squarefi-bff-api-module 1.13.0 → 1.13.2

package/CHANGELOG.md

@@ -5,6 +5,161 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.13.2] - 2025-04-08
+
+### Changed
+
+- Refactored encryption logic for improved security and maintainability
+
+## [1.13.1] - 2025-04-08
+
+### Fixed
+
+- Deprecated card sensitive data retrieval method
+- Improved error handling in API responses
+- Fixed decryption handling in issuing API
+
+## [1.13.0] - 2025-04-08
+
+### Changed
+
+- Replaced JSEncrypt with NodeRSA for encryption implementation
+
+## [1.12.1] - 2025-04-08
+
+### Fixed
+
+- Improved encryption implementation for card data
+
+## [1.12.0] - 2025-04-08
+
+### Added
+
+- Implemented encryption for sensitive card data
+
+## [1.11.3] - 2025-04-07
+
+### Changed
+
+- Updated Telegram sign-in method to use apiClientV2
+
+## [1.11.2] - 2025-04-07
+
+### Changed
+
+- Updated Telegram sign-in path for versioning clarity
+
+## [1.11.1] - 2025-04-07
+
+### Changed
+
+- Switched to apiClientV1 for Telegram sign-in
+
+## [1.11.0] - 2025-04-07
+
+### Changed
+
+- Updated external_crypto_data type in Counterparty destination
+- Simplified Response type for Counterparty destination
+
+## [1.10.13] - 2025-04-07
+
+### Changed
+
+- Updated external_crypto_data type in Counterparty destination
+
+## [1.10.12] - 2025-04-07
+
+### Changed
+
+- Simplified Response type for Counterparty destination
+
+## [1.10.11] - 2025-04-05
+
+### Fixed
+
+- Formatted phone numbers for Supabase compatibility
+
+## [1.10.10] - 2025-04-04
+
+### Fixed
+
+- Added search parameter to Counterparty request type
+
+## [1.10.9] - 2025-04-04
+
+### Fixed
+
+- Updated Counterparty fields to allow null values
+
+## [1.10.8] - 2025-04-04
+
+### Fixed
+
+- Added counterparty_account_id to Update request type for Counterparty
+
+## [1.10.7] - 2025-04-04
+
+### Fixed
+
+- Added wallet_id to Create and Update request types for Counterparty
+
+## [1.10.6] - 2025-04-04
+
+### Fixed
+
+- Made Counterparty fields optional in API types
+
+## [1.10.5] - 2025-04-03
+
+### Fixed
+
+- Included additional parameters in wallet transaction request
+
+## [1.10.4] - 2025-04-03
+
+### Fixed
+
+- Made wallet transaction filter fields optional
+
+## [1.10.3] - 2025-04-03
+
+### Added
+
+- Added WalletTransactionStatus enum
+- Updated API types with new status enum
+
+## [1.10.2] - 2025-04-02
+
+### Added
+
+- Added IssuingProgramStatus enum
+- Updated API types with new status enum
+
+## [1.10.1] - 2025-04-02
+
+### Fixed
+
+- Made filter object optional in wallet transaction request
+
+## [1.10.0] - 2025-04-02
+
+### Fixed
+
+- Simplified token refresh logic by removing TMA check
+
+## [1.9.0] - 2025-03-31
+
+### Added
+
+- Added filter options to wallet transaction request
+
+## [1.8.2] - 2025-03-26
+
+### Changed
+
+- Clarified LOGOUT_URL description in documentation
+
 ## [1.8.1] - 2025-03-26
 
 ### Added

package/dist/api/issuing.d.ts

@@ -12,10 +12,9 @@ export declare const issuing: {
         };
         getById: (card_id: string) => Promise<API.Cards.IssuingCardDetailItem>;
         sensitiveData: {
-            get: (card_id: string) => Promise<API.Cards.SensitiveData>;
             encrypted: {
                 secretKey: {
-                    get: (card_id: string) => Promise<any>;
+                    get: (card_id: string) => Promise<API.Cards.SensitiveData>;
                 };
             };
             otp: {

package/dist/api/issuing.js

@@ -8,12 +8,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.issuing = void 0;
-const node_rsa_1 = __importDefault(require("node-rsa"));
 const apiClientFactory_1 = require("../utils/apiClientFactory");
 const constants_1 = require("../constants");
 const fiat_accounts_1 = require("./fiat_accounts");
@@ -38,32 +34,22 @@ exports.issuing = {
             return Object.assign(Object.assign({}, card), { fiat_account: Object.assign(Object.assign({}, fiatAccountData), { type: card.fiat_account.type }) });
         }),
         sensitiveData: {
-            get: (card_id) => apiClientFactory_1.apiClientV1.getRequest(`/issuing/cards/${card_id}/sensitive`),
+            // get: (card_id: string) => apiClientV1.getRequest<API.Cards.SensitiveData>(`/issuing/cards/${card_id}/sensitive`), deprecated from v1.13.1
             encrypted: {
                 secretKey: {
                     get: (card_id) => __awaiter(void 0, void 0, void 0, function* () {
                         const serverPublicKeyEnv = process.env.SERVER_PUBLIC_KEY_BASE64;
-                        const clientRsa = new node_rsa_1.default();
+                        const callback = (props) => apiClientFactory_1.apiClientV1.postRequest(`/issuing/cards/${card_id}/sensitive/secretkey`, {
+                            data: props,
+                        });
                         if (!serverPublicKeyEnv) {
                             throw new Error('SERVER_PUBLIC_KEY_BASE64 is not set');
                         }
-                        const serverPublicKey = Buffer.from(serverPublicKeyEnv, 'base64').toString('utf8');
-                        clientRsa.importKey(serverPublicKey, 'pkcs8-public-pem');
-                        const clientSecretKey = (0, encrypt_1.generateSecretKey)();
-                        const clientPayload = {
-                            key: clientSecretKey.toString('base64'),
-                            timestamp: Date.now(),
-                        };
-                        const encrypted_key = clientRsa.encrypt(JSON.stringify(clientPayload), 'base64');
-                        const { success, encrypted, data, iv } = yield apiClientFactory_1.apiClientV1.postRequest(`/issuing/cards/${card_id}/sensitive/secretkey`, {
-                            data: {
-                                encrypted_key,
-                            },
+                        const encryptedData = yield (0, encrypt_1.makeSecureRequest)({
+                            callback,
+                            publicKey: serverPublicKeyEnv,
                         });
-                        if (success && encrypted && data && iv) {
-                            const decryptedData = (0, encrypt_1.decryptAESData)(data, iv, clientSecretKey);
-                            return decryptedData;
-                        }
+                        return encryptedData;
                     }),
                 },
             },

package/dist/api/types.d.ts

@@ -287,12 +287,6 @@ export declare namespace API {
             expiry_year: number;
             security_code?: string;
         }
-        interface SensitiveDataEncrypted {
-            data?: string;
-            success?: boolean;
-            encrypted?: boolean;
-            iv?: string;
-        }
         interface OTP {
             created_at: number;
             internal_card_id: string;
@@ -354,6 +348,17 @@ export declare namespace API {
                 filter?: Partial<Record<keyof T, any>>;
             }
         }
+        namespace Encrypted {
+            interface Request {
+                encrypted_key: string;
+            }
+            interface Response {
+                data: string;
+                success: boolean;
+                encrypted: boolean;
+                iv: string;
+            }
+        }
     }
     namespace Counterparties {
         interface Counterparty {

package/dist/utils/encrypt.d.ts

@@ -1,3 +1,10 @@
 import { CipherKey } from 'crypto';
+import { API } from '../api/types';
+type MakeSecureRequestParams = {
+    callback: (props: API.Common.Encrypted.Request) => Promise<API.Common.Encrypted.Response>;
+    publicKey: string;
+};
 export declare const generateSecretKey: () => Buffer<ArrayBufferLike>;
 export declare const decryptAESData: (encryptedData: string, iv: string, secretKey: CipherKey) => Promise<any>;
+export declare const makeSecureRequest: <T>({ callback, publicKey }: MakeSecureRequestParams) => Promise<T>;
+export {};

package/dist/utils/encrypt.js

@@ -12,8 +12,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decryptAESData = exports.generateSecretKey = void 0;
+exports.makeSecureRequest = exports.decryptAESData = exports.generateSecretKey = void 0;
 const crypto_1 = __importDefault(require("crypto"));
+const node_rsa_1 = __importDefault(require("node-rsa"));
 const generateSecretKey = () => {
     const secretKey = crypto_1.default.randomBytes(32);
     return secretKey;
@@ -26,3 +27,23 @@ const decryptAESData = (encryptedData, iv, secretKey) => __awaiter(void 0, void
     return JSON.parse(decrypted);
 });
 exports.decryptAESData = decryptAESData;
+const makeSecureRequest = (_a) => __awaiter(void 0, [_a], void 0, function* ({ callback, publicKey }) {
+    const clientRsa = new node_rsa_1.default();
+    const publicKeyBase64 = Buffer.from(publicKey, 'base64').toString('utf8');
+    clientRsa.importKey(publicKeyBase64, 'pkcs8-public-pem');
+    const clientSecretKey = (0, exports.generateSecretKey)();
+    const clientPayload = {
+        key: clientSecretKey.toString('base64'),
+        timestamp: Date.now(),
+    };
+    const encrypted_key = clientRsa.encrypt(JSON.stringify(clientPayload), 'base64');
+    const { success, encrypted, data, iv } = yield callback({ encrypted_key });
+    if (success && encrypted && data && iv) {
+        const decryptedData = yield (0, exports.decryptAESData)(data, iv, clientSecretKey);
+        return decryptedData.data;
+    }
+    else {
+        throw new Error('Failed to get encrypted secret key');
+    }
+});
+exports.makeSecureRequest = makeSecureRequest;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "Squarefi BFF API client module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api/issuing.ts

@@ -1,12 +1,8 @@
 import { API } from './types';
-import NodeRSA from 'node-rsa';
-
 import { apiClientV1 } from '../utils/apiClientFactory';
-
 import { defaultPaginationParams } from '../constants';
 import { fiat_accounts } from './fiat_accounts';
-import { decryptAESData, generateSecretKey } from '../utils/encrypt';
-
+import { makeSecureRequest } from '../utils/encrypt';
 export const issuing = {
   cards: {
     create: {
@@ -32,42 +28,26 @@ export const issuing = {
       return { ...card, fiat_account: { ...fiatAccountData, type: card.fiat_account.type } };
     },
     sensitiveData: {
-      get: (card_id: string) => apiClientV1.getRequest<API.Cards.SensitiveData>(`/issuing/cards/${card_id}/sensitive`),
+      // get: (card_id: string) => apiClientV1.getRequest<API.Cards.SensitiveData>(`/issuing/cards/${card_id}/sensitive`), deprecated from v1.13.1
       encrypted: {
         secretKey: {
-          get: async (card_id: string) => {
+          get: async (card_id: string): Promise<API.Cards.SensitiveData> => {
             const serverPublicKeyEnv = process.env.SERVER_PUBLIC_KEY_BASE64;
-            const clientRsa = new NodeRSA();
+            const callback = (props: API.Common.Encrypted.Request) =>
+              apiClientV1.postRequest<API.Common.Encrypted.Response>(`/issuing/cards/${card_id}/sensitive/secretkey`, {
+                data: props,
+              });
 
             if (!serverPublicKeyEnv) {
               throw new Error('SERVER_PUBLIC_KEY_BASE64 is not set');
             }
 
-            const serverPublicKey = Buffer.from(serverPublicKeyEnv, 'base64').toString('utf8');
-            clientRsa.importKey(serverPublicKey, 'pkcs8-public-pem');
-
-            const clientSecretKey = generateSecretKey();
-            const clientPayload = {
-              key: clientSecretKey.toString('base64'),
-              timestamp: Date.now(),
-            };
+            const encryptedData = await makeSecureRequest<API.Cards.SensitiveData>({
+              callback,
+              publicKey: serverPublicKeyEnv,
+            });
 
-            const encrypted_key = clientRsa.encrypt(JSON.stringify(clientPayload), 'base64');
-
-            const { success, encrypted, data, iv } = await apiClientV1.postRequest<API.Cards.SensitiveDataEncrypted>(
-              `/issuing/cards/${card_id}/sensitive/secretkey`,
-              {
-                data: {
-                  encrypted_key,
-                },
-              }
-            );
-
-            if (success && encrypted && data && iv) {
-              const decryptedData = decryptAESData(data, iv, clientSecretKey);
-
-              return decryptedData;
-            }
+            return encryptedData;
           },
         },
       },

package/src/api/types.ts

@@ -335,13 +335,6 @@ export namespace API {
       security_code?: string;
     }
 
-    export interface SensitiveDataEncrypted {
-      data?: string;
-      success?: boolean;
-      encrypted?: boolean;
-      iv?: string;
-    }
-
     export interface OTP {
       created_at: number;
       internal_card_id: string;
@@ -413,6 +406,18 @@ export namespace API {
         filter?: Partial<Record<keyof T, any>>;
       }
     }
+
+    export namespace Encrypted {
+      export interface Request {
+        encrypted_key: string;
+      }
+      export interface Response {
+        data: string;
+        success: boolean;
+        encrypted: boolean;
+        iv: string;
+      }
+    }
   }
 
   export namespace Counterparties {

package/src/utils/encrypt.ts

@@ -1,4 +1,12 @@
 import crypto, { CipherKey } from 'crypto';
+import NodeRSA from 'node-rsa';
+
+import { API } from '../api/types';
+
+type MakeSecureRequestParams = {
+  callback: (props: API.Common.Encrypted.Request) => Promise<API.Common.Encrypted.Response>;
+  publicKey: string;
+};
 
 export const generateSecretKey = () => {
   const secretKey = crypto.randomBytes(32);
@@ -11,3 +19,28 @@ export const decryptAESData = async (encryptedData: string, iv: string, secretKe
   decrypted += decipher.final('utf8');
   return JSON.parse(decrypted);
 };
+
+export const makeSecureRequest = async <T>({ callback, publicKey }: MakeSecureRequestParams): Promise<T> => {
+  const clientRsa = new NodeRSA();
+
+  const publicKeyBase64 = Buffer.from(publicKey, 'base64').toString('utf8');
+  clientRsa.importKey(publicKeyBase64, 'pkcs8-public-pem');
+
+  const clientSecretKey = generateSecretKey();
+  const clientPayload = {
+    key: clientSecretKey.toString('base64'),
+    timestamp: Date.now(),
+  };
+
+  const encrypted_key = clientRsa.encrypt(JSON.stringify(clientPayload), 'base64');
+
+  const { success, encrypted, data, iv } = await callback({ encrypted_key });
+
+  if (success && encrypted && data && iv) {
+    const decryptedData = await decryptAESData(data, iv, clientSecretKey);
+
+    return decryptedData.data;
+  } else {
+    throw new Error('Failed to get encrypted secret key');
+  }
+};