Refactor MultifactorAuthenticationContextProvider to XState state machine

config/eslint/eslint.config.mjs

@@ -169,6 +169,11 @@ const restrictedImportPaths = [
         name: '@src/utils/findNodeHandle',
         message: "Do not use 'findNodeHandle' as it is no longer supported on web.",
     },
+    {
+        name: '@xstate/react',
+        importNames: ['useMachine'],
+        message: 'Import `useInspectedMachine` from `@hooks/useInspectedMachine` instead so every machine is wired up to the XState inspector.',
+    },
 ];
 
 const restrictedImportPatterns = [

config/eslint/eslint.seatbelt.tsv

@@ -271,7 +271,6 @@
 "../../src/components/MultiGestureCanvas/usePanGesture.ts"	"no-restricted-syntax"	1
 "../../src/components/MultiGestureCanvas/usePinchGesture.ts"	"react-hooks/set-state-in-effect"	1
 "../../src/components/MultiGestureCanvas/useTapGestures.ts"	"no-restricted-syntax"	1
-"../../src/components/MultifactorAuthentication/Context/stateReducer.ts"	"@typescript-eslint/no-unsafe-type-assertion"	1
 "../../src/components/MultifactorAuthentication/Context/usePromptContent.ts"	"react-hooks/refs"	10
 "../../src/components/MultifactorAuthentication/ValidateCodeResendButton.tsx"	"no-restricted-syntax"	1
 "../../src/components/MultifactorAuthentication/components/Modals/createCancelConfirmModal.tsx"	"@typescript-eslint/no-deprecated/ConfirmModal"	1

package.json

@@ -132,6 +132,7 @@
     "@shopify/flash-list": "2.3.0",
     "@shopify/react-native-skia": "^2.4.14",
     "@ua/react-native-airship": "26.5.0",
+    "@xstate/react": "5.0.5",
     "array.prototype.tosorted": "^1.1.4",
     "awesome-phonenumber": "^5.4.0",
     "canvas-size": "^1.2.6",
@@ -225,7 +226,8 @@
     "react-webcam": "^7.1.1",
     "scheduler": "0.27.0",
     "victory-native": "^41.21.0",
-    "xlsx": "^0.18.5"
+    "xlsx": "^0.18.5",
+    "xstate": "5.31.1"
   },
   "devDependencies": {
     "@aaroon/workbox-rspack-plugin": "^1.0.1",
@@ -267,6 +269,7 @@
     "@rspack/plugin-react-refresh": "^2.0.2",
     "@sentry/cli": "3.3.0",
     "@sentry/webpack-plugin": "5.2.0",
+    "@statelyai/inspect": "^0.7.1",
     "@storybook/addon-a11y": "10.4.6",
     "@storybook/addon-docs": "10.4.6",
     "@storybook/cli": "10.4.6",

src/CONST/index.ts

@@ -208,6 +208,42 @@ const EMAIL = {
 };
 
 const CONST = {
+    /**
+     * Credential and secret keys that must be redacted before any user data leaves the running app.
+     * Every place where data can leave redacts them, such as the request and response logs
+     * (`sanitizeLogParams`), the thrown parameter errors (`requireParameters`), and the XState
+     * inspector stream (`XStateInspector/maskSensitive`). Keeping the keys in this single list is
+     * what stops those sites from drifting apart, so always add a new key here rather than at each
+     * call site.
+     */
+    SENSITIVE_AUTH_KEYS: [
+        'authToken',
+        'encryptedAuthToken',
+        'password',
+        'partnerUserSecret',
+        'partnerPassword',
+        'twoFactorAuthCode',
+        'idToken',
+        'token',
+        'validateCode',
+        'autoGeneratedPassword',
+        'autoGeneratedLogin',
+        'oldDotCurrentAuthToken',
+        'oldDotCurrentEncryptedAuthToken',
+        'oldDotAutoGeneratedPassword',
+        'pin',
+        'pan',
+        'cvv',
+        'expiration',
+        'expirationDate',
+        'otp',
+        'secret',
+        'keyInfo',
+        'challenge',
+        'signedChallenge',
+        'registrationChallenge',
+        'authorizationChallenge',
+    ],
     HEIC_SIGNATURES: [
         '6674797068656963', // 'ftypheic' - Indicates standard HEIC file
         '6674797068656978', // 'ftypheix' - Indicates a variation of HEIC