@yosle/tropipayjs 0.2.0 → 0.2.2

package/README.md

@@ -133,6 +133,33 @@ console.log(paylink.shortUrl);
 
 For more examples, please refer to the [Documentation](https://github.com/yosle/tropipayjs/blob/master/docs/)
 
+### Refunding a Transaction
+
+The library provides two methods for handling refunds with 2FA confirmation:
+
+#### Request a Security Code (Production only)
+
+In **Production** mode, you must first request a 2FA code via SMS:
+
+```javascript
+await tpp.requestSecurityCode();
+// An SMS with the code will be sent to your phone
+```
+
+#### Refund a Movement
+
+Once you have the security code (or in Development mode), you can refund a transaction:
+
+```javascript
+// Development mode — use the default test code
+const result = await tpp.refundMovement("ORD-123456", 5000, "123456");
+
+// Production mode — pass the code received via SMS
+const result = await tpp.refundMovement("ORD-123456", 5000, "847291");
+```
+
+**Note:** The refund endpoint requires the `ALLOW_REFUND` scope and 2FA to be enabled on your Tropipay account. In Development mode the default 2FA code is `123456` unless you have configured the Authenticator app.
+
 # Contributing
 
 If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

package/api/TropipayAPI.d.ts

@@ -5,7 +5,7 @@
  *
  */
 import { Axios } from "axios";
-import { TropipayConfig, AccountBalance, Country, PaymentLink, MediationPaymentCardConfig, LoginResponse } from "../interfaces";
+import { TropipayConfig, AccountBalance, Country, PaymentLink, MediationPaymentCardConfig, LoginResponse, RefundResponse } from "../interfaces";
 type ServerMode = "Development" | "Production";
 import TropipayHooks from "../hooks/TropipayHooks";
 import PaymentCard from "../paymentcard/PaymentCard";
@@ -16,7 +16,6 @@ export declare class Tropipay {
     readonly clientSecret: string;
     readonly scopes: String[];
     request: Axios;
-    loginRequest: Axios;
     static accessToken: string | null;
     static refreshToken: string | null;
     static expiresIn: number | null;
@@ -83,10 +82,39 @@ export declare class Tropipay {
      * belonging or not to the TropiPay platform with the particularity
      * that the payment will be held in custody or retained until it is
      * released with the approval of the payer.
+     * @deprecated This method is no longer supported and may be removed in a future release.
      * @see https://tpp.stoplight.io/docs/tropipay-api-doc/12a128ff971e4-creating-a-mediation-payment-card
      * @param config Payload with the payment details
      */
     createMediationPaymentCard(config: MediationPaymentCardConfig): Promise<PaymentLink>;
+    /**
+     * Refund a completed transaction.
+     * Requires 2FA enabled and ALLOW_REFUND permission on the Tropipay account.
+     *
+     * In Development mode, `securityCode` defaults to `"123456"` when omitted.
+     * In Production mode, you must first call `requestSecurityCode()` to receive
+     * the 2FA code via SMS, then pass it as the `securityCode` parameter.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @param orderCode Code of the order/transaction to refund (e.g. "ORD-123456")
+     * @param amount Amount to refund in cents (e.g. 5000 = 50.00 USD/EUR)
+     * @param securityCode 2FA confirmation code. Use "123456" in Development or
+     * the code received via SMS in Production (obtained via requestSecurityCode()).
+     */
+    refundMovement(orderCode: string, amount: number, securityCode: string): Promise<RefundResponse>;
+    /**
+     * Request a 2FA security code to be sent via SMS for confirming sensitive
+     * operations like refunds.
+     *
+     * In Production mode, you must call this method first to trigger an SMS with
+     * the code, then use the received code when calling `refundMovement()`.
+     * In Development mode this is not required as the default code "123456"
+     * is used automatically.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @returns The API response confirming the code was sent
+     */
+    requestSecurityCode(type?: "sms" | "email"): Promise<any>;
 }
 export declare class ClientSideUtils {
     constructor(tropipayInstance: Tropipay);
@@ -100,5 +128,6 @@ export declare const Scopes: {
     ALLOW_GET_BALANCE: string;
     ALLOW_GET_MOVEMENT_LIST: string;
     ALLOW_GET_CREDENTIAL: string;
+    ALLOW_REFUND: string;
 };
 export {};

package/index.d.ts

@@ -40,7 +40,6 @@ interface UserHookSubscribed extends UserHook {
     updatedAt: string;
 }
 interface PaymentLinkPayload {
-    accountId: number;
     reference: string;
     concept: string;
     favorite: boolean;
@@ -169,6 +168,16 @@ type AccountDeposits = {
     count: number;
     rows: Deposit[];
 };
+type RefundResponse = {
+    id: number;
+    orderCode: string;
+    amount: number;
+    currency: string;
+    state: string;
+    type: string;
+    createdAt: string;
+    completedAt: string;
+};
 
 declare class TropipayHooks {
     private tropipay;
@@ -334,7 +343,6 @@ declare class Tropipay {
     readonly clientSecret: string;
     readonly scopes: String[];
     request: Axios;
-    loginRequest: Axios;
     static accessToken: string | null;
     static refreshToken: string | null;
     static expiresIn: number | null;
@@ -401,10 +409,39 @@ declare class Tropipay {
      * belonging or not to the TropiPay platform with the particularity
      * that the payment will be held in custody or retained until it is
      * released with the approval of the payer.
+     * @deprecated This method is no longer supported and may be removed in a future release.
      * @see https://tpp.stoplight.io/docs/tropipay-api-doc/12a128ff971e4-creating-a-mediation-payment-card
      * @param config Payload with the payment details
      */
     createMediationPaymentCard(config: MediationPaymentCardConfig): Promise<PaymentLink>;
+    /**
+     * Refund a completed transaction.
+     * Requires 2FA enabled and ALLOW_REFUND permission on the Tropipay account.
+     *
+     * In Development mode, `securityCode` defaults to `"123456"` when omitted.
+     * In Production mode, you must first call `requestSecurityCode()` to receive
+     * the 2FA code via SMS, then pass it as the `securityCode` parameter.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @param orderCode Code of the order/transaction to refund (e.g. "ORD-123456")
+     * @param amount Amount to refund in cents (e.g. 5000 = 50.00 USD/EUR)
+     * @param securityCode 2FA confirmation code. Use "123456" in Development or
+     * the code received via SMS in Production (obtained via requestSecurityCode()).
+     */
+    refundMovement(orderCode: string, amount: number, securityCode: string): Promise<RefundResponse>;
+    /**
+     * Request a 2FA security code to be sent via SMS for confirming sensitive
+     * operations like refunds.
+     *
+     * In Production mode, you must call this method first to trigger an SMS with
+     * the code, then use the received code when calling `refundMovement()`.
+     * In Development mode this is not required as the default code "123456"
+     * is used automatically.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @returns The API response confirming the code was sent
+     */
+    requestSecurityCode(type?: "sms" | "email"): Promise<any>;
 }
 declare class ClientSideUtils {
     constructor(tropipayInstance: Tropipay);
@@ -414,9 +451,7 @@ declare class ServerSideUtils {
     private tropipay;
     constructor(tropipayInstance: Tropipay);
     /**
-     * DEPRECATED Verify Topipay's signature on API V2 webhooks.
-     * @deprecated This method is deprecated and will be removed in future versions.
-     * Use the `verifySignatureV3` method from the `ServerSideUtils` class instead.
+     * Verify Topipay's signature on webhooks.
      * @param credentials Credential object or Tropipay instance
      * @param {String} originalCurrencyAmount
      * @param bankOrderCode
@@ -455,19 +490,8 @@ declare class ServerSideUtils {
      * @return {Promise<string>} the valid base64 image
      */
     static isValidImage(base64Image: string): boolean;
-    /**
-     * Verify Topipay's signature on API V3 webhooks.
-     * @param {string} originalCurrencyAmount
-     * @param {string} bankOrderCode
-     * @param {string} signature signaturev3 field to be verified
-     * @returns {boolean}
-     */
-    static verifySignatureV3(credentials: {
-        clientId: string;
-        clientSecret: string;
-    } | Tropipay, originalCurrencyAmount: string, bankOrderCode: string, signature: string): boolean;
 }
 
 declare const SERVER_MODE: ServerMode$1;
 
-export { AccountBalance, AccountDeposits, ClientSideUtils, Country, Deposit, HookEventType, HookTargetType, LoginError, LoginResponse, MAX_IMAGE_SIZE_MB, MediationPaymentCardConfig, PaymentLink, PaymentLinkPayload, SERVER_MODE, ServerMode$1 as ServerMode, ServerSideUtils, Tropipay, TropipayConfig, TropipayCredentials, UserHook, UserHookSubscribed };
+export { AccountBalance, AccountDeposits, ClientSideUtils, Country, Deposit, HookEventType, HookTargetType, LoginError, LoginResponse, MAX_IMAGE_SIZE_MB, MediationPaymentCardConfig, PaymentLink, PaymentLinkPayload, RefundResponse, SERVER_MODE, ServerMode$1 as ServerMode, ServerSideUtils, Tropipay, TropipayConfig, TropipayCredentials, UserHook, UserHookSubscribed };

package/index.js

@@ -220,7 +220,7 @@ class PaymentCard {
             await this.tropipay.login();
         }
         try {
-            const paylink = await this.tropipay.request.post("/api/v3/paymentcards", payload, {
+            const paylink = await this.tropipay.request.post("/api/v2/paymentcards", payload, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -243,7 +243,7 @@ class PaymentCard {
             await this.tropipay.login();
         }
         try {
-            const paymentcards = await this.tropipay.request.get(`/api/v3/paymentcards`, {
+            const paymentcards = await this.tropipay.request.get(`/api/v2/paymentcards`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -268,7 +268,7 @@ class PaymentCard {
             await this.tropipay.login();
         }
         try {
-            const paymentcard = await this.tropipay.request.get(`/api/v3/paymentcards/${id}`, {
+            const paymentcard = await this.tropipay.request.get(`/api/v2/paymentcards/${id}`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -294,7 +294,7 @@ class PaymentCard {
             await this.tropipay.login();
         }
         try {
-            const paymentcard = await this.tropipay.request.delete(`/api/v3/paymentcards/`, {
+            const paymentcard = await this.tropipay.request.delete(`/api/v2/paymentcards/`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -360,7 +360,7 @@ class DepositAccounts {
             await this.tropipay.login();
         }
         try {
-            const deposit = await this.tropipay.request.get(`/api/v3/deposit_accounts`, {
+            const deposit = await this.tropipay.request.get(`/api/v2/deposit_accounts`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -383,7 +383,7 @@ class DepositAccounts {
             await this.tropipay.login();
         }
         try {
-            const deposit = await this.tropipay.request.post("/api/v3/deposit_accounts", depositAccountObj, {
+            const deposit = await this.tropipay.request.post("/api/v2/deposit_accounts", depositAccountObj, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -407,7 +407,7 @@ class DepositAccounts {
             await this.tropipay.login();
         }
         try {
-            const deposit = await this.tropipay.request.get(`/api/v3/deposit_accounts/${id}`, {
+            const deposit = await this.tropipay.request.get(`/api/v2/deposit_accounts/${id}`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -430,7 +430,7 @@ class DepositAccounts {
             await this.tropipay.login();
         }
         try {
-            const deposit = await this.tropipay.request.put(`/api/v3/deposit_accounts/`, {
+            const deposit = await this.tropipay.request.put(`/api/v2/deposit_accounts/`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -453,7 +453,7 @@ class DepositAccounts {
             await this.tropipay.login();
         }
         try {
-            const deposit = await this.tropipay.request.delete(`/api/v3/deposit_accounts/${id}`, {
+            const deposit = await this.tropipay.request.delete(`/api/v2/deposit_accounts/${id}`, {
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${Tropipay.accessToken}`,
@@ -479,7 +479,6 @@ class Tropipay {
     clientSecret;
     scopes;
     request;
-    loginRequest;
     static accessToken;
     static refreshToken;
     static expiresIn;
@@ -506,6 +505,7 @@ class Tropipay {
                 "ALLOW_GET_BALANCE",
                 "ALLOW_GET_MOVEMENT_LIST",
                 "ALLOW_GET_CREDENTIAL",
+                "ALLOW_REFUND",
             ];
         }
         else {
@@ -519,7 +519,7 @@ class Tropipay {
         this.serverMode = config.serverMode || "Development";
         const tpp_env = this.serverMode === "Production"
             ? "https://www.tropipay.com"
-            : "https://sandbox.tropipay.me";
+            : "https://tropipay-dev.herokuapp.com";
         this.request = axios__default["default"].create({
             baseURL: config.customTropipayUrl || tpp_env,
             headers: {
@@ -528,28 +528,21 @@ class Tropipay {
                 Authorization: `Bearer ${Tropipay.accessToken}`,
             },
         });
-        // Create a separate instance for login requests
-        this.loginRequest = axios__default["default"].create({
-            baseURL: config.customTropipayUrl || tpp_env,
-            headers: {
-                "Content-Type": "application/json",
-                Accept: "application/json",
-            },
-        });
         // Add request interceptor for Token expired
         this.request.interceptors.request.use(async (config) => {
-            const currentTimestamp = Math.floor(Date.now() / 1000);
+            const currentTimestamp = Math.floor(Date.now() / 1000); // Current time in seconds
             if (Tropipay.expiresIn && Tropipay.expiresIn < currentTimestamp) {
-                console.debug("Token expired, attempting to log in");
+                // Token has expired, attempt to refresh it
                 try {
                     await this.login();
                 }
                 catch (error) {
+                    // Handle token refresh error
+                    Tropipay.accessToken = null;
+                    Tropipay.refreshToken = null;
                     throw handleExceptions(error);
                 }
             }
-            // Update the Authorization header in the config
-            config.headers.Authorization = `Bearer ${Tropipay.accessToken}`;
             return config;
         }, (error) => {
             return Promise.reject(error);
@@ -561,8 +554,22 @@ class Tropipay {
     }
     async login() {
         try {
+            if (Tropipay.refreshToken) {
+                const { data } = await this.request.post("/api/v2/access/token", {
+                    client_id: this.clientId,
+                    client_secret: this.clientSecret,
+                    grant_type: "refresh_token",
+                    refresh_token: Tropipay.refreshToken,
+                }, {
+                    headers: {
+                        "Content-Type": "application/json",
+                        Accept: "application/json",
+                    },
+                });
+                return data;
+            }
             // normal credetials login
-            const { data } = await this.loginRequest.post("/api/v3/access/token", {
+            const { data } = await this.request.post("/api/v2/access/token", {
                 client_id: this.clientId,
                 client_secret: this.clientSecret,
                 grant_type: "client_credentials",
@@ -574,6 +581,7 @@ class Tropipay {
                 },
             });
             Tropipay.accessToken = data.access_token;
+            Tropipay.refreshToken = data.refresh_token;
             Tropipay.expiresIn = data.expires_in;
             return data;
         }
@@ -581,7 +589,6 @@ class Tropipay {
             Tropipay.accessToken = null;
             Tropipay.refreshToken = null;
             Tropipay.expiresIn = null;
-            Tropipay.expiresIn = null;
             throw handleExceptions(error);
         }
     }
@@ -733,6 +740,7 @@ class Tropipay {
      * belonging or not to the TropiPay platform with the particularity
      * that the payment will be held in custody or retained until it is
      * released with the approval of the payer.
+     * @deprecated This method is no longer supported and may be removed in a future release.
      * @see https://tpp.stoplight.io/docs/tropipay-api-doc/12a128ff971e4-creating-a-mediation-payment-card
      * @param config Payload with the payment details
      */
@@ -753,6 +761,71 @@ class Tropipay {
             throw handleExceptions(error);
         }
     }
+    /**
+     * Refund a completed transaction.
+     * Requires 2FA enabled and ALLOW_REFUND permission on the Tropipay account.
+     *
+     * In Development mode, `securityCode` defaults to `"123456"` when omitted.
+     * In Production mode, you must first call `requestSecurityCode()` to receive
+     * the 2FA code via SMS, then pass it as the `securityCode` parameter.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @param orderCode Code of the order/transaction to refund (e.g. "ORD-123456")
+     * @param amount Amount to refund in cents (e.g. 5000 = 50.00 USD/EUR)
+     * @param securityCode 2FA confirmation code. Use "123456" in Development or
+     * the code received via SMS in Production (obtained via requestSecurityCode()).
+     */
+    async refundMovement(orderCode, amount, securityCode) {
+        if (!Tropipay.accessToken) {
+            await this.login();
+        }
+        if (!this.scopes.includes("ALLOW_REFUND")) {
+            throw new TropipayJSException("The credential does not have the ALLOW_REFUND scope required to perform refunds. If you believe your account should have this permission, please contact Tropipay support.", 403, null);
+        }
+        try {
+            const response = await this.request.post("/api/v3/movements/in/refund", { orderCode, amount, securityCode }, {
+                headers: {
+                    "Content-Type": "application/json",
+                    Accept: "application/json",
+                    Authorization: `Bearer ${Tropipay.accessToken}`,
+                },
+            });
+            return response.data;
+        }
+        catch (error) {
+            throw handleExceptions(error);
+        }
+    }
+    /**
+     * Request a 2FA security code to be sent via SMS for confirming sensitive
+     * operations like refunds.
+     *
+     * In Production mode, you must call this method first to trigger an SMS with
+     * the code, then use the received code when calling `refundMovement()`.
+     * In Development mode this is not required as the default code "123456"
+     * is used automatically.
+     *
+     * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+     * @returns The API response confirming the code was sent
+     */
+    async requestSecurityCode(type = "sms") {
+        if (!Tropipay.accessToken) {
+            await this.login();
+        }
+        try {
+            const response = await this.request.post("/api/v3/users/sendSecurityCode", { type }, {
+                headers: {
+                    "Content-Type": "application/json",
+                    Accept: "application/json",
+                    Authorization: `Bearer ${Tropipay.accessToken}`,
+                },
+            });
+            return response.data;
+        }
+        catch (error) {
+            throw handleExceptions(error);
+        }
+    }
 }
 class ClientSideUtils {
     constructor(tropipayInstance) {
@@ -768,9 +841,7 @@ class ServerSideUtils {
         this.tropipay = tropipayInstance;
     }
     /**
-     * DEPRECATED Verify Topipay's signature on API V2 webhooks.
-     * @deprecated This method is deprecated and will be removed in future versions.
-     * Use the `verifySignatureV3` method from the `ServerSideUtils` class instead.
+     * Verify Topipay's signature on webhooks.
      * @param credentials Credential object or Tropipay instance
      * @param {String} originalCurrencyAmount
      * @param bankOrderCode
@@ -860,28 +931,6 @@ class ServerSideUtils {
             throw new Error(`Error checking base64 image`);
         }
     }
-    /**
-     * Verify Topipay's signature on API V3 webhooks.
-     * @param {string} originalCurrencyAmount
-     * @param {string} bankOrderCode
-     * @param {string} signature signaturev3 field to be verified
-     * @returns {boolean}
-     */
-    static verifySignatureV3(credentials, originalCurrencyAmount, bankOrderCode, signature) {
-        const sha1Secret = crypto__namespace
-            .createHash("sha1")
-            .update(credentials.clientSecret)
-            .digest("hex");
-        const dataToHash = bankOrderCode +
-            credentials.clientId +
-            sha1Secret +
-            originalCurrencyAmount;
-        const localSignature = crypto__namespace
-            .createHash("sha256")
-            .update(dataToHash)
-            .digest("hex");
-        return localSignature === signature;
-    }
 }
 
 const SERVER_MODE = "Development"; // Move the constant here

package/interfaces/index.d.ts

@@ -36,7 +36,6 @@ export interface UserHookSubscribed extends UserHook {
     updatedAt: string;
 }
 export interface PaymentLinkPayload {
-    accountId: number;
     reference: string;
     concept: string;
     favorite: boolean;
@@ -165,3 +164,13 @@ export type AccountDeposits = {
     count: number;
     rows: Deposit[];
 };
+export type RefundResponse = {
+    id: number;
+    orderCode: string;
+    amount: number;
+    currency: string;
+    state: string;
+    type: string;
+    createdAt: string;
+    completedAt: string;
+};

package/interfaces/paymentlink/index.d.ts

@@ -46,7 +46,6 @@ declare enum Reasons {
     SENDING_YOU_A_KISS = 80
 }
 export interface PaymentLinkPayload {
-    accountId: number;
     reference: string;
     concept: string;
     favorite: boolean;
@@ -61,6 +60,9 @@ export interface PaymentLinkPayload {
     urlFailed: string;
     urlNotification: string;
     serviceDate: string;
+    /**
+     * fgfsgdfgdfgd
+     */
     client?: {
         name: string;
         lastName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yosle/tropipayjs",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Javascript / Typescript SDK for the Tropipay API",
   "main": "index.js",
   "scripts": {
@@ -12,7 +12,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/yosle/tropipayjs"
+    "url": "git+https://github.com/yosle/tropipayjs.git"
+  },
+  "publishConfig": {
+    "access": "public"
   },
   "keywords": [
     "Javascript",

package/paymentcard/paymentcard.spec.d.ts

@@ -0,0 +1 @@
+declare function sum(a: number, b: number): number;

package/src/api/TropipayAPI.ts

@@ -15,6 +15,7 @@ import {
   MediationPaymentCardConfig,
   LoginResponse,
   AccountDeposits,
+  RefundResponse,
 } from "../interfaces";
 type ServerMode = "Development" | "Production";
 import TropipayHooks from "../hooks/TropipayHooks";
@@ -27,7 +28,6 @@ export class Tropipay {
   readonly clientSecret: string;
   readonly scopes: String[];
   public request: Axios;
-  public loginRequest: Axios;
   public static accessToken: string | null;
   public static refreshToken: string | null;
   public static expiresIn: number | null;
@@ -56,6 +56,7 @@ export class Tropipay {
         "ALLOW_GET_BALANCE",
         "ALLOW_GET_MOVEMENT_LIST",
         "ALLOW_GET_CREDENTIAL",
+        "ALLOW_REFUND",
       ];
     } else {
       this.scopes = config.scopes;
@@ -73,12 +74,11 @@ export class Tropipay {
     this.clientSecret = config.clientSecret;
     this.serverMode = config.serverMode || "Development";
 
-    const tpp_env =
-      this.serverMode === "Production"
-        ? "https://www.tropipay.com"
-        : "https://sandbox.tropipay.me";
+    const tpp_env = this.serverMode === "Production"
+    ? "https://www.tropipay.com"
+    : "https://tropipay-dev.herokuapp.com";
     this.request = axios.create({
-      baseURL: config.customTropipayUrl || tpp_env,
+      baseURL: config.customTropipayUrl || tpp_env,        
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
@@ -86,33 +86,27 @@ export class Tropipay {
       },
     });
 
-    // Create a separate instance for login requests
-    this.loginRequest = axios.create({
-      baseURL: config.customTropipayUrl || tpp_env,
-      headers: {
-        "Content-Type": "application/json",
-        Accept: "application/json",
-      },
-    });
 
-    // Add request interceptor for Token expired
-    this.request.interceptors.request.use(
-      async (config) => {
-        const currentTimestamp = Math.floor(Date.now() / 1000);
+     // Add request interceptor for Token expired
+     this.request.interceptors.request.use(
+      async (config: any) => {
+        const currentTimestamp = Math.floor(Date.now() / 1000); // Current time in seconds
 
         if (Tropipay.expiresIn && Tropipay.expiresIn < currentTimestamp) {
-          console.debug("Token expired, attempting to log in");
+          // Token has expired, attempt to refresh it
           try {
-            await this.login();
+             await this.login();
           } catch (error) {
-            throw handleExceptions(error as Error);
+            // Handle token refresh error
+            Tropipay.accessToken = null;
+            Tropipay.refreshToken = null;
+            throw handleExceptions(error as any);
           }
         }
-        // Update the Authorization header in the config
-        config.headers.Authorization = `Bearer ${Tropipay.accessToken}`;
+
         return config;
       },
-      (error) => {
+      (error: AxiosError) => {
         return Promise.reject(error);
       }
     );
@@ -122,13 +116,34 @@ export class Tropipay {
     this.mediationPaymentCard = new MediationPaymentCard(this);
 
     this.depositAccounts = new DepositAccounts(this);
+
+    
   }
 
   public async login() {
     try {
+      if (Tropipay.refreshToken) {
+        const { data } = await this.request.post<LoginResponse>(
+          "/api/v2/access/token",
+          {
+            client_id: this.clientId,
+            client_secret: this.clientSecret,
+            grant_type: "refresh_token",
+            refresh_token: Tropipay.refreshToken,
+          },
+          {
+            headers: {
+              "Content-Type": "application/json",
+              Accept: "application/json",
+            },
+          }
+        );
+        return data;
+      }
+
       // normal credetials login
-      const { data } = await this.loginRequest.post<LoginResponse>(
-        "/api/v3/access/token",
+      const { data } = await this.request.post<LoginResponse>(
+        "/api/v2/access/token",
         {
           client_id: this.clientId,
           client_secret: this.clientSecret,
@@ -144,13 +159,13 @@ export class Tropipay {
       );
 
       Tropipay.accessToken = data.access_token;
+      Tropipay.refreshToken = data.refresh_token;
       Tropipay.expiresIn = data.expires_in;
       return data;
     } catch (error) {
       Tropipay.accessToken = null;
       Tropipay.refreshToken = null;
       Tropipay.expiresIn = null;
-      Tropipay.expiresIn = null;
       throw handleExceptions(error as any);
     }
   }
@@ -313,6 +328,7 @@ export class Tropipay {
    * belonging or not to the TropiPay platform with the particularity
    * that the payment will be held in custody or retained until it is
    * released with the approval of the payer.
+   * @deprecated This method is no longer supported and may be removed in a future release.
    * @see https://tpp.stoplight.io/docs/tropipay-api-doc/12a128ff971e4-creating-a-mediation-payment-card
    * @param config Payload with the payment details
    */
@@ -337,6 +353,91 @@ export class Tropipay {
       throw handleExceptions(error as any);
     }
   }
+
+  /**
+   * Refund a completed transaction.
+   * Requires 2FA enabled and ALLOW_REFUND permission on the Tropipay account.
+   *
+   * In Development mode, `securityCode` defaults to `"123456"` when omitted.
+   * In Production mode, you must first call `requestSecurityCode()` to receive
+   * the 2FA code via SMS, then pass it as the `securityCode` parameter.
+   *
+   * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+   * @param orderCode Code of the order/transaction to refund (e.g. "ORD-123456")
+   * @param amount Amount to refund in cents (e.g. 5000 = 50.00 USD/EUR)
+   * @param securityCode 2FA confirmation code. Use "123456" in Development or
+   * the code received via SMS in Production (obtained via requestSecurityCode()).
+   */
+  async refundMovement(
+    orderCode: string,
+    amount: number,
+    securityCode: string
+  ): Promise<RefundResponse> {
+    if (!Tropipay.accessToken) {
+      await this.login();
+    }
+
+    if (!this.scopes.includes("ALLOW_REFUND")) {
+      throw new TropipayJSException(
+        "The credential does not have the ALLOW_REFUND scope required to perform refunds. If you believe your account should have this permission, please contact Tropipay support.",
+        403,
+        null
+      );
+    }
+
+    try {
+      const response = await this.request.post(
+        "/api/v3/movements/in/refund",
+        { orderCode, amount, securityCode },
+        {
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            Authorization: `Bearer ${Tropipay.accessToken}`,
+          },
+        }
+      );
+      return response.data as RefundResponse;
+    } catch (error) {
+      throw handleExceptions(error as any);
+    }
+  }
+
+  /**
+   * Request a 2FA security code to be sent via SMS for confirming sensitive
+   * operations like refunds.
+   *
+   * In Production mode, you must call this method first to trigger an SMS with
+   * the code, then use the received code when calling `refundMovement()`.
+   * In Development mode this is not required as the default code "123456"
+   * is used automatically.
+   *
+   * @see https://doc.tropipay.com/docs/api-reference/movements#refund-a-transaction
+   * @returns The API response confirming the code was sent
+   */
+  async requestSecurityCode(type: "sms" | "email" = "sms"): Promise<any> {
+    if (!Tropipay.accessToken) {
+      await this.login();
+    }
+
+    try {
+      const response = await this.request.post(
+        "/api/v3/users/sendSecurityCode",
+        { type },
+        {
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            Authorization: `Bearer ${Tropipay.accessToken}`,
+          },
+        }
+      );
+      return response.data;
+    } catch (error) {
+      throw handleExceptions(error as any);
+    }
+  }
+
 }
 
 export class ClientSideUtils {
@@ -354,4 +455,5 @@ export const Scopes = {
   ALLOW_GET_BALANCE: "ALLOW_GET_BALANCE",
   ALLOW_GET_MOVEMENT_LIST: "ALLOW_GET_MOVEMENT_LIST",
   ALLOW_GET_CREDENTIAL: "ALLOW_GET_CREDENTIAL",
+  ALLOW_REFUND: "ALLOW_REFUND",
 };

package/src/depositAccount/depositAccounts.ts

@@ -18,7 +18,7 @@ export default class DepositAccounts {
     }
     try {
       const deposit = await this.tropipay.request.get(
-        `/api/v3/deposit_accounts`,
+        `/api/v2/deposit_accounts`,
         {
           headers: {
             "Content-Type": "application/json",
@@ -43,7 +43,7 @@ export default class DepositAccounts {
     }
     try {
       const deposit = await this.tropipay.request.post(
-        "/api/v3/deposit_accounts",
+        "/api/v2/deposit_accounts",
         depositAccountObj,
         {
           headers: {
@@ -70,7 +70,7 @@ export default class DepositAccounts {
     }
     try {
       const deposit = await this.tropipay.request.get(
-        `/api/v3/deposit_accounts/${id}`,
+        `/api/v2/deposit_accounts/${id}`,
         {
           headers: {
             "Content-Type": "application/json",
@@ -96,7 +96,7 @@ export default class DepositAccounts {
     }
     try {
       const deposit = await this.tropipay.request.put(
-        `/api/v3/deposit_accounts/`,
+        `/api/v2/deposit_accounts/`,
         {
           headers: {
             "Content-Type": "application/json",
@@ -122,7 +122,7 @@ export default class DepositAccounts {
     }
     try {
       const deposit = await this.tropipay.request.delete(
-        `/api/v3/deposit_accounts/${id}`,
+        `/api/v2/deposit_accounts/${id}`,
         {
           headers: {
             "Content-Type": "application/json",

package/src/index.ts

@@ -26,3 +26,4 @@ export * from "./depositAccount/depositAccounts";
 export * from "./interfaces/index";
 export { SERVER_MODE } from "./config/TropipayConfig";
 export * from "./constants/TropipayConstants";
+export type { RefundResponse } from "./interfaces/index";

package/src/interfaces/index.ts

@@ -64,7 +64,6 @@ export interface UserHookSubscribed extends UserHook {
 }
 
 export interface PaymentLinkPayload {
-  accountId: number;
   reference: string;
   concept: string;
   favorite: boolean;
@@ -200,3 +199,14 @@ export type AccountDeposits = {
   count: number;
   rows: Deposit[];
 };
+
+export type RefundResponse = {
+  id: number;
+  orderCode: string;
+  amount: number;
+  currency: string;
+  state: string;
+  type: string;
+  createdAt: string;
+  completedAt: string;
+};

package/src/interfaces/paymentlink/index.d.ts

@@ -1,37 +1,36 @@
 export interface PaymentLinkPayload {
-  accountId: number;
-  reference: string;
-  concept: string;
-  favorite: boolean;
-  amount: number;
-  currency: string;
-  description: string;
-  singleUse: boolean;
-  reasonId: number;
-  expirationDays: number;
-  lang: string;
-  urlSuccess: string;
-  urlFailed: string;
-  urlNotification: string;
-  serviceDate: string;
-  client: {
-    name: string;
-    lastName: string;
-    address: string;
-    phone: string;
-    email: string;
-    countryId: number;
-    termsAndConditions: boolean;
-  };
-  directPayment: boolean;
-  paymentMethods?: string[];
+    reference: string;
+    concept: string;
+    favorite: boolean;
+    amount: number;
+    currency: string;
+    description: string;
+    singleUse: boolean;
+    reasonId: number;
+    expirationDays: number;
+    lang: string;
+    urlSuccess: string;
+    urlFailed: string;
+    urlNotification: string;
+    serviceDate: string;
+    client: {
+        name: string;
+        lastName: string;
+        address: string;
+        phone: string;
+        email: string;
+        countryId: number;
+        termsAndConditions: boolean;
+    };
+    directPayment: boolean;
+    paymentMethods?: string[];
 }
 export interface PaymentLink extends PaymentLinkPayload {
-  expirationDate: string;
-  hasClient: boolean;
-  updatedAt: string;
-  createdAt: string;
-  qrImage: string;
-  shortUrl: string;
-  paymentUrl: string;
+    expirationDate: string;
+    hasClient: boolean;
+    updatedAt: string;
+    createdAt: string;
+    qrImage: string;
+    shortUrl: string;
+    paymentUrl: string;
 }

package/src/interfaces/paymentlink/index.ts

@@ -50,7 +50,6 @@ enum Reasons {
 }
 
 export interface PaymentLinkPayload {
-  accountId: number;
   reference: string;
   concept: string;
   favorite: boolean;
@@ -65,6 +64,9 @@ export interface PaymentLinkPayload {
   urlFailed: string;
   urlNotification: string;
   serviceDate: string;
+  /**
+   * fgfsgdfgdfgd
+   */
   client?: {
     name: string;
     lastName: string;

package/src/paymentcard/PaymentCard.ts

@@ -20,7 +20,7 @@ export default class PaymentCard {
     }
     try {
       const paylink = await this.tropipay.request.post(
-        "/api/v3/paymentcards",
+        "/api/v2/paymentcards",
         payload,
         {
           headers: {
@@ -46,7 +46,7 @@ export default class PaymentCard {
     }
     try {
       const paymentcards = await this.tropipay.request.get(
-        `/api/v3/paymentcards`,
+        `/api/v2/paymentcards`,
         {
           headers: {
             "Content-Type": "application/json",
@@ -74,7 +74,7 @@ export default class PaymentCard {
     }
     try {
       const paymentcard = await this.tropipay.request.get(
-        `/api/v3/paymentcards/${id}`,
+        `/api/v2/paymentcards/${id}`,
         {
           headers: {
             "Content-Type": "application/json",
@@ -103,7 +103,7 @@ export default class PaymentCard {
     }
     try {
       const paymentcard = await this.tropipay.request.delete(
-        `/api/v3/paymentcards/`,
+        `/api/v2/paymentcards/`,
         {
           headers: {
             "Content-Type": "application/json",

package/src/utils/TropipayUtils.ts

@@ -11,9 +11,7 @@ export class ServerSideUtils {
   }
 
   /**
-   * DEPRECATED Verify Topipay's signature on API V2 webhooks.
-   * @deprecated This method is deprecated and will be removed in future versions.
-   * Use the `verifySignatureV3` method from the `ServerSideUtils` class instead.
+   * Verify Topipay's signature on webhooks.
    * @param credentials Credential object or Tropipay instance
    * @param {String} originalCurrencyAmount
    * @param bankOrderCode
@@ -125,41 +123,4 @@ export class ServerSideUtils {
       throw new Error(`Error checking base64 image`);
     }
   }
-
-  /**
-   * Verify Topipay's signature on API V3 webhooks.
-   * @param {string} originalCurrencyAmount
-   * @param {string} bankOrderCode
-   * @param {string} signature signaturev3 field to be verified
-   * @returns {boolean}
-   */
-  public static verifySignatureV3(
-    credentials:
-      | {
-          clientId: string;
-          clientSecret: string;
-        }
-      | Tropipay,
-    originalCurrencyAmount: string,
-    bankOrderCode: string,
-    signature: string
-  ): boolean {
-    const sha1Secret = crypto
-      .createHash("sha1")
-      .update(credentials.clientSecret)
-      .digest("hex");
-
-    const dataToHash =
-      bankOrderCode +
-      credentials.clientId +
-      sha1Secret +
-      originalCurrencyAmount;
-
-    const localSignature = crypto
-      .createHash("sha256")
-      .update(dataToHash)
-      .digest("hex");
-
-    return localSignature === signature;
-  }
 }

package/utils/TropipayUtils.d.ts

@@ -3,9 +3,7 @@ export declare class ServerSideUtils {
     private tropipay;
     constructor(tropipayInstance: Tropipay);
     /**
-     * DEPRECATED Verify Topipay's signature on API V2 webhooks.
-     * @deprecated This method is deprecated and will be removed in future versions.
-     * Use the `verifySignatureV3` method from the `ServerSideUtils` class instead.
+     * Verify Topipay's signature on webhooks.
      * @param credentials Credential object or Tropipay instance
      * @param {String} originalCurrencyAmount
      * @param bankOrderCode
@@ -44,15 +42,4 @@ export declare class ServerSideUtils {
      * @return {Promise<string>} the valid base64 image
      */
     static isValidImage(base64Image: string): boolean;
-    /**
-     * Verify Topipay's signature on API V3 webhooks.
-     * @param {string} originalCurrencyAmount
-     * @param {string} bankOrderCode
-     * @param {string} signature signaturev3 field to be verified
-     * @returns {boolean}
-     */
-    static verifySignatureV3(credentials: {
-        clientId: string;
-        clientSecret: string;
-    } | Tropipay, originalCurrencyAmount: string, bankOrderCode: string, signature: string): boolean;
 }