[Security] Biometric type from abstract method not validated — can be spoofed in mocked environments

[RUKAYAT-CODER]

Overview

mobileAuth.ts accepts a BiometricType return value from an abstract method without runtime validation. In a mocked or test environment, any string can be passed as the biometric type, bypassing the type guard.

Specifications

Features:

• Add a runtime validation function isValidBiometricType(value: unknown): value is BiometricType
• Call it before using the biometric type to authenticate

Tasks:

• Define a VALID_BIOMETRIC_TYPES constant array
• Implement the type guard
• Call the guard before biometric operations
• Write tests for invalid biometric type values

Impacted Files:

• src/services/mobileAuth.ts

Acceptance Criteria

• Invalid biometric types are rejected with a clear error
• No runtime spoofing possible even in test environments
• Type guard has 100% test coverage

[muhahahmad68]

@muhahahmad68 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Kindly assign this to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @muhahahmad68 to this issue.

[collinsezedike]

@collinsezedike has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I'd like to work on this issue! Adding explicit runtime type validation for biometric types prevents mock/test environments from injecting untrusted strings and bypassing type safety.

Implementation Plan

1. Define Valid Biometric Types Constant (src/services/mobileAuth.ts):

   • Declare an immutable array VALID_BIOMETRIC_TYPES containing all allowed BiometricType values (e.g., ['FINGERPRINT', 'FACIAL_RECOGNITION', 'IRIS'] or matching the enum/type bounds defined in the project).

2. Implement Type Guard:

   • Create the custom type guard:

     export function isValidBiometricType(value: unknown): value is BiometricType {
       return typeof value === 'string' && (VALID_BIOMETRIC_TYPES as readonly string[]).includes(value);
     }

3. Integrate Validation in Authentication Flow:

   • Invoke isValidBiometricType(retrievedType) immediately after receiving the biometric type from the abstract provider method.
   • Throw a descriptive runtime error if validation fails, halting the authentication process before execution.

4. Unit Tests & 100% Coverage:

   • Write tests in src/__tests__/services/mobileAuth.test.ts covering:
     • Valid biometric types successfully passing validation.
     • Invalid/mocked string values being rejected with the expected error.
     • Non-string / null / undefined inputs.
   • Verify 100% coverage on isValidBiometricType via npm run test:coverage.

Ready to implement as soon as assigned!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @collinsezedike to this issue.

[pharwasz]

@pharwasz has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I would like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @pharwasz to this issue.

[drips-wave]

Congratulations, @collinsezedike! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @collinsezedike: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊