react-native-dev-guard 0.0.1

package/lib/services/DeviceTokenService.js

@@ -0,0 +1,135 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceTokenService = void 0;
+const crypto_js_1 = __importDefault(require("crypto-js"));
+// Conditional import — react-native-keychain is a peer dependency
+let Keychain = null;
+try {
+    Keychain = require('react-native-keychain');
+}
+catch (e) {
+    // Keychain not available — fallback to in-memory with AES encryption
+    console.warn('DevGuard: react-native-keychain not installed. Device tokens will not persist across restarts.');
+}
+const TOKEN_SERVICE_KEY = 'com.devguard.device-token';
+const FINGERPRINT_SERVICE_KEY = 'com.devguard.fingerprint';
+class DeviceTokenService {
+    static instance;
+    cachedToken = null;
+    sessionKey;
+    fingerprint = null;
+    constructor() {
+        // Generate a session key without relying on native crypto, which often fails in RN environments
+        // without specific polyfills (e.g. react-native-get-random-values).
+        this.sessionKey = Date.now().toString(36) + Math.random().toString(36).substring(2);
+    }
+    static getInstance() {
+        if (!DeviceTokenService.instance) {
+            DeviceTokenService.instance = new DeviceTokenService();
+        }
+        return DeviceTokenService.instance;
+    }
+    /**
+     * Retrieves the device registration token.
+     * Reads from Keychain/Keystore if available, otherwise from in-memory cache.
+     */
+    async getToken() {
+        // Try Keychain first (persists across restarts)
+        if (Keychain) {
+            try {
+                const credentials = await Keychain.getGenericPassword({ service: TOKEN_SERVICE_KEY });
+                if (credentials && credentials.password) {
+                    return credentials.password;
+                }
+            }
+            catch (e) {
+                console.warn('DevGuard: Keychain read failed, using in-memory fallback');
+            }
+        }
+        // Fallback: in-memory token
+        return this.cachedToken;
+    }
+    /** Persists a registration token using Keychain/Keystore when available. */
+    async saveToken(token, useEnclave = false) {
+        let finalToken = token;
+        if (useEnclave) {
+            // Simulated enclave: reverse and prefix
+            finalToken = `se:${token.split('').reverse().join('')}`;
+        }
+        // Primary: Keychain/Keystore (hardware-backed, persists across restarts)
+        if (Keychain) {
+            try {
+                await Keychain.setGenericPassword('devguard', finalToken, {
+                    service: TOKEN_SERVICE_KEY,
+                    accessible: Keychain.ACCESSIBLE?.AFTER_FIRST_UNLOCK || undefined,
+                    securityLevel: Keychain.SECURITY_LEVEL?.SECURE_HARDWARE || undefined,
+                });
+            }
+            catch (e) {
+                console.warn('DevGuard: Keychain write failed, using in-memory fallback');
+            }
+        }
+        // Secondary: in-memory (always set as backup) - Plain for now due to RNG issues in RN
+        this.cachedToken = finalToken;
+    }
+    /**
+     * Removes the registration token. Only called on explicit admin revocation.
+     */
+    async clearToken() {
+        // Clear Keychain
+        if (Keychain) {
+            try {
+                await Keychain.resetGenericPassword({ service: TOKEN_SERVICE_KEY });
+            }
+            catch (e) {
+                // Ignore cleanup errors
+            }
+        }
+        // Clear in-memory
+        this.cachedToken = null;
+        this.sessionKey = Date.now().toString(36) + Math.random().toString(36).substring(2);
+    }
+    /**
+     * Generates a device fingerprint from hardware identifiers.
+     * This fingerprint persists even if the token is wiped, allowing
+     * the server to detect re-registrations from the same hardware.
+     */
+    static generateFingerprint(deviceId, model, os) {
+        const raw = `${deviceId}|${model}|${os}`;
+        return crypto_js_1.default.SHA256(raw).toString().substring(0, 16);
+    }
+    async saveFingerprint(fingerprint) {
+        this.fingerprint = fingerprint;
+        if (Keychain) {
+            try {
+                await Keychain.setGenericPassword('devguard', fingerprint, {
+                    service: FINGERPRINT_SERVICE_KEY,
+                });
+            }
+            catch (e) {
+                // Ignore
+            }
+        }
+    }
+    async getFingerprint() {
+        if (this.fingerprint)
+            return this.fingerprint;
+        if (Keychain) {
+            try {
+                const credentials = await Keychain.getGenericPassword({ service: FINGERPRINT_SERVICE_KEY });
+                if (credentials && credentials.password) {
+                    this.fingerprint = credentials.password;
+                    return this.fingerprint;
+                }
+            }
+            catch (e) {
+                // Ignore
+            }
+        }
+        return null;
+    }
+}
+exports.DeviceTokenService = DeviceTokenService;

package/lib/services/GuardEnforcement.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Client-side policy enforcement applied to a server response before it is
+ * shown to the user. Mirrors the Flutter plugin's `GuardEnforcement` so both
+ * platforms behave identically.
+ */
+export declare class GuardEnforcement {
+    /**
+     * Applies enforcement rules to a fresh server response.
+     *
+     * - `blockEmulators`: if the project blocks emulators and the current device
+     *   is not a physical device, the response is overridden to LOCKED.
+     *
+     * @param response The parsed server response (mutated copy returned).
+     * @param metadata The device metadata collected for this sync.
+     */
+    static apply(response: any, metadata: {
+        isPhysicalDevice?: boolean;
+    }): any;
+}

package/lib/services/GuardEnforcement.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardEnforcement = void 0;
+/**
+ * Client-side policy enforcement applied to a server response before it is
+ * shown to the user. Mirrors the Flutter plugin's `GuardEnforcement` so both
+ * platforms behave identically.
+ */
+class GuardEnforcement {
+    /**
+     * Applies enforcement rules to a fresh server response.
+     *
+     * - `blockEmulators`: if the project blocks emulators and the current device
+     *   is not a physical device, the response is overridden to LOCKED.
+     *
+     * @param response The parsed server response (mutated copy returned).
+     * @param metadata The device metadata collected for this sync.
+     */
+    static apply(response, metadata) {
+        if (response?.blockEmulators === true && metadata?.isPhysicalDevice === false) {
+            console.warn('DevGuard: Emulator blocked by project policy.');
+            return {
+                ...response,
+                status: 'LOCKED',
+                title: 'Emulator Detected',
+                message: 'This application cannot run on emulators or simulators for security reasons.',
+            };
+        }
+        return response;
+    }
+}
+exports.GuardEnforcement = GuardEnforcement;

package/lib/services/HardwareService.d.ts

@@ -0,0 +1,19 @@
+export declare class HardwareService {
+    private static instance;
+    private deviceId;
+    private constructor();
+    static getInstance(): HardwareService;
+    getDeviceId(): Promise<string>;
+    setDeviceUser(username?: string, email?: string, phone?: string, customData?: Record<string, any>): Promise<void>;
+    /** Clears stored device-user identity (username, email, phone, customData). */
+    clearDeviceUser(): Promise<void>;
+    getMetadata(betaFeatures?: any): Promise<any>;
+    private getNetworkType;
+    /**
+     * Collects advanced hardware telemetry as FLAT string fields, matching the
+     * Flutter plugin (battery/batteryCharging/batteryThermal/ram/storage) so the
+     * admin panel renders Health (Beta) identically on both platforms.
+     * Each metric is collected independently so one failure never blocks the rest.
+     */
+    private collectAdvancedTelemetry;
+}

package/lib/services/HardwareService.js

@@ -0,0 +1,222 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HardwareService = void 0;
+const react_native_device_info_1 = __importDefault(require("react-native-device-info"));
+const react_native_1 = require("react-native");
+const Keychain = __importStar(require("react-native-keychain"));
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const UsageLogger_1 = require("./UsageLogger");
+const DeviceTokenService_1 = require("./DeviceTokenService");
+class HardwareService {
+    static instance;
+    deviceId = null;
+    constructor() { }
+    static getInstance() {
+        if (!HardwareService.instance) {
+            HardwareService.instance = new HardwareService();
+        }
+        return HardwareService.instance;
+    }
+    async getDeviceId() {
+        if (this.deviceId)
+            return this.deviceId;
+        try {
+            const id = await react_native_device_info_1.default.getUniqueId();
+            if (id && id !== 'unknown') {
+                this.deviceId = id;
+                return id;
+            }
+        }
+        catch (e) {
+            console.warn('DevGuard: Native DeviceInfo failed, falling back to fingerprint');
+        }
+        const fingerprint = [
+            react_native_1.Platform.OS,
+            react_native_1.Platform.Version,
+            react_native_device_info_1.default.getBrand(),
+            react_native_device_info_1.default.getModel(),
+            react_native_device_info_1.default.getSystemName(),
+            react_native_device_info_1.default.getBundleId(),
+        ].join('|');
+        this.deviceId = crypto_js_1.default.SHA256(fingerprint).toString().substring(0, 16);
+        return this.deviceId;
+    }
+    async setDeviceUser(username, email, phone, customData) {
+        try {
+            const userData = JSON.stringify({ username, email, phone, customData });
+            await Keychain.setGenericPassword('devguard_user_info', userData, { service: 'devguard.user.service' });
+        }
+        catch (e) {
+            console.warn('DevGuard: Failed to save user info', e);
+        }
+    }
+    /** Clears stored device-user identity (username, email, phone, customData). */
+    async clearDeviceUser() {
+        try {
+            await Keychain.resetGenericPassword({ service: 'devguard.user.service' });
+        }
+        catch (e) {
+            // Ignore cleanup errors
+        }
+        try {
+            await Keychain.resetGenericPassword({ service: 'devguard.username.service' });
+        }
+        catch (e) {
+            // Ignore cleanup errors
+        }
+    }
+    async getMetadata(betaFeatures = {}) {
+        console.log('DevGuard: Collecting Hardware Metadata...');
+        const isEmulator = await react_native_device_info_1.default.isEmulator();
+        const deviceId = await this.getDeviceId();
+        const model = react_native_device_info_1.default.getModel();
+        const os = `${react_native_1.Platform.OS} ${react_native_1.Platform.Version}`;
+        const usageLogger = UsageLogger_1.UsageLogger.getInstance();
+        const tokenService = DeviceTokenService_1.DeviceTokenService.getInstance();
+        let username, email, phone, customData;
+        try {
+            const credentials = await Keychain.getGenericPassword({ service: 'devguard.user.service' });
+            if (credentials) {
+                const parsed = JSON.parse(credentials.password);
+                username = parsed.username;
+                email = parsed.email;
+                phone = parsed.phone;
+                customData = parsed.customData;
+            }
+            else {
+                // Fallback to older generic password entry
+                const oldCreds = await Keychain.getGenericPassword({ service: 'devguard.username.service' });
+                if (oldCreds)
+                    username = oldCreds.password;
+            }
+        }
+        catch (e) {
+            // Ignore
+        }
+        const isAdvanced = betaFeatures?.advancedTelemetry === true;
+        const metadata = {
+            deviceId,
+            deviceName: await react_native_device_info_1.default.getDeviceName(),
+            model: model,
+            brand: react_native_device_info_1.default.getBrand(),
+            os: os,
+            osVersion: react_native_1.Platform.Version,
+            version: react_native_device_info_1.default.getVersion(),
+            bundleId: react_native_device_info_1.default.getBundleId(),
+            isTablet: react_native_device_info_1.default.isTablet(),
+            isEmulator: isEmulator,
+            isPhysicalDevice: !isEmulator,
+            username: username,
+            email: email,
+            phone: phone,
+            customData: customData,
+            networkType: isAdvanced ? await this.getNetworkType() : 'REDACTED',
+            fingerprint: DeviceTokenService_1.DeviceTokenService.generateFingerprint(deviceId, model, os),
+            deviceToken: await tokenService.getToken(),
+            usageLogs: await usageLogger.getLogs(),
+        };
+        // Advanced telemetry MUST be emitted as FLAT string fields (battery / ram /
+        // storage / batteryCharging / batteryThermal) to match the Flutter plugin's
+        // DeviceMetadata shape. The admin "Health (Beta)" view reads these flat keys
+        // (displayData.battery / .ram / .storage); the old nested objects
+        // (ram.total, health.batteryLevel) were unreadable and rendered "No telemetry".
+        if (isAdvanced) {
+            Object.assign(metadata, await this.collectAdvancedTelemetry());
+        }
+        return metadata;
+    }
+    async getNetworkType() {
+        try {
+            const carrier = await react_native_device_info_1.default.getCarrier();
+            if (carrier && carrier.trim() && carrier.toLowerCase() !== 'unknown') {
+                return carrier;
+            }
+        }
+        catch (e) {
+            // Ignore — fall through to default.
+        }
+        return 'WiFi';
+    }
+    /**
+     * Collects advanced hardware telemetry as FLAT string fields, matching the
+     * Flutter plugin (battery/batteryCharging/batteryThermal/ram/storage) so the
+     * admin panel renders Health (Beta) identically on both platforms.
+     * Each metric is collected independently so one failure never blocks the rest.
+     */
+    async collectAdvancedTelemetry() {
+        const out = { batteryThermal: 'NORMAL' };
+        try {
+            const mem = await react_native_device_info_1.default.getTotalMemory();
+            if (typeof mem === 'number' && mem > 0) {
+                out.ram = `${(mem / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+            }
+        }
+        catch (e) {
+            // Ignore individual metric failure.
+        }
+        try {
+            const total = await react_native_device_info_1.default.getTotalDiskCapacity();
+            if (typeof total === 'number' && total > 0) {
+                out.storage = `${(total / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+            }
+        }
+        catch (e) {
+            // Ignore individual metric failure.
+        }
+        try {
+            // getBatteryLevel returns 0..1, or -1 when unavailable (e.g. simulator).
+            const level = await react_native_device_info_1.default.getBatteryLevel();
+            if (typeof level === 'number' && level >= 0) {
+                out.battery = `${Math.round(level * 100)}%`;
+            }
+        }
+        catch (e) {
+            // Ignore individual metric failure.
+        }
+        try {
+            const charging = await react_native_device_info_1.default.isBatteryCharging();
+            out.batteryCharging = charging ? 'charging' : 'discharging';
+        }
+        catch (e) {
+            // Ignore individual metric failure.
+        }
+        return out;
+    }
+}
+exports.HardwareService = HardwareService;

package/lib/services/RemoteWipeService.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Performs a hardened remote wipe of all local DevGuard security state.
+ * Mirrors the Flutter plugin's `RemoteWipeService` so a wipe clears the same
+ * surface on both platforms (not just the response cache).
+ */
+export declare class RemoteWipeService {
+    /**
+     * Clears local security state:
+     * - cached server response,
+     * - buffered usage logs,
+     * - encrypted vault diagnostics (info + errors),
+     * - stored device-user identity (username/email/phone/customData).
+     *
+     * @param projectId The project whose cache should be cleared.
+     * @param options.revokeToken Also clear the device registration token.
+     */
+    static execute(projectId: string, options?: {
+        revokeToken?: boolean;
+    }): Promise<void>;
+}

package/lib/services/RemoteWipeService.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteWipeService = void 0;
+const CacheService_1 = require("./CacheService");
+const UsageLogger_1 = require("./UsageLogger");
+const DevGuardLogger_1 = require("./DevGuardLogger");
+const DeviceTokenService_1 = require("./DeviceTokenService");
+const HardwareService_1 = require("./HardwareService");
+/**
+ * Performs a hardened remote wipe of all local DevGuard security state.
+ * Mirrors the Flutter plugin's `RemoteWipeService` so a wipe clears the same
+ * surface on both platforms (not just the response cache).
+ */
+class RemoteWipeService {
+    /**
+     * Clears local security state:
+     * - cached server response,
+     * - buffered usage logs,
+     * - encrypted vault diagnostics (info + errors),
+     * - stored device-user identity (username/email/phone/customData).
+     *
+     * @param projectId The project whose cache should be cleared.
+     * @param options.revokeToken Also clear the device registration token.
+     */
+    static async execute(projectId, options = {}) {
+        await CacheService_1.CacheService.clear();
+        await UsageLogger_1.UsageLogger.getInstance().clearLogs();
+        try {
+            await DevGuardLogger_1.DevGuardLogger.clearAll();
+        }
+        catch (e) {
+            // Vault logger may not be initialized — ignore.
+        }
+        try {
+            await HardwareService_1.HardwareService.getInstance().clearDeviceUser();
+        }
+        catch (e) {
+            // Ignore cleanup errors.
+        }
+        if (options.revokeToken) {
+            await DeviceTokenService_1.DeviceTokenService.getInstance().clearToken();
+        }
+    }
+}
+exports.RemoteWipeService = RemoteWipeService;

package/lib/services/UsageLogger.d.ts

@@ -0,0 +1,17 @@
+export interface UsageEvent {
+    type: string;
+    timestamp: string;
+    data?: any;
+}
+export declare class UsageLogger {
+    private static instance;
+    private logs;
+    private sessionPasscode;
+    private constructor();
+    static getInstance(): UsageLogger;
+    setSessionPasscode(passcode: string): void;
+    logEvent(eventType: string, data?: any): Promise<void>;
+    getLogs(): Promise<UsageEvent[]>;
+    clearLogs(): Promise<void>;
+    private crypt;
+}

package/lib/services/UsageLogger.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsageLogger = void 0;
+const crypto_js_1 = __importDefault(require("crypto-js"));
+class UsageLogger {
+    static instance;
+    logs = [];
+    sessionPasscode = null;
+    constructor() { }
+    static getInstance() {
+        if (!UsageLogger.instance) {
+            UsageLogger.instance = new UsageLogger();
+        }
+        return UsageLogger.instance;
+    }
+    setSessionPasscode(passcode) {
+        this.sessionPasscode = passcode;
+    }
+    async logEvent(eventType, data) {
+        const newEvent = {
+            type: eventType,
+            timestamp: new Date().toISOString(),
+            data,
+        };
+        this.logs.push(newEvent);
+        // Keep only the last 100 logs
+        if (this.logs.length > 100) {
+            this.logs = this.logs.slice(-100);
+        }
+        console.log(`DevGuard: Logged event: ${eventType}`);
+    }
+    async getLogs() {
+        return [...this.logs];
+    }
+    async clearLogs() {
+        this.logs = [];
+    }
+    // XOR Crypt logic from Flutter version (Simulated for parity)
+    crypt(text, passcode) {
+        const effectivePasscode = passcode || this.sessionPasscode || "secure_default";
+        const key = crypto_js_1.default.SHA256(effectivePasscode).toString();
+        let result = '';
+        for (let i = 0; i < text.length; i++) {
+            result += String.fromCharCode(text.charCodeAt(i) ^ key.charCodeAt(i % key.length));
+        }
+        return result;
+    }
+}
+exports.UsageLogger = UsageLogger;

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "react-native-dev-guard",
+  "version": "0.0.1",
+  "description": "DevGuard protection for React Native apps",
+  "license": "MIT",
+  "author": "arsarsars1",
+  "homepage": "https://github.com/DevGuard-uk/react-native-dev-guard",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DevGuard-uk/react-native-dev-guard.git"
+  },
+  "keywords": [
+    "react-native",
+    "devguard",
+    "license",
+    "app-protection",
+    "remote-lock",
+    "security"
+  ],
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib",
+    "android",
+    "ios",
+    "cpp"
+  ],
+  "scripts": {
+    "clean": "rimraf lib",
+    "build:ts": "tsc",
+    "build:obfuscate": "echo 'Skipping obfuscator for RN bundle compat'",
+    "build": "npm-run-all clean build:ts build:obfuscate",
+    "prepublishOnly": "npm run build",
+    "verify:versions": "node -e \"const rn=require('react-native/package.json');const r=require('react/package.json');console.log('react-native',rn.version,'react',r.version);\""
+  },
+  "dependencies": {
+    "crypto-js": "^4.2.0",
+    "pako": "^2.1.0",
+    "react-native-safe-area-context": "^5.5.2",
+    "react-native-vault-logger": "^0.1.2"
+  },
+  "devDependencies": {
+    "@types/crypto-js": "^4.2.2",
+    "@types/pako": "^2.0.3",
+    "@types/react": "^19.2.0",
+    "javascript-obfuscator": "^5.4.2",
+    "npm-run-all": "^4.1.5",
+    "react": "19.2.3",
+    "react-native": "0.85.3",
+    "react-native-device-info": "^15.0.2",
+    "react-native-jailbreak": "^0.1.0",
+    "react-native-keychain": "^10.0.0",
+    "rimraf": "^6.1.3",
+    "typescript": "^5.8.3"
+  },
+  "peerDependencies": {
+    "@react-native-async-storage/async-storage": ">=1.23.1",
+    "react": ">=18",
+    "react-native": ">=0.76",
+    "react-native-device-info": "*",
+    "react-native-keychain": "*"
+  }
+}