@prove-identity/prove-auth 2.8.2 → 2.9.0

package/build/lib/proveauth/internal/device-passive-stepup-step.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const logger_1 = require("../common/logger");
 const device_passive_step_1 = require("./device-passive-step");
 class DevicePassiveStepupStep extends device_passive_step_1.DevicePassiveActions {
-    constructor(getDisplayName) {
-        super(getDisplayName);
+    constructor(getDisplayName, handler) {
+        super(getDisplayName, handler);
         this.name = DevicePassiveStepupStep.NAME;
         this.log = logger_1.LoggerFactory.getLogger('device-passive-stepup-step');
     }
@@ -18,7 +18,29 @@ class DevicePassiveStepupStep extends device_passive_step_1.DevicePassiveActions
         if (session.settings.fidoPasskeyRegistered) {
             return Promise.reject(new Error('FIDO2 Passkey is already registered'));
         }
-        return this.register(session);
+        return new Promise((resolve, reject) => {
+            session
+                .getFingerprintData()
+                .then((signal) => {
+                const signals = {
+                    fingerprint: signal,
+                };
+                session.embedDarwiniumSignal(signals);
+                this.register(session, signals).then(resolve).catch(reject);
+            })
+                .catch((error) => {
+                const errorMsg = `Unexpected error happened during Fingerprint data collection: ${error.message}`;
+                this.log.warn(errorMsg);
+                this.log.warn(error);
+                const signals = {
+                    fingerprint: {
+                        error: errorMsg,
+                    },
+                };
+                session.embedDarwiniumSignal(signals);
+                this.register(session, signals).then(resolve).catch(reject);
+            });
+        });
     }
 }
 DevicePassiveStepupStep.NAME = 'device/passive/stepup';

package/build/lib/proveauth/internal/device-passive-verify-step.d.ts

@@ -1,10 +1,11 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
-import { Signals } from './auth-request';
+import { Logger } from '../common/logger';
 export default class DevicePassiveVerifyStep implements AuthStep {
     static readonly NAME = "device/passive/verify";
     private readonly log;
     readonly name = "device/passive/verify";
     execute(session: AuthSession): Promise<string>;
-    runFidoVerifyFinish(session: AuthSession, signals?: Signals): Promise<string>;
+    static runFidoVerify(log: Logger, session: AuthSession): Promise<string>;
+    private static makeFidoVerifyFinishRequest;
 }

package/build/lib/proveauth/internal/device-passive-verify-step.js

@@ -12,24 +12,33 @@ class DevicePassiveVerifyStep {
         this.name = DevicePassiveVerifyStep.NAME;
     }
     execute(session) {
+        return new Promise((resolve, reject) => {
+            DevicePassiveVerifyStep.runFidoVerify(this.log, session).then(resolve).catch(reject);
+        });
+    }
+    static runFidoVerify(log, session) {
         return new Promise((resolve, reject) => {
             session
                 .getFingerprintData()
                 .then((signal) => {
-                let signals = { fingerprint: signal };
+                const signals = { fingerprint: signal };
                 session.embedDarwiniumSignal(signals);
-                this.runFidoVerifyFinish(session, signals).then(resolve).catch(reject);
+                DevicePassiveVerifyStep.makeFidoVerifyFinishRequest(log, session, signals)
+                    .then(resolve)
+                    .catch(reject);
             })
                 .catch((error) => {
-                var errorMsg = `Unexpected error happened during Fingerprint data collection ${error.toString}`;
-                this.log.warn(errorMsg);
-                let signals = { fingerprint: { error: errorMsg } };
+                const errorMsg = `Unexpected error happened during Fingerprint data collection ${error.toString}`;
+                log.warn(errorMsg);
+                const signals = { fingerprint: { error: errorMsg } };
                 session.embedDarwiniumSignal(signals);
-                this.runFidoVerifyFinish(session).then(resolve).catch(reject);
+                DevicePassiveVerifyStep.makeFidoVerifyFinishRequest(log, session, signals)
+                    .then(resolve)
+                    .catch(reject);
             });
         });
     }
-    runFidoVerifyFinish(session, signals) {
+    static makeFidoVerifyFinishRequest(log, session, signals) {
         return new Promise((resolve, reject) => {
             const credential = session.credential;
             const assertion = credential.response;
@@ -52,16 +61,25 @@ class DevicePassiveVerifyStep {
             })
                 .then((response) => {
                 if (response.error) {
-                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                    reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                 }
                 else {
                     const data = response.data;
-                    if (data && data.scanMessage) {
-                        session.authMessage = data.scanMessage;
+                    if (data) {
+                        if (data.deviceId) {
+                            session.settings.deviceId = data.deviceId;
+                        }
+                        if (data.passkey) {
+                            session.settings.fidoPasskeyRegistered = true;
+                        }
+                        if (data.scanMessage) {
+                            session.authMessage = data.scanMessage;
+                        }
                     }
                     else {
-                        this.log.warn('No data was received in the response');
+                        log.warn('No data was received in the response');
                     }
+                    session.settings.fidoPasskeyRegistered = true;
                     resolve(response.next);
                 }
             })

package/build/lib/proveauth/internal/fido-options-error.d.ts

@@ -0,0 +1,30 @@
+import Platform from './platform';
+export declare class FidoOptionsError extends Error {
+    static readonly MISSING_PUBLIC_KEY_PROPERTY = "options missing publicKey property";
+    static readonly ABORT_SIGNAL = "Authentication was sent an abort signal";
+    static readonly INVALID_STATE_ERROR = "The authenticator was already registered";
+    static readonly UNKNOWN_ERROR = "Unknown error: the authenticator was unable to process the predefined options, or unable to generate a new credential";
+    static readonly SECURITY_ERROR_FOUND = "Security error found";
+    static readonly INVALID_RP_ID = "The rp.id is not valid for the current domain";
+    static readonly CONSTRAINT_ERROR = "Discoverable credentials is required but found no matching supported authenticator";
+    static readonly USER_VERIFICATION_NOT_POSSILE = "User verification is required during automatic registration but this could not be performed";
+    static readonly NO_MATCHING_AUTHENTICATOR = "User verification is required but found no matching supported authenticator";
+    static readonly INVALID_CRED_PARAMS = "No entry in pubKeyCredParams having the type of public-key";
+    static readonly NO_MATCHING_AUTHENTICATOR_FOR_PARAMS_ALGO = "No available authenticator supported any of the specified pubKeyCredParams algorithms";
+    static readonly INVALID_USER_ID_LENGTH = "User ID has invalid length";
+    constructor({ message, cause, name }: {
+        message: string;
+        cause: Error;
+        name?: string;
+    });
+    static identifyAuthenticationError({ error, options, platform, }: {
+        error: Error;
+        options: CredentialRequestOptions;
+        platform: Platform;
+    }): FidoOptionsError | Error;
+    static identifyRegistrationError({ error, options, platform, }: {
+        error: Error;
+        options: CredentialCreationOptions;
+        platform: Platform;
+    }): FidoOptionsError | Error;
+}

package/build/lib/proveauth/internal/fido-options-error.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FidoOptionsError = void 0;
+class FidoOptionsError extends Error {
+    constructor({ message, cause, name }) {
+        super(message, { cause });
+        this.name = name !== null && name !== void 0 ? name : cause.name;
+    }
+    static identifyAuthenticationError({ error, options, platform, }) {
+        const { publicKey } = options;
+        if (!publicKey) {
+            return new FidoOptionsError({
+                message: FidoOptionsError.MISSING_PUBLIC_KEY_PROPERTY,
+                cause: new Error(FidoOptionsError.MISSING_PUBLIC_KEY_PROPERTY),
+            });
+        }
+        if (error.name === 'AbortError') {
+            if (options.signal instanceof AbortSignal) {
+                return new FidoOptionsError({
+                    message: FidoOptionsError.ABORT_SIGNAL,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'NotAllowedError') {
+            return new FidoOptionsError({
+                message: error.message,
+                cause: error,
+            });
+        }
+        else if (error.name === 'SecurityError') {
+            const currentDomain = platform.getOrigin();
+            if (publicKey.rpId !== currentDomain) {
+                return new FidoOptionsError({
+                    message: `${FidoOptionsError.INVALID_RP_ID}: ${publicKey.rpId}`,
+                    cause: error,
+                });
+            }
+            else {
+                return new FidoOptionsError({
+                    message: `${FidoOptionsError.SECURITY_ERROR_FOUND}: ${error.message}`,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'UnknownError') {
+            return new FidoOptionsError({
+                message: FidoOptionsError.UNKNOWN_ERROR,
+                cause: error,
+            });
+        }
+        return error;
+    }
+    static identifyRegistrationError({ error, options, platform, }) {
+        var _a, _b, _c;
+        const { publicKey } = options;
+        if (!publicKey) {
+            return new FidoOptionsError({
+                message: FidoOptionsError.MISSING_PUBLIC_KEY_PROPERTY,
+                cause: new Error(FidoOptionsError.MISSING_PUBLIC_KEY_PROPERTY),
+            });
+        }
+        if (error.name === 'InvalidStateError') {
+            return new FidoOptionsError({
+                message: FidoOptionsError.INVALID_STATE_ERROR,
+                cause: error,
+            });
+        }
+        else if (error.name === 'AbortError') {
+            if (options.signal instanceof AbortSignal) {
+                return new FidoOptionsError({
+                    message: this.ABORT_SIGNAL,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'ConstraintError') {
+            if (((_a = publicKey.authenticatorSelection) === null || _a === void 0 ? void 0 : _a.requireResidentKey) === true) {
+                return new FidoOptionsError({
+                    message: this.CONSTRAINT_ERROR,
+                    cause: error,
+                });
+            }
+            else if (options.mediation === 'conditional' &&
+                ((_b = publicKey.authenticatorSelection) === null || _b === void 0 ? void 0 : _b.userVerification) === 'required') {
+                return new FidoOptionsError({
+                    message: this.USER_VERIFICATION_NOT_POSSILE,
+                    cause: error,
+                });
+            }
+            else if (((_c = publicKey.authenticatorSelection) === null || _c === void 0 ? void 0 : _c.userVerification) === 'required') {
+                return new FidoOptionsError({
+                    message: this.NO_MATCHING_AUTHENTICATOR,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'NotAllowedError') {
+            return new FidoOptionsError({
+                message: error.message,
+                cause: error,
+            });
+        }
+        else if (error.name === 'NotSupportedError') {
+            const validPubKeyCredParams = publicKey.pubKeyCredParams.filter((param) => param.type === 'public-key');
+            if (validPubKeyCredParams.length === 0) {
+                return new FidoOptionsError({
+                    message: this.INVALID_CRED_PARAMS,
+                    cause: error,
+                });
+            }
+            return new FidoOptionsError({
+                message: FidoOptionsError.NO_MATCHING_AUTHENTICATOR_FOR_PARAMS_ALGO,
+                cause: error,
+            });
+        }
+        else if (error.name === 'SecurityError') {
+            const currentDomain = platform.getOrigin();
+            if (publicKey.rp.id !== currentDomain) {
+                return new FidoOptionsError({
+                    message: `${FidoOptionsError.INVALID_RP_ID}: ${publicKey.rp.id}`,
+                    cause: error,
+                });
+            }
+            else {
+                return new FidoOptionsError({
+                    message: `${FidoOptionsError.SECURITY_ERROR_FOUND}: ${error.message}`,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'TypeError') {
+            if (publicKey.user.id.byteLength < 1 || publicKey.user.id.byteLength > 64) {
+                return new FidoOptionsError({
+                    message: FidoOptionsError.INVALID_USER_ID_LENGTH,
+                    cause: error,
+                });
+            }
+        }
+        else if (error.name === 'UnknownError') {
+            return new FidoOptionsError({
+                message: FidoOptionsError.UNKNOWN_ERROR,
+                cause: error,
+            });
+        }
+        return error;
+    }
+}
+FidoOptionsError.MISSING_PUBLIC_KEY_PROPERTY = 'options missing publicKey property';
+FidoOptionsError.ABORT_SIGNAL = 'Authentication was sent an abort signal';
+FidoOptionsError.INVALID_STATE_ERROR = 'The authenticator was already registered';
+FidoOptionsError.UNKNOWN_ERROR = 'Unknown error: the authenticator was unable to process the predefined options, or unable to generate a new credential';
+FidoOptionsError.SECURITY_ERROR_FOUND = 'Security error found';
+FidoOptionsError.INVALID_RP_ID = 'The rp.id is not valid for the current domain';
+FidoOptionsError.CONSTRAINT_ERROR = 'Discoverable credentials is required but found no matching supported authenticator';
+FidoOptionsError.USER_VERIFICATION_NOT_POSSILE = 'User verification is required during automatic registration but this could not be performed';
+FidoOptionsError.NO_MATCHING_AUTHENTICATOR = 'User verification is required but found no matching supported authenticator';
+FidoOptionsError.INVALID_CRED_PARAMS = 'No entry in pubKeyCredParams having the type of public-key';
+FidoOptionsError.NO_MATCHING_AUTHENTICATOR_FOR_PARAMS_ALGO = 'No available authenticator supported any of the specified pubKeyCredParams algorithms';
+FidoOptionsError.INVALID_USER_ID_LENGTH = 'User ID has invalid length';
+exports.FidoOptionsError = FidoOptionsError;

package/build/lib/proveauth/internal/main-authenticator.js

@@ -110,7 +110,7 @@ class MainAuthenticator {
                 })
                     .then((response) => {
                     if (response.error) {
-                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next));
+                        reject(new auth_error_1.default(response.error.message, response.error.code, response.next, false));
                     }
                     else {
                         resolve();

package/build/lib/proveauth/internal/mobile-instantlink-step.js

@@ -7,6 +7,7 @@ const logger_1 = require("../common/logger");
 const phone_number_input_1 = require("./phone-number-input");
 const auth_error_1 = __importDefault(require("./auth-error"));
 const auth_status_actions_1 = require("./auth-status-actions");
+const mobile_otp_step_1 = __importDefault(require("./mobile-otp-step"));
 const SIMULATED_LINK_CLICK_DELAY = 100;
 class MobileInstantLinkStep extends auth_status_actions_1.AuthStatusActions {
     constructor(startStep, getDeviceIp) {
@@ -44,39 +45,45 @@ class MobileInstantLinkStep extends auth_status_actions_1.AuthStatusActions {
                 this.startStep
                     .execute(phoneNumberNeeded, phoneValidationError)
                     .then((input) => {
-                    session
-                        .fetchFromBackend('/v1/client/mobile/instantlink/start', {
-                        sourceIp: this.getDeviceIp(),
-                        mobileNumber: input === null || input === void 0 ? void 0 : input.phoneNumber,
-                    })
-                        .then((response) => {
-                        var _a, _b, _c;
-                        const authResponse = response;
-                        if (authResponse.error) {
-                            reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
-                        }
-                        else if (authResponse.data) {
-                            var errorMessage = '';
-                            if ((_a = authResponse.data) === null || _a === void 0 ? void 0 : _a.code) {
-                                errorMessage += `Error Code: ${authResponse.data.code}, `;
+                    const inputError = mobile_otp_step_1.default.validatePhoneNumberInput(input);
+                    if (inputError) {
+                        reject(inputError);
+                    }
+                    else {
+                        session
+                            .fetchFromBackend('/v1/client/mobile/instantlink/start', {
+                            sourceIp: this.getDeviceIp(),
+                            mobileNumber: input === null || input === void 0 ? void 0 : input.phoneNumber,
+                        })
+                            .then((response) => {
+                            var _a, _b, _c;
+                            const authResponse = response;
+                            if (authResponse.error) {
+                                reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
                             }
-                            if ((_b = authResponse.data) === null || _b === void 0 ? void 0 : _b.message) {
-                                errorMessage += `${authResponse.data.message}`;
+                            else if (authResponse.data) {
+                                var errorMessage = '';
+                                if ((_a = authResponse.data) === null || _a === void 0 ? void 0 : _a.code) {
+                                    errorMessage += `Error Code: ${authResponse.data.code}, `;
+                                }
+                                if ((_b = authResponse.data) === null || _b === void 0 ? void 0 : _b.message) {
+                                    errorMessage += `${authResponse.data.message}`;
+                                }
+                                else {
+                                    errorMessage += `Error validating phone number`;
+                                }
+                                let phoneNumberValidationError = new phone_number_input_1.PhoneValidationError(errorMessage, (_c = authResponse.data) === null || _c === void 0 ? void 0 : _c.code);
+                                this.log.error(`Server reports invalid phone number: ${errorMessage}`);
+                                this.runStartStep(session, phoneNumberNeeded, phoneNumberValidationError)
+                                    .then(resolve)
+                                    .catch(reject);
                             }
                             else {
-                                errorMessage += `Error validating phone number`;
+                                resolve(authResponse.next);
                             }
-                            let phoneNumberValidationError = new phone_number_input_1.PhoneValidationError(errorMessage, (_c = authResponse.data) === null || _c === void 0 ? void 0 : _c.code);
-                            this.log.error(`Server reports invalid phone number: ${errorMessage}`);
-                            this.runStartStep(session, phoneNumberNeeded, phoneNumberValidationError)
-                                .then(resolve)
-                                .catch(reject);
-                        }
-                        else {
-                            resolve(authResponse.next);
-                        }
-                    })
-                        .catch(reject);
+                        })
+                            .catch(reject);
+                    }
                 })
                     .catch(reject);
             }

package/build/lib/proveauth/internal/mobile-otp-step.d.ts

@@ -1,5 +1,6 @@
 import AuthSession from './auth-session';
 import AuthStep from './auth-step';
+import AuthError from './auth-error';
 import { OtpStartStep, OtpFinishStep } from '../otp';
 export default class MobileOtpStep implements AuthStep {
     static readonly NAME = "mobile/otp";
@@ -9,6 +10,8 @@ export default class MobileOtpStep implements AuthStep {
     private otpFinishStep?;
     constructor(otpStartStep?: OtpStartStep, otpFinishStep?: OtpFinishStep);
     execute(session: AuthSession): Promise<string>;
+    static validatePhoneNumberInput(input: any): AuthError | undefined;
     private runOtpStartStep;
+    static validateFinishResult(result: any): AuthError | undefined;
     private runOtpFinishStep;
 }

package/build/lib/proveauth/internal/mobile-otp-step.js

@@ -34,45 +34,66 @@ class MobileOtpStep {
                 .catch(reject);
         });
     }
+    static validatePhoneNumberInput(input) {
+        if (input === null || input === undefined) {
+            return;
+        }
+        if (typeof input !== 'object') {
+            return new auth_error_1.default('Input must be an object');
+        }
+        if (!('phoneNumber' in input)) {
+            return new auth_error_1.default('phoneNumber field in the input is missing');
+        }
+        if (typeof input.phoneNumber !== 'string') {
+            return new auth_error_1.default('phoneNumber field in the input must be a string');
+        }
+        return;
+    }
     runOtpStartStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, phoneValidationError) {
         return new Promise((resolve, reject) => {
             otpStartStep
                 .execute(phoneNumberNeeded, phoneValidationError)
                 .then((input) => {
-                session
-                    .fetchFromBackend('/v1/client/mobile/otp/start', {
-                    mobileNumber: input === null || input === void 0 ? void 0 : input.phoneNumber,
-                })
-                    .then((response) => {
-                    const authResponse = response;
-                    if (authResponse.error) {
-                        reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
-                    }
-                    else if (authResponse.data) {
-                        let data = authResponse.data;
-                        var errorMessage = '';
-                        if (data === null || data === void 0 ? void 0 : data.code) {
-                            errorMessage += `Error Code: ${data.code}, `;
+                const inputError = MobileOtpStep.validatePhoneNumberInput(input);
+                if (inputError) {
+                    reject(inputError);
+                }
+                else {
+                    session
+                        .fetchFromBackend('/v1/client/mobile/otp/start', {
+                        mobileNumber: input === null || input === void 0 ? void 0 : input.phoneNumber,
+                    })
+                        .then((response) => {
+                        const authResponse = response;
+                        if (authResponse.error) {
+                            reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
                         }
-                        if (data === null || data === void 0 ? void 0 : data.message) {
-                            errorMessage += `${data.message}`;
+                        else if (authResponse.data) {
+                            let data = authResponse.data;
+                            var errorMessage = '';
+                            if (data === null || data === void 0 ? void 0 : data.code) {
+                                errorMessage += `Error Code: ${data.code}, `;
+                            }
+                            if (data === null || data === void 0 ? void 0 : data.message) {
+                                errorMessage += `${data.message}`;
+                            }
+                            else {
+                                errorMessage += `Error validating phone number`;
+                            }
+                            let phoneNumberValidationError = new phone_number_input_1.PhoneValidationError(errorMessage, data === null || data === void 0 ? void 0 : data.code);
+                            this.log.error(`Server reports invalid phone number: ${errorMessage}`);
+                            this.runOtpStartStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, phoneNumberValidationError)
+                                .then(resolve)
+                                .catch(reject);
                         }
                         else {
-                            errorMessage += `Error validating phone number`;
+                            this.runOtpFinishStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded)
+                                .then(resolve)
+                                .catch(reject);
                         }
-                        let phoneNumberValidationError = new phone_number_input_1.PhoneValidationError(errorMessage, data === null || data === void 0 ? void 0 : data.code);
-                        this.log.error(`Server reports invalid phone number: ${errorMessage}`);
-                        this.runOtpStartStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, phoneNumberValidationError)
-                            .then(resolve)
-                            .catch(reject);
-                    }
-                    else {
-                        this.runOtpFinishStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded)
-                            .then(resolve)
-                            .catch(reject);
-                    }
-                })
-                    .catch(reject);
+                    })
+                        .catch(reject);
+                }
             })
                 .catch((error) => {
                 const message = auth_error_1.default.extractMessage(error);
@@ -80,6 +101,27 @@ class MobileOtpStep {
             });
         });
     }
+    static validateFinishResult(result) {
+        if (result === null || result === undefined || typeof result !== 'object') {
+            return new auth_error_1.default('result should be a valid object');
+        }
+        else if (!('resultType' in result)) {
+            return new auth_error_1.default('resultType field in the result is missing');
+        }
+        else if (result.resultType === otp_1.OtpFinishResultType.OnSuccess) {
+            const input = result.input;
+            if (input === null || input === undefined || typeof input !== 'object') {
+                return new auth_error_1.default('input should be a valid object when resultType field is set with OnSuccess value');
+            }
+            if (!('otp' in input)) {
+                return new auth_error_1.default('otp field in the input is missing');
+            }
+            if (typeof input.otp !== 'string') {
+                return new auth_error_1.default('otp field in the input must be a string');
+            }
+        }
+        return;
+    }
     runOtpFinishStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, otpError) {
         return new Promise((resolve, reject) => {
             otpFinishStep
@@ -87,47 +129,53 @@ class MobileOtpStep {
                 .then((otpFinishResult) => {
                 var _a;
                 let result = otpFinishResult;
-                switch (result.resultType) {
-                    case otp_1.OtpFinishResultType.OnResendOtp:
-                        this.runOtpStartStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded)
-                            .then(resolve)
-                            .catch(reject);
-                        break;
-                    case otp_1.OtpFinishResultType.OnSuccess:
-                        let input = result.input;
-                        session
-                            .fetchFromBackend('/v1/client/mobile/otp/finish', {
-                            otp: (_a = input === null || input === void 0 ? void 0 : input.otp) !== null && _a !== void 0 ? _a : '',
-                        })
-                            .then((response) => {
-                            const authResponse = response;
-                            if (authResponse.error) {
-                                reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
-                            }
-                            else if (authResponse.data) {
-                                let data = authResponse.data;
-                                var errorMessage = '';
-                                if (data === null || data === void 0 ? void 0 : data.code) {
-                                    errorMessage += `Error Code: ${data.code}, `;
+                const resultError = MobileOtpStep.validateFinishResult(result);
+                if (resultError) {
+                    reject(resultError);
+                }
+                else {
+                    switch (result.resultType) {
+                        case otp_1.OtpFinishResultType.OnResendOtp:
+                            this.runOtpStartStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded)
+                                .then(resolve)
+                                .catch(reject);
+                            break;
+                        case otp_1.OtpFinishResultType.OnSuccess:
+                            let input = result.input;
+                            session
+                                .fetchFromBackend('/v1/client/mobile/otp/finish', {
+                                otp: (_a = input === null || input === void 0 ? void 0 : input.otp) !== null && _a !== void 0 ? _a : '',
+                            })
+                                .then((response) => {
+                                const authResponse = response;
+                                if (authResponse.error) {
+                                    reject(new auth_error_1.default(authResponse.error.message, authResponse.error.code, response.next, false));
                                 }
-                                if (data === null || data === void 0 ? void 0 : data.message) {
-                                    errorMessage += `${data.message}`;
+                                else if (authResponse.data) {
+                                    let data = authResponse.data;
+                                    var errorMessage = '';
+                                    if (data === null || data === void 0 ? void 0 : data.code) {
+                                        errorMessage += `Error Code: ${data.code}, `;
+                                    }
+                                    if (data === null || data === void 0 ? void 0 : data.message) {
+                                        errorMessage += `${data.message}`;
+                                    }
+                                    else {
+                                        errorMessage += `Error validating OTP`;
+                                    }
+                                    let otpError = new otp_1.OtpError(errorMessage, data === null || data === void 0 ? void 0 : data.code);
+                                    this.log.error(`Server reports invalid OTP: ${errorMessage}`);
+                                    this.runOtpFinishStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, otpError)
+                                        .then(resolve)
+                                        .catch(reject);
                                 }
                                 else {
-                                    errorMessage += `Error validating OTP`;
+                                    resolve(response.next);
                                 }
-                                let otpError = new otp_1.OtpError(errorMessage, data === null || data === void 0 ? void 0 : data.code);
-                                this.log.error(`Server reports invalid OTP: ${errorMessage}`);
-                                this.runOtpFinishStep(session, otpStartStep, otpFinishStep, phoneNumberNeeded, otpError)
-                                    .then(resolve)
-                                    .catch(reject);
-                            }
-                            else {
-                                resolve(response.next);
-                            }
-                        })
-                            .catch(reject);
-                        break;
+                            })
+                                .catch(reject);
+                            break;
+                    }
                 }
             })
                 .catch((error) => {