@enfuce/nextgen-sdk 0.0.1

package/test/oauth.test.ts

@@ -0,0 +1,205 @@
+/**
+ * Tests for the hand-written OAuth token-management helper (src/oauth).
+ *
+ * Covers the TokenManager cache/refresh/single-flight logic, the client-credentials
+ * fetcher and the reactive 401-retry axios instance, using capturing axios adapters
+ * so nothing hits the network.
+ */
+import axios, { type AxiosAdapter, type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+import { oauth } from '../src';
+
+const { TokenManager, clientCredentialsFetcher, clientCredentials, createOAuthAxios } = oauth;
+
+function makeClock(start = 1000) {
+  const state = { t: start };
+  return { now: () => state.t, advance: (ms: number) => (state.t += ms), state };
+}
+
+function countingFetcher(expiresInSeconds = 300) {
+  const calls = { n: 0 };
+  const fetch = async () => {
+    calls.n += 1;
+    return { accessToken: `token-${calls.n}`, expiresInSeconds };
+  };
+  return { fetch, calls };
+}
+
+describe('TokenManager', () => {
+  it('caches the token within its validity window', async () => {
+    const { fetch, calls } = countingFetcher();
+    const clock = makeClock();
+    const mgr = new TokenManager(fetch, 60, clock.now);
+
+    expect(await mgr.getToken()).toBe('token-1');
+    expect(await mgr.getToken()).toBe('token-1');
+    expect(calls.n).toBe(1);
+  });
+
+  it('refreshes once past expiry minus skew', async () => {
+    const { fetch, calls } = countingFetcher(300);
+    const clock = makeClock();
+    const mgr = new TokenManager(fetch, 60, clock.now);
+
+    expect(await mgr.getToken()).toBe('token-1');
+    clock.advance(239_000);
+    expect(await mgr.getToken()).toBe('token-1');
+    expect(calls.n).toBe(1);
+
+    clock.advance(2_000); // 241s elapsed > 300 - 60
+    expect(await mgr.getToken()).toBe('token-2');
+    expect(calls.n).toBe(2);
+  });
+
+  it('refetches every call when lifetime is unknown', async () => {
+    const { fetch, calls } = countingFetcher(0);
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    await mgr.getToken();
+    await mgr.getToken();
+    expect(calls.n).toBe(2);
+  });
+
+  it('shares a single in-flight fetch across concurrent callers', async () => {
+    const { fetch, calls } = countingFetcher();
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+
+    const results = await Promise.all([mgr.getToken(), mgr.getToken(), mgr.getToken()]);
+
+    expect(calls.n).toBe(1);
+    expect(results).toEqual(['token-1', 'token-1', 'token-1']);
+  });
+
+  it('forceRefresh is a no-op when the cached token already moved on', async () => {
+    const { fetch, calls } = countingFetcher();
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+
+    expect(await mgr.getToken()).toBe('token-1');
+    expect(await mgr.forceRefresh('an-older-token')).toBe('token-1');
+    expect(calls.n).toBe(1);
+
+    expect(await mgr.forceRefresh('token-1')).toBe('token-2');
+    expect(calls.n).toBe(2);
+  });
+});
+
+describe('clientCredentialsFetcher', () => {
+  function capturingAxios(response: unknown) {
+    const captured: { config?: InternalAxiosRequestConfig } = {};
+    const adapter: AxiosAdapter = async (config) => {
+      captured.config = config;
+      return { data: response, status: 200, statusText: 'OK', headers: {}, config };
+    };
+    return { captured, instance: axios.create({ adapter }) };
+  }
+
+  it('POSTs a form body with Basic auth and parses the token', async () => {
+    const { captured, instance } = capturingAxios({ access_token: 'abc', expires_in: 120 });
+    const fetch = clientCredentialsFetcher({
+      tokenUrl: 'https://auth.example.com/oauth/token',
+      clientId: 'my-id',
+      clientSecret: 'my-secret',
+      scopes: ['cards:read', 'cards:write'],
+      axiosInstance: instance,
+    });
+
+    const token = await fetch();
+
+    expect(token).toEqual({ accessToken: 'abc', expiresInSeconds: 120 });
+    expect(captured.config?.url).toBe('https://auth.example.com/oauth/token');
+    expect(captured.config?.method).toBe('post');
+    expect(captured.config?.data).toContain('grant_type=client_credentials');
+    expect(captured.config?.data).toContain('scope=cards%3Aread+cards%3Awrite');
+    expect(captured.config?.auth).toEqual({ username: 'my-id', password: 'my-secret' });
+  });
+
+  it('sends credentials in the body when authStyle is "body"', async () => {
+    const { captured, instance } = capturingAxios({ access_token: 'abc', expires_in: 60 });
+    const fetch = clientCredentialsFetcher({
+      tokenUrl: 'https://auth.example.com/oauth/token',
+      clientId: 'my-id',
+      clientSecret: 'my-secret',
+      authStyle: 'body',
+      axiosInstance: instance,
+    });
+
+    await fetch();
+
+    expect(captured.config?.data).toContain('client_id=my-id');
+    expect(captured.config?.data).toContain('client_secret=my-secret');
+    expect(captured.config?.auth).toBeUndefined();
+  });
+
+  it('clientCredentials returns a caching TokenManager', async () => {
+    const { instance } = capturingAxios({ access_token: 'abc', expires_in: 120 });
+    const mgr = clientCredentials(
+      { tokenUrl: 'https://auth.example.com/oauth/token', clientId: 'id', clientSecret: 's', axiosInstance: instance },
+    );
+    expect(await mgr.getToken()).toBe('abc');
+  });
+});
+
+describe('createOAuthAxios', () => {
+  it('retries the request with a refreshed token when the first call rejects with 401', async () => {
+    const { fetch } = countingFetcher();
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    await mgr.getToken(); // seed token-1
+
+    const seenAuth: (string | undefined)[] = [];
+    let calls = 0;
+    const adapter: AxiosAdapter = async (config) => {
+      calls += 1;
+      seenAuth.push(config.headers?.Authorization as string | undefined);
+      if (calls === 1) {
+        // eslint-disable-next-line prefer-promise-reject-errors
+        return Promise.reject(
+          Object.assign(new Error('401'), {
+            isAxiosError: true,
+            config,
+            response: { data: {}, status: 401, statusText: 'Unauthorized', headers: {}, config },
+          }),
+        );
+      }
+      return { data: { ok: true }, status: 200, statusText: 'OK', headers: {}, config };
+    };
+    const http = createOAuthAxios(mgr, axios.create({ adapter }));
+
+    const response = await http.request({
+      url: 'http://localhost/v1/cards/x',
+      method: 'get',
+      headers: { Authorization: 'Bearer token-1' } as never,
+    });
+
+    expect(response.status).toBe(200);
+    expect(calls).toBe(2);
+    expect(seenAuth[0]).toBe('Bearer token-1');
+    expect(seenAuth[1]).toBe('Bearer token-2');
+  });
+
+  it('surfaces the error after a single retry (no infinite loop)', async () => {
+    const { fetch } = countingFetcher();
+    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    await mgr.getToken();
+
+    let calls = 0;
+    const adapter: AxiosAdapter = async (config) => {
+      calls += 1;
+      return Promise.reject(
+        Object.assign(new Error('401'), {
+          isAxiosError: true,
+          config,
+          response: { data: {}, status: 401, statusText: 'Unauthorized', headers: {}, config },
+        }),
+      );
+    };
+    const http = createOAuthAxios(mgr, axios.create({ adapter }));
+
+    await expect(
+      http.request({
+        url: 'http://localhost/v1/cards/x',
+        method: 'get',
+        headers: { Authorization: 'Bearer token-1' } as never,
+      }),
+    ).rejects.toThrow();
+    expect(calls).toBe(2); // original + one retry only
+  });
+});

package/test/pin.test.ts

@@ -0,0 +1,39 @@
+/**
+ * Wire-level tests for the pin API client, asserting the request against an
+ * exact JSON payload. A capturing axios adapter intercepts the request instead of
+ * hitting the network, so this exercises the real generated client (URL building,
+ * Content-Type, body serialization) without a live server or a mock library.
+ */
+import axios, { type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+import { PINOperationsUsingPKIApi } from '../src/pin';
+
+function capturingClient() {
+  const captured: { config?: InternalAxiosRequestConfig } = {};
+  const instance = axios.create({
+    adapter: async (config) => {
+      captured.config = config;
+      return { data: undefined, status: 200, statusText: 'OK', headers: {}, config };
+    },
+  });
+  return { captured, instance };
+}
+
+describe('PINOperationsUsingPKIApi.viewPin', () => {
+  it('POSTs the exact view-pin JSON to the pin view endpoint', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new PINOperationsUsingPKIApi(undefined, 'http://localhost', instance);
+
+    await api.viewPin({
+      pinControlId: '11111111-1111-1111-1111-111111111111',
+      pubKey: 'SYNTHETIC_PUBLIC_KEY',
+    });
+
+    expect(captured.config?.method?.toUpperCase()).toBe('POST');
+    expect(captured.config?.url).toBe('http://localhost/v1/pin/view');
+    expect(captured.config?.headers?.['Content-Type']).toBe('application/json');
+    expect(captured.config?.data).toBe(
+      '{"pinControlId":"11111111-1111-1111-1111-111111111111","pubKey":"SYNTHETIC_PUBLIC_KEY"}',
+    );
+  });
+});

package/test/threeds-oob.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Wire-level tests for the threeds-oob API client, asserting the request against an
+ * exact JSON payload. A capturing axios adapter intercepts the request instead of
+ * hitting the network, so this exercises the real generated client (URL building,
+ * Content-Type, body serialization) without a live server or a mock library.
+ */
+import axios, { type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+import {
+  OOBAuthenticationChallengeWebhookNotificationApi,
+  ThreeDsTransactionCategoryEnum,
+  ThreeDsTransactionDeviceChannelEnum,
+} from '../src/threeds-oob';
+
+function capturingClient() {
+  const captured: { config?: InternalAxiosRequestConfig } = {};
+  const instance = axios.create({
+    adapter: async (config) => {
+      captured.config = config;
+      return { data: undefined, status: 200, statusText: 'OK', headers: {}, config };
+    },
+  });
+  return { captured, instance };
+}
+
+describe('OOBAuthenticationChallengeWebhookNotificationApi.initiateAuthenticationChallenge', () => {
+  it('POSTs the exact challenge JSON to the OOB challenge initiate endpoint', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new OOBAuthenticationChallengeWebhookNotificationApi(undefined, 'http://localhost', instance);
+
+    await api.initiateAuthenticationChallenge({
+      authenticationId: '11111111-1111-1111-1111-111111111111',
+      challengeId: '22222222-2222-2222-2222-222222222222',
+      cardholder: {
+        id: '33333333-3333-3333-3333-333333333333',
+        customerNumber: 'CUST-0001',
+      },
+      card: {
+        id: '44444444-4444-4444-4444-444444444444',
+        maskedPan: '512345******0000',
+      },
+      threeDsTransaction: {
+        transactionAmount: { amount: 1000, currency: 'EUR' },
+        category: ThreeDsTransactionCategoryEnum.Payment,
+        deviceChannel: ThreeDsTransactionDeviceChannelEnum.App,
+        processedDateTime: '2024-05-31T06:55:17Z',
+      },
+      merchant: {
+        name: 'Acme Shop',
+        country: 'FIN',
+        url: 'https://merchant.example',
+      },
+    });
+
+    expect(captured.config?.method?.toUpperCase()).toBe('POST');
+    expect(captured.config?.url).toBe('http://localhost/v1/3ds/oob/challenge/initiate');
+    expect(captured.config?.headers?.['Content-Type']).toBe('application/json');
+    expect(captured.config?.data).toBe(
+      '{"authenticationId":"11111111-1111-1111-1111-111111111111","challengeId":"22222222-2222-2222-2222-222222222222","cardholder":{"id":"33333333-3333-3333-3333-333333333333","customerNumber":"CUST-0001"},"card":{"id":"44444444-4444-4444-4444-444444444444","maskedPan":"512345******0000"},"threeDsTransaction":{"transactionAmount":{"amount":1000,"currency":"EUR"},"category":"PAYMENT","deviceChannel":"APP","processedDateTime":"2024-05-31T06:55:17Z"},"merchant":{"name":"Acme Shop","country":"FIN","url":"https://merchant.example"}}',
+    );
+  });
+
+  it('serializes the NON_PAYMENT category to the exact JSON body', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new OOBAuthenticationChallengeWebhookNotificationApi(undefined, 'http://localhost', instance);
+
+    await api.initiateAuthenticationChallenge({
+      authenticationId: '55555555-5555-5555-5555-555555555555',
+      challengeId: '66666666-6666-6666-6666-666666666666',
+      cardholder: {
+        id: '77777777-7777-7777-7777-777777777777',
+        customerNumber: 'CUST-0002',
+      },
+      card: {
+        id: '88888888-8888-8888-8888-888888888888',
+        maskedPan: '512345******1111',
+      },
+      threeDsTransaction: {
+        transactionAmount: { amount: 2500, currency: 'EUR' },
+        category: ThreeDsTransactionCategoryEnum.NonPayment,
+        deviceChannel: ThreeDsTransactionDeviceChannelEnum.Browser,
+        processedDateTime: '2024-06-01T10:00:00Z',
+      },
+    });
+
+    expect(captured.config?.data).toBe(
+      '{"authenticationId":"55555555-5555-5555-5555-555555555555","challengeId":"66666666-6666-6666-6666-666666666666","cardholder":{"id":"77777777-7777-7777-7777-777777777777","customerNumber":"CUST-0002"},"card":{"id":"88888888-8888-8888-8888-888888888888","maskedPan":"512345******1111"},"threeDsTransaction":{"transactionAmount":{"amount":2500,"currency":"EUR"},"category":"NON_PAYMENT","deviceChannel":"BROWSER","processedDateTime":"2024-06-01T10:00:00Z"}}',
+    );
+  });
+});

package/test/threeds.test.ts

@@ -0,0 +1,55 @@
+/**
+ * Wire-level tests for the threeds API client, asserting the request against an
+ * exact JSON payload. A capturing axios adapter intercepts the request instead of
+ * hitting the network, so this exercises the real generated client (URL building,
+ * Content-Type, body serialization) without a live server or a mock library.
+ */
+import axios, { type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+import { ThreeDSApi, AuthenticationChallengeResultBodyResultEnum } from '../src/threeds';
+
+function capturingClient() {
+  const captured: { config?: InternalAxiosRequestConfig } = {};
+  const instance = axios.create({
+    adapter: async (config) => {
+      captured.config = config;
+      return { data: undefined, status: 200, statusText: 'OK', headers: {}, config };
+    },
+  });
+  return { captured, instance };
+}
+
+describe('ThreeDSApi.handleAuthenticationChallengeResult', () => {
+  it('POSTs the exact challenge-result JSON to the OOB result endpoint', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new ThreeDSApi(undefined, 'http://localhost', instance);
+
+    await api.handleAuthenticationChallengeResult({
+      authenticationId: '11111111-1111-1111-1111-111111111111',
+      challengeId: '22222222-2222-2222-2222-222222222222',
+      result: AuthenticationChallengeResultBodyResultEnum.Success,
+    });
+
+    expect(captured.config?.method?.toUpperCase()).toBe('POST');
+    expect(captured.config?.url).toBe('http://localhost/v1/3ds/challenge/oob/result');
+    expect(captured.config?.headers?.['Content-Type']).toBe('application/json');
+    expect(captured.config?.data).toBe(
+      '{"authenticationId":"11111111-1111-1111-1111-111111111111","challengeId":"22222222-2222-2222-2222-222222222222","result":"SUCCESS"}',
+    );
+  });
+
+  it('serializes the FAIL result to the exact JSON body', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new ThreeDSApi(undefined, 'http://localhost', instance);
+
+    await api.handleAuthenticationChallengeResult({
+      authenticationId: '33333333-3333-3333-3333-333333333333',
+      challengeId: '44444444-4444-4444-4444-444444444444',
+      result: AuthenticationChallengeResultBodyResultEnum.Fail,
+    });
+
+    expect(captured.config?.data).toBe(
+      '{"authenticationId":"33333333-3333-3333-3333-333333333333","challengeId":"44444444-4444-4444-4444-444444444444","result":"FAIL"}',
+    );
+  });
+});

package/test/wallet.test.ts

@@ -0,0 +1,62 @@
+/**
+ * Wire-level tests for the wallet API client, asserting the request against an
+ * exact JSON payload. A capturing axios adapter intercepts the request instead of
+ * hitting the network, so this exercises the real generated client (URL building,
+ * Content-Type, body serialization) without a live server or a mock library.
+ */
+import axios, { type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+import {
+  PushCardsApi,
+  PushAccountsToTokenRequestorRequestIncludeAccountHolderDataEnum,
+} from '../src/wallet';
+
+function capturingClient() {
+  const captured: { config?: InternalAxiosRequestConfig } = {};
+  const instance = axios.create({
+    adapter: async (config) => {
+      captured.config = config;
+      return { data: undefined, status: 200, statusText: 'OK', headers: {}, config };
+    },
+  });
+  return { captured, instance };
+}
+
+describe('PushCardsApi.pushCardsToTokenRequestor', () => {
+  it('POSTs the exact push-cards JSON to the mdestokenconnect push endpoint', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new PushCardsApi(undefined, 'http://localhost', instance);
+
+    await api.pushCardsToTokenRequestor({
+      tokenRequestorId: '11111111-1111-1111-1111-111111111111',
+      cardIds: ['22222222-2222-2222-2222-222222222222'],
+      includeAccountHolderData: [
+        PushAccountsToTokenRequestorRequestIncludeAccountHolderDataEnum.AllSupported,
+      ],
+    });
+
+    expect(captured.config?.method?.toUpperCase()).toBe('POST');
+    expect(captured.config?.url).toBe('http://localhost/v1/wallet/mdestokenconnect/push');
+    expect(captured.config?.headers?.['Content-Type']).toBe('application/json');
+    expect(captured.config?.data).toBe(
+      '{"tokenRequestorId":"11111111-1111-1111-1111-111111111111","cardIds":["22222222-2222-2222-2222-222222222222"],"includeAccountHolderData":["ALL_SUPPORTED"]}',
+    );
+  });
+
+  it('serializes the NAME account-holder-data enum to the exact JSON body', async () => {
+    const { captured, instance } = capturingClient();
+    const api = new PushCardsApi(undefined, 'http://localhost', instance);
+
+    await api.pushCardsToTokenRequestor({
+      tokenRequestorId: '33333333-3333-3333-3333-333333333333',
+      cardIds: ['44444444-4444-4444-4444-444444444444'],
+      includeAccountHolderData: [
+        PushAccountsToTokenRequestorRequestIncludeAccountHolderDataEnum.Name,
+      ],
+    });
+
+    expect(captured.config?.data).toBe(
+      '{"tokenRequestorId":"33333333-3333-3333-3333-333333333333","cardIds":["44444444-4444-4444-4444-444444444444"],"includeAccountHolderData":["NAME"]}',
+    );
+  });
+});

package/tsconfig.esm.json

@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "module": "esnext",
+    "outDir": "dist/esm"
+  }
+}

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "declaration": true,
+    "target": "ES6",
+    "module": "commonjs",
+    "noImplicitAny": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "moduleResolution": "node",
+    "typeRoots": ["node_modules/@types"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["dist", "node_modules"]
+}