@de./sdk 2.1.0 → 2.1.1

package/src/allend/OTPAuth/index.ts

@@ -1,3 +1,4 @@
+import type { SigninBody, CreateAccountBody, VerificationBody } from '@de./types'
 import type { AccessOptions, UserSession } from '../../types/access'
 import AccessManager from '../Access'
 import { qs, type Res } from '../../utils'
@@ -16,15 +17,23 @@ import { qs, type Res } from '../../utils'
 // single method it had could never succeed. Route shapes are taken from
 // de.auth/src/routes/{auth,user}/index.ts.
 //
+// The paths now say what they do — `/auth/otp/send` rather than `/signin`,
+// which sent a code and signed nobody in. The method names here are kept as
+// they were: `signin` is what a caller is doing, even when what it costs is
+// one SMS.
+//
 // ─────────────────────────────────────────────────────────────────────────────
 
-export type SigninBody = {
-	phone: string
-	/** Device fingerprint — an object or its JSON string. */
-	device: string | Record<string, any>
-	/** ISO 3166-1 alpha-2. */
-	country?: string
-}
+/**
+ * Request bodies come from `@de./types`, which is what de.auth validates
+ * against — these were hand-declared here, and said `country?: string` where
+ * de.auth wants the Country OBJECT. Its schema is additionalProperties:false,
+ * so a caller trusting the SDK's type was answered `body/country must be
+ * object`. Nothing caught it because this client could not be constructed at
+ * all: AccessManager demanded a workspace context and a bearer token, which
+ * sign-in is what produces.
+ */
+export type { SigninBody, CreateAccountBody, VerificationBody, Country } from '@de./types'
 
 export type SigninResult = {
 	/** What the caller must do next — verification, or account creation first. */
@@ -38,17 +47,6 @@ export type SigninResult = {
 	testVCode?: number
 }
 
-export type CreateAccountBody = {
-	phone: string
-	agreeTerms: boolean | string
-	firstName?: string
-	lastName?: string
-	photo?: string
-	type?: string
-	country?: string
-	newsletters?: boolean | string
-}
-
 export type VerifyResult = {
 	ctoken?: string
 	deviceId?: string
@@ -57,7 +55,17 @@ export type VerifyResult = {
 
 export default class OTPAuth extends AccessManager {
 	constructor( access: AccessOptions ){
-		super( access, 'ASI' )
+		/**
+		 * de.auth admits an agent that does not start with `De.service` only if
+		 * the request carries an Authorization header — and the whole point of
+		 * this client is the flow that has no token yet. The SDK's default
+		 * platform is `proxy`, so every sign-in through it was answered 412
+		 * before reaching a handler.
+		 *
+		 * `service` is the platform this client is for; a caller that knows
+		 * better can still say so.
+		 */
+		super({ ...access, platform: access.platform || 'service' }, 'ASI' )
 	}
 
 	// ── Sign-in ───────────────────────────────────────────────────────────────
@@ -66,26 +74,26 @@ export default class OTPAuth extends AccessManager {
 	async signin( body: SigninBody ): Promise<Res<SigninResult>> {
 		if( !body.phone ) throw new Error('<phone> argument required')
 
-		return this.request<Res<SigninResult>>({ url: '/signin', method: 'POST', body })
+		return this.request<Res<SigninResult>>({ url: '/auth/otp/send', method: 'POST', body })
 	}
 
 	/** Step 2 — exchanges the code for a session. */
 	async verify( body: { phone: string, pvc: number, new_phone?: string }): Promise<Res<VerifyResult>> {
-		return this.request<Res<VerifyResult>>({ url: '/verification', method: 'POST', body })
+		return this.request<Res<VerifyResult>>({ url: '/auth/otp/verify', method: 'POST', body })
 	}
 
 	/** Step 1a — for a phone de.auth has never seen. */
 	async setAccount( body: CreateAccountBody ): Promise<Res<{ next: string }>> {
-		return this.request<Res<{ next: string }>>({ url: '/set-account', method: 'POST', body })
+		return this.request<Res<{ next: string }>>({ url: '/auth/account/create', method: 'POST', body })
 	}
 
 	async resendSms( body: { phone: string }): Promise<Res<void>> {
-		return this.request<Res<void>>({ url: '/resend/sms', method: 'POST', body })
+		return this.request<Res<void>>({ url: '/auth/otp/resend', method: 'POST', body })
 	}
 
-	/** GET, with the scope in the querystring — not a POST. */
+	/** A state change, so a POST — it was a GET, which is cacheable. */
 	async signout( querystring?: { allDevices?: boolean | string }): Promise<Res<void>> {
-		return this.request<Res<void>>({ url: `/signout${qs( querystring )}`, method: 'GET' })
+		return this.request<Res<void>>({ url: `/auth/session/revoke${qs( querystring )}`, method: 'POST' })
 	}
 
 	// ── The signed-in person ──────────────────────────────────────────────────

package/src/utils/index.ts

@@ -21,16 +21,35 @@ export type Res<T = any> = { error: boolean, status?: string, message?: string,
  */
 export type Data<T> = 'data' extends keyof T ? T['data'] : undefined
 
+/**
+ * Serialize a querystring for a De. route.
+ *
+ * Array values are appended as repeated keys — `state=A&state=B` — which is
+ * what Fastify's query parser turns back into an array. `String( value )` on
+ * an array produces `A,B`, a single comma-joined string, and the route answers
+ * `querystring/state must be array`: the schema is right, the request never
+ * matched it. Every array parameter the SDK sent was malformed this way, the
+ * same shape of fault as the coordinates object that once serialized to
+ * `[object Object]`.
+ *
+ * @param params - Query parameters; null and undefined values are dropped
+ * @return - `?a=1&b=2`, or an empty string when there is nothing to send
+ */
 export const qs = ( params?: Record<string, any> ): string => {
   if( !params ) return ''
-  const q = new URLSearchParams(
-    Object.fromEntries(
-      Object.entries( params )
-            .filter( ( [, v] ) => v != null )
-            .map( ( [k, v] ) => [k, String( v )] )
-    )
-  ).toString()
-  return q ? `?${q}` : ''
+
+  const q = new URLSearchParams()
+
+  for( const [ key, value ] of Object.entries( params ) ){
+    if( value === null || value === undefined ) continue
+
+    Array.isArray( value )
+      ? value.forEach( each => each !== null && each !== undefined && q.append( key, String( each ) ) )
+      : q.append( key, String( value ) )
+  }
+
+  const query = q.toString()
+  return query ? `?${query}` : ''
 }
 
 export default { Stream }