squarefi-bff-api-module 1.36.20 → 1.36.22

package/dist/api/auth.d.ts

@@ -24,6 +24,7 @@ export declare const auth: {
         password: (email: string, password: string, captcha: string) => Promise<API.Auth.Tokens>;
         telegram: (data: API.Auth.Telegram.Signup.Request) => Promise<API.Auth.Telegram.Signup.Response>;
     };
+    register: (data?: API.Auth.Register.Request) => Promise<API.Auth.Register.Response>;
     refresh: {
         refresh_token: (data: API.Auth.RefreshToken.Request) => Promise<API.Auth.RefreshToken.Response>;
     };

package/dist/api/auth.js

@@ -42,7 +42,10 @@ export const auth = {
             headers: { captcha },
             context: { bypassUnauthorizedHandler: true },
         }),
-        telegram: (data) => apiClientV2.postRequest(telegramSignInPath, { data, context: { bypassUnauthorizedHandler: true } }),
+        telegram: (data) => apiClientV2.postRequest(telegramSignInPath, {
+            data,
+            context: { bypassUnauthorizedHandler: true },
+        }),
         password: (email, password, captcha) => apiClientV2.postRequest('/auth/sign-in/password/email', {
             data: { email, password },
             headers: { captcha },
@@ -60,8 +63,12 @@ export const auth = {
             headers: { captcha },
             context: { bypassUnauthorizedHandler: true },
         }),
-        telegram: (data) => apiClientV2.postRequest(telegramSignUpPath, { data, context: { bypassUnauthorizedHandler: true } }),
+        telegram: (data) => apiClientV2.postRequest(telegramSignUpPath, {
+            data,
+            context: { bypassUnauthorizedHandler: true },
+        }),
     },
+    register: (data = {}) => apiClientV2.postRequest('/auth/register', { data }),
     refresh: {
         refresh_token: (data) => apiClientV2.postRequest(refreshTokenPath, { data }),
     },

package/dist/api/types/types.d.ts

@@ -69,6 +69,10 @@ export declare namespace API {
                 }
             }
         }
+        namespace Register {
+            type Request = operations['AuthController_register']['requestBody']['content']['application/json'];
+            type Response = operations['AuthController_register']['responses']['200']['content']['application/json'];
+        }
         namespace VerifyOtp {
             type Response = {
                 access_token: string;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { squarefi_bff_api_client } from './api';
 export * from './utils/apiClientFactory';
-export { setAccessTokenProvider, setOnUnauthorized, type AccessTokenProvider, type ResolveTokenOptions, type UnauthorizedHandler, } from './utils/accessTokenProvider';
+export { setAccessTokenProvider, setOnReverificationRequired, setOnUnauthorized, type AccessTokenProvider, type ResolveTokenOptions, type ReverificationHandler, type ReverificationMeta, type UnauthorizedHandler, } from './utils/accessTokenProvider';
 export * from './utils/tokensFactory';
 export * from './utils/fileStorage';
 export * from './constants';

package/dist/index.js

@@ -1,6 +1,6 @@
 export { squarefi_bff_api_client } from './api';
 export * from './utils/apiClientFactory';
-export { setAccessTokenProvider, setOnUnauthorized, } from './utils/accessTokenProvider';
+export { setAccessTokenProvider, setOnReverificationRequired, setOnUnauthorized, } from './utils/accessTokenProvider';
 export * from './utils/tokensFactory';
 export * from './utils/fileStorage';
 export * from './constants';

package/dist/utils/accessTokenProvider.d.ts

@@ -4,6 +4,14 @@ export type ResolveTokenOptions = {
 };
 export type AccessTokenProvider = (options?: ResolveTokenOptions) => Promise<string | null | undefined>;
 export type UnauthorizedHandler = () => void;
+/** Details the backend attaches to a step-up (2FA reverification) rejection. */
+export type ReverificationMeta = Record<string, unknown>;
+/**
+ * Handler that performs a step-up reverification (e.g. re-entering an already-enrolled second
+ * factor). Resolves `true` once the user has re-verified so the original request can be retried,
+ * or `false` if the reverification was cancelled or failed.
+ */
+export type ReverificationHandler = (meta: ReverificationMeta) => Promise<boolean>;
 /**
  * Register an external source of the access token (e.g. Clerk `getToken`).
  * When set, the API clients stop reading tokens from localStorage and delegate
@@ -16,7 +24,16 @@ export declare const setAccessTokenProvider: (provider: AccessTokenProvider | nu
  * recovered by refreshing the token (e.g. to trigger a Clerk sign-out).
  */
 export declare const setOnUnauthorized: (handler: UnauthorizedHandler | null) => void;
+/**
+ * Register a handler invoked when the backend rejects a request because a step-up 2FA
+ * reverification is required (HTTP `403` with a `two_factor_reverification_required` code). The
+ * handler drives the provider-specific re-verification (e.g. Clerk) and resolves `true` on success
+ * so the API client retries the original request once. Pass `null` to unregister.
+ */
+export declare const setOnReverificationRequired: (handler: ReverificationHandler | null) => void;
 /** Whether an external token provider is active (Clerk mode). */
 export declare const isExternalAuthMode: () => boolean;
 export declare const resolveAccessToken: (options?: ResolveTokenOptions) => Promise<string | null>;
 export declare const triggerUnauthorized: () => void;
+/** Invokes the registered reverification handler; resolves `false` when none is registered. */
+export declare const triggerReverification: (meta: ReverificationMeta) => Promise<boolean>;

package/dist/utils/accessTokenProvider.js

@@ -1,6 +1,7 @@
 import { getFromLocalStorage } from './storage';
 let accessTokenProvider = null;
 let unauthorizedHandler = null;
+let reverificationHandler = null;
 let inFlightRefresh = null;
 /**
  * Register an external source of the access token (e.g. Clerk `getToken`).
@@ -18,6 +19,15 @@ export const setAccessTokenProvider = (provider) => {
 export const setOnUnauthorized = (handler) => {
     unauthorizedHandler = handler;
 };
+/**
+ * Register a handler invoked when the backend rejects a request because a step-up 2FA
+ * reverification is required (HTTP `403` with a `two_factor_reverification_required` code). The
+ * handler drives the provider-specific re-verification (e.g. Clerk) and resolves `true` on success
+ * so the API client retries the original request once. Pass `null` to unregister.
+ */
+export const setOnReverificationRequired = (handler) => {
+    reverificationHandler = handler;
+};
 /** Whether an external token provider is active (Clerk mode). */
 export const isExternalAuthMode = () => accessTokenProvider !== null;
 export const resolveAccessToken = async (options) => {
@@ -48,3 +58,5 @@ export const resolveAccessToken = async (options) => {
 export const triggerUnauthorized = () => {
     unauthorizedHandler?.();
 };
+/** Invokes the registered reverification handler; resolves `false` when none is registered. */
+export const triggerReverification = (meta) => reverificationHandler ? reverificationHandler(meta) : Promise.resolve(false);

package/dist/utils/apiClientFactory.js

@@ -3,9 +3,11 @@ import { isTMA } from '@telegram-apps/sdk-react';
 import axios from 'axios';
 import { telegramSignUpPath, telegramSignInPath, refreshTokenPath } from '../api/auth';
 import { AppEnviroment, ResponseStatus } from '../constants';
-import { isExternalAuthMode, resolveAccessToken, triggerUnauthorized } from './accessTokenProvider';
+import { isExternalAuthMode, resolveAccessToken, triggerReverification, triggerUnauthorized, } from './accessTokenProvider';
 import { deleteTokens, getTokens, refreshTokens } from './tokensFactory';
 // eslint-disable-next-line no-constant-condition
+// Backend signals that a sensitive request needs a fresh second-factor verification with this code.
+const TWO_FACTOR_REVERIFICATION_CODE = 'two_factor_reverification_required';
 const apiV1BaseURL = process.env.API_URL ?? 'ENV variable API_URL is not defined';
 const apiV2BaseURL = process.env.API_V2_URL ?? 'ENV variable API_V2_URL is not defined';
 const apiTOTPBaseURL = process.env.API_TOTP_URL ?? 'ENV variable API_TOTP_URL is not defined';
@@ -41,6 +43,23 @@ export const createApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         if (typeof window === 'undefined') {
             return Promise.reject(error);
         }
+        // Step-up 2FA: the backend rejects a sensitive request until the user re-verifies their
+        // second factor. Hand off to the consumer's reverification handler and retry once on success.
+        if (error?.response?.status === ResponseStatus.FORBIDDEN &&
+            error?.response?.data?.code === TWO_FACTOR_REVERIFICATION_CODE &&
+            !error?.response?.config.context?.isRetryRequest) {
+            const { response, config: failedRequestConfig } = error;
+            return triggerReverification(response.data).then((didReverify) => {
+                if (!didReverify) {
+                    return Promise.reject(error);
+                }
+                failedRequestConfig.context = {
+                    ...failedRequestConfig.context,
+                    isRetryRequest: true,
+                };
+                return instance(failedRequestConfig);
+            });
+        }
         if (error?.response?.status === ResponseStatus.UNAUTHORIZED &&
             !error?.response?.config.context?.bypassUnauthorizedHandler) {
             const { response, config: failedRequestConfig } = error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.36.20",
+  "version": "1.36.22",
   "description": "Squarefi BFF API client module",
   "type": "module",
   "main": "./dist/index.js",