Fix mobile robustness gaps: HMAC-SHA256 signing, real RASP detection, centralized API client, configurable cert pinning

[devin-ai-integration]

Fix mobile robustness gaps across all 3 variants (native, hybrid, PWA)

Summary

Addresses critical security and integration gaps identified in the mobile layer (168 source files across native-enhanced, hybrid, and PWA variants). The key changes are:

Security hardening:

• Replaced weak DJB2 hash with HMAC-SHA256 (via crypto.subtle) in TransactionSigning.ts across all 3 variants
• Replaced weak DJB2 hash with SubtleCrypto SHA-256 in DeviceBinding.ts across all 3 variants
• Implemented real RASP Frida/debugger detection (port scanning on 27042/27043, native module library checks) replacing stubs that always returned false
• Made certificate pinning hashes configurable via env vars (REACT_NATIVE_PIN_*, VITE_PIN_*) instead of hardcoded placeholder strings

API client centralization:

• Created new ApiClient.ts singleton with env-based URL resolution, retry with exponential backoff, auth token management, and timeout handling
• Wired CertificatePinning.fetch() into ApiClient so all API calls go through SSL pinning
• Replaced 10+ hardcoded fetch('https://api.agentbanking.com/...') calls across security/performance modules

Bug fixes:

• Fixed PWA broken platform checks — replaced dead code like if ('web' === 'ios') with proper navigator.userAgent detection via getPlatform() helper
• Fixed USSD manager: replaced simulation stubs with real native module bridge (NativeModules.USSDModule) + system dialer fallback (Linking.openURL)
• Replaced base64 "compression" placeholder with a custom DEFLATE implementation in PerformanceManager.ts

All changes applied consistently to mobile-native-enhanced/, mobile-hybrid/, and mobile-pwa/ with platform-appropriate adaptations (React Native Platform.OS / Capacitor Capacitor.getPlatform() / user-agent sniffing for PWA).

Review & Testing Checklist for Human

• Custom DEFLATE implementation correctness — deflateSync/inflateSync in PerformanceManager.ts are hand-rolled stored-block DEFLATE. Verify round-trip correctness with non-trivial payloads and compatibility with any backend expecting standard zlib/deflate. This is the highest-risk change in the PR.
• Circular import risk: ApiClient ↔ CertificatePinning — ApiClient.ts imports CertificatePinning, while CertificatePinning uses fetch internally. Other security modules (RASP, DeviceBinding, TransactionSigning) import ApiClient. Verify no circular dependency at runtime across all 3 variants.
• TypeScript compilation — The mobile TypeScript files were never compiled against real dependencies. Run tsc --noEmit in each mobile variant directory to catch type errors (e.g., missing @types/react-native, Capacitor types).
• PWA process.env at runtime — PWA files reference process.env.VITE_* which requires Vite's define plugin. Verify these are replaced at build time and don't cause runtime errors in the browser.
• RASP Frida port scanning false positives — The new Frida detection tries to fetch('http://127.0.0.1:27042') which could trigger CORS errors or network failures in production. Test on real devices to ensure this doesn't cause app crashes or false alarms.

Test Plan

1. Build all 3 mobile variants and verify no TypeScript/build errors
2. Test API calls in each variant to confirm CertificatePinning.fetch() is invoked (check network logs for SSL pinning behavior)
3. Test compression round-trip: call PerformanceManager.compressData() → decompressData() with a large JSON payload and verify data integrity
4. Test USSD on Android device (native-enhanced/hybrid) to confirm native module bridge or system dialer fallback works
5. Test PWA platform detection on iOS Safari, Android Chrome, and desktop to verify getPlatform() returns correct values
6. Verify env var substitution — set REACT_NATIVE_PIN_API_PRIMARY / VITE_PIN_API_PRIMARY and confirm cert pinning uses those values instead of placeholder strings

Notes

• This PR includes the entire platform codebase (7,100+ files) from the previous merge work, not just the mobile fixes. The mobile-specific changes are in the 21 files listed in the commit message.
• No tests were added for the mobile TypeScript changes. The existing test suite doesn't cover mobile code.
• The custom DEFLATE implementation is a simplified stored-block format (no dynamic Huffman coding). It may not be compatible with standard zlib decompression on the backend.
• The RASP Frida detection via localhost port scanning could be blocked by corporate firewalls or VPNs.
• PWA user-agent sniffing is inherently unreliable (can be spoofed, doesn't detect all platforms).

---

Link to Devin run: https://app.devin.ai/sessions/d1d1a2af0045435da944c1a7e061484d
Requested by: @munisp

[devin-ai-integration]

Original prompt from Patrick

https://drive.google.com/file/d/1oiQtq3bXtpKrTCU9LUWZXs8pGA2AS83V/view?usp=sharing

Merge, Extract(everything) Analyze and  
perform a thorough verification of the unified platform to ensure everything is properly included and functional. This will include:
* 		Structure Verification - Confirm all directories and files exist
* 		Code Analysis - Verify code quality and completeness
* 		Dependency Check - Validate all imports and dependencies
* 		Configuration Validation - Check all config files
* 		Test Verification - Confirm all tests are runnable
		Documentation Review - Verify documentation complete
 conduct a comprehensive audit of all guides and summaries to ensure complete end-to-end implementation across the platform. This will involve:
* 		Searching all TODO items across the entire project
* 		Identifying gaps between documentation and implementation
* 		Implementing all missing features - no mocks, no placeholders
* 		Optimizing HA configurations for all infrastructure services
* 		Minimizing documentation - keeping only essential operational guides

can you ensure for every guide and summary you have created have the equivalent implementation end to end across the platform. implement all the TODO, no mocks, no placeholders search /home/ubuntu  - minimize the level of document generated - optimize and provide HA for Kafka, Dapr, fluvio, temporal, keycloak, permify, redis,  and apisix, tigerbeetle, and lakehouse, openappsec, kubernetes, openstack
perform a thorough audits of every file/services/features and ensure that there no stubs/mock/placeholders/partial/missing/todo ui-ux/methods/services/files/featuers and everything is properly and completely integrated end to end. perform regression/integretion/security/performance/chaos/user (all stackhodlers)experience robust testing





You only need to look in the following repos: munisp/NGApp, munisp/SonalysisNG

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-advanced-security]

Trivy found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.