@truly-you/trulyyou-web-sdk 0.1.0 → 0.1.2

package/dist/sdk/TrulyYouSDK.d.ts

@@ -42,11 +42,6 @@ export declare class TrulyYouSDK {
      * Also checks backend to verify key exists and is active
      */
     private probeIframeForKey;
-    /**
-     * Lightweight API call to check if key exists and is active in backend
-     * Calls SDK frontend which proxies to SDK backend
-     */
-    private checkKeyStatus;
     /**
      * Open enrollment popup and wait for completion
      */

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "@truly-you/trulyyou-web-sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "TrulyYou Web SDK for secure authentication and payload signing",
   "type": "module",
   "main": "dist/index.esm.js",
   "module": "dist/index.esm.js",
   "types": "dist/index.d.ts",
+  "private": false,
+  "publishConfig": {
+    "access": "restricted"
+  },
   "exports": {
     ".": {
       "import": "./dist/index.esm.js",

package/src/sdk/TrulyYouSDK.ts

@@ -299,18 +299,8 @@ export class TrulyYouSDK {
           if (data?.type === 'KEY_CHECK_RESULT') {
             cleanup()
             if (data.hasKey && data.keyId) {
-              // Key found in localStorage - verify it's active in backend
-              if (!backendCheckPromise) {
-                backendCheckPromise = this.checkKeyStatus(data.keyId)
-              }
-              
-              const isActive = await backendCheckPromise
-              if (isActive) {
-                resolve(data.keyId)
-              } else {
-                console.log('[SDK]: Key found in localStorage but not active in backend, ignoring')
-                resolve(null)
-              }
+              // Key found in localStorage - it will be validated when used in /api/signatures/create
+              resolve(data.keyId)
             } else {
               resolve(null)
             }
@@ -334,42 +324,6 @@ export class TrulyYouSDK {
     })
   }
 
-  /**
-   * Lightweight API call to check if key exists and is active in backend
-   * Calls SDK frontend which proxies to SDK backend
-   */
-  private async checkKeyStatus(keyId: string): Promise<boolean> {
-    try {
-      const response = await fetch(`${this.frontendUrl}/api/key/check/${encodeURIComponent(keyId)}`, {
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json' }
-      })
-      
-      if (!response.ok) {
-        console.log('[SDK]: Key status check failed:', response.status)
-        return false
-      }
-      
-      const result = await response.json() as any
-      const isActive = result.success && result.exists && result.active === true
-      
-      if (!isActive) {
-        console.log('[SDK]: Key found but not active:', {
-          exists: result.exists,
-          active: result.active,
-          status: result.status
-        })
-      }
-      
-      return isActive
-    } catch (error) {
-      console.error('[SDK]: Error checking key status:', error)
-      // If backend check fails, treat as invalid (fail closed for security)
-      // This ensures we don't use keys if we can't verify their status
-      return false
-    }
-  }
-
   /**
    * Open enrollment popup and wait for completion
    */
@@ -378,24 +332,45 @@ export class TrulyYouSDK {
       throw new Error('authAppId is required for enrollment. Please configure authAppId in SDK config.')
     }
 
-    // Generate session first
-    const sessionResponse = await fetch(`${this.frontendUrl}/api/sessions/generate`, {
+    // authAppId is guaranteed to exist here due to check above
+    const appId = this.authAppId!
+
+    // Get app to retrieve authFlowId
+    const appResponse = await fetch(`${this.apiUrl}/api/apps/${appId}`)
+    
+    if (!appResponse.ok) {
+      throw new Error('Failed to load app configuration')
+    }
+
+    const appData = await appResponse.json()
+    const app = appData.app
+
+    if (!app.authFlowId) {
+      throw new Error('App does not have an authentication flow configured')
+    }
+
+    // Generate a clientId for this session
+    const clientId = `client_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`
+
+    // Create session directly via SDK backend
+    const sessionResponse = await fetch(`${this.apiUrl}/api/sessions`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ authAppId: this.authAppId })
+      body: JSON.stringify({
+        appId: appId,
+        flowId: app.authFlowId,
+        clientId: clientId
+      })
     })
 
     if (!sessionResponse.ok) {
       const errorData = await sessionResponse.json()
-      throw new Error(errorData.error || 'Failed to generate enrollment session')
+      throw new Error(errorData.error || 'Failed to create enrollment session')
     }
 
     const sessionData = await sessionResponse.json()
     const sessionId = sessionData.data.sessionId
 
-    // authAppId is guaranteed to exist here due to check above
-    const appId = this.authAppId!
-
     return new Promise((resolve, reject) => {
       const origin = window.location.origin
       
@@ -1708,7 +1683,7 @@ export class TrulyYouSDK {
           signatureId = `sig_${Date.now()}_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`
           
           // Get keyId and userId from localStorage
-          const keyId = localStorage.getItem('trulyYouKeyId')
+          let keyId = localStorage.getItem('trulyYouKeyId')
           const userIdStr = localStorage.getItem('trulyYouUserId')
           let userId: string | undefined
           if (userIdStr) {
@@ -1722,6 +1697,29 @@ export class TrulyYouSDK {
           // Check if this will be a handoff flow (desktop device)
           const isHandoff = this.isDesktopDevice()
 
+          // For mobile devices (non-handoff), if no key exists, trigger enrollment
+          if (!isHandoff && !keyId) {
+            console.log('[SDK]: No key found in localStorage, triggering enrollment...')
+            
+            // Probe iframe first to check if key exists there
+            keyId = await this.probeIframeForKey()
+            
+            if (!keyId) {
+              // No key found, trigger enrollment
+              console.log('[SDK]: No key in iframe either, opening enrollment popup...')
+              await this.enrollWithPopup()
+              
+              // After enrollment, probe again to get the new key
+              keyId = await this.probeIframeForKey()
+              
+              if (!keyId) {
+                throw new Error('Enrollment completed but no key found. Please try again.')
+              }
+              
+              console.log('[SDK]: Enrollment successful, obtained keyId:', keyId)
+            }
+          }
+
           // Create signature document BEFORE signing (this also validates domain and template and starts countdown for handoff)
           const createResponse = await fetch(`${this.apiUrl}/api/signatures/create`, {
             method: 'POST',