@getpara/user-management-client 3.4.0 → 3.5.0

package/dist/cjs/client.js

@@ -112,7 +112,7 @@ const throwParaApiError = (message, code, status, responseURL, data, cause) => {
   throw paraApiError;
 };
 const handleResponseError = (error) => {
-  var _a, _b, _c;
+  var _a, _c, _d;
   if (error === null) throw new import_error.ParaApiError("Error is null");
   if (import_axios.default.isAxiosError(error)) {
     const data = (_a = error.response) == null ? void 0 : _a.data;
@@ -123,7 +123,12 @@ const handleResponseError = (error) => {
       const body = data;
       if (hasUsableString(body.message)) message = body.message;
       serverCode = body.code;
-      serverData = body.data;
+      if (body.data && typeof body.data === "object") {
+        serverData = body.data;
+      } else {
+        const _b = body, { message: _message, code: _code } = _b, rest = __objRest(_b, ["message", "code"]);
+        serverData = Object.keys(rest).length > 0 ? rest : void 0;
+      }
     }
     if (error.code === "ERR_NETWORK") {
       message = "Connection error";
@@ -133,8 +138,8 @@ const handleResponseError = (error) => {
     throwParaApiError(
       message,
       serverCode != null ? serverCode : error.code,
-      (_b = error.response) == null ? void 0 : _b.status,
-      (_c = error.request) == null ? void 0 : _c.responseURL,
+      (_c = error.response) == null ? void 0 : _c.status,
+      (_d = error.request) == null ? void 0 : _d.responseURL,
       serverData,
       error
     );
@@ -191,6 +196,33 @@ class Client {
       const res = yield this.baseRequest.post("/users/verify-oauth");
       return res.data;
     });
+    // POST /internal/v1/auth/2fa/enroll
+    // Login-time 2FA enrollment (ENG-6906). Authenticated by the active session.
+    // Returns the otpauth URI to render as a QR plus the one-time backup codes.
+    this.enrollMfa = () => __async(this, null, function* () {
+      const res = yield this.baseRequest.post("/internal/v1/auth/2fa/enroll");
+      return res.data;
+    });
+    // POST /internal/v1/auth/2fa/verify
+    // Login-time 2FA verification (ENG-6906). On success the backend stamps the
+    // session so the keyshare/sign gate passes; callers should then re-poll the login
+    // status (verify-oauth) to advance to `stage:'done'`. A wrong code is a 401 with
+    // `code:'UNAUTHORIZED'` carrying the remaining attempt budget — we surface that as
+    // a typed `{ ok:false, attemptsRemaining }` rather than throwing, so the UI can
+    // re-prompt. Other failures (e.g. NOT_ENROLLED 400, network) still throw.
+    this.verifyMfa = (code) => __async(this, null, function* () {
+      try {
+        yield this.baseRequest.post("/internal/v1/auth/2fa/verify", { code });
+        return { ok: true };
+      } catch (error) {
+        const apiError = error;
+        if ((apiError == null ? void 0 : apiError.isParaApiError) && (apiError.code === "UNAUTHORIZED" || apiError.status === 401)) {
+          const data = apiError.data;
+          return { ok: false, attemptsRemaining: data == null ? void 0 : data.attemptsRemaining };
+        }
+        throw error;
+      }
+    });
     this.loginExternalWallet = (_0) => __async(this, [_0], function* ({
       externalWallet,
       shouldTrackUser,

package/dist/esm/client.js

@@ -43,7 +43,7 @@ const throwParaApiError = (message, code, status, responseURL, data, cause) => {
   throw paraApiError;
 };
 const handleResponseError = (error) => {
-  var _a, _b, _c;
+  var _a, _c, _d;
   if (error === null) throw new ParaApiError("Error is null");
   if (axios.isAxiosError(error)) {
     const data = (_a = error.response) == null ? void 0 : _a.data;
@@ -54,7 +54,12 @@ const handleResponseError = (error) => {
       const body = data;
       if (hasUsableString(body.message)) message = body.message;
       serverCode = body.code;
-      serverData = body.data;
+      if (body.data && typeof body.data === "object") {
+        serverData = body.data;
+      } else {
+        const _b = body, { message: _message, code: _code } = _b, rest = __objRest(_b, ["message", "code"]);
+        serverData = Object.keys(rest).length > 0 ? rest : void 0;
+      }
     }
     if (error.code === "ERR_NETWORK") {
       message = "Connection error";
@@ -64,8 +69,8 @@ const handleResponseError = (error) => {
     throwParaApiError(
       message,
       serverCode != null ? serverCode : error.code,
-      (_b = error.response) == null ? void 0 : _b.status,
-      (_c = error.request) == null ? void 0 : _c.responseURL,
+      (_c = error.response) == null ? void 0 : _c.status,
+      (_d = error.request) == null ? void 0 : _d.responseURL,
       serverData,
       error
     );
@@ -122,6 +127,33 @@ class Client {
       const res = yield this.baseRequest.post("/users/verify-oauth");
       return res.data;
     });
+    // POST /internal/v1/auth/2fa/enroll
+    // Login-time 2FA enrollment (ENG-6906). Authenticated by the active session.
+    // Returns the otpauth URI to render as a QR plus the one-time backup codes.
+    this.enrollMfa = () => __async(this, null, function* () {
+      const res = yield this.baseRequest.post("/internal/v1/auth/2fa/enroll");
+      return res.data;
+    });
+    // POST /internal/v1/auth/2fa/verify
+    // Login-time 2FA verification (ENG-6906). On success the backend stamps the
+    // session so the keyshare/sign gate passes; callers should then re-poll the login
+    // status (verify-oauth) to advance to `stage:'done'`. A wrong code is a 401 with
+    // `code:'UNAUTHORIZED'` carrying the remaining attempt budget — we surface that as
+    // a typed `{ ok:false, attemptsRemaining }` rather than throwing, so the UI can
+    // re-prompt. Other failures (e.g. NOT_ENROLLED 400, network) still throw.
+    this.verifyMfa = (code) => __async(this, null, function* () {
+      try {
+        yield this.baseRequest.post("/internal/v1/auth/2fa/verify", { code });
+        return { ok: true };
+      } catch (error) {
+        const apiError = error;
+        if ((apiError == null ? void 0 : apiError.isParaApiError) && (apiError.code === "UNAUTHORIZED" || apiError.status === 401)) {
+          const data = apiError.data;
+          return { ok: false, attemptsRemaining: data == null ? void 0 : data.attemptsRemaining };
+        }
+        throw error;
+      }
+    });
     this.loginExternalWallet = (_0) => __async(this, [_0], function* ({
       externalWallet,
       shouldTrackUser,

package/dist/types/client.d.ts

@@ -163,6 +163,24 @@ interface EncryptedWalletPrivateKey {
     biometricPublicKey?: string;
     passwordId?: string;
 }
+/**
+ * Login-time 2FA (MFA) enroll/verify response shapes (ENG-6906). The challenge
+ * payload itself (`MfaChallenge`) lives in @getpara/shared and flows through the
+ * login auth-state poll; these are the bodies of the two dedicated session-authed
+ * endpoints under /internal/v1/auth/2fa.
+ */
+export type EnrollMfaResponse = {
+    /** otpauth:// URI for the authenticator app. */
+    uri: string;
+    /** One-time backup codes, shown to the user exactly once at enrollment. */
+    backupCodes: string[];
+};
+export type VerifyMfaResult = {
+    ok: true;
+} | {
+    ok: false;
+    attemptsRemaining?: number;
+};
 export type SDKType = 'WEB' | 'SERVER' | 'BRIDGE' | 'REACT_NATIVE';
 export type VerifyTelegramRes = {
     isValid: true;
@@ -192,6 +210,8 @@ declare class Client {
         sessionLookupId?: string;
     }) => Promise<VerifyTelegramResponse>;
     verifyOAuth: () => Promise<VerifyThirdPartyAuth | null>;
+    enrollMfa: () => Promise<EnrollMfaResponse>;
+    verifyMfa: (code: string) => Promise<VerifyMfaResult>;
     loginExternalWallet: ({ externalWallet, shouldTrackUser, chainId, uri, }: {
         externalWallet: ExternalWalletInfo;
         shouldTrackUser?: boolean;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@getpara/user-management-client",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "dependencies": {
-    "@getpara/shared": "^1.21.0",
+    "@getpara/shared": "^1.23.0",
     "@opentelemetry/api": "^1.9.1",
     "axios": "^1.8.4",
     "axios-retry": "^4.5.0",
@@ -22,7 +22,7 @@
     "dist",
     "package.json"
   ],
-  "gitHead": "795829c50bb71817a84bdbf5e6561ca4df3a827d",
+  "gitHead": "2e70485f8f206ff50f58b339ebf0922fd259858f",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "scripts": {