_v2(response_body_c, signature_c);
         resolve(@(isValid == 1));
     } @catch (NSException *exception) {
         reject(@"DEVGUARD_ERROR", @"Failed to verify response", nil);
     }
 }
 
+RCT_EXPORT_METHOD(evaluatePolicy:(nonnull NSNumber *)blockEmulators
+                  isPhysical:(nonnull NSNumber *)isPhysical
+                  isCompromised:(nonnull NSNumber *)isCompromised
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+{
+    @try {
+        int code = dg_e1(
+            [blockEmulators intValue],
+            [isPhysical intValue],
+            [isCompromised intValue]
+        );
+        resolve(@(code));
+    } @catch (NSException *exception) {
+        reject(@"DEVGUARD_ERROR", @"Failed to evaluate policy", nil);
+    }
+}
+
 @end

package/lib/components/LockScreen.d.ts

@@ -1,4 +1,5 @@
 import React from 'react';
+import { LockScreenBranding } from '../types/branding';
 interface LockScreenProps {
     status: string;
     title?: string;
@@ -7,6 +8,7 @@ interface LockScreenProps {
     contactPhone?: string;
     contactWhatsapp?: string;
     allowUnlock?: boolean;
+    branding?: LockScreenBranding | null;
     onUnlock: (key: string) => Promise<boolean>;
 }
 export declare const LockScreen: React.FC<LockScreenProps>;