feat: React Native mobile app, compliance reporting, real-time FX WebSocket (#942 #943 #944)

[ink-mami]

Summary

---

closes #942 — React Native mobile app for senders (mobile/)

Why: Migrant workers predominantly use mobile devices; SwiftRemit had no mobile surface.

What was built:

• Expo-based React Native project (mobile/) targeting iOS and Android
• Send Money wizard (3 steps): recipient details → amount + live FX preview → biometric-confirmed review
• Transaction History screen with pull-to-refresh and status badges
• Transaction Detail screen with a visual step-progress indicator
• KYC Status screen showing verification state, required fields, and rejection reasons
• Biometric confirmation (expo-local-authentication) — Face ID / fingerprint required before every transfer; gracefully falls through on devices without hardware biometrics
• Push notifications (expo-notifications) — registers for FCM (Android) and APNs (iOS) on first launch; notification tap deep-links to the relevant transaction
• Secure JWT storage via expo-secure-store; typed service layer for all backend API calls
• Bottom-tab + stack navigation via @react-navigation

Key files:

File	Purpose
mobile/App.tsx	Entry point; push token registration, notification response listener
mobile/src/screens/SendMoneyScreen.tsx	3-step send wizard with live FX quote + biometric confirm
mobile/src/screens/TransactionHistoryScreen.tsx	Paginated, pull-to-refresh transaction list
mobile/src/screens/KycStatusScreen.tsx	KYC state display with actionable CTA
mobile/src/services/api.ts	Typed axios client (auth, remittance, KYC, FX)
mobile/src/services/biometrics.ts	Biometric gate with graceful hardware fallback
mobile/src/services/notifications.ts	Push token registration + listener helpers

---

closes #943 — Compliance reporting dashboard for regulators (backend/)

Why: Regulators require real-time / periodic reporting of cross-border transfers above a threshold.

What was built:

• DB migration (add_compliance_reporting.sql) — three new tables:
  • compliance_thresholds — configurable per-corridor thresholds (e.g. USD/PHP above $3 000)
  • compliance_flagged_remittances — auto-flagged transfers with status lifecycle (pending → reported → cleared)
  • compliance_report_audit — immutable log of every report access (actor, IP, filters, row count)
• Auto-flagging — autoFlagIfAboveThreshold() called on every new remittance creation; no manual intervention needed
• REST endpoints under /api/compliance:

  Method	Path	Description
  GET	/report	Filtered report (date range, status, currency, corridor); JSON or CSV export
  GET	/thresholds	List all thresholds
  POST	/thresholds	Create / update a threshold
  POST	/flag	Manually flag a remittance
  PATCH	/flag/:id	Update flag status (reported / cleared)

• CSV export uses csv-stringify — FINCEN/FATF-compatible column headers
• All report accesses write an audit row atomically

---

closes #944 — Real-time FX rate WebSocket feed (backend/)

Why: Clients had to poll REST to get FX updates; adds latency and unnecessary load.

What was built:

• socket.io dependency added to backend
• FxRateWebSocketServer (backend/src/fx-rate-websocket.ts) — Socket.io namespace /fx-rates mounted at path /ws on the existing http.Server
• Subscription filtering — clients emit subscribe/unsubscribe with a pairs array (e.g. ["USD/PHP", "USD/MXN"]); internally rooms are keyed by pair so only relevant subscribers receive each update
• Rate-replay on connect/subscribe — last known rate fetched from cache and emitted immediately so reconnecting clients never display stale data
• Push on cache refresh — FxRateCache now emits rate_updated via an injected EventEmitter; background refreshes and new fetches both trigger the event, so connected clients receive updates within 1 s of any cache write
• Graceful shutdown — fxRateWss.close() called before PostgreSQL pool drain
• Full protocol documented in API.md (connection URL, events, reconnect behaviour, JS example)

Test plan

• cd mobile && npx expo start — app boots on iOS / Android simulator; all 3 tabs reachable
• Send money wizard: enter recipient → set amount → biometric prompt fires → transfer created and navigates to detail screen
• On a physical device: push notification arrives within 10 s of a backend status-change event
• POST /api/compliance/thresholds with { "corridor": "USD/PHP", "currency": "USD", "threshold": 100 } → create a remittance > 100 → GET /api/compliance/report returns the flagged record in < 5 s
• GET /api/compliance/report?format=csv returns a downloadable CSV
• Socket.io client connects → emits subscribe { pairs: ["USD/PHP"] } → receives fx_rate immediately (rate-replay) and again within 1 s of next cache refresh

[vercel]

@ink-mami is attempting to deploy a commit to the Harold's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@ink-mami Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits