|
| 1 | +// Tests for src/utils/deviceIntegrity.ts (jail-monkey + Sentry mocked). |
| 2 | +const mockIsJailBroken = jest.fn(); |
| 3 | +const mockHookDetected = jest.fn(); |
| 4 | +const mockCanMockLocation = jest.fn(); |
| 5 | + |
| 6 | +jest.mock('jail-monkey', () => ({ |
| 7 | + __esModule: true, |
| 8 | + default: { |
| 9 | + isJailBroken: () => mockIsJailBroken(), |
| 10 | + hookDetected: () => mockHookDetected(), |
| 11 | + canMockLocation: () => mockCanMockLocation(), |
| 12 | + }, |
| 13 | +})); |
| 14 | + |
| 15 | +const mockSetTag = jest.fn(); |
| 16 | +const mockSetContext = jest.fn(); |
| 17 | +const mockCaptureMessage = jest.fn(); |
| 18 | +jest.mock('@sentry/react-native', () => ({ |
| 19 | + setTag: (...a: any[]) => mockSetTag(...a), |
| 20 | + setContext: (...a: any[]) => mockSetContext(...a), |
| 21 | + captureMessage: (...a: any[]) => mockCaptureMessage(...a), |
| 22 | +})); |
| 23 | + |
| 24 | +jest.mock('i18next', () => ({ |
| 25 | + t: (key: string) => key, |
| 26 | +})); |
| 27 | + |
| 28 | +jest.mock('../managers/LogManager', () => ({ |
| 29 | + logManager: {warn: jest.fn(), error: jest.fn(), info: jest.fn()}, |
| 30 | +})); |
| 31 | + |
| 32 | +// Helper: fresh module instance with a clean cache. |
| 33 | +const loadModule = () => { |
| 34 | + let mod: typeof import('./deviceIntegrity'); |
| 35 | + jest.isolateModules(() => { |
| 36 | + mod = require('./deviceIntegrity'); |
| 37 | + }); |
| 38 | + // @ts-ignore assigned inside isolateModules |
| 39 | + return mod; |
| 40 | +}; |
| 41 | + |
| 42 | +describe('deviceIntegrity', () => { |
| 43 | + beforeEach(() => { |
| 44 | + jest.clearAllMocks(); |
| 45 | + mockIsJailBroken.mockReturnValue(false); |
| 46 | + mockHookDetected.mockReturnValue(false); |
| 47 | + mockCanMockLocation.mockReturnValue(false); |
| 48 | + }); |
| 49 | + |
| 50 | + describe('getDeviceIntegrity', () => { |
| 51 | + it('reports a clean device', () => { |
| 52 | + const {getDeviceIntegrity} = loadModule(); |
| 53 | + expect(getDeviceIntegrity()).toEqual({ |
| 54 | + isCompromised: false, |
| 55 | + hookDetected: false, |
| 56 | + mockLocationEnabled: false, |
| 57 | + reason: null, |
| 58 | + }); |
| 59 | + }); |
| 60 | + |
| 61 | + it('flags a jailbroken/rooted device with reason "jailbroken"', () => { |
| 62 | + mockIsJailBroken.mockReturnValue(true); |
| 63 | + const {getDeviceIntegrity} = loadModule(); |
| 64 | + const result = getDeviceIntegrity(); |
| 65 | + expect(result.isCompromised).toBe(true); |
| 66 | + expect(result.reason).toBe('jailbroken'); |
| 67 | + }); |
| 68 | + |
| 69 | + it('flags a hooked device and prefers "jailbroken" when both are true', () => { |
| 70 | + mockIsJailBroken.mockReturnValue(false); |
| 71 | + mockHookDetected.mockReturnValue(true); |
| 72 | + const {getDeviceIntegrity} = loadModule(); |
| 73 | + expect(getDeviceIntegrity().reason).toBe('hook-detected'); |
| 74 | + |
| 75 | + mockIsJailBroken.mockReturnValue(true); |
| 76 | + const {getDeviceIntegrity: fresh} = loadModule(); |
| 77 | + expect(fresh().reason).toBe('jailbroken'); |
| 78 | + }); |
| 79 | + |
| 80 | + it('does not treat mock-location alone as a compromise', () => { |
| 81 | + mockCanMockLocation.mockReturnValue(true); |
| 82 | + const {getDeviceIntegrity} = loadModule(); |
| 83 | + const result = getDeviceIntegrity(); |
| 84 | + expect(result.mockLocationEnabled).toBe(true); |
| 85 | + expect(result.isCompromised).toBe(false); |
| 86 | + expect(result.reason).toBeNull(); |
| 87 | + }); |
| 88 | + |
| 89 | + it('fails open when the native module throws', () => { |
| 90 | + mockIsJailBroken.mockImplementation(() => { |
| 91 | + throw new Error('native module unavailable'); |
| 92 | + }); |
| 93 | + const {getDeviceIntegrity} = loadModule(); |
| 94 | + expect(getDeviceIntegrity().isCompromised).toBe(false); |
| 95 | + }); |
| 96 | + |
| 97 | + it('caches the result and only hits native once', () => { |
| 98 | + const {getDeviceIntegrity} = loadModule(); |
| 99 | + getDeviceIntegrity(); |
| 100 | + getDeviceIntegrity(); |
| 101 | + expect(mockIsJailBroken).toHaveBeenCalledTimes(1); |
| 102 | + }); |
| 103 | + }); |
| 104 | + |
| 105 | + describe('assertDeviceIntegrityForSensitiveAction', () => { |
| 106 | + it('is a no-op on a clean device', () => { |
| 107 | + const {assertDeviceIntegrityForSensitiveAction} = loadModule(); |
| 108 | + expect(() => |
| 109 | + assertDeviceIntegrityForSensitiveAction('crypto-sign'), |
| 110 | + ).not.toThrow(); |
| 111 | + }); |
| 112 | + |
| 113 | + it('throws DeviceCompromisedError on a compromised device (release builds)', () => { |
| 114 | + const prevDev = (global as any).__DEV__; |
| 115 | + (global as any).__DEV__ = false; |
| 116 | + mockIsJailBroken.mockReturnValue(true); |
| 117 | + const { |
| 118 | + assertDeviceIntegrityForSensitiveAction, |
| 119 | + isDeviceCompromisedError, |
| 120 | + } = loadModule(); |
| 121 | + try { |
| 122 | + assertDeviceIntegrityForSensitiveAction('passkey-register'); |
| 123 | + throw new Error('should have thrown'); |
| 124 | + } catch (err) { |
| 125 | + expect(isDeviceCompromisedError(err)).toBe(true); |
| 126 | + } |
| 127 | + (global as any).__DEV__ = prevDev; |
| 128 | + }); |
| 129 | + |
| 130 | + it('does not block in development builds but still reports telemetry', () => { |
| 131 | + const prevDev = (global as any).__DEV__; |
| 132 | + (global as any).__DEV__ = true; |
| 133 | + mockIsJailBroken.mockReturnValue(true); |
| 134 | + const {assertDeviceIntegrityForSensitiveAction} = loadModule(); |
| 135 | + expect(() => |
| 136 | + assertDeviceIntegrityForSensitiveAction('crypto-sign'), |
| 137 | + ).not.toThrow(); |
| 138 | + expect(mockSetTag).toHaveBeenCalledWith('device.compromised', 'true'); |
| 139 | + (global as any).__DEV__ = prevDev; |
| 140 | + }); |
| 141 | + }); |
| 142 | + |
| 143 | + describe('reportDeviceIntegrityToSentry', () => { |
| 144 | + it('tags the scope and captures a message once for compromised devices', () => { |
| 145 | + mockIsJailBroken.mockReturnValue(true); |
| 146 | + const {getDeviceIntegrity, reportDeviceIntegrityToSentry} = loadModule(); |
| 147 | + const result = getDeviceIntegrity(); |
| 148 | + reportDeviceIntegrityToSentry(result); |
| 149 | + reportDeviceIntegrityToSentry(result); |
| 150 | + expect(mockSetTag).toHaveBeenCalledWith('device.compromised', 'true'); |
| 151 | + expect(mockCaptureMessage).toHaveBeenCalledTimes(1); |
| 152 | + }); |
| 153 | + |
| 154 | + it('never throws even if Sentry throws', () => { |
| 155 | + mockSetTag.mockImplementation(() => { |
| 156 | + throw new Error('sentry down'); |
| 157 | + }); |
| 158 | + const {getDeviceIntegrity, reportDeviceIntegrityToSentry} = loadModule(); |
| 159 | + expect(() => |
| 160 | + reportDeviceIntegrityToSentry(getDeviceIntegrity()), |
| 161 | + ).not.toThrow(); |
| 162 | + }); |
| 163 | + }); |
| 164 | + |
| 165 | + describe('dev override seam', () => { |
| 166 | + it('simulate() forces detection and blocks sensitive actions', () => { |
| 167 | + const {getDeviceIntegrity, assertDeviceIntegrityForSensitiveAction} = |
| 168 | + loadModule(); |
| 169 | + (global as any).__deviceIntegrity.simulate('hook-detected'); |
| 170 | + expect(getDeviceIntegrity().reason).toBe('hook-detected'); |
| 171 | + expect(() => |
| 172 | + assertDeviceIntegrityForSensitiveAction('crypto-sign'), |
| 173 | + ).toThrow(); |
| 174 | + }); |
| 175 | + |
| 176 | + it('clear() restores native detection', () => { |
| 177 | + const {getDeviceIntegrity} = loadModule(); |
| 178 | + (global as any).__deviceIntegrity.simulate(); |
| 179 | + (global as any).__deviceIntegrity.clear(); |
| 180 | + expect(getDeviceIntegrity().isCompromised).toBe(false); |
| 181 | + }); |
| 182 | + }); |
| 183 | +}); |
0 commit comments