react-native-dev-guard 0.0.1 → 1.0.1

package/lib/services/CacheService.js

@@ -32,22 +32,17 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CacheService = void 0;
 const Keychain = __importStar(require("react-native-keychain"));
-const crypto_js_1 = __importDefault(require("crypto-js"));
+const cacheCrypto_1 = require("./cacheCrypto");
 class CacheService {
     static SERVICE_NAME = 'devguard.cache.service';
     static WIPE_SERVICE = 'devguard.wipe.service';
     static async saveResponse(projectId, response) {
         try {
             const dataString = JSON.stringify(response);
-            // Use projectId as the encryption key for the payload
-            const encrypted = crypto_js_1.default.AES.encrypt(dataString, projectId).toString();
-            // Store in secure keychain
+            const encrypted = (0, cacheCrypto_1.encryptCachePayload)(projectId, dataString);
             await Keychain.setGenericPassword(`devguard_${projectId}`, encrypted, { service: this.SERVICE_NAME });
         }
         catch (e) {
@@ -58,10 +53,7 @@ class CacheService {
         try {
             const credentials = await Keychain.getGenericPassword({ service: this.SERVICE_NAME });
             if (credentials && credentials.username === `devguard_${projectId}`) {
-                const encrypted = credentials.password;
-                // Decrypt using projectId
-                const bytes = crypto_js_1.default.AES.decrypt(encrypted, projectId);
-                const decrypted = bytes.toString(crypto_js_1.default.enc.Utf8);
+                const decrypted = (0, cacheCrypto_1.decryptCachePayload)(projectId, credentials.password);
                 if (decrypted) {
                     return JSON.parse(decrypted);
                 }
@@ -81,7 +73,11 @@ class CacheService {
             console.warn('DevGuard Cache: Failed to clear cache', e);
         }
     }
-    /** Last remote-wipe nonce executed on this device, or null. */
+    /**
+     * Returns the last remote-wipe nonce this client has executed, or null.
+     * Stored separately from the response cache so it survives a cache wipe
+     * (parity with Flutter's nonce persistence).
+     */
     static async getLastWipeNonce(projectId) {
         try {
             const credentials = await Keychain.getGenericPassword({ service: this.WIPE_SERVICE });

package/lib/services/DevGuardLogger.d.ts

@@ -3,7 +3,7 @@ export declare class DevGuardLogger {
     static showConsoleLogs: boolean;
     private static initialized;
     private static infoLogs;
-    static init(): Promise<void>;
+    static init(deviceId: string): Promise<void>;
     static enableConsoleLogs(): void;
     static info(message: string, data?: Record<string, any>): void;
     static warning(message: string, data?: Record<string, any>): void;

package/lib/services/DevGuardLogger.js

@@ -1,18 +1,28 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DevGuardLogger = void 0;
+const crypto_js_1 = __importDefault(require("crypto-js"));
 const react_native_vault_logger_1 = require("react-native-vault-logger");
+function deriveVaultKeyMaterial(deviceId, salt) {
+    const hex = crypto_js_1.default.SHA256(`${deviceId}_${salt}`).toString(crypto_js_1.default.enc.Hex);
+    return crypto_js_1.default.enc.Hex.parse(hex).toString(crypto_js_1.default.enc.Latin1);
+}
 class DevGuardLogger {
     static showConsoleLogs = false;
     static initialized = false;
     static infoLogs = [];
-    static async init() {
+    static async init(deviceId) {
         if (this.initialized)
             return;
         try {
+            const encryptionKey = deriveVaultKeyMaterial(deviceId, 'dg_vault_key_v1');
+            const encryptionIV = deriveVaultKeyMaterial(deviceId, 'dg_vault_iv_v1').substring(0, 16);
             await react_native_vault_logger_1.CrashLogService.init({
-                encryptionKey: 'DevGuard_Secure_Vault_Key_32_Ch!',
-                encryptionIV: 'DevGuard_IV_16_C',
+                encryptionKey,
+                encryptionIV,
                 maxLogCount: 1000,
             });
             this.initialized = true;

package/lib/services/DeviceTokenService.d.ts

@@ -10,7 +10,10 @@ export declare class DeviceTokenService {
      * Reads from Keychain/Keystore if available, otherwise from in-memory cache.
      */
     getToken(): Promise<string | null>;
-    /** Persists a registration token using Keychain/Keystore when available. */
+    /**
+     * Persists a registration token received from the server.
+     * Uses hardware-backed Keychain/Keystore when available (parity with Flutter's flutter_secure_storage).
+     */
     saveToken(token: string, useEnclave?: boolean): Promise<void>;
     /**
      * Removes the registration token. Only called on explicit admin revocation.

package/lib/services/DeviceTokenService.js

@@ -52,11 +52,14 @@ class DeviceTokenService {
         // Fallback: in-memory token
         return this.cachedToken;
     }
-    /** Persists a registration token using Keychain/Keystore when available. */
+    /**
+     * Persists a registration token received from the server.
+     * Uses hardware-backed Keychain/Keystore when available (parity with Flutter's flutter_secure_storage).
+     */
     async saveToken(token, useEnclave = false) {
         let finalToken = token;
         if (useEnclave) {
-            // Simulated enclave: reverse and prefix
+            // Simulated Enclave: Reverse and prefix (parity with Flutter)
             finalToken = `se:${token.split('').reverse().join('')}`;
         }
         // Primary: Keychain/Keystore (hardware-backed, persists across restarts)

package/lib/services/GuardEnforcement.d.ts

@@ -1,19 +1,10 @@
 /**
  * Client-side policy enforcement applied to a server response before it is
- * shown to the user. Mirrors the Flutter plugin's `GuardEnforcement` so both
- * platforms behave identically.
+ * shown to the user. Mirrors Flutter `GuardEnforcement` + native `dg_e1`.
  */
 export declare class GuardEnforcement {
-    /**
-     * Applies enforcement rules to a fresh server response.
-     *
-     * - `blockEmulators`: if the project blocks emulators and the current device
-     *   is not a physical device, the response is overridden to LOCKED.
-     *
-     * @param response The parsed server response (mutated copy returned).
-     * @param metadata The device metadata collected for this sync.
-     */
+    private static evaluatePolicy;
     static apply(response: any, metadata: {
         isPhysicalDevice?: boolean;
-    }): any;
+    }, isCompromised?: boolean): Promise<any>;
 }

package/lib/services/GuardEnforcement.js

@@ -1,29 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GuardEnforcement = void 0;
+const react_native_1 = require("react-native");
+const obf_1 = require("../internal/obf");
+const { DevGuard: DevGuardNative } = react_native_1.NativeModules;
 /**
  * Client-side policy enforcement applied to a server response before it is
- * shown to the user. Mirrors the Flutter plugin's `GuardEnforcement` so both
- * platforms behave identically.
+ * shown to the user. Mirrors Flutter `GuardEnforcement` + native `dg_e1`.
  */
 class GuardEnforcement {
-    /**
-     * Applies enforcement rules to a fresh server response.
-     *
-     * - `blockEmulators`: if the project blocks emulators and the current device
-     *   is not a physical device, the response is overridden to LOCKED.
-     *
-     * @param response The parsed server response (mutated copy returned).
-     * @param metadata The device metadata collected for this sync.
-     */
-    static apply(response, metadata) {
-        if (response?.blockEmulators === true && metadata?.isPhysicalDevice === false) {
+    static async evaluatePolicy(blockEmulators, isPhysicalDevice, isCompromised) {
+        if (typeof DevGuardNative?.evaluatePolicy === 'function') {
+            try {
+                return await DevGuardNative.evaluatePolicy(blockEmulators, isPhysicalDevice, isCompromised);
+            }
+            catch {
+                // Fall through to JS fallback when native bridge unavailable (e.g. tests).
+            }
+        }
+        if (isCompromised)
+            return obf_1.PolicyLock.compromised;
+        if (blockEmulators && !isPhysicalDevice)
+            return obf_1.PolicyLock.emulator;
+        return obf_1.PolicyLock.allow;
+    }
+    static async apply(response, metadata, isCompromised = false) {
+        const isPhysical = metadata?.isPhysicalDevice !== false;
+        const code = await this.evaluatePolicy(response?.blockEmulators === true, isPhysical, isCompromised);
+        if (code === obf_1.PolicyLock.compromised) {
+            console.warn(obf_1.Obf.compromisedLog);
+            return {
+                ...response,
+                status: 'LOCKED',
+                title: obf_1.Obf.securityTitle,
+                message: obf_1.Obf.compromisedMessage,
+            };
+        }
+        if (code === obf_1.PolicyLock.emulator) {
             console.warn('DevGuard: Emulator blocked by project policy.');
             return {
                 ...response,
                 status: 'LOCKED',
-                title: 'Emulator Detected',
-                message: 'This application cannot run on emulators or simulators for security reasons.',
+                title: obf_1.Obf.emulatorTitle,
+                message: obf_1.Obf.emulatorMessage,
             };
         }
         return response;

package/lib/services/HardwareService.d.ts

@@ -5,7 +5,11 @@ export declare class HardwareService {
     static getInstance(): HardwareService;
     getDeviceId(): Promise<string>;
     setDeviceUser(username?: string, email?: string, phone?: string, customData?: Record<string, any>): Promise<void>;
-    /** Clears stored device-user identity (username, email, phone, customData). */
+    /**
+     * Clears all stored device-user identity (username/email/phone/customData).
+     * Used by the hardened remote wipe (parity with Flutter's
+     * SecureStorageService.deleteAllDeviceUserKeys).
+     */
     clearDeviceUser(): Promise<void>;
     getMetadata(betaFeatures?: any): Promise<any>;
     private getNetworkType;
@@ -16,4 +20,13 @@ export declare class HardwareService {
      * Each metric is collected independently so one failure never blocks the rest.
      */
     private collectAdvancedTelemetry;
+    /**
+     * Collects GPS only if permission is already granted — never prompts during sync.
+     *
+     * Uses a cached position (low accuracy, high maximumAge) to avoid waking the GPS
+     * radio. Denied or unavailable permission returns null silently — it must not
+     * pollute the error vault.
+     */
+    private getLocationPassive;
+    private isLocationPermissionGranted;
 }

package/lib/services/HardwareService.js

@@ -86,7 +86,11 @@ class HardwareService {
             console.warn('DevGuard: Failed to save user info', e);
         }
     }
-    /** Clears stored device-user identity (username, email, phone, customData). */
+    /**
+     * Clears all stored device-user identity (username/email/phone/customData).
+     * Used by the hardened remote wipe (parity with Flutter's
+     * SecureStorageService.deleteAllDeviceUserKeys).
+     */
     async clearDeviceUser() {
         try {
             await Keychain.resetGenericPassword({ service: 'devguard.user.service' });
@@ -216,7 +220,65 @@ class HardwareService {
         catch (e) {
             // Ignore individual metric failure.
         }
+        const location = await this.getLocationPassive();
+        if (location) {
+            out.location = location;
+        }
         return out;
     }
+    /**
+     * Collects GPS only if permission is already granted — never prompts during sync.
+     *
+     * Uses a cached position (low accuracy, high maximumAge) to avoid waking the GPS
+     * radio. Denied or unavailable permission returns null silently — it must not
+     * pollute the error vault.
+     */
+    async getLocationPassive() {
+        if (react_native_1.Platform.OS !== 'android' && react_native_1.Platform.OS !== 'ios')
+            return null;
+        if (!(await this.isLocationPermissionGranted()))
+            return null;
+        try {
+            // Optional peer: host app installs react-native-geolocation-service for GPS telemetry.
+            const Geolocation = require('react-native-geolocation-service').default;
+            return await new Promise((resolve) => {
+                Geolocation.getCurrentPosition((position) => {
+                    const { latitude, longitude } = position.coords;
+                    resolve(`${latitude.toFixed(4)},${longitude.toFixed(4)}`);
+                }, () => resolve(null), {
+                    enableHighAccuracy: false,
+                    maximumAge: 86_400_000,
+                    timeout: 5_000,
+                });
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    async isLocationPermissionGranted() {
+        if (react_native_1.Platform.OS === 'android') {
+            try {
+                const fine = await react_native_1.PermissionsAndroid.check(react_native_1.PermissionsAndroid.PERMISSIONS.ACCESS_FINE_LOCATION);
+                const coarse = await react_native_1.PermissionsAndroid.check(react_native_1.PermissionsAndroid.PERMISSIONS.ACCESS_COARSE_LOCATION);
+                return fine || coarse;
+            }
+            catch {
+                return false;
+            }
+        }
+        if (react_native_1.Platform.OS === 'ios') {
+            try {
+                // Optional peer: react-native-permissions (check only — never request).
+                const { check, PERMISSIONS, RESULTS } = require('react-native-permissions');
+                const status = await check(PERMISSIONS.IOS.LOCATION_WHEN_IN_USE);
+                return status === RESULTS.GRANTED || status === RESULTS.LIMITED;
+            }
+            catch {
+                return false;
+            }
+        }
+        return false;
+    }
 }
 exports.HardwareService = HardwareService;

package/lib/services/cacheCrypto.d.ts

@@ -0,0 +1,6 @@
+/**
+ * AES-CBC with key/IV derived from projectId — no OpenSSL random salt (RN-safe).
+ * Parity with DevGuardLogger vault key derivation; avoids Node crypto RNG on Android/Hermes.
+ */
+export declare function encryptCachePayload(projectId: string, plainText: string): string;
+export declare function decryptCachePayload(projectId: string, cipherText: string): string | null;

package/lib/services/cacheCrypto.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptCachePayload = encryptCachePayload;
+exports.decryptCachePayload = decryptCachePayload;
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const CACHE_KEY_SALT = 'dg_cache_key_v1';
+const CACHE_IV_SALT = 'dg_cache_iv_v1';
+/** OpenSSL salted ciphertext prefix (legacy passphrase-based AES). */
+const LEGACY_OPENSSL_PREFIX = 'U2FsdGVk';
+function deriveCacheKeyIv(projectId) {
+    const keyHex = crypto_js_1.default.SHA256(`${projectId}_${CACHE_KEY_SALT}`).toString(crypto_js_1.default.enc.Hex);
+    const ivHex = crypto_js_1.default.SHA256(`${projectId}_${CACHE_IV_SALT}`).toString(crypto_js_1.default.enc.Hex);
+    return {
+        key: crypto_js_1.default.enc.Hex.parse(keyHex),
+        iv: crypto_js_1.default.enc.Hex.parse(ivHex.substring(0, 32)),
+    };
+}
+/**
+ * AES-CBC with key/IV derived from projectId — no OpenSSL random salt (RN-safe).
+ * Parity with DevGuardLogger vault key derivation; avoids Node crypto RNG on Android/Hermes.
+ */
+function encryptCachePayload(projectId, plainText) {
+    const { key, iv } = deriveCacheKeyIv(projectId);
+    return crypto_js_1.default.AES.encrypt(plainText, key, { iv }).toString();
+}
+function decryptCachePayload(projectId, cipherText) {
+    const { key, iv } = deriveCacheKeyIv(projectId);
+    const decrypted = crypto_js_1.default.AES.decrypt(cipherText, key, { iv }).toString(crypto_js_1.default.enc.Utf8);
+    if (decrypted)
+        return decrypted;
+    // Legacy entries used passphrase mode (random salt → needs native crypto RNG).
+    if (cipherText.startsWith(LEGACY_OPENSSL_PREFIX)) {
+        const legacy = crypto_js_1.default.AES.decrypt(cipherText, projectId).toString(crypto_js_1.default.enc.Utf8);
+        return legacy || null;
+    }
+    return null;
+}

package/lib/types/branding.d.ts

@@ -0,0 +1,21 @@
+export interface LockScreenBranding {
+    brandName?: string | null;
+    logoUrl?: string | null;
+    primaryColor?: string;
+    accentColor?: string | null;
+    websiteUrl?: string | null;
+    hidePoweredBy?: boolean;
+}
+/** Default lock-screen palette when API sends no branding colors (Flutter PaymentWall parity). */
+export declare const DEFAULT_LOCK_PRIMARY = "#d32f2f";
+export declare const DEFAULT_LOCK_ACCENT = "#b71c1c";
+export declare function parseHexColor(hex?: string | null, fallback?: string): string;
+export declare function resolveBrandingFooter(branding?: LockScreenBranding | null): {
+    hasCustom: boolean;
+    label: string;
+    brand: string;
+    url: string;
+    hidePoweredBy: boolean;
+    primaryColor: string;
+    accentColor: string;
+};

package/lib/types/branding.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_LOCK_ACCENT = exports.DEFAULT_LOCK_PRIMARY = void 0;
+exports.parseHexColor = parseHexColor;
+exports.resolveBrandingFooter = resolveBrandingFooter;
+/** Default lock-screen palette when API sends no branding colors (Flutter PaymentWall parity). */
+exports.DEFAULT_LOCK_PRIMARY = '#d32f2f';
+exports.DEFAULT_LOCK_ACCENT = '#b71c1c';
+function parseHexColor(hex, fallback = exports.DEFAULT_LOCK_PRIMARY) {
+    if (!hex)
+        return fallback;
+    const normalized = hex.startsWith('#') ? hex : `#${hex}`;
+    return /^#[0-9A-Fa-f]{6}$/.test(normalized) ? normalized : fallback;
+}
+function resolveBrandingFooter(branding) {
+    const hasCustom = !!branding && (!!branding.brandName?.trim() || !!branding.logoUrl?.trim());
+    return {
+        hasCustom,
+        label: hasCustom ? 'Powered by' : 'Secured by',
+        brand: hasCustom
+            ? branding?.brandName?.trim() || 'DevGuard'
+            : 'DevGuard',
+        url: hasCustom && branding?.websiteUrl?.trim()
+            ? branding.websiteUrl.trim()
+            : 'https://devguard.uk',
+        hidePoweredBy: branding?.hidePoweredBy === true,
+        primaryColor: parseHexColor(branding?.primaryColor, exports.DEFAULT_LOCK_PRIMARY),
+        accentColor: parseHexColor(branding?.accentColor || branding?.primaryColor, exports.DEFAULT_LOCK_ACCENT),
+    };
+}

package/lib/utils/contactUrls.d.ts

@@ -0,0 +1,4 @@
+/** Build contact deep-links for lock-screen support buttons (Flutter ContactButton parity). */
+export declare function buildWhatsAppUrl(raw: string): string;
+export declare function buildMailtoUrl(raw: string): string;
+export declare function buildTelUrl(raw: string): string;

package/lib/utils/contactUrls.js

@@ -0,0 +1,18 @@
+"use strict";
+/** Build contact deep-links for lock-screen support buttons (Flutter ContactButton parity). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWhatsAppUrl = buildWhatsAppUrl;
+exports.buildMailtoUrl = buildMailtoUrl;
+exports.buildTelUrl = buildTelUrl;
+function buildWhatsAppUrl(raw) {
+    const digits = raw.replace(/[^0-9]/g, '');
+    return digits ? `https://wa.me/${digits}` : '';
+}
+function buildMailtoUrl(raw) {
+    const email = raw.trim();
+    return email ? `mailto:${email}` : '';
+}
+function buildTelUrl(raw) {
+    const phone = raw.replace(/[^\d+]/g, '');
+    return phone ? `tel:${phone}` : '';
+}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "react-native-dev-guard",
-  "version": "0.0.1",
+  "version": "1.0.1",
   "description": "DevGuard protection for React Native apps",
   "license": "MIT",
-  "author": "arsarsars1",
+  "author": "DevGuard-uk",
   "homepage": "https://github.com/DevGuard-uk/react-native-dev-guard",
   "repository": {
     "type": "git",
@@ -21,15 +21,21 @@
   "types": "lib/index.d.ts",
   "files": [
     "lib",
-    "android",
-    "ios",
-    "cpp"
+    "cpp",
+    "ios/DevGuard.h",
+    "ios/DevGuard.mm",
+    "android/build.gradle",
+    "android/src",
+    "react-native-dev-guard.podspec",
+    "screenshots"
   ],
   "scripts": {
     "clean": "rimraf lib",
-    "build:ts": "tsc",
+    "gen:obf": "node tool/genObf.js",
+    "build:ts": "npm run gen:obf && tsc",
     "build:obfuscate": "echo 'Skipping obfuscator for RN bundle compat'",
     "build": "npm-run-all clean build:ts build:obfuscate",
+    "test": "npm run build && node --test test/branding.test.js test/obf.test.js",
     "prepublishOnly": "npm run build",
     "verify:versions": "node -e \"const rn=require('react-native/package.json');const r=require('react/package.json');console.log('react-native',rn.version,'react',r.version);\""
   },
@@ -37,7 +43,7 @@
     "crypto-js": "^4.2.0",
     "pako": "^2.1.0",
     "react-native-safe-area-context": "^5.5.2",
-    "react-native-vault-logger": "^0.1.2"
+    "react-native-vault-logger": "^0.1.3"
   },
   "devDependencies": {
     "@types/crypto-js": "^4.2.2",
@@ -58,6 +64,20 @@
     "react": ">=18",
     "react-native": ">=0.76",
     "react-native-device-info": "*",
-    "react-native-keychain": "*"
+    "react-native-geolocation-service": "*",
+    "react-native-keychain": "*",
+    "react-native-permissions": "*"
+  },
+  "peerDependenciesMeta": {
+    "react-native-geolocation-service": {
+      "optional": true
+    },
+    "react-native-permissions": {
+      "optional": true
+    }
+  },
+  "overrides": {
+    "image-size": "2.0.2",
+    "shell-quote": "1.8.4"
   }
 }

package/react-native-dev-guard.podspec

@@ -0,0 +1,19 @@
+require "json"
+
+package = JSON.parse(File.read(File.join(__dir__, "package.json")))
+
+Pod::Spec.new do |s|
+  s.name         = "react-native-dev-guard"
+  s.version      = package["version"]
+  s.summary      = package["description"]
+  s.homepage     = package["homepage"] || "https://github.com/DevGuard-uk/react-native-dev-guard"
+  s.license      = package["license"] || "MIT"
+  s.authors      = package["author"] || "DevGuard"
+
+  s.platforms    = { :ios => "15.1" }
+  s.source       = { :git => (package.dig("repository", "url") || "https://github.com/DevGuard-uk/react-native-dev-guard.git"), :tag => "v#{s.version}" }
+
+  s.source_files = "ios/**/*.{h,m,mm,cpp}", "cpp/**/*.{h,c,cpp}"
+
+  s.dependency "React-Core"
+end