smartcomply-web-sdk 1.0.88 → 1.0.90

package/dist/smartcomply.browser.js

@@ -5764,9 +5764,36 @@ var SmartComplySDK = (() => {
       this.http.setSessionToken(response.token);
       return response;
     }
+    /**
+     * Resume an existing session from a resume_token (client-initiated
+     * resubmit — see the "Resubmit" action in the Adhere dashboard). Unlike
+     * createSession(), this makes no network call: a resume_token IS already
+     * a valid SessionToken row on the backend (SDKSessionTokenAuthentication
+     * checks it against SessionToken.active the same way as any session
+     * token), so there is nothing to create — only to start using directly.
+     *
+     * Must be used INSTEAD OF createSession(), not alongside it. Calling
+     * createSession() after this would mint a second, unrelated session and
+     * silently abandon the resume — the backend's resume-match in
+     * LivenessCreateAPIView only fires for the session actually presented on
+     * the request, so the resume_token has to be the one in use throughout.
+     *
+     * No expires_at is set here — the resume_token's own issuance response
+     * only carries resume_expires_at (a 72h invite-link window), not the
+     * session's own runtime expiry the way createSession() returns one. The
+     * backend still enforces the real expiry server-side regardless; this
+     * only means the client-side "session about to expire" warning timer
+     * (see SmartComplyFlow.initialize()) has nothing to schedule against and
+     * is skipped for a resumed session.
+     */
+    resumeSession(resumeToken) {
+      this._sessionToken = resumeToken;
+      this._sessionExpiresAt = null;
+      this.http.setSessionToken(resumeToken);
+    }
     /**
      * Fetch SDK configuration from the backend.
-     * Must be called after createSession().
+     * Must be called after createSession() or resumeSession().
      *
      * GET /v1/initialize/
      * Auth: x-access-token: <sessionToken>
@@ -5781,6 +5808,22 @@ var SmartComplySDK = (() => {
       this._sdkConfig = config;
       return config;
     }
+    /**
+     * Resolve a resume_token to the entry/step it's resuming, without
+     * consuming the single-use resume binding (unlike create/, which does).
+     * Only meaningful after resumeSession() — a normal createSession()
+     * session was never issued for a resume, so this returns a 404
+     * (NOT_A_RESUME_TOKEN) for it, same as the backend.
+     *
+     * GET /v1/sdk/liveness/resume-info/
+     * Auth: x-access-token: <sessionToken>
+     */
+    async getResumeInfo() {
+      return this.http.sessionRequest(
+        "GET",
+        "/v1/sdk/liveness/resume-info/"
+      );
+    }
   };
   /**
    * Package version, hardcoded to match package.json — bump this alongside
@@ -5791,7 +5834,7 @@ var SmartComplySDK = (() => {
    * CDN tag they installed with (e.g. @1, which floats to the latest
    * matching release) actually resolved to the version they expect.
    */
-  _SmartComply.VERSION = "1.0.88";
+  _SmartComply.VERSION = "1.0.90";
   var SmartComply = _SmartComply;
 
   // src/flow/theme.ts
@@ -7761,19 +7804,23 @@ var SmartComplySDK = (() => {
     async initialize() {
       this.showStep("loading");
       try {
-        await this.sdk.createSession();
-        const expiresAt = this.sdk.sessionExpiresAt;
-        if (expiresAt) {
-          const expiresMs = new Date(expiresAt).getTime() - Date.now();
-          const warnMs = Math.max(expiresMs - 12e4, 0);
-          this.sessionExpiryTimer = setTimeout(
-            () => this._showExpiryWarningWhenSafe(),
-            warnMs
-          );
-          this.sessionExpiredTimer = setTimeout(
-            () => this._enforceSessionExpiry(),
-            Math.max(expiresMs, 0)
-          );
+        if (this.options.resumeToken) {
+          this.sdk.resumeSession(this.options.resumeToken);
+        } else {
+          await this.sdk.createSession();
+          const expiresAt = this.sdk.sessionExpiresAt;
+          if (expiresAt) {
+            const expiresMs = new Date(expiresAt).getTime() - Date.now();
+            const warnMs = Math.max(expiresMs - 12e4, 0);
+            this.sessionExpiryTimer = setTimeout(
+              () => this._showExpiryWarningWhenSafe(),
+              warnMs
+            );
+            this.sessionExpiredTimer = setTimeout(
+              () => this._enforceSessionExpiry(),
+              Math.max(expiresMs, 0)
+            );
+          }
         }
         this.sdkConfig = await this.sdk.initializeConfig();
         if (this.sdkConfig.theme) {
@@ -7788,11 +7835,61 @@ var SmartComplySDK = (() => {
           this.brandLogoImg.style.display = "block";
         }
         if (this.isDestroyed) return;
-        this.showStep("welcome");
+        this.showStep(this.options.resumeToken ? await this._resolveResumeStep() : "welcome");
       } catch (err) {
         this.showErrorStep(err.message || "Failed to initialize. Please try again.");
       }
     }
+    // Resolves a resume_token to the step the customer should land on,
+    // pre-selecting the same country/ID type the original attempt used (the
+    // same state renderCountrySelect/renderIdTypeSelect's own click handlers
+    // set) so document_capture/liveness render correctly instead of assuming
+    // state that was never set. Falls back to "welcome" on anything that
+    // doesn't resolve cleanly — this is a UX improvement, not a requirement:
+    // the backend's own resume-match at create/ time still works correctly
+    // even if the widget can't figure out which screen to pre-select.
+    async _resolveResumeStep() {
+      try {
+        const info = await this.sdk.getResumeInfo();
+        if (info.verification_type === "liveness_only" || info.failure_stage === "liveness" || // data_match is always a selfie-vs-identity-photo mismatch (see the
+        // backend's own comment in _process_identity_face_match) — fixed by
+        // redoing the selfie/video, same as a "liveness" failure. There is
+        // no document step in data verification at all, so this can never
+        // legitimately need document_capture.
+        info.failure_stage === "data_match") {
+          this.selectedCountry = info.country || this.selectedCountry || "global";
+          return "liveness";
+        }
+        if (info.failure_stage === "document" && info.country && info.identifier_type) {
+          const channels = this.sdkConfig?.channels || {};
+          const idTypes = channels[info.country] || [];
+          const match = idTypes.find((idType) => {
+            const code = typeof idType === "string" ? idType : idType.code || idType.name;
+            return code === info.identifier_type;
+          });
+          if (match) {
+            const typeName = typeof match === "string" ? match : match.name;
+            const typeCode = typeof match === "string" ? match : match.code || match.name;
+            const channelFields = typeof match !== "string" ? match.fields || [] : [];
+            const isDocFlow = channelFields.some((f2) => isUploadFieldType(f2.type)) || this.isDocumentFlow();
+            const info2 = resolveIdTypeInfo(typeName, isDocFlow);
+            const requiresBackFromBackend = typeof match !== "string" ? match.requires_back_side : void 0;
+            this.selectedCountry = info.country;
+            this.selectedIdType = typeCode;
+            this.selectedIdTypeName = typeName;
+            this.selectedRequiresBack = requiresBackFromBackend ?? info2.requiresBack;
+            if (typeof match !== "string") {
+              this.selectedChannelId = match.id;
+              this.selectedChannelFields = match.fields || [];
+            }
+            return "document_capture";
+          }
+        }
+        return "welcome";
+      } catch {
+        return "welcome";
+      }
+    }
     // Defers the expiry warning while the user is on a camera-active step
     // (document_capture/liveness) — showing it there would blow away a live
     // video element and in-progress MediaRecorder mid-scan.