@getpara/user-management-client 3.3.0 → 3.5.0

package/dist/cjs/client.js

@@ -99,34 +99,52 @@ const handleResponseSuccess = (response) => {
   }
   throw new import_error.ParaApiError("Invalid status code");
 };
+const UNKNOWN_ERROR_MESSAGE = "Unknown error";
+const hasUsableString = (value) => typeof value === "string" && value.trim().length > 0;
+const getFallbackErrorMessage = (error) => {
+  if (hasUsableString(error == null ? void 0 : error.message)) return error.message;
+  if (hasUsableString(error == null ? void 0 : error.code)) return error.code;
+  return UNKNOWN_ERROR_MESSAGE;
+};
+const throwParaApiError = (message, code, status, responseURL, data, cause) => {
+  const paraApiError = new import_error.ParaApiError(message, code, status, responseURL, data);
+  if (cause !== void 0) paraApiError.cause = cause;
+  throw paraApiError;
+};
 const handleResponseError = (error) => {
-  var _a, _b, _c;
+  var _a, _c, _d;
   if (error === null) throw new import_error.ParaApiError("Error is null");
   if (import_axios.default.isAxiosError(error)) {
     const data = (_a = error.response) == null ? void 0 : _a.data;
-    let message = typeof data === "string" ? data : "Unknown error";
+    let message = hasUsableString(data) ? data : getFallbackErrorMessage(error);
     let serverCode;
     let serverData;
     if (data && typeof data === "object") {
       const body = data;
-      if (typeof body.message === "string") message = body.message;
+      if (hasUsableString(body.message)) message = body.message;
       serverCode = body.code;
-      serverData = body.data;
+      if (body.data && typeof body.data === "object") {
+        serverData = body.data;
+      } else {
+        const _b = body, { message: _message, code: _code } = _b, rest = __objRest(_b, ["message", "code"]);
+        serverData = Object.keys(rest).length > 0 ? rest : void 0;
+      }
     }
     if (error.code === "ERR_NETWORK") {
       message = "Connection error";
     } else if (error.code === "ERR_CANCELED") {
       message = "Connection canceled";
     }
-    throw new import_error.ParaApiError(
+    throwParaApiError(
       message,
       serverCode != null ? serverCode : error.code,
-      (_b = error.response) == null ? void 0 : _b.status,
-      (_c = error.request) == null ? void 0 : _c.responseURL,
-      serverData
+      (_c = error.response) == null ? void 0 : _c.status,
+      (_d = error.request) == null ? void 0 : _d.responseURL,
+      serverData,
+      error
     );
   }
-  throw new import_error.ParaApiError("Unknown error");
+  throwParaApiError(getFallbackErrorMessage(error), void 0, void 0, void 0, void 0, error);
 };
 const isRetryableError = (error) => {
   var _a, _b, _c, _d;
@@ -143,7 +161,9 @@ class Client {
     retrieveSessionCookie,
     persistSessionCookie,
     partnerConfigOverride,
-    staticTraceContext
+    staticTraceContext,
+    httpAgent,
+    httpsAgent
   }) {
     this.inFlightFaucetRequests = /* @__PURE__ */ new Map();
     this.signUpOrLogIn = (body) => __async(this, null, function* () {
@@ -176,6 +196,33 @@ class Client {
       const res = yield this.baseRequest.post("/users/verify-oauth");
       return res.data;
     });
+    // POST /internal/v1/auth/2fa/enroll
+    // Login-time 2FA enrollment (ENG-6906). Authenticated by the active session.
+    // Returns the otpauth URI to render as a QR plus the one-time backup codes.
+    this.enrollMfa = () => __async(this, null, function* () {
+      const res = yield this.baseRequest.post("/internal/v1/auth/2fa/enroll");
+      return res.data;
+    });
+    // POST /internal/v1/auth/2fa/verify
+    // Login-time 2FA verification (ENG-6906). On success the backend stamps the
+    // session so the keyshare/sign gate passes; callers should then re-poll the login
+    // status (verify-oauth) to advance to `stage:'done'`. A wrong code is a 401 with
+    // `code:'UNAUTHORIZED'` carrying the remaining attempt budget — we surface that as
+    // a typed `{ ok:false, attemptsRemaining }` rather than throwing, so the UI can
+    // re-prompt. Other failures (e.g. NOT_ENROLLED 400, network) still throw.
+    this.verifyMfa = (code) => __async(this, null, function* () {
+      try {
+        yield this.baseRequest.post("/internal/v1/auth/2fa/verify", { code });
+        return { ok: true };
+      } catch (error) {
+        const apiError = error;
+        if ((apiError == null ? void 0 : apiError.isParaApiError) && (apiError.code === "UNAUTHORIZED" || apiError.status === 401)) {
+          const data = apiError.data;
+          return { ok: false, attemptsRemaining: data == null ? void 0 : data.attemptsRemaining };
+        }
+        throw error;
+      }
+    });
     this.loginExternalWallet = (_0) => __async(this, [_0], function* ({
       externalWallet,
       shouldTrackUser,
@@ -636,12 +683,12 @@ class Client {
       // plain-text bodies for backward compat with older SDKs.
       [import_shared.STRUCTURED_ERRORS_HEADER]: "1"
     });
-    const axiosConfig = {
+    const axiosConfig = __spreadValues(__spreadValues({
       baseURL: userManagementHost,
       withCredentials: true,
       timeout: 6e4,
       headers
-    };
+    }, httpAgent ? { httpAgent } : {}), httpsAgent ? { httpsAgent } : {});
     if (retrieveSessionCookie) {
       const defaultTransformRequest = Array.isArray(import_axios.default.defaults.transformRequest) ? import_axios.default.defaults.transformRequest : [import_axios.default.defaults.transformRequest];
       axiosConfig.transformRequest = [

package/dist/esm/client.js

@@ -30,34 +30,52 @@ const handleResponseSuccess = (response) => {
   }
   throw new ParaApiError("Invalid status code");
 };
+const UNKNOWN_ERROR_MESSAGE = "Unknown error";
+const hasUsableString = (value) => typeof value === "string" && value.trim().length > 0;
+const getFallbackErrorMessage = (error) => {
+  if (hasUsableString(error == null ? void 0 : error.message)) return error.message;
+  if (hasUsableString(error == null ? void 0 : error.code)) return error.code;
+  return UNKNOWN_ERROR_MESSAGE;
+};
+const throwParaApiError = (message, code, status, responseURL, data, cause) => {
+  const paraApiError = new ParaApiError(message, code, status, responseURL, data);
+  if (cause !== void 0) paraApiError.cause = cause;
+  throw paraApiError;
+};
 const handleResponseError = (error) => {
-  var _a, _b, _c;
+  var _a, _c, _d;
   if (error === null) throw new ParaApiError("Error is null");
   if (axios.isAxiosError(error)) {
     const data = (_a = error.response) == null ? void 0 : _a.data;
-    let message = typeof data === "string" ? data : "Unknown error";
+    let message = hasUsableString(data) ? data : getFallbackErrorMessage(error);
     let serverCode;
     let serverData;
     if (data && typeof data === "object") {
       const body = data;
-      if (typeof body.message === "string") message = body.message;
+      if (hasUsableString(body.message)) message = body.message;
       serverCode = body.code;
-      serverData = body.data;
+      if (body.data && typeof body.data === "object") {
+        serverData = body.data;
+      } else {
+        const _b = body, { message: _message, code: _code } = _b, rest = __objRest(_b, ["message", "code"]);
+        serverData = Object.keys(rest).length > 0 ? rest : void 0;
+      }
     }
     if (error.code === "ERR_NETWORK") {
       message = "Connection error";
     } else if (error.code === "ERR_CANCELED") {
       message = "Connection canceled";
     }
-    throw new ParaApiError(
+    throwParaApiError(
       message,
       serverCode != null ? serverCode : error.code,
-      (_b = error.response) == null ? void 0 : _b.status,
-      (_c = error.request) == null ? void 0 : _c.responseURL,
-      serverData
+      (_c = error.response) == null ? void 0 : _c.status,
+      (_d = error.request) == null ? void 0 : _d.responseURL,
+      serverData,
+      error
     );
   }
-  throw new ParaApiError("Unknown error");
+  throwParaApiError(getFallbackErrorMessage(error), void 0, void 0, void 0, void 0, error);
 };
 const isRetryableError = (error) => {
   var _a, _b, _c, _d;
@@ -74,7 +92,9 @@ class Client {
     retrieveSessionCookie,
     persistSessionCookie,
     partnerConfigOverride,
-    staticTraceContext
+    staticTraceContext,
+    httpAgent,
+    httpsAgent
   }) {
     this.inFlightFaucetRequests = /* @__PURE__ */ new Map();
     this.signUpOrLogIn = (body) => __async(this, null, function* () {
@@ -107,6 +127,33 @@ class Client {
       const res = yield this.baseRequest.post("/users/verify-oauth");
       return res.data;
     });
+    // POST /internal/v1/auth/2fa/enroll
+    // Login-time 2FA enrollment (ENG-6906). Authenticated by the active session.
+    // Returns the otpauth URI to render as a QR plus the one-time backup codes.
+    this.enrollMfa = () => __async(this, null, function* () {
+      const res = yield this.baseRequest.post("/internal/v1/auth/2fa/enroll");
+      return res.data;
+    });
+    // POST /internal/v1/auth/2fa/verify
+    // Login-time 2FA verification (ENG-6906). On success the backend stamps the
+    // session so the keyshare/sign gate passes; callers should then re-poll the login
+    // status (verify-oauth) to advance to `stage:'done'`. A wrong code is a 401 with
+    // `code:'UNAUTHORIZED'` carrying the remaining attempt budget — we surface that as
+    // a typed `{ ok:false, attemptsRemaining }` rather than throwing, so the UI can
+    // re-prompt. Other failures (e.g. NOT_ENROLLED 400, network) still throw.
+    this.verifyMfa = (code) => __async(this, null, function* () {
+      try {
+        yield this.baseRequest.post("/internal/v1/auth/2fa/verify", { code });
+        return { ok: true };
+      } catch (error) {
+        const apiError = error;
+        if ((apiError == null ? void 0 : apiError.isParaApiError) && (apiError.code === "UNAUTHORIZED" || apiError.status === 401)) {
+          const data = apiError.data;
+          return { ok: false, attemptsRemaining: data == null ? void 0 : data.attemptsRemaining };
+        }
+        throw error;
+      }
+    });
     this.loginExternalWallet = (_0) => __async(this, [_0], function* ({
       externalWallet,
       shouldTrackUser,
@@ -567,12 +614,12 @@ class Client {
       // plain-text bodies for backward compat with older SDKs.
       [STRUCTURED_ERRORS_HEADER]: "1"
     });
-    const axiosConfig = {
+    const axiosConfig = __spreadValues(__spreadValues({
       baseURL: userManagementHost,
       withCredentials: true,
       timeout: 6e4,
       headers
-    };
+    }, httpAgent ? { httpAgent } : {}), httpsAgent ? { httpsAgent } : {});
     if (retrieveSessionCookie) {
       const defaultTransformRequest = Array.isArray(axios.defaults.transformRequest) ? axios.defaults.transformRequest : [axios.defaults.transformRequest];
       axiosConfig.transformRequest = [

package/dist/types/client.d.ts

@@ -24,6 +24,13 @@ type ClientConfig = {
      * interceptor that pulls from context.active().
      */
     staticTraceContext?: Record<string, string>;
+    /**
+     * Node-only keep-alive agents, set by the server SDK so server-to-server
+     * callers reuse connections instead of re-handshaking TCP+TLS per request.
+     * Left undefined in the browser, where the runtime pools sockets itself.
+     */
+    httpAgent?: unknown;
+    httpsAgent?: unknown;
 };
 interface createUserIdRes {
     protocolId: string;
@@ -156,6 +163,24 @@ interface EncryptedWalletPrivateKey {
     biometricPublicKey?: string;
     passwordId?: string;
 }
+/**
+ * Login-time 2FA (MFA) enroll/verify response shapes (ENG-6906). The challenge
+ * payload itself (`MfaChallenge`) lives in @getpara/shared and flows through the
+ * login auth-state poll; these are the bodies of the two dedicated session-authed
+ * endpoints under /internal/v1/auth/2fa.
+ */
+export type EnrollMfaResponse = {
+    /** otpauth:// URI for the authenticator app. */
+    uri: string;
+    /** One-time backup codes, shown to the user exactly once at enrollment. */
+    backupCodes: string[];
+};
+export type VerifyMfaResult = {
+    ok: true;
+} | {
+    ok: false;
+    attemptsRemaining?: number;
+};
 export type SDKType = 'WEB' | 'SERVER' | 'BRIDGE' | 'REACT_NATIVE';
 export type VerifyTelegramRes = {
     isValid: true;
@@ -168,12 +193,12 @@ export type VerifyTelegramRes = {
     isValid: false;
 };
 export declare const handleResponseSuccess: (response: AxiosResponse<any, any>) => AxiosResponse<any, any>;
-export declare const handleResponseError: (error: any) => never;
+export declare const handleResponseError: (error: any) => void;
 export declare const isRetryableError: (error: AxiosError) => boolean;
 declare class Client {
     private baseRequest;
     private inFlightFaucetRequests;
-    constructor({ userManagementHost, apiKey, partnerId, version, clientType, opts, retrieveSessionCookie, persistSessionCookie, partnerConfigOverride, staticTraceContext, }: ClientConfig);
+    constructor({ userManagementHost, apiKey, partnerId, version, clientType, opts, retrieveSessionCookie, persistSessionCookie, partnerConfigOverride, staticTraceContext, httpAgent, httpsAgent, }: ClientConfig);
     signUpOrLogIn: (body: VerifiedAuth & VerificationEmailProps) => Promise<SignUpOrLogInResponse>;
     /**
      * @deprecated
@@ -185,6 +210,8 @@ declare class Client {
         sessionLookupId?: string;
     }) => Promise<VerifyTelegramResponse>;
     verifyOAuth: () => Promise<VerifyThirdPartyAuth | null>;
+    enrollMfa: () => Promise<EnrollMfaResponse>;
+    verifyMfa: (code: string) => Promise<VerifyMfaResult>;
     loginExternalWallet: ({ externalWallet, shouldTrackUser, chainId, uri, }: {
         externalWallet: ExternalWalletInfo;
         shouldTrackUser?: boolean;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@getpara/user-management-client",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "dependencies": {
-    "@getpara/shared": "^1.21.0",
+    "@getpara/shared": "^1.23.0",
     "@opentelemetry/api": "^1.9.1",
     "axios": "^1.8.4",
     "axios-retry": "^4.5.0",
@@ -22,7 +22,7 @@
     "dist",
     "package.json"
   ],
-  "gitHead": "d9b54921d4187e2dd25f314b62ed99988e9b5b1c",
+  "gitHead": "2e70485f8f206ff50f58b339ebf0922fd259858f",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "scripts": {