@incodetech/web 2.3.2-rc.4 → 2.4.0-rc.0

package/dist/deviceWallet-CoXT8GNt.js

@@ -0,0 +1,66 @@
+import { o as useTranslation } from "./uiConfig-CzjzpmLx.js";
+import { v as u } from "./vendor-preact-C0jX1Cbq.js";
+import { t as TransitionSpinner } from "./transitionSpinner-CPK1gaqC.js";
+import { t as VerificationResult } from "./verificationResult-CZbJPu23.js";
+//#region src/modules/id/deviceWallet/errorScreen.tsx
+/**
+* Failure screen for the device-wallet (mDL) handshake. Renders the shared
+* `VerificationResult` (same look as the digital-ID redirect failure screen)
+* with per-reason copy. Keys are static literals so i18nexus can extract them
+* (author EN + supported locales in i18nexus); the subtitle keys match the
+* core `DEVICE_WALLET_ERROR_KEYS` map, kept local here — like
+* `digitalIdRedirect/failureScreen.tsx` — to avoid a runtime value import
+* from `@incodetech/core`. Failure is non-blocking: retry restarts the
+* handshake, or fall back to the ID-Capture chooser.
+*/
+var COPY_KEYS = {
+	UNSUPPORTED_PLATFORM: {
+		title: "idv2.deviceWallet.unsupportedPlatformTitle",
+		subtitle: "idv2.deviceWallet.unsupportedPlatformDescription"
+	},
+	NO_CREDENTIAL: {
+		title: "idv2.deviceWallet.noCredentialTitle",
+		subtitle: "idv2.deviceWallet.noCredentialDescription"
+	},
+	WALLET_ERROR: {
+		title: "idv2.deviceWallet.errorTitle",
+		subtitle: "idv2.deviceWallet.errorDescription"
+	}
+};
+var GENERIC_KEYS = {
+	title: "idv2.deviceWallet.errorTitle",
+	subtitle: "idv2.deviceWallet.errorDescription"
+};
+var ErrorScreen = ({ failReason, onRetry, onUseAnotherMethod }) => {
+	const { t } = useTranslation();
+	const { title, subtitle } = failReason ? COPY_KEYS[failReason] : GENERIC_KEYS;
+	const canRetry = failReason !== "UNSUPPORTED_PLATFORM";
+	return /* @__PURE__ */ u(VerificationResult, {
+		status: "failure",
+		failureTitle: t(title),
+		errorMessage: t(subtitle),
+		onRetry: canRetry ? onRetry : void 0,
+		retryLabel: t("common.tryAgain"),
+		onSkip: onUseAnotherMethod,
+		skipLabel: t("idv2.deviceWallet.useAnotherMethodButton")
+	});
+};
+//#endregion
+//#region src/modules/id/deviceWallet/deviceWallet.tsx
+/**
+* Device-wallet (mDL) handshake rendered INSIDE ID-Capture as a child machine
+* — mirrors `digitalIdRedirect/digitalIdRedirect.tsx`. The core child owns
+* request → wallet sheet → decrypt; this layer only renders the phase. During
+* `presenting` the OS wallet sheet covers the page, so a spinner is all the
+* page itself needs.
+*/
+var DeviceWallet = ({ manager, state }) => {
+	if (state.phase === "failed") return /* @__PURE__ */ u(ErrorScreen, {
+		failReason: state.failReason,
+		onRetry: () => manager.deviceWalletRetry(),
+		onUseAnotherMethod: () => manager.deviceWalletUseAnotherMethod()
+	});
+	return /* @__PURE__ */ u(TransitionSpinner, { hideText: true });
+};
+//#endregion
+export { DeviceWallet };

package/dist/digitalIdRedirect-CI0JpjXY.js

@@ -0,0 +1,162 @@
+import { o as useTranslation } from "./uiConfig-CzjzpmLx.js";
+import { _ as y, v as u } from "./vendor-preact-C0jX1Cbq.js";
+import { t as TransitionSpinner } from "./transitionSpinner-CPK1gaqC.js";
+import { t as VerificationResult } from "./verificationResult-CZbJPu23.js";
+//#region src/modules/id/digitalIdRedirect/failureScreen.tsx
+/**
+* Failure screen for the digital-ID web-redirect (Trinsic iDIN/FTN). Renders the
+* shared `VerificationResult` (same look as ekyc/ekyb) with the module's own
+* per-reason copy. Copy is i18nexus-keyed under
+* `idv2.digitalIdRedirect.failureScreen.*` (add EN, plus NL for iDIN and FI/SV
+* for FTN, in i18nexus). Failure is non-blocking: retry (new session/billing
+* event) or use another method (back to the ID-Capture chooser).
+*
+* The nine `failureReason`s collapse into six copy groups; keys are written as
+* static literals so i18nexus can extract them. A translator can split a group
+* into per-reason copy later without a code change.
+*/
+var COPY_KEYS = {
+	USER_CANCELED: {
+		title: "idv2.digitalIdRedirect.failureScreen.canceled.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.canceled.subtitle"
+	},
+	RP_CANCELED: {
+		title: "idv2.digitalIdRedirect.failureScreen.canceled.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.canceled.subtitle"
+	},
+	AUTHENTICATION_FAILED: {
+		title: "idv2.digitalIdRedirect.failureScreen.authenticationFailed.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.authenticationFailed.subtitle"
+	},
+	VERIFICATION_FAILED: {
+		title: "idv2.digitalIdRedirect.failureScreen.verificationFailed.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.verificationFailed.subtitle"
+	},
+	SESSION_EXPIRED: {
+		title: "idv2.digitalIdRedirect.failureScreen.sessionExpired.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.sessionExpired.subtitle"
+	},
+	SESSION_TOKEN_EXPIRED: {
+		title: "idv2.digitalIdRedirect.failureScreen.sessionExpired.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.sessionExpired.subtitle"
+	},
+	PROVIDER_INTERNAL_ERROR: {
+		title: "idv2.digitalIdRedirect.failureScreen.technicalError.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.technicalError.subtitle"
+	},
+	RESULTS_EXCHANGE_FAILED: {
+		title: "idv2.digitalIdRedirect.failureScreen.technicalError.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.technicalError.subtitle"
+	},
+	INVALID_REDIRECT_RESULT: {
+		title: "idv2.digitalIdRedirect.failureScreen.technicalError.title",
+		subtitle: "idv2.digitalIdRedirect.failureScreen.technicalError.subtitle"
+	}
+};
+var GENERIC_KEYS = {
+	title: "idv2.digitalIdRedirect.failureScreen.generic.title",
+	subtitle: "idv2.digitalIdRedirect.failureScreen.generic.subtitle"
+};
+var FailureScreen = ({ failureReason, onRetry, onUseAnotherMethod }) => {
+	const { t } = useTranslation();
+	const copy = failureReason ? COPY_KEYS[failureReason] : GENERIC_KEYS;
+	return /* @__PURE__ */ u(VerificationResult, {
+		status: "failure",
+		failureTitle: t(copy.title),
+		errorMessage: t(copy.subtitle),
+		onRetry,
+		retryLabel: t("common.tryAgain"),
+		onSkip: onUseAnotherMethod,
+		skipLabel: t("idv2.digitalIdRedirect.failureScreen.useAnotherMethod")
+	});
+};
+//#endregion
+//#region src/shared/utils/safeRedirectUrl/safeRedirectUrl.ts
+var LOCAL_HOSTNAMES = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/**
+* Parses a full-page redirect target and returns it only when it is safe to
+* navigate to: an absolute `https:` URL, or an `http:` localhost URL while the
+* page itself runs on localhost (local development). Anything else — a
+* `javascript:` / `data:` URL from a compromised or MITM'd API, plain `http:`,
+* a relative or unparseable value — returns `null` and logs a warning, so the
+* caller does not navigate. The warning names only the scheme, never the URL,
+* so query-string tokens and script payloads stay out of the console.
+*/
+var getSafeRedirectUrl = (value, currentHostname = window.location.hostname) => {
+	let url;
+	try {
+		url = new URL(value);
+	} catch (_error) {
+		console.warn("[incode] Not redirecting: the redirect URL could not be parsed. Only https URLs are allowed.");
+		return null;
+	}
+	if (url.protocol === "https:") return url;
+	if (url.protocol === "http:" && LOCAL_HOSTNAMES.has(url.hostname) && LOCAL_HOSTNAMES.has(currentHostname)) return url;
+	console.warn(`[incode] Not redirecting to a "${url.protocol}" URL. Only https URLs are allowed.`);
+	return null;
+};
+//#endregion
+//#region src/modules/id/digitalIdRedirect/redirectingScreen.tsx
+/**
+* Performs the full-page redirect out to the identity provider (bank login).
+* Full-page navigation lives in L2, so core stays window-free. The pending
+* verificationId was already persisted by the core child machine (its
+* `persisting` state) before this screen renders, so the return leg can recover
+* it from storage after the reload.
+*/
+var RedirectingScreen = ({ launchUrl }) => {
+	y(() => {
+		const safeUrl = launchUrl ? getSafeRedirectUrl(launchUrl) : null;
+		if (safeUrl) window.location.assign(safeUrl.href);
+	}, [launchUrl]);
+	return /* @__PURE__ */ u(TransitionSpinner, { hideText: true });
+};
+//#endregion
+//#region src/modules/id/digitalIdRedirect/successScreen.tsx
+/**
+* Success confirmation for the digital-ID web-redirect (Trinsic iDIN/FTN).
+* Renders the shared `VerificationResult` (same look as ekyc/ekyb) with a manual
+* Continue action — the child machine parks in `succeeded` until the user
+* acknowledges, so the flow does not silently skip past the result.
+*
+* Copy is i18nexus-keyed under `idv2.digitalIdRedirect.successScreen.*`
+* (add EN, plus NL for iDIN and FI/SV for FTN, in i18nexus).
+*/
+var SuccessScreen = ({ onContinue }) => {
+	const { t } = useTranslation();
+	return /* @__PURE__ */ u(VerificationResult, {
+		status: "success",
+		successTitle: t("idv2.digitalIdRedirect.successScreen.title"),
+		successSubtitle: t("idv2.digitalIdRedirect.successScreen.subtitle"),
+		onContinue,
+		continueLabel: t("idv2.digitalIdRedirect.successScreen.continue")
+	});
+};
+//#endregion
+//#region src/modules/id/digitalIdRedirect/digitalIdRedirect.tsx
+/**
+* Digital ID web-redirect (Trinsic iDIN/FTN) rendered INSIDE ID-Capture as a
+* child machine — mirrors `digitalIdUpload/digitalIdUpload.tsx`. The core child
+* owns create → persist → redirect (and, on the return leg, submit → poll); this
+* layer only renders the phase and performs the full-page navigation.
+*/
+var DigitalIdRedirect = ({ manager, state }) => {
+	if (state.phase === "redirecting") return /* @__PURE__ */ u(RedirectingScreen, { launchUrl: state.launchUrl ?? "" });
+	if (state.phase === "success") return /* @__PURE__ */ u(SuccessScreen, { onContinue: () => manager.digitalIdRedirectContinue() });
+	if (state.phase === "failed") return /* @__PURE__ */ u(FailureScreen, {
+		failureReason: state.failureReason,
+		onRetry: () => manager.digitalIdRedirectRetry(),
+		onUseAnotherMethod: () => manager.digitalIdRedirectUseAnotherMethod()
+	});
+	if (state.phase === "error") return /* @__PURE__ */ u(FailureScreen, {
+		onRetry: () => manager.digitalIdRedirectRetry(),
+		onUseAnotherMethod: () => manager.digitalIdRedirectUseAnotherMethod()
+	});
+	return /* @__PURE__ */ u(TransitionSpinner, { hideText: true });
+};
+//#endregion
+export { DigitalIdRedirect };