squarefi-bff-api-module 1.36.31 → 1.36.32

package/dist/api/types/types.d.ts

@@ -1,4 +1,4 @@
-import { APIKeyRole, CardFormFactor, CardTransactionType, CardType, CurrencyType, IssuingProgramStatus, OrderType, SortingDirection, SubAccountType } from '../../constants';
+import { APIKeyRole, CardFormFactor, CardTransactionType, CardType, CurrencyType, IssuingProgramStatus, OrderStatuses, OrderType, SortingDirection, SubAccountType } from '../../constants';
 import { components, operations, paths } from './autogen/apiV2.types';
 import { components as componentsV1Frontend, paths as pathsV1Frontend } from './autogen/apiV1Frontend.types';
 import { paths as pathsV1Legacy } from './autogen/apiV1Legacy.types';
@@ -664,6 +664,50 @@ export declare namespace API {
                 }
             }
         }
+        namespace Issuing {
+            type CardDepositRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/deposit'];
+            type CardWithdrawRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/withdraw'];
+            type SubAccountDepositRoot = pathsV1Frontend['/frontend/issuing/sub-accounts/{sub_account_id}/deposit'];
+            type SubAccountWithdrawRoot = pathsV1Frontend['/frontend/issuing/sub-accounts/{sub_account_id}/withdraw'];
+            type WithOrderStatus<T extends {
+                data?: {
+                    status?: string;
+                };
+            }> = Omit<T, 'data'> & {
+                data?: Omit<NonNullable<T['data']>, 'status'> & {
+                    status?: `${OrderStatuses}`;
+                };
+            };
+            export namespace SubAccounts {
+                namespace Deposit {
+                    type Request = {
+                        sub_account_id: string;
+                    } & SubAccountDepositRoot['post']['requestBody']['content']['application/json'];
+                    type Response = WithOrderStatus<SubAccountDepositRoot['post']['responses']['200']['content']['application/json']>;
+                }
+                namespace Withdraw {
+                    type Request = {
+                        sub_account_id: string;
+                    } & SubAccountWithdrawRoot['post']['requestBody']['content']['application/json'];
+                    type Response = WithOrderStatus<SubAccountWithdrawRoot['post']['responses']['200']['content']['application/json']>;
+                }
+            }
+            export namespace Cards {
+                namespace Deposit {
+                    type Request = {
+                        card_id: string;
+                    } & CardDepositRoot['post']['requestBody']['content']['application/json'];
+                    type Response = SubAccounts.Deposit.Response;
+                }
+                namespace Withdraw {
+                    type Request = {
+                        card_id: string;
+                    } & CardWithdrawRoot['post']['requestBody']['content']['application/json'];
+                    type Response = SubAccounts.Withdraw.Response;
+                }
+            }
+            export {};
+        }
     }
     namespace Issuing {
         namespace Programs {
@@ -1799,10 +1843,6 @@ export declare namespace API {
                         type Request = componentsV1Frontend['schemas']['FrontendL2FOrderRequest'];
                         type Response = OrderEnvelope;
                     }
-                    namespace Card {
-                        type Request = pathsV1Frontend['/frontend/orders/withdrawal/card']['post']['requestBody']['content']['application/json'];
-                        type Response = OrderEnvelope;
-                    }
                 }
                 namespace Exchange {
                     type Request = componentsV1Frontend['schemas']['FrontendExchangeOrderRequest'];
@@ -2270,6 +2310,16 @@ export declare namespace API {
                 type Response = operations['UserController_updateMyUserData']['responses']['200']['content']['application/json'];
             }
         }
+        namespace Verification {
+            type Flow = components['schemas']['UserVerificationFlow'];
+            namespace Init {
+                type Request = operations['UserVerificationController_init']['requestBody']['content']['application/json'];
+                type Response = operations['UserVerificationController_init']['responses']['200']['content']['application/json'];
+            }
+            namespace Resume {
+                type Response = operations['UserVerificationController_resume']['responses']['200']['content']['application/json'];
+            }
+        }
     }
     namespace Wallets {
         export interface SimplifiedWallet {

package/dist/api/user.d.ts

@@ -7,6 +7,10 @@ export declare const user: {
         get: (options?: GetUserDataOptions) => Promise<API.User.UserData.Get.Response>;
         update: (data: API.User.UserData.Update.Request) => Promise<API.User.UserData.Update.Response>;
     };
+    verification: {
+        init: (data: API.User.Verification.Init.Request) => Promise<API.User.Verification.Init.Response>;
+        resume: () => Promise<API.User.Verification.Resume.Response>;
+    };
     update: {
         phone: {
             request: (data: API.User.UpdateUser.Phone.RequestOTP.Request) => Promise<void>;

package/dist/api/user.js

@@ -4,6 +4,16 @@ export const user = {
         get: (options) => apiClientV2.getRequest('/user/user-data', options?.bypassUnauthorizedHandler ? { context: { bypassUnauthorizedHandler: true } } : undefined),
         update: (data) => apiClientV2.patchRequest('/user/user-data', { data }),
     },
+    verification: {
+        // Starts (or moves up) the per-user Sumsub level for the requested step and returns the WebSDK
+        // credentials. Resolves 404 when the tenant has no level configured for the step. Step results
+        // land on user-data (`identity_verification_status` / `face_verification_status`), so poll
+        // `user.userData.get()` after the WebSDK reports completion.
+        init: (data) => apiClientV2.postRequest('/user/verification/init', { data }),
+        // Re-issues the WebSDK access token for the level the user is already on; 404 when the user has
+        // never been initialized.
+        resume: () => apiClientV2.postRequest('/user/verification/resume'),
+    },
     update: {
         phone: {
             request: (data) => apiClientV2.patchRequest('/user/phone', { data }),

package/dist/constants.d.ts

@@ -294,6 +294,13 @@ export declare enum KYCStatuses {
 }
 export declare const KYCStatusCheck: IsEnumEqualToUnion<KYCStatuses, API.KYC.KYCStatus>;
 export type KYCStatusMismatch = EnumUnionMismatch<KYCStatuses, API.KYC.KYCStatus>;
+export declare enum UserVerificationFlows {
+    DATA = "data",
+    DOCUMENTS = "documents",
+    FACE = "face"
+}
+export declare const UserVerificationFlowCheck: IsEnumEqualToUnion<UserVerificationFlows, API.User.Verification.Flow>;
+export type UserVerificationFlowMismatch = EnumUnionMismatch<UserVerificationFlows, API.User.Verification.Flow>;
 export declare enum OrderStatuses {
     NEW = "NEW",
     PENDING = "PENDING",

package/dist/constants.js

@@ -308,6 +308,14 @@ export var KYCStatuses;
     KYCStatuses["WAITING_ON_REVIEW"] = "WAITING_ON_REVIEW";
 })(KYCStatuses || (KYCStatuses = {}));
 export const KYCStatusCheck = true;
+// Steps of the per-user verification ladder passed to `user.verification.init`.
+export var UserVerificationFlows;
+(function (UserVerificationFlows) {
+    UserVerificationFlows["DATA"] = "data";
+    UserVerificationFlows["DOCUMENTS"] = "documents";
+    UserVerificationFlows["FACE"] = "face";
+})(UserVerificationFlows || (UserVerificationFlows = {}));
+export const UserVerificationFlowCheck = true;
 export var OrderStatuses;
 (function (OrderStatuses) {
     OrderStatuses["NEW"] = "NEW";

package/dist/utils/apiClientFactory.js

@@ -4,7 +4,7 @@ import axios from 'axios';
 import { telegramSignUpPath, telegramSignInPath, refreshTokenPath } from '../api/auth';
 import { AppEnviroment, ResponseStatus } from '../constants';
 import { isExternalAuthMode, resolveAccessToken, triggerReverification, triggerUnauthorized, } from './accessTokenProvider';
-import { deleteTokens, getTokens, refreshTokens } from './tokensFactory';
+import { ExternalAuthRequiredError, deleteTokens, getTokens, refreshTokens } from './tokensFactory';
 // eslint-disable-next-line no-constant-condition
 // Backend signals that a sensitive request needs a fresh second-factor verification with this code.
 // Backend error codes are UPPER_SNAKE_CASE, and the code can sit at either `data.code` or
@@ -119,6 +119,15 @@ export const createApiClient = ({ baseURL, isBearerToken, tenantId }) => {
                     }
                 })
                     .catch((tokenRefreshError) => {
+                    // A Clerk tenant answered the sign-in with a one-time ticket: the SDK cannot complete
+                    // it here, but the stored session is still valid and the app recovers by registering
+                    // `setAccessTokenProvider`. Settle the queued requests with the error instead of
+                    // wiping the tokens and redirecting to logout.
+                    if (tokenRefreshError instanceof ExternalAuthRequiredError) {
+                        requestQueue.forEach((request) => request.fail(tokenRefreshError));
+                        requestQueue = [];
+                        return;
+                    }
                     if (typeof window !== 'undefined') {
                         window.location.href = envLogoutURL;
                         deleteTokens();
@@ -140,6 +149,7 @@ export const createApiClient = ({ baseURL, isBearerToken, tenantId }) => {
                         return res(instance(failedRequestConfig));
                     },
                     reject: () => rej(instance(failedRequestConfig)),
+                    fail: (queuedError) => rej(queuedError),
                 });
             });
         }

package/dist/utils/tokensFactory.d.ts

@@ -2,6 +2,16 @@ type ITokens = {
     access_token: string;
     refresh_token?: string | null;
 };
+/**
+ * Raised when the tenant's auth provider answers a sign-in with a one-time Clerk ticket
+ * (`{ ticket, expires_at }`) instead of a session. This localStorage flow cannot complete such a
+ * sign-in, but the session is **not** dead: the app is expected to exchange the ticket via Clerk JS
+ * (`signIn.create({ strategy: 'ticket', ticket })`) and register `setAccessTokenProvider`. Callers
+ * must treat it as "retry once the provider is ready", never as a reason to sign the user out.
+ */
+export declare class ExternalAuthRequiredError extends Error {
+    constructor(message?: string);
+}
 export declare function setTokens({ access_token, refresh_token }: ITokens): void;
 export declare function deleteTokens(): void;
 export declare function refreshTokens(): Promise<ITokens>;

package/dist/utils/tokensFactory.js

@@ -1,6 +1,19 @@
 import { initData, isTMA } from '@telegram-apps/sdk-react';
 import { deleteFromLocalStorage, getFromLocalStorage, setToLocalStorage } from './storage';
 import { auth } from '../api/auth';
+/**
+ * Raised when the tenant's auth provider answers a sign-in with a one-time Clerk ticket
+ * (`{ ticket, expires_at }`) instead of a session. This localStorage flow cannot complete such a
+ * sign-in, but the session is **not** dead: the app is expected to exchange the ticket via Clerk JS
+ * (`signIn.create({ strategy: 'ticket', ticket })`) and register `setAccessTokenProvider`. Callers
+ * must treat it as "retry once the provider is ready", never as a reason to sign the user out.
+ */
+export class ExternalAuthRequiredError extends Error {
+    constructor(message = 'Sign-in returned a Clerk ticket instead of a session; exchange it via Clerk and register setAccessTokenProvider') {
+        super(message);
+        this.name = 'ExternalAuthRequiredError';
+    }
+}
 export function setTokens({ access_token, refresh_token }) {
     access_token && setToLocalStorage('access_token', access_token);
     refresh_token && setToLocalStorage('refresh_token', refresh_token);
@@ -27,6 +40,18 @@ export async function refreshTokens() {
             hash,
             init_data_raw,
         });
+        // A malformed body (empty response, HTML error page) leaves the session unusable, so it stays a
+        // plain error and drives the caller's sign-out path.
+        if (typeof telegramSignInResponse !== 'object' || telegramSignInResponse === null) {
+            return Promise.reject(new Error('Telegram sign-in returned an unexpected response body'));
+        }
+        // Clerk tenants answer with a one-time sign-in ticket instead of a session: there is no bearer
+        // token to store here. Those apps exchange the ticket via Clerk JS and register
+        // `setAccessTokenProvider`, which bypasses this localStorage flow entirely — so this is a
+        // recoverable state, not a dead session.
+        if (!('access_token' in telegramSignInResponse)) {
+            return Promise.reject(new ExternalAuthRequiredError());
+        }
         setTokens(telegramSignInResponse);
         return telegramSignInResponse;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.36.31",
+  "version": "1.36.32",
   "description": "Squarefi BFF API client module",
   "type": "module",
   "main": "./dist/index.js",