Architecture Securite

import LocalAuthentication

class BiometricAuthManager: ObservableObject {
    @Published var isAuthenticated = false
    @Published var biometricType: LABiometryType = .none

    func authenticate() async throws -> Bool {
        let context = LAContext()
        var error: NSError?

        guard context.canEvaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            error: &error
        ) else {
            throw AuthError.biometricNotAvailable
        }

        // Store biometric type for UI adaptation
        biometricType = context.biometryType

        let success = try await context.evaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            localizedReason: "Authentifiez-vous pour acceder a YaniPay"
        )

        await MainActor.run {
            isAuthenticated = success
        }

        return success
    }

    func checkBiometricAvailability() -> BiometricStatus {
        let context = LAContext()
        var error: NSError?

        if context.canEvaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            error: &error
        ) {
            return .available(context.biometryType)
        }

        return .unavailable(error?.localizedDescription ?? "Unknown")
    }
}

import CryptoKit
import Security

class EncryptionManager {

    // MARK: - AES-256-GCM Encryption

    /// Encrypt data using AES-256-GCM
    func encrypt(_ data: Data, key: SymmetricKey) throws -> Data {
        let sealedBox = try AES.GCM.seal(data, using: key)
        guard let combined = sealedBox.combined else {
            throw EncryptionError.sealingFailed
        }
        return combined
    }

    /// Decrypt data using AES-256-GCM
    func decrypt(_ data: Data, key: SymmetricKey) throws -> Data {
        let sealedBox = try AES.GCM.SealedBox(combined: data)
        return try AES.GCM.open(sealedBox, using: key)
    }

    // MARK: - Secure Enclave Key Generation

    /// Generate an ECC P-256 key pair stored in Secure Enclave
    func generateSecureKey() throws -> SecKey {
        let attributes: [String: Any] = [
            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
            kSecAttrKeySizeInBits as String: 256,
            kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
            kSecPrivateKeyAttrs as String: [
                kSecAttrIsPermanent as String: true,
                kSecAttrApplicationTag as String: "com.yanipay.secure-key",
                kSecAttrAccessControl as String: try createAccessControl()
            ]
        ]

        var error: Unmanaged<CFError>?
        guard let privateKey = SecKeyCreateRandomKey(
            attributes as CFDictionary, &error
        ) else {
            throw EncryptionError.keyGenerationFailed(
                error?.takeRetainedValue().localizedDescription ?? "Unknown"
            )
        }

        return privateKey
    }

    // MARK: - Access Control

    private func createAccessControl() throws -> SecAccessControl {
        var error: Unmanaged<CFError>?
        guard let access = SecAccessControlCreateWithFlags(
            kCFAllocatorDefault,
            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
            [.privateKeyUsage, .biometryCurrentSet],
            &error
        ) else {
            throw EncryptionError.accessControlFailed
        }
        return access
    }
}

import Foundation
import UIKit

class EnhancedSecurityManager {

    /// Multi-layer jailbreak detection
    func isDeviceCompromised() -> Bool {
        // Layer 1: Check for suspicious files
        let suspiciousPaths = [
            "/Applications/Cydia.app",
            "/Library/MobileSubstrate/MobileSubstrate.dylib",
            "/usr/sbin/sshd",
            "/usr/bin/apt",
            "/bin/bash",
            "/usr/lib/system/libsystem_kernel.dylib",
            "/var/cache/apt",
            "/var/lib/apt",
            "/var/lib/cydia",
            "/var/log/syslog",
            "/private/var/stash"
        ]

        for path in suspiciousPaths {
            if FileManager.default.fileExists(atPath: path) {
                return true
            }
        }

        // Layer 2: Write test (jailbroken devices allow writes
        // to restricted directories)
        let testPath = "/private/jailbreak_test"
        do {
            try "test".write(
                toFile: testPath,
                atomically: true,
                encoding: .utf8
            )
            try FileManager.default.removeItem(atPath: testPath)
            return true // Write succeeded = compromised
        } catch {
            // Expected: write should fail on non-jailbroken device
        }

        // Layer 3: Check URL schemes
        if let url = URL(string: "cydia://package/com.example") {
            if UIApplication.shared.canOpenURL(url) {
                return true
            }
        }

        // Layer 4: Check for dynamic libraries
        let dylibs = [
            "SubstrateLoader.dylib",
            "SSLKillSwitch2.dylib",
            "0Shadow.dylib"
        ]
        for dylib in dylibs {
            if let _ = dlopen(dylib, RTLD_NOW) {
                return true
            }
        }

        return false
    }

    /// Action when compromised device detected
    func handleCompromisedDevice() {
        // Wipe sensitive data from Keychain
        KeychainManager.shared.deleteAll()

        // Notify backend
        SecurityReporter.shared.reportCompromise()

        // Show alert and block app usage
        DispatchQueue.main.async {
            NotificationCenter.default.post(
                name: .deviceCompromised,
                object: nil
            )
        }
    }
}

class DataMaskingManager {
    static let shared = DataMaskingManager()

    /// Mask credit card number: **** **** **** 0366
    func maskCard(_ number: String) -> String {
        let clean = number.replacingOccurrences(of: " ", with: "")
        guard clean.count >= 4 else { return "****" }
        let last4 = String(clean.suffix(4))
        return "**** **** **** \(last4)"
    }

    /// Mask email: u***r@yanipay.com
    func maskEmail(_ email: String) -> String {
        guard let atIndex = email.firstIndex(of: "@") else { return "***" }
        let local = String(email[email.startIndex..<atIndex])
        let domain = String(email[atIndex...])
        guard local.count > 2 else { return "***\(domain)" }
        let first = local.prefix(1)
        let last = local.suffix(1)
        let stars = String(repeating: "*", count: min(3, local.count - 2))
        return "\(first)\(stars)\(last)\(domain)"
    }

    /// Mask IBAN: FR** **** **** **** **** 0366
    func maskIBAN(_ iban: String) -> String {
        let clean = iban.replacingOccurrences(of: " ", with: "")
        guard clean.count >= 6 else { return "****" }
        let prefix = String(clean.prefix(2))
        let last4 = String(clean.suffix(4))
        return "\(prefix)** **** **** **** **** \(last4)"
    }
}

import Security
import Foundation

class KeychainManager {
    static let shared = KeychainManager()

    private let service = "com.yanipay.keychain"

    /// Save data to Keychain with biometric protection
    func save(key: String, data: Data, requireBiometric: Bool = true) throws {
        // Delete existing item first
        try? delete(key: key)

        var query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecValueData as String: data
        ]

        if requireBiometric {
            let access = SecAccessControlCreateWithFlags(
                nil,
                kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
                .biometryCurrentSet,
                nil
            )
            query[kSecAttrAccessControl as String] = access
        }

        let status = SecItemAdd(query as CFDictionary, nil)
        guard status == errSecSuccess else {
            throw KeychainError.saveFailed(status)
        }
    }

    /// Read data from Keychain
    func read(key: String) throws -> Data {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        guard status == errSecSuccess, let data = result as? Data else {
            throw KeychainError.readFailed(status)
        }

        return data
    }

    /// Delete all YaniPay entries (used on compromise detection)
    func deleteAll() {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service
        ]
        SecItemDelete(query as CFDictionary)
    }
}