RG-T89 ADP Support

src/api/calls/callFiles.ts

@@ -3,8 +3,10 @@ import { Platform } from 'react-native';
 
 import { createApiEndpoint } from '@/api/common/client';
 import { logger } from '@/lib/logging';
+import { getBaseApiUrl } from '@/lib/storage/app';
 import { type CallFilesResult } from '@/models/v4/callFiles/callFilesResult';
 import { type SaveCallFileResult } from '@/models/v4/callFiles/saveCallFileResult';
+import useAuthStore from '@/stores/auth/store';
 
 // Event types for the download process
 export type DownloadEventType = 'start' | 'progress' | 'complete' | 'error';
@@ -30,6 +32,25 @@ export interface DownloadOptions {
 const getCallFilesApi = createApiEndpoint('/CallFiles/GetFilesForCall');
 const saveCallFileApi = createApiEndpoint('/CallFiles/SaveCallFile');
 
+/**
+ * Whether `url` points at the department's own Resgrid API.
+ *
+ * Attachment URLs arrive inside the server payload, and not all of them are ours: a department on
+ * external blob storage gets a pre-signed CDN link back. Those links carry their own credential in
+ * the query string and need no bearer, so sending one would hand this member's access token to a
+ * third-party host for nothing.
+ */
+const isApiOrigin = (url: string): boolean => {
+  try {
+    const target = new URL(url, getBaseApiUrl());
+    const api = new URL(getBaseApiUrl());
+    return target.origin === api.origin;
+  } catch {
+    // An unparseable URL is not a host we can vouch for.
+    return false;
+  }
+};
+
 // Function to download a file with progress reporting
 export const getCallAttachmentFile = async (url: string, options: DownloadOptions = {}): Promise<Blob> => {
   const { onEvent, headers = {}, timeout = 30000 } = options;
@@ -40,9 +61,16 @@ export const getCallAttachmentFile = async (url: string, options: DownloadOption
       type: 'start',
     });
 
+    // Attach the signed-in bearer, but only for our own API origin: authenticated file routes
+    // require it, the anonymous signed-link route simply ignores it, and an external storage or
+    // CDN host must never see it. Caller-supplied headers win on conflict.
+    const token = isApiOrigin(url) ? useAuthStore.getState().accessToken : null;
     const config: AxiosRequestConfig = {
       responseType: 'blob',
-      headers,
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        ...headers,
+      },
       timeout,
       onDownloadProgress: (progressEvent: AxiosProgressEvent) => {
         if (progressEvent.total) {

src/api/chat/chat.ts

@@ -206,9 +206,13 @@ export const getChatAttachmentThumbnailUrl = (attachmentId: string): string => `
 /**
  * Image source (with bearer auth header) suitable for expo-image / RN Image
  * when rendering a chat attachment.
+ *
+ * `accessToken` lets a component pass the token it is subscribed to. Reading it from the store
+ * here is a one-shot snapshot, so a component that does not subscribe would keep rendering the
+ * pre-refresh bearer after a token rotation and the image request would 401.
  */
-export const getChatAttachmentImageSource = (attachmentId: string) => {
-  const token = useAuthStore.getState().accessToken;
+export const getChatAttachmentImageSource = (attachmentId: string, accessToken?: string | null) => {
+  const token = accessToken !== undefined ? accessToken : useAuthStore.getState().accessToken;
   return {
     uri: getChatAttachmentUrl(attachmentId),
     headers: token ? { Authorization: `Bearer ${token}` } : undefined,

src/api/common/client.tsx

@@ -1,5 +1,6 @@
 import axios, { type AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
 
+import { readProtectedGrantHeaders } from '@/lib/data-protection/grant-provider';
 import { logger } from '@/lib/logging';
 import { getBaseApiUrl } from '@/lib/storage/app';
 import useAuthStore from '@/stores/auth/store';
@@ -45,6 +46,21 @@ axiosInstance.interceptors.request.use(
     if (accessToken) {
       config.headers.Authorization = `Bearer ${accessToken}`;
     }
+
+    // Advanced Data Protection: while the member holds a live grant, every read through this
+    // instance carries it, so a protected value comes back decrypted instead of REDACTED.
+    //
+    // Attached centrally on purpose. The alternative - each screen remembering to add the header -
+    // is the failure mode that already shipped twice on the web side, and it fails SILENTLY: the
+    // screen looks fine and simply shows placeholders. The grant only ever goes to Resgrid's own
+    // API (this instance's baseURL), is short-lived, and is bound to this member, department and
+    // policy epoch, so the server is the only thing that can act on it.
+    if (config.headers) {
+      for (const [name, value] of Object.entries(readProtectedGrantHeaders())) {
+        config.headers.set(name, value);
+      }
+    }
+
     return config;
   },
   (error: AxiosError) => {

src/api/data-protection/data-protection.ts

@@ -0,0 +1,71 @@
+import { api } from '../common/client';
+
+const DATA_PROTECTION = '/DataProtection';
+
+// ---------------------------------------------------------------------------
+// Advanced Data Protection (ADP) — capability report, MFA step-up, and the
+// exemption path.
+//
+// The step-up window is ABSOLUTE: the server returns its expiry once and never
+// slides it. Clients conceal protected values at expiry and ask again on the
+// next reveal.
+// ---------------------------------------------------------------------------
+
+export interface DataProtectionCapabilitiesData {
+  State: number;
+  StateName?: string | null;
+  IsProtectionEnabled: boolean;
+  CatalogVersion: number;
+  CurrentCatalogVersion: number;
+  PolicyEpoch: number;
+  StepUpWindowMinutes: number;
+  IsDepartmentLocked: boolean;
+  LockReason?: string | null;
+  LockProjectedEndUtc?: string | null;
+}
+
+export interface DataProtectionCapabilitiesResult {
+  Data?: DataProtectionCapabilitiesData;
+}
+
+export interface StepUpResult {
+  /** Grant id (jti) for display/audit correlation; null when grants are not configured. */
+  GrantId?: string | null;
+  /** Signed Protected Data Grant. MEMORY ONLY — never persisted, never logged. */
+  GrantToken?: string | null;
+  /** Absolute UTC expiry of the step-up window (ISO 8601). */
+  StepUpExpiresOnUtc?: string | null;
+  StepUpWindowMinutes?: number;
+}
+
+/** Value-free ADP capability report for the caller's department. */
+export const getDataProtectionCapabilities = async (signal?: AbortSignal) => {
+  const response = await api.get<DataProtectionCapabilitiesResult>(`${DATA_PROTECTION}/Capabilities`, { signal });
+  return response.data;
+};
+
+/**
+ * Asks for a grant WITHOUT a second factor.
+ *
+ * A department may release named apps from the step-up prompt (ADP plan 3.3) — a dispatcher on a
+ * live incident cannot stop to read a code off a phone. The server answers with a grant when this
+ * department has exempted THIS app, and with `step_up_required` otherwise. The client never makes
+ * that decision; it only asks and reacts.
+ *
+ * Nothing is weakened by asking: the caller is still authenticated, and the grant that comes back
+ * is still tenant-bound, epoch-bound, short-lived and audited on every read it authorizes.
+ */
+export const requestProtectedGrant = async () => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/RequestGrant`, {});
+  return response.data;
+};
+
+/**
+ * Verifies the user's authenticator (TOTP) code for the ADP step-up.
+ * Server problem types: invalid_totp (400/401), mfa_not_enrolled (409),
+ * too_many_attempts (429). The code is never logged anywhere.
+ */
+export const verifyStepUp = async (code: string) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/VerifyStepUp`, { Code: code });
+  return response.data;
+};

src/app/(app)/_layout.tsx

@@ -9,6 +9,7 @@ import { useTranslation } from 'react-i18next';
 import { ActivityIndicator, type ColorValue, Platform, StyleSheet, useWindowDimensions } from 'react-native';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
+import { StepUpPromptHost } from '@/components/data-protection/step-up-prompt-host';
 import { NotificationButton } from '@/components/notifications/NotificationButton';
 import { NotificationInbox } from '@/components/notifications/NotificationInbox';
 import Sidebar from '@/components/sidebar/sidebar';
@@ -33,6 +34,7 @@ import { bluetoothAudioService } from '@/services/bluetooth-audio.service';
 import { usePushNotifications } from '@/services/push-notification';
 import { useCoreStore } from '@/stores/app/core-store';
 import { useCallsStore } from '@/stores/calls/store';
+import { dataProtectionStore } from '@/stores/data-protection/store';
 import { FeatureFlagKeys, featureFlagsStore } from '@/stores/feature-flags/store';
 import { useRolesStore } from '@/stores/roles/store';
 import { securityStore } from '@/stores/security/store';
@@ -175,7 +177,14 @@ export default function TabLayout() {
 
       // These fetches are independent of each other — run in parallel to cut
       // time-to-interactive (previously 8+ serial network hops).
-      await Promise.all([useRolesStore.getState().init(), useCallsStore.getState().init(), useWeatherAlertsStore.getState().init(), securityStore.getState().getRights(), featureFlagsStore.getState().fetchFlags()]);
+      await Promise.all([
+        useRolesStore.getState().init(),
+        useCallsStore.getState().init(),
+        useWeatherAlertsStore.getState().init(),
+        securityStore.getState().getRights(),
+        featureFlagsStore.getState().fetchFlags(),
+        dataProtectionStore.getState().fetchCapabilities(),
+      ]);
 
       if (!isCurrentRun()) return;
 
@@ -575,6 +584,13 @@ export default function TabLayout() {
 
   const content = (
     <View style={styles.container} pointerEvents="box-none">
+      {/*
+        The app's single Advanced Data Protection prompt. Mounted here so any screen can trigger it
+        through the store without carrying a modal of its own, and so two screens can never stack
+        two prompts over each other.
+      */}
+      <StepUpPromptHost />
+
       {/* Loading overlay during initialization — shown on top of Tabs so the navigator stays mounted */}
       {!isInitComplete ? (
         <View style={styles.loadingOverlay}>

src/app/(app)/contacts.tsx

@@ -7,6 +7,7 @@ import { Loading } from '@/components/common/loading';
 import ZeroState from '@/components/common/zero-state';
 import { ContactCard } from '@/components/contacts/contact-card';
 import { ContactDetailsSheet } from '@/components/contacts/contact-details-sheet';
+import { ProtectedRevealBar } from '@/components/data-protection/protected-reveal-bar';
 import { FocusAwareStatusBar } from '@/components/ui';
 import { Box } from '@/components/ui/box';
 import { FlatList } from '@/components/ui/flat-list';
@@ -84,6 +85,13 @@ export default function Contacts() {
     <View className="flex-1 bg-gray-50 dark:bg-gray-900">
       <FocusAwareStatusBar />
       <Box className="flex-1 px-4 pt-4">
+        {/*
+          Contacts are heavily cataloged - names, phone numbers, email, government identifiers and
+          location. They arrive REDACTED and only come back decrypted on a request carrying a grant,
+          so revealing has to re-read the list. Renders nothing without the addon.
+        */}
+        <ProtectedRevealBar onRefresh={() => fetchContacts(true)} />
+
         <Input className="mb-4 rounded-lg bg-white dark:bg-gray-800" size="md" variant="outline">
           <InputSlot className="pl-3">
             <InputIcon as={Search} />

src/app/call/[id].tsx

@@ -9,6 +9,8 @@ import { CheckInTabContent } from '@/components/check-in-timers/check-in-tab-con
 import { HeaderBackButton } from '@/components/common/header-back-button';
 import { Loading } from '@/components/common/loading';
 import ZeroState from '@/components/common/zero-state';
+import { ProtectedRevealBar } from '@/components/data-protection/protected-reveal-bar';
+import { ProtectedText } from '@/components/data-protection/protected-text';
 import { IncidentCommandTabPanel } from '@/components/incident-command/incident-command-tab-panel';
 import { FullScreenMap } from '@/components/maps/full-screen-map';
 // Import a static map component instead of react-native-maps
@@ -24,6 +26,7 @@ import { Text } from '@/components/ui/text';
 import { VStack } from '@/components/ui/vstack';
 import { useAnalytics } from '@/hooks/use-analytics';
 import { getUnitTypeCheckInBadge } from '@/lib/check-in-timer-utils';
+import { isFieldRedacted, ProtectedFieldIds } from '@/lib/data-protection/redacted';
 import { logger } from '@/lib/logging';
 import { openMapsWithDirections } from '@/lib/navigation';
 import { parseApiUtcDate, safeFormatDate } from '@/lib/utils';
@@ -373,7 +376,7 @@ export default function CallDetail() {
               </Box>
               <Box className="border-b border-outline-100 pb-2">
                 <Text className="text-sm text-gray-500">{t('call_detail.address')}</Text>
-                <Text className="font-medium">{call.Address}</Text>
+                <ProtectedText value={call.Address} fieldId={ProtectedFieldIds.callAddress} redactedFields={call.RedactedFields} className="font-medium" />
               </Box>
               {destinationLabel ? (
                 <Box className="border-b border-outline-100 pb-2">
@@ -385,7 +388,16 @@ export default function CallDetail() {
               <Box className="border-b border-outline-100 pb-2">
                 <Text className="text-sm text-gray-500">{t('call_detail.note')}</Text>
                 <Box>
-                  <HtmlRenderer html={call.Note ?? ''} style={StyleSheet.flatten([styles.container, { height: 200 }])} />
+                  {/*
+                    A withheld note is not empty HTML — rendering the sentinel through the HTML
+                    renderer would print the bare word REDACTED in the body copy, which reads as
+                    the note's content rather than as an absence.
+                  */}
+                  {isFieldRedacted(call.RedactedFields, ProtectedFieldIds.callNotes, call.Note) ? (
+                    <ProtectedText value={call.Note} fieldId={ProtectedFieldIds.callNotes} redactedFields={call.RedactedFields} />
+                  ) : (
+                    <HtmlRenderer html={call.Note ?? ''} style={StyleSheet.flatten([styles.container, { height: 200 }])} />
+                  )}
                 </Box>
               </Box>
             </VStack>
@@ -409,11 +421,11 @@ export default function CallDetail() {
               </Box>
               <Box className="border-b border-outline-100 pb-2">
                 <Text className="text-sm text-gray-500">{t('call_detail.contact_name')}</Text>
-                <Text className="font-medium">{call.ContactName}</Text>
+                <ProtectedText value={call.ContactName} fieldId={ProtectedFieldIds.callContactName} redactedFields={call.RedactedFields} className="font-medium" />
               </Box>
               <Box className="border-b border-outline-100 pb-2">
                 <Text className="text-sm text-gray-500">{t('call_detail.contact_info')}</Text>
-                <Text className="font-medium">{call.ContactInfo}</Text>
+                <ProtectedText value={call.ContactInfo} fieldId={ProtectedFieldIds.callContactNumber} redactedFields={call.RedactedFields} className="font-medium" />
               </Box>
             </VStack>
           </Box>
@@ -545,8 +557,14 @@ export default function CallDetail() {
   const showingDestination = hasDestinationCoordinates && (mapTarget === 'destination' || !hasCallCoordinates);
   const mapLatitude = showingDestination ? destinationLatitude : coordinates.latitude;
   const mapLongitude = showingDestination ? destinationLongitude : coordinates.longitude;
-  const mapAddress = showingDestination ? call.DestinationAddress || call.DestinationName || '' : call.Address;
-  const mapTitle = showingDestination ? call.DestinationName || t('call_detail.destination') : call.Name || t('call_detail.call_location');
+  // A withheld address or name must not leak through the map chrome. StaticMap prints `address`
+  // in its overlay AND its accessibility label, and FullScreenMap prints both the address overlay
+  // and the marker title, so the sentinel would surface there verbatim after being suppressed
+  // everywhere else on the screen. Destination fields are not in the protected catalog.
+  const isAddressRedacted = isFieldRedacted(call.RedactedFields, ProtectedFieldIds.callAddress, call.Address);
+  const isNameRedacted = isFieldRedacted(call.RedactedFields, ProtectedFieldIds.callName, call.Name);
+  const mapAddress = showingDestination ? call.DestinationAddress || call.DestinationName || '' : isAddressRedacted ? undefined : call.Address;
+  const mapTitle = showingDestination ? call.DestinationName || t('call_detail.destination') : (isNameRedacted ? undefined : call.Name) || t('call_detail.call_location');
 
   return (
     <>
@@ -560,11 +578,25 @@ export default function CallDetail() {
         }}
       />
       <ScrollView className="size-full w-full flex-1 bg-gray-50 dark:bg-gray-900" contentContainerStyle={{ paddingBottom: 16 }}>
+        {/*
+          Protected values (call name, nature, notes, address, contact details) arrive REDACTED and
+          only come back decrypted on a request carrying a grant, so revealing has to re-read the
+          call. Renders nothing for a department without the addon.
+        */}
+        <ProtectedRevealBar onRefresh={() => fetchCallDetail(callId)} />
+
         {/* Header */}
         <Box className="mx-4 mt-3 rounded-xl bg-white p-4 shadow-xs dark:bg-gray-800">
           <HStack className="mb-2 items-center justify-between">
             <Heading size="md">
-              {call.Name} ({call.Number})
+              {/* The call NUMBER is not cataloged, so it stays visible and the record stays findable. */}
+              {isFieldRedacted(call.RedactedFields, ProtectedFieldIds.callName, call.Name) ? (
+                <ProtectedText value={call.Name} fieldId={ProtectedFieldIds.callName} redactedFields={call.RedactedFields} />
+              ) : (
+                <>
+                  {call.Name} ({call.Number})
+                </>
+              )}
             </Heading>
             {/* Show "Set Active" button if this call is not the active call and there is an active unit */}
             {activeUnit && activeCall?.CallId !== call.CallId ? (
@@ -576,7 +608,11 @@ export default function CallDetail() {
           </HStack>
           <VStack className="space-y-1">
             <ScrollView style={{ height: 180 }} nestedScrollEnabled={true} showsVerticalScrollIndicator={true}>
-              <HtmlRenderer html={call.Nature ?? ''} style={StyleSheet.flatten([styles.container, { minHeight: 170 }])} />
+              {isFieldRedacted(call.RedactedFields, ProtectedFieldIds.callNature, call.Nature) ? (
+                <ProtectedText value={call.Nature} fieldId={ProtectedFieldIds.callNature} redactedFields={call.RedactedFields} />
+              ) : (
+                <HtmlRenderer html={call.Nature ?? ''} style={StyleSheet.flatten([styles.container, { minHeight: 170 }])} />
+              )}
             </ScrollView>
           </VStack>
         </Box>