fix: idempotent dose logging, timezone-safe schedules, canonical commitments, co-sign replay guard

Closes #958, closes #957, closes #955, closes #953.

- medicationService: add stable scheduledDoseId + logDoseIdempotent so a dose
  marked from a notification action and a replayed offline-queue entry converge
  on one record (#958).
- medicationService: add doseIdentityKey / reconcileDoseSchedules keyed on the
  absolute UTC instant so schedule edits and timezone/DST changes no longer
  stack overlapping local notifications (#957).
- blockchainIntegration: add versioned, domain-separated canonical serialization
  (canonicalizeMedicalCommitment / hashMedicalCommitment / verifyMedicalCommitment)
  with golden vectors shared with the contract suite (#955).
- coSignReplayGuard + PendingCoSignScreen: nonce/status/expiry checks and an
  atomic consume step so captured co-sign links cannot be replayed (#953).
- Adds focused unit tests characterizing prior behavior for each change.

Author: iam-mercy

src/screens/PendingCoSignScreen.tsx

@@ -21,6 +21,12 @@ import {
 } from 'react-native';
 
 import multisigService, { type PendingTransactionResponse } from '../services/multisigService';
+import {
+  evaluateCoSignEligibility,
+  markCoSignConsumed,
+  releaseCoSignClaim,
+  CO_SIGN_REJECT_MESSAGE,
+} from '../utils/coSignReplayGuard';
 
 // ─── Props ────────────────────────────────────────────────────────────────────
 
@@ -65,13 +71,20 @@ const PendingCoSignScreen: React.FC<Props> = ({
 
   const userSigner = transaction.signers.find((s) => s.publicKey === currentUserPublicKey);
   const alreadySigned = userSigner?.hasSigned ?? false;
-  const canSign = !!userSigner && !alreadySigned && transaction.status === 'pending';
+  const eligibility = evaluateCoSignEligibility(transaction, currentUserPublicKey);
+  const canSign = eligibility.canSign;
 
   const isExpired = new Date() > new Date(transaction.expiresAt);
   const isExpiringSoon =
     !isExpired && new Date(transaction.expiresAt).getTime() - Date.now() < 24 * 60 * 60 * 1000;
 
   const handleSign = async () => {
+    // Replay guard: re-check the request is still signable before doing anything.
+    const gate = evaluateCoSignEligibility(transaction, currentUserPublicKey);
+    if (!gate.canSign) {
+      Alert.alert('Cannot Sign', CO_SIGN_REJECT_MESSAGE[gate.reason ?? 'not-pending']);
+      return;
+    }
     if (!privateKey.trim()) {
       Alert.alert(
         'Private Key Required',
@@ -96,6 +109,12 @@ const PendingCoSignScreen: React.FC<Props> = ({
           text: 'Sign',
           style: 'destructive',
           onPress: async () => {
+            // Atomically claim this request+nonce. If another tap / re-entered
+            // screen already claimed it, bail out instead of double-submitting.
+            if (!markCoSignConsumed(transaction)) {
+              Alert.alert('Cannot Sign', CO_SIGN_REJECT_MESSAGE['nonce-consumed']);
+              return;
+            }
             setSigning(true);
             try {
               // In production: use the keypair from secure storage, not user input
@@ -110,6 +129,8 @@ const PendingCoSignScreen: React.FC<Props> = ({
                 [{ text: 'OK', onPress: onSigned }],
               );
             } catch (error: any) {
+              // Submission failed — release the claim so a retry is possible.
+              releaseCoSignClaim(transaction);
               Alert.alert('Signing Failed', error?.message ?? 'Failed to sign transaction.');
             } finally {
               setSigning(false);

src/services/__tests__/blockchainIntegration.canonical.test.ts

@@ -0,0 +1,114 @@
+/**
+ * #955 — on-chain medical commitments must use a deterministic, versioned,
+ * domain-separated pre-image so the mobile app, backend, and Soroban contract
+ * tests all derive the same hash.
+ *
+ * The golden vectors below are the shared contract: any change to them must be
+ * mirrored in the contract test-suite and paired with a version bump.
+ */
+import {
+  MEDICAL_COMMITMENT_DOMAIN,
+  MEDICAL_COMMITMENT_VERSION,
+  canonicalizeMedicalCommitment,
+  hashMedicalCommitment,
+  verifyMedicalCommitment,
+  type MedicalCommitment,
+} from '../blockchainIntegration';
+
+const VECTOR_A: MedicalCommitment = {
+  recordId: 'rec_001',
+  petId: 'pet_abc',
+  payloadHash: 'a'.repeat(64),
+  issuedAt: 1735689600000,
+  issuer: 'GABC123',
+};
+
+const VECTOR_B: MedicalCommitment = {
+  recordId: 'rec_002',
+  petId: 'pet_xyz',
+  payloadHash: 'deadbeef'.repeat(8),
+  issuedAt: 0,
+  issuer: 'GXYZ',
+};
+
+const GOLDEN = {
+  a: {
+    canonical:
+      '{"domain":"petchain.medical.commitment","fields":{"issuedAt":1735689600000,"issuer":"GABC123","payloadHash":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","petId":"pet_abc","recordId":"rec_001"},"version":1}',
+    sha256: '87dce2b771b56cdb0c57a67872a882724dfccf57cc24faf80a0cd70c280eb0c3',
+  },
+  b: {
+    canonical:
+      '{"domain":"petchain.medical.commitment","fields":{"issuedAt":0,"issuer":"GXYZ","payloadHash":"deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef","petId":"pet_xyz","recordId":"rec_002"},"version":1}',
+    sha256: '4c0214f74ccdce3287e7f0846d861bf761fd008429cec210fed278845bc91e8f',
+  },
+};
+
+describe('canonicalizeMedicalCommitment — golden vectors', () => {
+  it('exposes a stable domain tag and version', () => {
+    expect(MEDICAL_COMMITMENT_DOMAIN).toBe('petchain.medical.commitment');
+    expect(MEDICAL_COMMITMENT_VERSION).toBe(1);
+  });
+
+  it('matches the golden canonical pre-image', () => {
+    expect(canonicalizeMedicalCommitment(VECTOR_A)).toBe(GOLDEN.a.canonical);
+    expect(canonicalizeMedicalCommitment(VECTOR_B)).toBe(GOLDEN.b.canonical);
+  });
+
+  it('matches the golden SHA-256 digest', () => {
+    expect(hashMedicalCommitment(VECTOR_A)).toBe(GOLDEN.a.sha256);
+    expect(hashMedicalCommitment(VECTOR_B)).toBe(GOLDEN.b.sha256);
+  });
+});
+
+describe('determinism', () => {
+  it('is independent of input key order', () => {
+    const shuffled: MedicalCommitment = {
+      issuer: VECTOR_A.issuer,
+      issuedAt: VECTOR_A.issuedAt,
+      recordId: VECTOR_A.recordId,
+      payloadHash: VECTOR_A.payloadHash,
+      petId: VECTOR_A.petId,
+    };
+    expect(hashMedicalCommitment(shuffled)).toBe(GOLDEN.a.sha256);
+  });
+
+  it('normalises payloadHash case and unicode form', () => {
+    expect(
+      hashMedicalCommitment({ ...VECTOR_A, payloadHash: 'A'.repeat(64) }),
+    ).toBe(GOLDEN.a.sha256);
+  });
+
+  it('changes the digest when any field changes', () => {
+    expect(hashMedicalCommitment({ ...VECTOR_A, issuedAt: VECTOR_A.issuedAt + 1 })).not.toBe(
+      GOLDEN.a.sha256,
+    );
+  });
+});
+
+describe('validation', () => {
+  it('rejects a malformed payload hash', () => {
+    expect(() => canonicalizeMedicalCommitment({ ...VECTOR_A, payloadHash: 'xyz' })).toThrow();
+  });
+
+  it('rejects a non-integer / negative issuedAt', () => {
+    expect(() => canonicalizeMedicalCommitment({ ...VECTOR_A, issuedAt: -1 })).toThrow();
+    expect(() => canonicalizeMedicalCommitment({ ...VECTOR_A, issuedAt: 1.5 })).toThrow();
+  });
+
+  it('rejects missing identifiers', () => {
+    expect(() => canonicalizeMedicalCommitment({ ...VECTOR_A, recordId: '' })).toThrow();
+  });
+});
+
+describe('verifyMedicalCommitment', () => {
+  it('accepts a correct digest (any case)', () => {
+    expect(verifyMedicalCommitment(VECTOR_A, GOLDEN.a.sha256)).toBe(true);
+    expect(verifyMedicalCommitment(VECTOR_A, GOLDEN.a.sha256.toUpperCase())).toBe(true);
+  });
+
+  it('rejects a wrong or truncated digest', () => {
+    expect(verifyMedicalCommitment(VECTOR_A, GOLDEN.b.sha256)).toBe(false);
+    expect(verifyMedicalCommitment(VECTOR_A, 'abcd')).toBe(false);
+  });
+});

src/services/__tests__/medicationService.idempotency.test.ts

@@ -0,0 +1,123 @@
+/**
+ * #958 — dose logging must be idempotent across offline-queue replay and
+ * notification actions. Characterises the old duplicate behaviour, then locks
+ * in the conflict-safe path.
+ */
+
+// In-memory stand-in for the encrypted SQLite dose-log store.
+const store: any[] = [];
+
+jest.mock('../localDB', () => ({
+  getAllMedications: jest.fn(async () => []),
+  upsertMedication: jest.fn(async () => {}),
+  deleteMedicationById: jest.fn(async () => {}),
+  getDoseLogs: jest.fn(async () => [...store]),
+  addDoseLog: jest.fn(async (log: any) => {
+    const idx = store.findIndex((l) => l.id === log.id);
+    if (idx >= 0) store[idx] = log;
+    else store.push(log);
+  }),
+}));
+
+import {
+  scheduledDoseId,
+  isDoseAlreadyLogged,
+  logDose,
+  logDoseIdempotent,
+  getDoseLogs,
+  type DoseLog,
+} from '../medicationService';
+
+const SCHEDULED_FOR = '2026-03-01T08:00:00.000Z';
+
+const baseLog = (overrides: Partial<DoseLog> = {}): DoseLog => ({
+  id: `log-${Math.random().toString(36).slice(2)}`,
+  medicationId: 'med-1',
+  takenAt: '2026-03-01T08:03:12.000Z',
+  scheduledFor: SCHEDULED_FOR,
+  ...overrides,
+});
+
+beforeEach(() => {
+  store.length = 0;
+  jest.clearAllMocks();
+});
+
+describe('scheduledDoseId', () => {
+  it('is stable for the same medication + scheduled instant', () => {
+    expect(scheduledDoseId('med-1', SCHEDULED_FOR)).toBe(
+      scheduledDoseId('med-1', new Date(SCHEDULED_FOR)),
+    );
+  });
+
+  it('ignores sub-minute clock skew between entry points', () => {
+    expect(scheduledDoseId('med-1', '2026-03-01T08:00:05.000Z')).toBe(
+      scheduledDoseId('med-1', '2026-03-01T08:00:59.999Z'),
+    );
+  });
+
+  it('differs by medication and by dose time', () => {
+    expect(scheduledDoseId('med-1', SCHEDULED_FOR)).not.toBe(
+      scheduledDoseId('med-2', SCHEDULED_FOR),
+    );
+    expect(scheduledDoseId('med-1', SCHEDULED_FOR)).not.toBe(
+      scheduledDoseId('med-1', '2026-03-01T20:00:00.000Z'),
+    );
+  });
+
+  it('throws on an invalid timestamp', () => {
+    expect(() => scheduledDoseId('med-1', 'not-a-date')).toThrow();
+  });
+});
+
+describe('current behaviour: plain logDose double-counts', () => {
+  it('writes two records when the same dose is marked from two entry points', async () => {
+    await logDose(baseLog({ id: 'from-notification' }));
+    await logDose(baseLog({ id: 'from-offline-replay' }));
+    expect(await getDoseLogs()).toHaveLength(2);
+  });
+});
+
+describe('logDoseIdempotent', () => {
+  it('writes the dose once and reports later attempts as duplicates', async () => {
+    const first = await logDoseIdempotent(baseLog({ id: 'from-notification' }));
+    expect(first.duplicate).toBe(false);
+
+    const replay = await logDoseIdempotent(baseLog({ id: 'from-offline-replay' }));
+    expect(replay.duplicate).toBe(true);
+    expect(replay.log.id).toBe('from-notification'); // authoritative record
+
+    expect(await getDoseLogs()).toHaveLength(1);
+  });
+
+  it('stamps a stable scheduledDoseId on the stored log', async () => {
+    const { log } = await logDoseIdempotent(baseLog());
+    expect(log.scheduledDoseId).toBe(scheduledDoseId('med-1', SCHEDULED_FOR));
+  });
+
+  it('dedupes even when only takenAt is available (no scheduledFor)', async () => {
+    await logDoseIdempotent(baseLog({ id: 'a', scheduledFor: undefined, takenAt: '2026-03-01T08:00:10.000Z' }));
+    const dup = await logDoseIdempotent(
+      baseLog({ id: 'b', scheduledFor: undefined, takenAt: '2026-03-01T08:00:40.000Z' }),
+    );
+    expect(dup.duplicate).toBe(true);
+    expect(await getDoseLogs()).toHaveLength(1);
+  });
+
+  it('still records genuinely different doses', async () => {
+    await logDoseIdempotent(baseLog({ id: 'morning' }));
+    const evening = await logDoseIdempotent(
+      baseLog({ id: 'evening', scheduledFor: '2026-03-01T20:00:00.000Z' }),
+    );
+    expect(evening.duplicate).toBe(false);
+    expect(await getDoseLogs()).toHaveLength(2);
+  });
+});
+
+describe('isDoseAlreadyLogged', () => {
+  it('matches on scheduled-dose identity across differing log ids', () => {
+    const existing = [baseLog({ id: 'x', scheduledDoseId: scheduledDoseId('med-1', SCHEDULED_FOR) })];
+    expect(isDoseAlreadyLogged(baseLog({ id: 'y' }), existing)).toBe(true);
+    expect(isDoseAlreadyLogged(baseLog({ id: 'z', medicationId: 'med-2' }), existing)).toBe(false);
+  });
+});

src/services/__tests__/medicationService.timezone.test.ts

@@ -0,0 +1,86 @@
+/**
+ * #957 — editing a schedule or travelling across timezones (including DST
+ * transitions and overnight doses) must not leave overlapping local
+ * notification schedules. Reconciliation is by absolute dose identity.
+ */
+jest.mock('../localDB', () => ({
+  getAllMedications: jest.fn(async () => []),
+  upsertMedication: jest.fn(async () => {}),
+  deleteMedicationById: jest.fn(async () => {}),
+  getDoseLogs: jest.fn(async () => []),
+  addDoseLog: jest.fn(async () => {}),
+}));
+
+import {
+  doseIdentityKey,
+  reconcileDoseSchedules,
+  type ScheduledDose,
+} from '../medicationService';
+
+describe('doseIdentityKey', () => {
+  it('is identical for the same instant expressed in different timezones', () => {
+    // 2026-03-08T07:30:00Z === 2026-03-08 02:30 America/New_York (pre-DST)
+    const asUtc: ScheduledDose = { medicationId: 'm', fireDate: '2026-03-08T07:30:00.000Z' };
+    const asOffset: ScheduledDose = { medicationId: 'm', fireDate: new Date('2026-03-08T02:30:00.000-05:00') };
+    expect(doseIdentityKey(asUtc)).toBe(doseIdentityKey(asOffset));
+  });
+
+  it('distinguishes an overnight dose from the next morning dose', () => {
+    const night: ScheduledDose = { medicationId: 'm', fireDate: '2026-03-08T04:00:00.000Z' };
+    const morning: ScheduledDose = { medicationId: 'm', fireDate: '2026-03-08T13:00:00.000Z' };
+    expect(doseIdentityKey(night)).not.toBe(doseIdentityKey(morning));
+  });
+});
+
+describe('reconcileDoseSchedules', () => {
+  it('cancels exact duplicate notifications for the same instant (post-edit stacking)', () => {
+    const existing: ScheduledDose[] = [
+      { medicationId: 'm', notificationId: 'n1', fireDate: '2026-06-01T09:00:00.000Z' },
+      { medicationId: 'm', notificationId: 'n2', fireDate: '2026-06-01T09:00:00.000Z' },
+    ];
+    const desired: ScheduledDose[] = [{ medicationId: 'm', fireDate: '2026-06-01T09:00:00.000Z' }];
+
+    const { toCancel, toSchedule, keep } = reconcileDoseSchedules(existing, desired);
+    expect(toCancel).toEqual(['n2']);
+    expect(keep).toEqual(['n1']);
+    expect(toSchedule).toHaveLength(0);
+  });
+
+  it('keeps DST-equivalent schedules instead of re-creating them on travel', () => {
+    // Traveller re-opens the app; the app recomputes the same absolute dose
+    // times but from a new device timezone. Nothing should be cancelled or added.
+    const existing: ScheduledDose[] = [
+      { medicationId: 'm', notificationId: 'n1', fireDate: '2026-03-08T07:00:00.000Z' },
+      { medicationId: 'm', notificationId: 'n2', fireDate: '2026-03-08T19:00:00.000Z' },
+    ];
+    const desired: ScheduledDose[] = [
+      { medicationId: 'm', fireDate: new Date('2026-03-08T02:00:00.000-05:00') },
+      { medicationId: 'm', fireDate: new Date('2026-03-08T14:00:00.000-05:00') },
+    ];
+
+    const { toCancel, toSchedule, keep } = reconcileDoseSchedules(existing, desired);
+    expect(toCancel).toHaveLength(0);
+    expect(toSchedule).toHaveLength(0);
+    expect(keep.sort()).toEqual(['n1', 'n2']);
+  });
+
+  it('cancels stale doses and schedules new ones after a schedule change', () => {
+    const existing: ScheduledDose[] = [
+      { medicationId: 'm', notificationId: 'old', fireDate: '2026-06-01T08:00:00.000Z' },
+    ];
+    const desired: ScheduledDose[] = [{ medicationId: 'm', fireDate: '2026-06-01T12:00:00.000Z' }];
+
+    const { toCancel, toSchedule } = reconcileDoseSchedules(existing, desired);
+    expect(toCancel).toEqual(['old']);
+    expect(toSchedule).toEqual([{ medicationId: 'm', fireDate: '2026-06-01T12:00:00.000Z' }]);
+  });
+
+  it('is a no-op for an already-consistent overnight schedule', () => {
+    const existing: ScheduledDose[] = [
+      { medicationId: 'm', notificationId: 'n1', fireDate: '2026-11-01T05:30:00.000Z' },
+    ];
+    const desired: ScheduledDose[] = [{ medicationId: 'm', fireDate: '2026-11-01T05:30:00.000Z' }];
+    const result = reconcileDoseSchedules(existing, desired);
+    expect(result).toEqual({ toCancel: [], toSchedule: [], keep: ['n1'] });
+  });
+});