chore: declare the end-to-end encryption for app store export compliance #58

app.config.js

@@ -58,10 +58,10 @@ module.exports = {
       bundleIdentifier: 'org.bulwarkmail.mobile',
       buildNumber: IOS_BUILD_NUMBER,
       config: {
-        // The app only speaks HTTPS/TLS and uses platform crypto, which is
+        // PGP and S/MIME (#58) add end-to-end encryption beyond HTTPS/TLS,
-        // exempt. Declaring it here skips the manual export-compliance
+        // so the app declares non-exempt encryption; App Store Connect asks
-        // questionnaire that otherwise blocks every TestFlight build.
+        // for the export compliance documentation on upload.
-        usesNonExemptEncryption: false,
+        usesNonExemptEncryption: true,
       },
     },
     android: {

src/lib/__tests__/export-compliance.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+
+// With PGP and S/MIME in the app (#58) the encryption is no longer only
+// HTTPS/TLS, so the App Store export compliance answer must say so.
+
+describe('export compliance', () => {
+  it('declares non-exempt encryption for iOS', () => {
+    const src = fs.readFileSync(path.resolve(__dirname, '../../../app.config.js'), 'utf8');
+    expect(src).toMatch(/usesNonExemptEncryption: true/);
+    expect(src).not.toMatch(/usesNonExemptEncryption: false/);
+  });
+});