@alviere/core 0.18.1 → 0.18.3

package/dist/index.mjs

@@ -149,7 +149,6 @@ class Cryptor {
    *
    */
   constructor(logger) {
-    this.nonce = new Uint8Array(12);
     this.logger = logger;
     this.rsa_key = getRSA_PUB_KEY();
     this.key = this.generate_key();
@@ -161,14 +160,14 @@ class Cryptor {
    * @returns
    */
   async encrypt(data) {
-    this.nonce = this.generate_nonce();
+    const nonce = this.generate_nonce();
     const encoded = new TextEncoder().encode(JSON.stringify(data));
-    const alg = { name: "AES-GCM", iv: this.nonce };
+    const alg = { name: "AES-GCM", iv: nonce };
     const crypto_key = await this.import_key();
     const cipher = await crypto.subtle.encrypt(alg, crypto_key, encoded);
     const cipherB64 = btoa(this.bufferToStr(new Uint8Array(cipher)));
     const keyB64 = btoa(this.bufferToStr(this.key));
-    const nonceB64 = btoa(this.bufferToStr(this.nonce));
+    const nonceB64 = btoa(this.bufferToStr(nonce));
     this.logger?.debug(`🔐 RSA_KEY: ${this.rsa_key.substring(0, 50)}...`);
     const publicKey = pki.publicKeyFromPem(this.rsa_key);
     const keyNonceB64 = btoa(publicKey.encrypt(keyB64 + "::" + nonceB64));
@@ -180,16 +179,17 @@ class Cryptor {
     this.logger?.debug(
       `🔐 ENCRYPTED_REQUEST: p=${encrypted_request.p.substring(0, 20)}..., i=${encrypted_request.i}`
     );
-    return encrypted_request;
+    return { request: encrypted_request, nonce };
   }
   /**
    *
    * @param data
+   * @param nonce the nonce returned by the encrypt() call this response corresponds to
    * @returns
    */
-  async decrypt(data) {
+  async decrypt(data, nonce) {
     const decrypted = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: this.nonce },
+      { name: "AES-GCM", iv: nonce },
       await this.import_key(),
       Uint8Array.from(atob(data.p), (c) => c.charCodeAt(0))
     );
@@ -712,6 +712,7 @@ class AlcoreBase {
    */
   constructor(jwt, cryptor, logger) {
     this.endpoint = "/alcore";
+    this.responseNonces = /* @__PURE__ */ new WeakMap();
     this.jwt = jwt;
     this.cryptor = cryptor;
     this.domain = getALVIERE_DOMAIN();
@@ -737,8 +738,11 @@ class AlcoreBase {
     this.logger.debug("DATA TO SEND before encrypt");
     this.logger.debug(payload);
     let encryptedData;
+    let nonce;
     try {
-      encryptedData = await this.cryptor.encrypt(request);
+      const encrypted = await this.cryptor.encrypt(request);
+      encryptedData = encrypted.request;
+      nonce = encrypted.nonce;
       this.logger.debug("🔐 Encryption successful");
     } catch (encryptError) {
       this.logger.debug(
@@ -767,13 +771,14 @@ class AlcoreBase {
       if (!response.ok) {
         let error = await response.json();
         if (error.p) {
-          error = await this.decrypt(error);
+          error = await this.cryptor.decrypt(error, nonce);
         }
         const errorCode = response.status === 500 ? AlcoreErrorCodes.UNDERLYING_API_ERROR : error.error_code;
         const errorDescription = error.error_description || getErrorMessage(errorCode);
         this.logger.debug(`❌ API Error - Code: ${errorCode}, Description: ${errorDescription}`);
         throw new AlcoreApiError(errorCode, errorDescription, response.status);
       }
+      this.responseNonces.set(response, nonce);
       return response;
     } catch (fetchError) {
       this.logger.debug(
@@ -785,9 +790,16 @@ class AlcoreBase {
   /**
    *
    * @param data
+   * @param response the Response returned by the send() call this data came from
    */
-  async decrypt(data) {
-    return this.cryptor.decrypt(data);
+  async decrypt(data, response) {
+    const nonce = this.responseNonces.get(response);
+    if (!nonce) {
+      throw new Error(
+        "Cannot decrypt: no nonce recorded for this response. Pass the Response returned by send()."
+      );
+    }
+    return this.cryptor.decrypt(data, nonce);
   }
 }
 function getSanitizedBody(data) {
@@ -883,21 +895,21 @@ class PaymentsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/payment-methods/cards`;
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async add_bank_account(accountUuid, data) {
     const endpoint = `/accounts/${accountUuid}/payment-methods/bank-accounts`;
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async get_bank_accounts(accountUuid) {
     const endpoint = `/accounts/${accountUuid}/payment-methods/bank-accounts?limit=100`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async delete_bank_account(accountUuid, uuid) {
@@ -909,7 +921,7 @@ class PaymentsGateway extends AlcoreBase {
     const endpoint = `/payment-methods/bank-accounts/${uuid}`;
     const response = await this.send("PATCH", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
 }
@@ -924,7 +936,7 @@ class WalletsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/wallets${query}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   // async getWallet(accountUuid: string, walletUuid: string): Promise<WalletResponse> {
@@ -934,7 +946,7 @@ class WalletsGateway extends AlcoreBase {
     const endpoint = `/wallets/${walletUuid}/load`;
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   // async withdrawFunds(walletUuid: string, data: WithdrawFundsRequest): Promise<WalletTransactionResponse> {
@@ -964,14 +976,14 @@ class PaymentInstrumentsGateway extends AlcoreBase {
     const endpoint = "/payments/payment-instruments";
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async getPaymentInstrument(paymentInstrumentUuid) {
     const endpoint = `/payments/payment-instruments/${paymentInstrumentUuid}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async deletePaymentInstrument(paymentInstrumentUuid) {
@@ -982,15 +994,17 @@ class PaymentInstrumentsGateway extends AlcoreBase {
     const endpoint = "/payments/debit";
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async listCards(accountUuid, params) {
-    const query = params ? "?" + new URLSearchParams(Object.entries(params).filter(([_, v]) => v !== void 0)) : "";
+    const query = params ? "?" + new URLSearchParams(
+      Object.entries(params).filter(([_, v]) => v !== void 0)
+    ) : "";
     const endpoint = `/accounts/${accountUuid}/payment-methods/cards${query}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
 }
@@ -1003,21 +1017,21 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = "/accounts";
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async getAccount(accountUuid) {
     const endpoint = `/accounts/${accountUuid}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async updateAccount(accountUuid, data) {
     const endpoint = `/accounts/${accountUuid}`;
     const response = await this.send("PATCH", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async deleteAccount(accountUuid) {
@@ -1031,7 +1045,7 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = `/accounts${query}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async activateAccount(accountUuid) {
@@ -1050,7 +1064,7 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/addresses`;
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async getAddresses(accountUuid, params) {
@@ -1060,14 +1074,14 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/addresses${query}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async updateAddress(accountUuid, addressUuid, data) {
     const endpoint = `/accounts/${accountUuid}/addresses/${addressUuid}`;
     const response = await this.send("PATCH", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async deleteAddress(accountUuid, addressUuid) {
@@ -1078,7 +1092,7 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/dossiers`;
     const response = await this.send("POST", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async getDossiers(accountUuid, params) {
@@ -1088,28 +1102,28 @@ class AccountsGateway extends AlcoreBase {
     const endpoint = `/accounts/${accountUuid}/dossiers${query}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async getDossier(accountUuid, dossierUuid) {
     const endpoint = `/accounts/${accountUuid}/dossiers/${dossierUuid}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async updateDossier(accountUuid, dossierUuid, data) {
     const endpoint = `/accounts/${accountUuid}/dossiers/${dossierUuid}`;
     const response = await this.send("PUT", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async replaceDossier(accountUuid, dossierUuid, data) {
     const endpoint = `/accounts/${accountUuid}/dossiers/${dossierUuid}`;
     const response = await this.send("PATCH", endpoint, data);
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
   async deleteDossier(accountUuid, dossierUuid) {
@@ -1138,7 +1152,8 @@ class AuthGateway extends AlcoreBase {
     this.logger.debug("🌐 Endpoint: /v3/auth");
     this.logger.debug("🌐 Account UUID: " + data.account_uuid);
     const response = await this.send("POST", "/v3/auth", data);
-    const decryptedResponse = await this.decrypt(await response.json());
+    const encrypted = await response.json();
+    const decryptedResponse = await this.decrypt(encrypted, response);
     this.logger.debug("✅ Scoped token generated successfully");
     return decryptedResponse;
   }
@@ -1385,7 +1400,7 @@ class BankInfoGateway extends AlcoreBase {
     const endpoint = `/v3/bank-info?routing_number=${routingNumber}`;
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
 }
@@ -1403,7 +1418,7 @@ class LegalTextsGateway extends AlcoreBase {
     this.logger.debug(`endpoint -> ${endpoint}`);
     const response = await this.send("GET", endpoint, {});
     const encrypted = await response.json();
-    const decrypted = await this.decrypt(encrypted);
+    const decrypted = await this.decrypt(encrypted, response);
     return throwIfApiError(decrypted);
   }
 }