import * as Keychain from 'react-native-keychain';

// Store credentials
async function storeToken(token: string): Promise<void> {
  await Keychain.setGenericPassword('auth', token, {
    accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
    securityLevel: Keychain.SECURITY_LEVEL.SECURE_HARDWARE,
  });
}

// Retrieve credentials
async function getToken(): Promise<string | null> {
  const credentials = await Keychain.getGenericPassword();
  if (credentials) {
    return credentials.password;
  }
  return null;
}

// Clear on logout
async function clearToken(): Promise<void> {
  await Keychain.resetGenericPassword();
}

import * as SecureStore from 'expo-secure-store';

await SecureStore.setItemAsync('refreshToken', token, {
  keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
});

const stored = await SecureStore.getItemAsync('refreshToken');

import * as Keychain from 'react-native-keychain';
import ReactNativeBiometrics from 'react-native-biometrics';

const biometrics = new ReactNativeBiometrics();

async function storeWithBiometric(key: string, value: string): Promise<void> {
  await Keychain.setGenericPassword(key, value, {
    accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
    accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
    authenticationType: Keychain.AUTHENTICATION_TYPE.BIOMETRICS,
  });
}

async function getWithBiometric(): Promise<string | null> {
  const { available } = await biometrics.isSensorAvailable();
  if (!available) {
    // Fall back to PIN/passcode prompt
    return null;
  }

  try {
    const credentials = await Keychain.getGenericPassword({
      authenticationPrompt: {
        title: 'Authenticate to access your account',
      },
    });
    return credentials ? credentials.password : null;
  } catch {
    // User cancelled or biometric failed
    return null;
  }
}

import { fetch } from 'react-native-ssl-pinning';

async function secureFetch(url: string, accessToken: string) {
  const response = await fetch(url, {
    method: 'GET',
    headers: {
      Authorization: `Bearer ${accessToken}`,
    },
    sslPinning: {
      certs: ['server-cert'], // .cer file in app bundle
    },
    timeoutInterval: 10000,
  });

  return response.json();
}

<!-- ios/YourApp/Info.plist -->
<key>NSAppTransportSecurity</key>
<dict>
  <!-- Do NOT set NSAllowsArbitraryLoads to true in production -->
  <key>NSExceptionDomains</key>
  <dict>
    <key>legacy-api.example.com</key>
    <dict>
      <key>NSExceptionMinimumTLSVersion</key>
      <string>TLSv1.2</string>
      <key>NSExceptionRequiresForwardSecrecy</key>
      <true/>
    </dict>
  </dict>
</dict>

<!-- android/app/src/main/res/xml/network_security_config.xml -->
<network-security-config>
  <base-config cleartextTrafficPermitted="false">
    <trust-anchors>
      <certificates src="system" />
    </trust-anchors>
  </base-config>

  <domain-config>
    <domain includeSubdomains="true">api.yourapp.com</domain>
    <pin-set expiration="2027-01-01">
      <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
      <!-- Always include a backup pin -->
      <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
    </pin-set>
  </domain-config>
</network-security-config>

<application
  android:networkSecurityConfig="@xml/network_security_config"
  ...>

Client app  ──→  Your backend proxy  ──→  Third-party API
                  (holds the real key)

// Bad: API key in the JS bundle — extractable in minutes
const response = await fetch('https://maps.googleapis.com/maps/api/...', {
  headers: { 'X-API-Key': 'AIzaSy...' }, // shipped to every device
});

// Good: proxy through your backend
const response = await fetch('https://api.yourapp.com/maps/geocode', {
  headers: { Authorization: `Bearer ${accessToken}` },
});
// Your backend adds the Google API key server-side

android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
                          'proguard-rules.pro'
        }
    }
}

// core/security/obfuscate.ts

// Simple XOR obfuscation — not cryptographic, but defeats grep
function deobfuscate(encoded: number[], key: number): string {
  return String.fromCharCode(...encoded.map((c) => c ^ key));
}

// Pre-compute at build time, store as number arrays
// "api/v2/payments" → XOR with key 42
const PAYMENTS_ENDPOINT = deobfuscate(
  [75, 90, 73, 89, 88, 84, 89, 90, 75, 91, 69, 78, 68, 82, 84],
  42,
);

import JailMonkey from 'jail-monkey';

interface DeviceSecurityStatus {
  isRooted: boolean;
  canMockLocation: boolean;
  isDebugMode: boolean;
  isOnExternalStorage: boolean;
}

function checkDeviceSecurity(): DeviceSecurityStatus {
  return {
    isRooted: JailMonkey.isJailBroken(),
    canMockLocation: JailMonkey.canMockLocation(),
    isDebugMode: JailMonkey.isDebuggedMode(),
    isOnExternalStorage: JailMonkey.isOnExternalStorage(),
  };
}

import { useFreeRasp, type TalsecConfig } from 'freerasp-react-native';

const talsecConfig: TalsecConfig = {
  androidConfig: {
    packageName: 'com.yourapp',
    certificateHashes: ['your_signing_cert_hash'],
  },
  iosConfig: {
    appBundleId: 'com.yourapp',
    appTeamId: 'YOUR_TEAM_ID',
  },
  watcherMail: 'security@yourapp.com',
};

const threatCallbacks = {
  onRootDetected: () => handleThreat('root'),
  onDebuggerDetected: () => handleThreat('debugger'),
  onTamperDetected: () => handleThreat('tamper'),
  onHookDetected: () => handleThreat('hook'),
  onDeviceBindingDetected: () => handleThreat('deviceBinding'),
  onUnofficialStoreDetected: () => handleThreat('unofficialStore'),
};

function handleThreat(type: string): void {
  // Tiered response — see below
  analytics.track('security_threat', { type });

  switch (type) {
    case 'root':
    case 'hook':
      // Degrade gracefully: disable sensitive features
      securityStore.setState({ restrictedMode: true });
      break;
    case 'tamper':
    case 'debugger':
      // Hard block: force logout
      authStore.getState().logout();
      break;
  }
}

// In your App component
function App() {
  useFreeRasp(talsecConfig, threatCallbacks);
  return <MainNavigator />;
}

// android/app/src/main/java/com/yourapp/ScreenProtectionModule.kt
package com.yourapp

import android.view.WindowManager
import com.facebook.react.bridge.ReactApplicationContext
import com.facebook.react.bridge.ReactContextBaseJavaModule
import com.facebook.react.bridge.ReactMethod

class ScreenProtectionModule(
    private val reactContext: ReactApplicationContext
) : ReactContextBaseJavaModule(reactContext) {

    override fun getName() = "ScreenProtection"

    @ReactMethod
    fun enable() {
        currentActivity?.runOnUiThread {
            currentActivity?.window?.addFlags(
                WindowManager.LayoutParams.FLAG_SECURE
            )
        }
    }

    @ReactMethod
    fun disable() {
        currentActivity?.runOnUiThread {
            currentActivity?.window?.clearFlags(
                WindowManager.LayoutParams.FLAG_SECURE
            )
        }
    }
}

import { NativeModules } from 'react-native';

const { ScreenProtection } = NativeModules;

// Enable on sensitive screens
function PaymentScreen() {
  useEffect(() => {
    ScreenProtection.enable();
    return () => ScreenProtection.disable();
  }, []);

  return <PaymentForm />;
}

// Hook to overlay a blur/splash when app backgrounds
import { useEffect } from 'react';
import { AppState, type AppStateStatus } from 'react-native';

export function useAppBackgroundProtection() {
  useEffect(() => {
    const handleChange = (state: AppStateStatus) => {
      if (state === 'inactive' || state === 'background') {
        // Show a privacy overlay (splash screen, blur)
        privacyOverlayStore.setState({ visible: true });
      } else if (state === 'active') {
        privacyOverlayStore.setState({ visible: false });
      }
    };

    const subscription = AppState.addEventListener('change', handleChange);
    return () => subscription.remove();
  }, []);
}

// core/security/debugDetection.ts

export function isDebugEnvironment(): boolean {
  if (__DEV__) return true;

  // Android: check for debugger attachment
  // This requires a native module for reliable detection
  return false;
}

export function enforceReleaseMode(): void {
  if (__DEV__) {
    console.warn('Running in debug mode — security checks relaxed');
    return;
  }

  // In release, verify integrity
  const checks = [
    !__DEV__,
    typeof atob === 'function', // Hermes environment check
  ];

  if (checks.some((c) => !c)) {
    // Environment has been tampered with
    authStore.getState().logout();
  }
}

// core/auth/tokenManager.ts
import * as Keychain from 'react-native-keychain';

class TokenManager {
  // Access token lives in memory only — never persisted to disk
  private accessToken: string | null = null;

  async setTokens(access: string, refresh: string): Promise<void> {
    this.accessToken = access;
    await Keychain.setGenericPassword('refresh', refresh, {
      service: 'com.yourapp.refresh-token',
      accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
    });
  }

  getAccessToken(): string | null {
    return this.accessToken;
  }

  async getRefreshToken(): Promise<string | null> {
    const creds = await Keychain.getGenericPassword({
      service: 'com.yourapp.refresh-token',
    });
    return creds ? creds.password : null;
  }

  async clearAll(): Promise<void> {
    this.accessToken = null;
    await Keychain.resetGenericPassword({
      service: 'com.yourapp.refresh-token',
    });
  }
}

export const tokenManager = new TokenManager();

// core/auth/refreshTokenRotation.ts
import { tokenManager } from './tokenManager';

let refreshPromise: Promise<boolean> | null = null;

export async function refreshAccessToken(): Promise<boolean> {
  // Deduplicate concurrent refresh attempts
  if (refreshPromise) return refreshPromise;

  refreshPromise = (async () => {
    try {
      const refreshToken = await tokenManager.getRefreshToken();
      if (!refreshToken) return false;

      const response = await fetch('https://api.yourapp.com/auth/refresh', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ refreshToken }),
      });

      if (!response.ok) {
        await tokenManager.clearAll();
        return false;
      }

      const { accessToken, refreshToken: newRefreshToken } =
        await response.json();

      // Server issues a new refresh token — old one is invalidated
      await tokenManager.setTokens(accessToken, newRefreshToken);
      return true;
    } catch {
      return false;
    } finally {
      refreshPromise = null;
    }
  })();

  return refreshPromise;
}

import ReactNativeBiometrics from 'react-native-biometrics';

const biometrics = new ReactNativeBiometrics({
  allowDeviceCredentials: true, // fall back to device PIN
});

export async function authenticateUser(): Promise<boolean> {
  const { available, biometryType } = await biometrics.isSensorAvailable();

  if (!available) {
    // Device has no biometric hardware — fall back to password
    return false;
  }

  const { success } = await biometrics.simplePrompt({
    promptMessage: `Sign in with ${biometryType}`,
    cancelButtonText: 'Use password',
  });

  return success;
}

// core/auth/sessionTimeout.ts
import { AppState, type AppStateStatus } from 'react-native';

const SESSION_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes

class SessionTimeoutManager {
  private backgroundedAt: number | null = null;

  start(): void {
    AppState.addEventListener('change', this.handleAppStateChange);
  }

  private handleAppStateChange = (state: AppStateStatus): void => {
    if (state === 'background') {
      this.backgroundedAt = Date.now();
    } else if (state === 'active' && this.backgroundedAt) {
      const elapsed = Date.now() - this.backgroundedAt;
      this.backgroundedAt = null;

      if (elapsed > SESSION_TIMEOUT_MS) {
        // Session expired — require re-authentication
        authStore.getState().requireReauth();
      }
    }
  };
}

export const sessionTimeout = new SessionTimeoutManager();

import { authorize, type AuthConfiguration } from 'react-native-app-auth';

const config: AuthConfiguration = {
  issuer: 'https://auth.yourapp.com',
  clientId: 'mobile-app',
  redirectUrl: 'com.yourapp://oauth/callback',
  scopes: ['openid', 'profile', 'offline_access'],
  usePKCE: true, // generates code_verifier + code_challenge automatically
  additionalParameters: {
    prompt: 'consent',
  },
};

export async function login(): Promise<void> {
  try {
    const result = await authorize(config);

    await tokenManager.setTokens(
      result.accessToken,
      result.refreshToken ?? '',
    );
  } catch (error) {
    // User cancelled or auth failed
    throw new AuthenticationError('Login failed', { cause: error });
  }
}

// Validate incoming deep links before acting on them
import { Linking } from 'react-native';

const ALLOWED_HOSTS = ['app.yourapp.com', 'yourapp.com'];

async function handleDeepLink(url: string): Promise<void> {
  const parsed = new URL(url);

  // Reject links from unexpected origins
  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
    console.warn(`Rejected deep link from unknown host: ${parsed.hostname}`);
    return;
  }

  // Validate path structure before navigating
  const oauthCallback = parsed.pathname.match(/^\/oauth\/callback/);
  if (oauthCallback) {
    const code = parsed.searchParams.get('code');
    const state = parsed.searchParams.get('state');

    if (!code || !state) {
      console.warn('Malformed OAuth callback — missing code or state');
      return;
    }

    // Validate state parameter matches what we generated
    const expectedState = await SecureStore.getItemAsync('oauth_state');
    if (state !== expectedState) {
      console.warn('OAuth state mismatch — possible CSRF');
      return;
    }

    await exchangeCodeForTokens(code);
  }
}

// babel.config.js
module.exports = {
  presets: ['module:@react-native/babel-preset'],
  env: {
    production: {
      plugins: ['transform-remove-console'],
    },
  },
};

// babel.config.js
module.exports = {
  presets: ['module:@react-native/babel-preset'],
  env: {
    production: {
      plugins: [
        ['transform-remove-console', { exclude: ['error', 'warn'] }],
      ],
    },
  },
};

import { WebView } from 'react-native-webview';

function SecureWebView({ url }: { url: string }) {
  return (
    <WebView
      source={{ uri: url }}
      // Restrict which origins can load
      originWhitelist={['https://trusted.yourapp.com']}
      // Disable JavaScript if content is static
      javaScriptEnabled={false}
      // Prevent navigation to unexpected URLs
      onShouldStartLoadWithRequest={(request) => {
        return request.url.startsWith('https://trusted.yourapp.com');
      }}
      // Do NOT use injectedJavaScript for sensitive operations
      // It runs in the WebView context and can be intercepted
    />
  );
}

// core/storage/gdprWipe.ts
import AsyncStorage from '@react-native-async-storage/async-storage';
import * as Keychain from 'react-native-keychain';
import { MMKV } from 'react-native-mmkv';

const storage = new MMKV();

export async function wipeAllUserData(): Promise<void> {
  // 1. Clear secure credentials
  await Keychain.resetGenericPassword();
  await Keychain.resetGenericPassword({ service: 'com.yourapp.refresh-token' });

  // 2. Clear fast storage
  storage.clearAll();

  // 3. Clear async storage
  await AsyncStorage.clear();

  // 4. Request server-side deletion
  await fetch('https://api.yourapp.com/user/delete', {
    method: 'DELETE',
    headers: { Authorization: `Bearer ${lastAccessToken}` },
  });
}