sunuid-sdk 1.0.24 → 1.0.26

package/dist/sunuid-sdk.js

@@ -1,6 +1,14 @@
 (function () {
   'use strict';
 
+  function _arrayLikeToArray(r, a) {
+    (null == a || a > r.length) && (a = r.length);
+    for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
+    return n;
+  }
+  function _arrayWithHoles(r) {
+    if (Array.isArray(r)) return r;
+  }
   function asyncGeneratorStep(n, t, e, r, o, a, c) {
     try {
       var i = n[a](c),
@@ -48,6 +56,36 @@
       writable: !0
     }) : e[r] = t, e;
   }
+  function _iterableToArrayLimit(r, l) {
+    var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"];
+    if (null != t) {
+      var e,
+        n,
+        i,
+        u,
+        a = [],
+        f = !0,
+        o = !1;
+      try {
+        if (i = (t = t.call(r)).next, 0 === l) {
+          if (Object(t) !== t) return;
+          f = !1;
+        } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0);
+      } catch (r) {
+        o = !0, n = r;
+      } finally {
+        try {
+          if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return;
+        } finally {
+          if (o) throw n;
+        }
+      }
+      return a;
+    }
+  }
+  function _nonIterableRest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+  }
   function ownKeys(e, r) {
     var t = Object.keys(e);
     if (Object.getOwnPropertySymbols) {
@@ -177,6 +215,26 @@
       }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2));
     }, _regeneratorDefine(e, r, n, t);
   }
+  function _regeneratorValues(e) {
+    if (null != e) {
+      var t = e["function" == typeof Symbol && Symbol.iterator || "@@iterator"],
+        r = 0;
+      if (t) return t.call(e);
+      if ("function" == typeof e.next) return e;
+      if (!isNaN(e.length)) return {
+        next: function () {
+          return e && r >= e.length && (e = void 0), {
+            value: e && e[r++],
+            done: !e
+          };
+        }
+      };
+    }
+    throw new TypeError(typeof e + " is not iterable");
+  }
+  function _slicedToArray(r, e) {
+    return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest();
+  }
   function _toPrimitive(t, r) {
     if ("object" != typeof t || !t) return t;
     var e = t[Symbol.toPrimitive];
@@ -191,6 +249,22 @@
     var i = _toPrimitive(t, "string");
     return "symbol" == typeof i ? i : i + "";
   }
+  function _typeof(o) {
+    "@babel/helpers - typeof";
+
+    return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
+      return typeof o;
+    } : function (o) {
+      return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+    }, _typeof(o);
+  }
+  function _unsupportedIterableToArray(r, a) {
+    if (r) {
+      if ("string" == typeof r) return _arrayLikeToArray(r, a);
+      var t = {}.toString.call(r).slice(8, -1);
+      return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
+    }
+  }
 
   /**
    * SunuID SDK - Package d'intégration pour partenaires
@@ -207,8 +281,10 @@
       apiUrl: ((_window$SunuIDConfig = window.SunuIDConfig) === null || _window$SunuIDConfig === void 0 ? void 0 : _window$SunuIDConfig.apiUrl) || 'https://api.sunuid.fayma.sn',
       clientId: null,
       secretId: null,
-      type: 1,
-      // Type par défaut (1 = authentification)
+      type: 2,
+      // Type par défaut (2 = authentification)
+      partnerName: 'SunuID',
+      // Nom du partenaire par défaut
       theme: 'light',
       language: 'fr',
       autoRefresh: true,
@@ -217,7 +293,17 @@
       onSuccess: null,
       onError: null,
       onStatusUpdate: null,
-      onExpired: null
+      onExpired: null,
+      // Nouvelles options de sécurité
+      enableSecurityLogs: true,
+      validateInputs: true,
+      maxRetries: 3,
+      requestTimeout: 10000,
+      // 10 secondes
+      // Options d'initialisation sécurisée
+      secureInit: false,
+      secureInitUrl: 'http://localhost:8081/secure-init.php',
+      token: null
     };
 
     /**
@@ -232,9 +318,9 @@
         this.refreshTimer = null;
         this.isInitialized = false;
         this.socket = null;
-        this.websocketRetryCount = 0;
-        this.maxWebSocketRetries = 5;
-        this.init();
+
+        // Initialisation asynchrone
+        this.initPromise = this.init();
       }
 
       /**
@@ -242,15 +328,185 @@
        */
       return _createClass(SunuID, [{
         key: "init",
-        value: function init() {
-          if (!this.config.clientId || !this.config.secretId) {
-            throw new Error('SunuID: clientId et secretId sont requis');
+        value: (function () {
+          var _init = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+            var _t;
+            return _regenerator().w(function (_context) {
+              while (1) switch (_context.p = _context.n) {
+                case 0:
+                  _context.p = 0;
+                  if (!this.config.secureInit) {
+                    _context.n = 2;
+                    break;
+                  }
+                  _context.n = 1;
+                  return this.secureInit();
+                case 1:
+                  _context.n = 3;
+                  break;
+                case 2:
+                  // Validation sécurisée des paramètres
+                  if (this.config.validateInputs) {
+                    this.validateSecurityParams();
+                  }
+                case 3:
+                  // Log de sécurité pour l'initialisation
+                  this.logSecurityEvent('SDK_INIT_START', {
+                    apiUrl: this.config.apiUrl,
+                    type: this.config.type,
+                    partnerName: this.config.partnerName,
+                    secureInit: this.config.secureInit
+                  });
+
+                  // Obscurcir les credentials dans les logs
+                  this.obfuscateCredentials();
+                  this.isInitialized = true;
+                  console.log('SunuID SDK initialisé avec succès');
+                  this.logSecurityEvent('SDK_INIT_SUCCESS');
+
+                  // Initialiser la connexion WebSocket
+                  this.initWebSocket();
+                  _context.n = 5;
+                  break;
+                case 4:
+                  _context.p = 4;
+                  _t = _context.v;
+                  this.logSecurityEvent('SDK_INIT_ERROR', {
+                    error: _t.message
+                  });
+                  throw _t;
+                case 5:
+                  return _context.a(2);
+              }
+            }, _callee, this, [[0, 4]]);
+          }));
+          function init() {
+            return _init.apply(this, arguments);
           }
-          this.isInitialized = true;
-          console.log('SunuID SDK initialisé avec succès');
+          return init;
+        }()
+        /**
+         * Initialisation sécurisée via PHP
+         */
+        )
+      }, {
+        key: "secureInit",
+        value: (function () {
+          var _secureInit = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+            var initData, response, result, decodedToken, _t2;
+            return _regenerator().w(function (_context2) {
+              while (1) switch (_context2.p = _context2.n) {
+                case 0:
+                  _context2.p = 0;
+                  this.logSecurityEvent('SECURE_INIT_START');
+                  initData = {
+                    type: this.config.type,
+                    partnerName: this.config.partnerName,
+                    theme: this.config.theme
+                  };
+                  _context2.n = 1;
+                  return fetch(this.config.secureInitUrl, {
+                    method: 'POST',
+                    headers: {
+                      'Content-Type': 'application/json',
+                      'Accept': 'application/json'
+                    },
+                    body: JSON.stringify(initData)
+                  });
+                case 1:
+                  response = _context2.v;
+                  if (response.ok) {
+                    _context2.n = 2;
+                    break;
+                  }
+                  throw new Error("Erreur HTTP: ".concat(response.status));
+                case 2:
+                  _context2.n = 3;
+                  return response.json();
+                case 3:
+                  result = _context2.v;
+                  if (result.success) {
+                    _context2.n = 4;
+                    break;
+                  }
+                  throw new Error(result.error || 'Erreur lors de l\'initialisation sécurisée');
+                case 4:
+                  // Stocker le token et les données sécurisées
+                  this.config.token = result.data.token;
+                  this.config.apiUrl = result.data.api_url;
 
-          // Initialiser la connexion WebSocket
-          this.initWebSocket();
+                  // Décoder le token pour récupérer les credentials
+                  decodedToken = this.decodeSecureToken(result.data.token);
+                  if (!decodedToken) {
+                    _context2.n = 5;
+                    break;
+                  }
+                  this.config.clientId = decodedToken.client_id;
+                  this.config.secretId = decodedToken.secret_id;
+                  _context2.n = 6;
+                  break;
+                case 5:
+                  throw new Error('Impossible de décoder le token sécurisé');
+                case 6:
+                  this.config.expiresIn = result.data.expires_in;
+                  this.config.maxRequests = result.data.max_requests;
+                  this.config.requestCount = 0;
+                  this.logSecurityEvent('SECURE_INIT_SUCCESS', {
+                    expiresIn: result.data.expires_in,
+                    maxRequests: result.data.max_requests
+                  });
+                  console.log('✅ Initialisation sécurisée réussie');
+                  _context2.n = 8;
+                  break;
+                case 7:
+                  _context2.p = 7;
+                  _t2 = _context2.v;
+                  this.logSecurityEvent('SECURE_INIT_ERROR', {
+                    error: _t2.message
+                  });
+                  throw new Error("\xC9chec de l'initialisation s\xE9curis\xE9e: ".concat(_t2.message));
+                case 8:
+                  return _context2.a(2);
+              }
+            }, _callee2, this, [[0, 7]]);
+          }));
+          function secureInit() {
+            return _secureInit.apply(this, arguments);
+          }
+          return secureInit;
+        }()
+        /**
+         * Décoder le token sécurisé
+         */
+        )
+      }, {
+        key: "decodeSecureToken",
+        value: function decodeSecureToken(token) {
+          try {
+            var parts = token.split('.');
+            if (parts.length !== 2) {
+              console.error('❌ Format de token invalide');
+              return null;
+            }
+            var _parts = _slicedToArray(parts, 2),
+              payload = _parts[0],
+              signature = _parts[1];
+
+            // Décoder le payload (base64)
+            var decodedPayload = atob(payload);
+            var tokenData = JSON.parse(decodedPayload);
+
+            // Vérifier l'expiration
+            if (tokenData.exp && tokenData.exp < Date.now() / 1000) {
+              console.error('❌ Token expiré');
+              return null;
+            }
+            console.log('✅ Token décodé avec succès');
+            return tokenData;
+          } catch (error) {
+            console.error('❌ Erreur décodage token:', error);
+            return null;
+          }
         }
 
         /**
@@ -263,16 +519,11 @@
           try {
             // Vérifier si Socket.IO est disponible
             if (typeof io === 'undefined') {
-              this.websocketRetryCount++;
-              if (this.websocketRetryCount <= this.maxWebSocketRetries) {
-                console.warn("\u26A0\uFE0F Socket.IO non disponible (tentative ".concat(this.websocketRetryCount, "/").concat(this.maxWebSocketRetries, "), WebSocket sera initialis\xE9 plus tard"));
-                // Réessayer après un délai
-                setTimeout(function () {
-                  return _this.initWebSocket();
-                }, 1000);
-              } else {
-                console.warn('⚠️ Socket.IO non disponible après plusieurs tentatives, WebSocket désactivé');
-              }
+              console.warn('⚠️ Socket.IO non disponible, WebSocket sera initialisé plus tard');
+              // Réessayer après un délai
+              setTimeout(function () {
+                return _this.initWebSocket();
+              }, 1000);
               return;
             }
 
@@ -331,6 +582,135 @@
           return '127.0.0.1';
         }
 
+        /**
+         * Obtenir le nom du type à partir du numéro
+         */
+      }, {
+        key: "getTypeName",
+        value: function getTypeName(type) {
+          switch (type) {
+            case 1:
+              return 'KYC';
+            case 2:
+              return 'AUTH';
+            case 3:
+              return 'SIGNATURE';
+            default:
+              return "TYPE-".concat(type);
+          }
+        }
+
+        /**
+         * Validation sécurisée des paramètres
+         */
+      }, {
+        key: "validateSecurityParams",
+        value: function validateSecurityParams() {
+          var errors = [];
+
+          // Validation du clientId
+          if (!this.config.clientId || typeof this.config.clientId !== 'string') {
+            errors.push('clientId invalide ou manquant');
+          } else if (this.config.clientId.length < 10) {
+            errors.push('clientId trop court');
+          }
+
+          // Validation du secretId
+          if (!this.config.secretId || typeof this.config.secretId !== 'string') {
+            errors.push('secretId invalide ou manquant');
+          } else if (this.config.secretId.length < 32) {
+            errors.push('secretId trop court (minimum 32 caractères)');
+          }
+
+          // Validation de l'URL API
+          if (!this.config.apiUrl || !this.isValidUrl(this.config.apiUrl)) {
+            errors.push('apiUrl invalide');
+          }
+
+          // Validation du type
+          if (![1, 2, 3].includes(this.config.type)) {
+            errors.push('type invalide (doit être 1, 2 ou 3)');
+          }
+          if (errors.length > 0) {
+            this.logSecurityEvent('VALIDATION_ERROR', {
+              errors: errors
+            });
+            throw new Error("Param\xE8tres de s\xE9curit\xE9 invalides: ".concat(errors.join(', ')));
+          }
+          this.logSecurityEvent('VALIDATION_SUCCESS');
+        }
+
+        /**
+         * Validation d'URL sécurisée
+         */
+      }, {
+        key: "isValidUrl",
+        value: function isValidUrl(string) {
+          try {
+            var url = new URL(string);
+            return url.protocol === 'https:' || url.protocol === 'http:';
+          } catch (_) {
+            return false;
+          }
+        }
+
+        /**
+         * Logs de sécurité
+         */
+      }, {
+        key: "logSecurityEvent",
+        value: function logSecurityEvent(event) {
+          var data = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+          if (!this.config.enableSecurityLogs) return;
+          var securityLog = {
+            timestamp: new Date().toISOString(),
+            event: event,
+            data: data,
+            userAgent: navigator.userAgent,
+            url: window.location.href
+          };
+          console.warn('🔒 [SECURITY]', securityLog);
+
+          // Stocker les logs de sécurité (optionnel)
+          if (!window.SunuIDSecurityLogs) {
+            window.SunuIDSecurityLogs = [];
+          }
+          window.SunuIDSecurityLogs.push(securityLog);
+        }
+
+        /**
+         * Chiffrement simple des credentials (pour éviter l'exposition en clair)
+         */
+      }, {
+        key: "obfuscateCredentials",
+        value: function obfuscateCredentials() {
+          // Stocker les vraies valeurs pour les logs de sécurité
+          this.config.originalClientId = this.config.clientId;
+          this.config.originalSecretId = this.config.secretId;
+
+          // Créer des versions obfusquées pour l'affichage uniquement
+          if (this.config.clientId) {
+            this.config.clientIdDisplay = this.config.clientId.replace(/(.{3}).*(.{3})/, '$1***$2');
+          }
+          if (this.config.secretId) {
+            this.config.secretIdDisplay = this.config.secretId.replace(/(.{4}).*(.{4})/, '$1***$2');
+          }
+        }
+
+        /**
+         * Validation des entrées utilisateur
+         */
+      }, {
+        key: "sanitizeInput",
+        value: function sanitizeInput(input) {
+          if (typeof input !== 'string') return input;
+
+          // Protection contre les injections XSS basiques
+          return input.replace(/[<>]/g, '') // Supprimer les balises HTML
+          .replace(/javascript:/gi, '') // Supprimer les protocoles dangereux
+          .trim();
+        }
+
         /**
          * Gérer la mise à jour du statut QR
          */
@@ -410,38 +790,71 @@
       }, {
         key: "generateQR",
         value: (function () {
-          var _generateQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(containerId) {
+          var _generateQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(containerId) {
+            var _this2 = this;
             var options,
               response,
               imageBaseUrl,
               qrImageUrl,
-              _args = arguments,
-              _t;
-            return _regenerator().w(function (_context) {
-              while (1) switch (_context.p = _context.n) {
+              _waitForSocketId,
+              _args3 = arguments,
+              _t3;
+            return _regenerator().w(function (_context3) {
+              while (1) switch (_context3.p = _context3.n) {
                 case 0:
-                  options = _args.length > 1 && _args[1] !== undefined ? _args[1] : {};
+                  options = _args3.length > 1 && _args3[1] !== undefined ? _args3[1] : {};
+                  if (!this.initPromise) {
+                    _context3.n = 2;
+                    break;
+                  }
+                  _context3.n = 1;
+                  return this.initPromise;
+                case 1:
+                  this.initPromise = null;
+                case 2:
                   if (this.isInitialized) {
-                    _context.n = 1;
+                    _context3.n = 3;
                     break;
                   }
                   throw new Error('SunuID: SDK non initialisé');
-                case 1:
-                  _context.p = 1;
-                  _context.n = 2;
+                case 3:
+                  _context3.p = 3;
+                  _context3.n = 4;
                   return this.makeRequest('/qr-generate', _objectSpread2({
                     type: this.config.type
                   }, options));
-                case 2:
-                  response = _context.v;
+                case 4:
+                  response = _context3.v;
                   if (!response.success) {
-                    _context.n = 3;
+                    _context3.n = 5;
                     break;
                   }
                   // Construire l'URL complète de l'image QR avec la base URL pour les images
                   imageBaseUrl = 'https://sunuid.fayma.sn';
                   qrImageUrl = "".concat(imageBaseUrl).concat(response.data.qrcode);
                   this.displayQRCode(containerId, qrImageUrl, this.config.type, options);
+
+                  // Générer le QR code personnalisé avec le type + code de l'API + socket ID
+                  if (this.pendingQRInfo && response.data.code) {
+                    // Attendre que le socket ID soit bien défini
+                    _waitForSocketId = function waitForSocketId() {
+                      if (_this2.socket && _this2.socket.id && _this2.socket.id !== 'unknown') {
+                        var socketId = _this2.socket.id;
+                        var qrContent = "".concat(_this2.config.type, "-").concat(response.data.code, "-").concat(socketId);
+
+                        // Utiliser le partnerName de la réponse API et le nom du type
+                        var partnerName = response.data.partnerName || _this2.config.partnerName || 'SunuID';
+                        var typeName = _this2.getTypeName(_this2.config.type);
+                        var qrLabel = "".concat(typeName, " - ").concat(partnerName);
+                        _this2.generateCustomQRCode(qrContent, qrLabel, _this2.pendingQRInfo.options);
+                        _this2.pendingQRInfo = null; // Nettoyer
+                      } else {
+                        // Réessayer après un délai si le socket ID n'est pas encore disponible
+                        setTimeout(_waitForSocketId, 100);
+                      }
+                    };
+                    _waitForSocketId();
+                  }
                   this.startAutoRefresh(containerId, this.config.type, options);
 
                   // Émettre un événement WebSocket pour la génération du QR
@@ -449,28 +862,37 @@
                     serviceId: response.data.service_id,
                     type: this.config.type,
                     qrCodeUrl: qrImageUrl,
+                    code: response.data.code,
                     timestamp: Date.now()
                   });
-                  return _context.a(2, _objectSpread2(_objectSpread2({}, response.data), {}, {
+                  return _context3.a(2, _objectSpread2(_objectSpread2({}, response.data), {}, {
                     qrCodeUrl: qrImageUrl,
                     sessionId: response.data.service_id
                   }));
-                case 3:
+                case 5:
                   throw new Error(response.message || 'Erreur lors de la génération du QR code');
-                case 4:
-                  _context.n = 6;
+                case 6:
+                  _context3.n = 8;
                   break;
-                case 5:
-                  _context.p = 5;
-                  _t = _context.v;
-                  console.error('Erreur API détectée:', _t.message);
+                case 7:
+                  _context3.p = 7;
+                  _t3 = _context3.v;
+                  console.error('Erreur API détectée:', _t3.message);
+                  console.error('Stack trace complet:', _t3.stack);
+                  console.error('Configuration SDK:', {
+                    apiUrl: this.config.apiUrl,
+                    type: this.config.type,
+                    secureInit: this.config.secureInit,
+                    clientId: this.config.clientId ? '***' + this.config.clientId.slice(-4) : 'null',
+                    secretId: this.config.secretId ? '***' + this.config.secretId.slice(-4) : 'null'
+                  });
                   console.log('Affichage du message "Service non disponible" pour type ' + this.config.type);
                   this.displayServiceUnavailable(containerId, this.config.type);
                   throw new Error('Service non disponible');
-                case 6:
-                  return _context.a(2);
+                case 8:
+                  return _context3.a(2);
               }
-            }, _callee, this, [[1, 5]]);
+            }, _callee3, this, [[3, 7]]);
           }));
           function generateQR(_x) {
             return _generateQR.apply(this, arguments);
@@ -484,59 +906,100 @@
       }, {
         key: "generateCustomQR",
         value: (function () {
-          var _generateCustomQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(containerId, type) {
+          var _generateCustomQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(containerId, type) {
+            var _this3 = this;
             var options,
-              response,
+              _response,
               imageBaseUrl,
               qrImageUrl,
-              _args2 = arguments,
-              _t2;
-            return _regenerator().w(function (_context2) {
-              while (1) switch (_context2.p = _context2.n) {
+              _waitForSocketId2,
+              _args4 = arguments,
+              _t4;
+            return _regenerator().w(function (_context4) {
+              while (1) switch (_context4.p = _context4.n) {
                 case 0:
-                  options = _args2.length > 2 && _args2[2] !== undefined ? _args2[2] : {};
+                  options = _args4.length > 2 && _args4[2] !== undefined ? _args4[2] : {};
+                  if (!this.initPromise) {
+                    _context4.n = 2;
+                    break;
+                  }
+                  _context4.n = 1;
+                  return this.initPromise;
+                case 1:
+                  this.initPromise = null;
+                case 2:
                   if (this.isInitialized) {
-                    _context2.n = 1;
+                    _context4.n = 3;
                     break;
                   }
                   throw new Error('SunuID: SDK non initialisé');
-                case 1:
-                  _context2.p = 1;
-                  _context2.n = 2;
+                case 3:
+                  _context4.p = 3;
+                  _context4.n = 4;
                   return this.makeRequest('/qr-generate', _objectSpread2({
                     type: type
                   }, options));
-                case 2:
-                  response = _context2.v;
-                  if (!response.success) {
-                    _context2.n = 3;
+                case 4:
+                  _response = _context4.v;
+                  if (!_response.success) {
+                    _context4.n = 5;
                     break;
                   }
                   // Construire l'URL complète de l'image QR avec la base URL pour les images
                   imageBaseUrl = 'https://sunuid.fayma.sn';
-                  qrImageUrl = "".concat(imageBaseUrl).concat(response.data.qrcode);
+                  qrImageUrl = "".concat(imageBaseUrl).concat(_response.data.qrcode);
                   this.displayQRCode(containerId, qrImageUrl, type, options);
+
+                  // Générer le QR code personnalisé avec le type + code de l'API + socket ID
+                  if (this.pendingQRInfo && _response.data.code) {
+                    // Attendre que le socket ID soit bien défini
+                    _waitForSocketId2 = function waitForSocketId() {
+                      if (_this3.socket && _this3.socket.id && _this3.socket.id !== 'unknown') {
+                        var socketId = _this3.socket.id;
+                        var qrContent = "".concat(type, "-").concat(_response.data.code, "-").concat(socketId);
+
+                        // Utiliser le partnerName de la réponse API et le nom du type
+                        var partnerName = _response.data.partnerName || _this3.config.partnerName || 'SunuID';
+                        var typeName = _this3.getTypeName(type);
+                        var qrLabel = "".concat(typeName, " - ").concat(partnerName);
+                        _this3.generateCustomQRCode(qrContent, qrLabel, _this3.pendingQRInfo.options);
+                        _this3.pendingQRInfo = null; // Nettoyer
+                      } else {
+                        // Réessayer après un délai si le socket ID n'est pas encore disponible
+                        setTimeout(_waitForSocketId2, 100);
+                      }
+                    };
+                    _waitForSocketId2();
+                  }
                   this.startAutoRefresh(containerId, type, options);
-                  return _context2.a(2, _objectSpread2(_objectSpread2({}, response.data), {}, {
+                  return _context4.a(2, _objectSpread2(_objectSpread2({}, _response.data), {}, {
                     qrCodeUrl: qrImageUrl,
-                    sessionId: response.data.service_id
+                    sessionId: _response.data.service_id
                   }));
-                case 3:
-                  throw new Error(response.message || 'Erreur lors de la génération du QR code');
-                case 4:
-                  _context2.n = 6;
-                  break;
                 case 5:
-                  _context2.p = 5;
-                  _t2 = _context2.v;
-                  console.error('Erreur API détectée:', _t2.message);
+                  throw new Error(_response.message || 'Erreur lors de la génération du QR code');
+                case 6:
+                  _context4.n = 8;
+                  break;
+                case 7:
+                  _context4.p = 7;
+                  _t4 = _context4.v;
+                  console.error('Erreur API détectée:', _t4.message);
+                  console.error('Stack trace complet:', _t4.stack);
+                  console.error('Configuration SDK (Custom):', {
+                    apiUrl: this.config.apiUrl,
+                    type: type,
+                    secureInit: this.config.secureInit,
+                    clientId: this.config.clientId ? '***' + this.config.clientId.slice(-4) : 'null',
+                    secretId: this.config.secretId ? '***' + this.config.secretId.slice(-4) : 'null'
+                  });
                   console.log('Affichage du message "Service non disponible" pour type ' + type);
                   this.displayServiceUnavailable(containerId, type);
                   throw new Error('Service non disponible');
-                case 6:
-                  return _context2.a(2);
+                case 8:
+                  return _context4.a(2);
               }
-            }, _callee2, this, [[1, 5]]);
+            }, _callee4, this, [[3, 7]]);
           }));
           function generateCustomQR(_x2, _x3) {
             return _generateCustomQR.apply(this, arguments);
@@ -547,16 +1010,16 @@
       }, {
         key: "generateAuthQR",
         value: function () {
-          var _generateAuthQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(containerId) {
+          var _generateAuthQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(containerId) {
             var options,
-              _args3 = arguments;
-            return _regenerator().w(function (_context3) {
-              while (1) switch (_context3.n) {
+              _args5 = arguments;
+            return _regenerator().w(function (_context5) {
+              while (1) switch (_context5.n) {
                 case 0:
-                  options = _args3.length > 1 && _args3[1] !== undefined ? _args3[1] : {};
-                  return _context3.a(2, this.generateQR(containerId, options));
+                  options = _args5.length > 1 && _args5[1] !== undefined ? _args5[1] : {};
+                  return _context5.a(2, this.generateQR(containerId, options));
               }
-            }, _callee3, this);
+            }, _callee5, this);
           }));
           function generateAuthQR(_x4) {
             return _generateAuthQR.apply(this, arguments);
@@ -566,82 +1029,116 @@
       }, {
         key: "generateKYCQR",
         value: function () {
-          var _generateKYCQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(containerId) {
+          var _generateKYCQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee6(containerId) {
             var options,
               originalType,
-              _args4 = arguments;
-            return _regenerator().w(function (_context4) {
-              while (1) switch (_context4.p = _context4.n) {
+              _args6 = arguments;
+            return _regenerator().w(function (_context6) {
+              while (1) switch (_context6.p = _context6.n) {
                 case 0:
-                  options = _args4.length > 1 && _args4[1] !== undefined ? _args4[1] : {};
+                  options = _args6.length > 1 && _args6[1] !== undefined ? _args6[1] : {};
                   // Sauvegarder le type actuel
                   originalType = this.config.type; // Changer temporairement le type pour KYC
-                  this.config.type = 2;
-                  _context4.p = 1;
-                  _context4.n = 2;
+                  this.config.type = 1;
+                  _context6.p = 1;
+                  _context6.n = 2;
                   return this.generateQR(containerId, options);
                 case 2:
-                  return _context4.a(2, _context4.v);
+                  return _context6.a(2, _context6.v);
                 case 3:
-                  _context4.p = 3;
+                  _context6.p = 3;
                   // Restaurer le type original
                   this.config.type = originalType;
-                  return _context4.f(3);
+                  return _context6.f(3);
                 case 4:
-                  return _context4.a(2);
+                  return _context6.a(2);
               }
-            }, _callee4, this, [[1,, 3, 4]]);
+            }, _callee6, this, [[1,, 3, 4]]);
           }));
           function generateKYCQR(_x5) {
             return _generateKYCQR.apply(this, arguments);
           }
           return generateKYCQR;
         }()
+      }, {
+        key: "generateSignatureQR",
+        value: function () {
+          var _generateSignatureQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee7(containerId) {
+            var options,
+              originalType,
+              _args7 = arguments;
+            return _regenerator().w(function (_context7) {
+              while (1) switch (_context7.p = _context7.n) {
+                case 0:
+                  options = _args7.length > 1 && _args7[1] !== undefined ? _args7[1] : {};
+                  // Sauvegarder le type actuel
+                  originalType = this.config.type; // Changer temporairement le type pour Signature
+                  this.config.type = 3;
+                  _context7.p = 1;
+                  _context7.n = 2;
+                  return this.generateQR(containerId, options);
+                case 2:
+                  return _context7.a(2, _context7.v);
+                case 3:
+                  _context7.p = 3;
+                  // Restaurer le type original
+                  this.config.type = originalType;
+                  return _context7.f(3);
+                case 4:
+                  return _context7.a(2);
+              }
+            }, _callee7, this, [[1,, 3, 4]]);
+          }));
+          function generateSignatureQR(_x6) {
+            return _generateSignatureQR.apply(this, arguments);
+          }
+          return generateSignatureQR;
+        }()
         /**
          * Vérifier le statut d'un QR code
          */
       }, {
         key: "checkQRStatus",
         value: (function () {
-          var _checkQRStatus = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(sessionId) {
-            var response, _t3;
-            return _regenerator().w(function (_context5) {
-              while (1) switch (_context5.p = _context5.n) {
+          var _checkQRStatus = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee8(sessionId) {
+            var _response2, _t5;
+            return _regenerator().w(function (_context8) {
+              while (1) switch (_context8.p = _context8.n) {
                 case 0:
                   if (this.isInitialized) {
-                    _context5.n = 1;
+                    _context8.n = 1;
                     break;
                   }
                   throw new Error('SunuID: SDK non initialisé');
                 case 1:
-                  _context5.p = 1;
-                  _context5.n = 2;
+                  _context8.p = 1;
+                  _context8.n = 2;
                   return this.makeRequest('/qr-status', {
                     serviceId: sessionId
                   });
                 case 2:
-                  response = _context5.v;
-                  if (!response.success) {
-                    _context5.n = 3;
+                  _response2 = _context8.v;
+                  if (!_response2.success) {
+                    _context8.n = 3;
                     break;
                   }
-                  return _context5.a(2, response.data);
+                  return _context8.a(2, _response2.data);
                 case 3:
-                  throw new Error(response.message || 'Erreur lors de la vérification du statut');
+                  throw new Error(_response2.message || 'Erreur lors de la vérification du statut');
                 case 4:
-                  _context5.n = 6;
+                  _context8.n = 6;
                   break;
                 case 5:
-                  _context5.p = 5;
-                  _t3 = _context5.v;
-                  this.handleError(_t3);
-                  throw _t3;
+                  _context8.p = 5;
+                  _t5 = _context8.v;
+                  this.handleError(_t5);
+                  throw _t5;
                 case 6:
-                  return _context5.a(2);
+                  return _context8.a(2);
               }
-            }, _callee5, this, [[1, 5]]);
+            }, _callee8, this, [[1, 5]]);
           }));
-          function checkQRStatus(_x6) {
+          function checkQRStatus(_x7) {
             return _checkQRStatus.apply(this, arguments);
           }
           return checkQRStatus;
@@ -665,13 +1162,172 @@
           // Créer l'élément QR code
           var qrElement = document.createElement('div');
           qrElement.className = 'sunuid-qr-code';
-          qrElement.innerHTML = "\n                    <div class=\"sunuid-qr-header\">\n                    <h3>".concat(type === 1 ? 'Authentification' : type === 2 ? 'Vérification KYC' : type === 3 ? 'Service Type 3' : 'Service Type ' + type, "</h3>\n                    </div>\n                <div class=\"sunuid-qr-image\">\n                    <img src=\"").concat(qrUrl, "\" alt=\"QR Code SunuID\" style=\"max-width: 300px; height: auto;\">\n                    </div>\n                <div class=\"sunuid-qr-instructions\">\n                    <p>Scannez ce QR code avec l'application SunuID pour vous connecter</p>\n                    </div>\n                <div class=\"sunuid-qr-status\" id=\"sunuid-status\">\n                    <p>En attente de scan...</p>\n                </div>\n            ");
+
+          // Afficher un loader en attendant la réponse API et la connexion socket
+          this.getTypeName(type);
+          qrElement.innerHTML = "\n                <div class=\"sunuid-qr-header\">\n                    <h3>".concat(type === 1 ? 'Vérification KYC' : type === 2 ? 'Authentification' : type === 3 ? 'Signature' : 'Service Type ' + type, "</h3>\n                </div>\n                <div class=\"sunuid-qr-image\" id=\"sunuid-qr-container\">\n                    <div style=\"text-align: center; padding: 40px;\">\n                        <div class=\"sunuid-loader\">\n                            <div class=\"sunuid-spinner\"></div>\n                            <p style=\"margin-top: 20px; color: #666;\">Initialisation en cours...</p>\n                            <p style=\"font-size: 12px; color: #999; margin-top: 10px;\">Connexion API et WebSocket</p>\n                            <p style=\"font-size: 11px; color: #ccc; margin-top: 5px;\">Attente du Socket ID...</p>\n                        </div>\n                    </div>\n                </div>\n                <div class=\"sunuid-qr-instructions\" style=\"display: none;\">\n                    <p>Scannez ce QR code avec l'application SunuID pour vous connecter</p>\n                </div>\n                <div class=\"sunuid-qr-status\" id=\"sunuid-status\" style=\"display: none;\">\n                    <p>En attente de scan...</p>\n                </div>\n            ");
           container.appendChild(qrElement);
 
+          // Stocker les informations pour la génération ultérieure
+          this.pendingQRInfo = {
+            containerId: containerId,
+            type: type,
+            options: options
+          };
+
           // Appliquer le thème
           this.applyTheme(options.theme || this.config.theme);
         }
 
+        /**
+         * Générer un QR code personnalisé avec PHP Endroid
+         */
+      }, {
+        key: "generateCustomQRCode",
+        value: (function () {
+          var _generateCustomQRCode = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee9(content, label) {
+            var qrContainer,
+              _response3,
+              responseData,
+              instructionsElement,
+              statusElement,
+              _t6;
+            return _regenerator().w(function (_context9) {
+              while (1) switch (_context9.p = _context9.n) {
+                case 0:
+                  _context9.p = 1;
+                  console.log('🎨 Début génération QR personnalisé avec PHP...');
+                  console.log('📄 Contenu:', content);
+                  console.log('🏷️ Label:', label);
+                  qrContainer = document.getElementById('sunuid-qr-container');
+                  if (qrContainer) {
+                    _context9.n = 2;
+                    break;
+                  }
+                  console.error('❌ QR container not found');
+                  this.displayFallbackImage();
+                  return _context9.a(2);
+                case 2:
+                  console.log('✅ QR container trouvé');
+
+                  // Nettoyer le conteneur
+                  qrContainer.innerHTML = '<div style="text-align: center; padding: 20px;"><p>Génération QR code avec PHP...</p></div>';
+
+                  // Appeler l'endpoint PHP
+                  console.log('🔄 Appel endpoint PHP...');
+                  _context9.n = 3;
+                  return fetch('http://localhost:8081/qr-generator.php', {
+                    method: 'POST',
+                    headers: {
+                      'Content-Type': 'application/json',
+                      'Accept': 'application/json'
+                    },
+                    body: JSON.stringify({
+                      content: content,
+                      label: label,
+                      size: 300,
+                      margin: 10
+                    })
+                  });
+                case 3:
+                  _response3 = _context9.v;
+                  console.log('📥 Réponse PHP reçue - Status:', _response3.status);
+                  if (_response3.ok) {
+                    _context9.n = 4;
+                    break;
+                  }
+                  throw new Error("Erreur HTTP: ".concat(_response3.status));
+                case 4:
+                  _context9.n = 5;
+                  return _response3.json();
+                case 5:
+                  responseData = _context9.v;
+                  if (responseData.success) {
+                    _context9.n = 6;
+                    break;
+                  }
+                  throw new Error("Erreur PHP: ".concat(responseData.error));
+                case 6:
+                  console.log('✅ QR code généré par PHP avec succès');
+                  console.log('📊 Taille:', responseData.data.size + 'px');
+                  console.log('📊 Longueur base64:', responseData.data.length + ' caractères');
+
+                  // Créer le conteneur avec le QR code PHP
+                  qrContainer.innerHTML = "\n                    <div class=\"sunuid-qr-ready\" style=\"text-align: center; padding: 20px;\">\n                        <img src=\"".concat(responseData.data.dataUrl, "\" alt=\"QR Code SunuID\" style=\"max-width: 300px; border: 2px solid #ddd; border-radius: 10px;\">\n                        <div style=\"margin-top: 15px;\">\n                            <p style=\"font-weight: bold; color: #333; margin: 5px 0;\">").concat(label, "</p>\n                            <p style=\"color: #666; font-size: 12px; margin: 5px 0;\">").concat(content, "</p>\n                        </div>\n                    </div>\n                ");
+
+                  // Afficher les instructions et le statut maintenant que le QR est prêt
+                  instructionsElement = qrContainer.parentElement.querySelector('.sunuid-qr-instructions');
+                  statusElement = qrContainer.parentElement.querySelector('.sunuid-qr-status');
+                  if (instructionsElement) {
+                    instructionsElement.style.display = 'block';
+                    instructionsElement.classList.add('sunuid-qr-ready');
+                  }
+                  if (statusElement) {
+                    statusElement.style.display = 'block';
+                    statusElement.classList.add('sunuid-qr-ready');
+                  }
+                  console.log('✅ QR code PHP affiché dans le conteneur');
+                  _context9.n = 8;
+                  break;
+                case 7:
+                  _context9.p = 7;
+                  _t6 = _context9.v;
+                  console.error('❌ Erreur génération QR PHP:', _t6);
+                  console.error('Stack trace:', _t6.stack);
+                  this.displayFallbackImage();
+                case 8:
+                  return _context9.a(2);
+              }
+            }, _callee9, this, [[1, 7]]);
+          }));
+          function generateCustomQRCode(_x8, _x9) {
+            return _generateCustomQRCode.apply(this, arguments);
+          }
+          return generateCustomQRCode;
+        }()
+        /**
+         * Ajouter le logo au centre du QR code
+         */
+        )
+      }, {
+        key: "addLogoToCenter",
+        value: function addLogoToCenter(ctx, x, y, width, height) {
+          try {
+            // Créer une image pour le logo
+            var logo = new Image();
+            logo.onload = function () {
+              var logoSize = 40;
+              var logoX = x + (width - logoSize) / 2;
+              var logoY = y + (width - logoSize) / 2;
+
+              // Dessiner un fond blanc pour le logo
+              ctx.fillStyle = 'white';
+              ctx.fillRect(logoX - 2, logoY - 2, logoSize + 4, logoSize + 4);
+
+              // Dessiner le logo
+              ctx.drawImage(logo, logoX, logoY, logoSize, logoSize);
+            };
+            logo.src = 'src/logoqr.png';
+          } catch (error) {
+            console.warn('Logo non disponible:', error);
+          }
+        }
+
+        /**
+         * Afficher l'image de fallback
+         */
+      }, {
+        key: "displayFallbackImage",
+        value: function displayFallbackImage() {
+          console.log('⚠️ Affichage de l\'image de fallback');
+          var qrContainer = document.getElementById('sunuid-qr-container');
+          if (qrContainer) {
+            qrContainer.innerHTML = "\n                    <div style=\"text-align: center; padding: 20px; color: #666;\">\n                        <p>\u26A0\uFE0F G\xE9n\xE9ration QR personnalis\xE9 non disponible</p>\n                        <p>Utilisation de l'image par d\xE9faut</p>\n                        <p><strong>Debug:</strong> QRCode disponible: ".concat(typeof QRCode !== 'undefined', "</p>\n                        <p><strong>Debug:</strong> Container trouv\xE9: ").concat(qrContainer !== null, "</p>\n                    </div>\n                ");
+          } else {
+            console.error('❌ Container QR non trouvé pour fallback');
+          }
+        }
+
         /**
          * Afficher "Service non disponible"
          */
@@ -684,7 +1340,7 @@
             console.error("Container ".concat(containerId, " non trouv\xE9"));
             return;
           }
-          container.innerHTML = "\n                <div class=\"sunuid-service-unavailable\" style=\"\n                    text-align: center;\n                    padding: 40px 20px;\n                    background: #f8f9fa;\n                    border: 2px dashed #dee2e6;\n                    border-radius: 10px;\n                    color: #6c757d;\n                    font-family: Arial, sans-serif;\n                \">\n                    <div style=\"font-size: 48px; margin-bottom: 20px;\">\u26A0\uFE0F</div>\n                    <h3 style=\"margin: 0 0 10px 0; color: #495057;\">Service Non Disponible</h3>\n                    <p style=\"margin: 0; font-size: 14px;\">\n                        Le service d'authentification est temporairement indisponible.<br>\n                        Veuillez r\xE9essayer plus tard.\n                    </p>\n                    <div style=\"margin-top: 20px; font-size: 12px; color: #adb5bd;\">\n                        Type: ".concat(type.toUpperCase(), "\n                    </div>\n                </div>\n            ");
+          container.innerHTML = "\n                <div class=\"sunuid-service-unavailable\" style=\"\n                    text-align: center;\n                    padding: 40px 20px;\n                    background: #f8f9fa;\n                    border: 2px dashed #dee2e6;\n                    border-radius: 10px;\n                    color: #6c757d;\n                    font-family: Arial, sans-serif;\n                \">\n                    <div style=\"font-size: 48px; margin-bottom: 20px;\">\u26A0\uFE0F</div>\n                    <h3 style=\"margin: 0 0 10px 0; color: #495057;\">Service Non Disponible</h3>\n                    <p style=\"margin: 0; font-size: 14px;\">\n                        Le service d'authentification est temporairement indisponible.<br>\n                        Veuillez r\xE9essayer plus tard.\n                    </p>\n                    <div style=\"margin-top: 20px; font-size: 12px; color: #adb5bd;\">\n                        Type: ".concat(String(type).toUpperCase(), "\n                    </div>\n                </div>\n            ");
         }
 
         /**
@@ -693,33 +1349,33 @@
       }, {
         key: "refreshQR",
         value: (function () {
-          var _refreshQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee6(containerId) {
+          var _refreshQR = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee0(containerId) {
             var options,
               result,
-              _args6 = arguments,
-              _t4;
-            return _regenerator().w(function (_context6) {
-              while (1) switch (_context6.p = _context6.n) {
+              _args0 = arguments,
+              _t7;
+            return _regenerator().w(function (_context0) {
+              while (1) switch (_context0.p = _context0.n) {
                 case 0:
-                  options = _args6.length > 1 && _args6[1] !== undefined ? _args6[1] : {};
-                  _context6.p = 1;
-                  _context6.n = 2;
+                  options = _args0.length > 1 && _args0[1] !== undefined ? _args0[1] : {};
+                  _context0.p = 1;
+                  _context0.n = 2;
                   return this.generateQR(containerId, options);
                 case 2:
-                  result = _context6.v;
-                  return _context6.a(2, result);
+                  result = _context0.v;
+                  return _context0.a(2, result);
                 case 3:
-                  _context6.p = 3;
-                  _t4 = _context6.v;
-                  console.error('Erreur lors du rafraîchissement:', _t4.message);
+                  _context0.p = 3;
+                  _t7 = _context0.v;
+                  console.error('Erreur lors du rafraîchissement:', _t7.message);
                   this.displayServiceUnavailable(containerId, this.config.type);
-                  throw _t4;
+                  throw _t7;
                 case 4:
-                  return _context6.a(2);
+                  return _context0.a(2);
               }
-            }, _callee6, this, [[1, 3]]);
+            }, _callee0, this, [[1, 3]]);
           }));
-          function refreshQR(_x7) {
+          function refreshQR(_x0) {
             return _refreshQR.apply(this, arguments);
           }
           return refreshQR;
@@ -731,27 +1387,27 @@
       }, {
         key: "startAutoRefresh",
         value: function startAutoRefresh(containerId, type, options) {
-          var _this2 = this;
+          var _this4 = this;
           if (!this.config.autoRefresh) return;
-          this.refreshTimer = setInterval(/*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee7() {
-            var _t5;
-            return _regenerator().w(function (_context7) {
-              while (1) switch (_context7.p = _context7.n) {
+          this.refreshTimer = setInterval(/*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee1() {
+            var _t8;
+            return _regenerator().w(function (_context1) {
+              while (1) switch (_context1.p = _context1.n) {
                 case 0:
-                  _context7.p = 0;
-                  _context7.n = 1;
-                  return _this2.refreshQR(containerId, type, options);
+                  _context1.p = 0;
+                  _context1.n = 1;
+                  return _this4.refreshQR(containerId, type, options);
                 case 1:
-                  _context7.n = 3;
+                  _context1.n = 3;
                   break;
                 case 2:
-                  _context7.p = 2;
-                  _t5 = _context7.v;
-                  console.warn('Erreur lors du rafraîchissement automatique:', _t5);
+                  _context1.p = 2;
+                  _t8 = _context1.v;
+                  console.warn('Erreur lors du rafraîchissement automatique:', _t8);
                 case 3:
-                  return _context7.a(2);
+                  return _context1.a(2);
               }
-            }, _callee7, null, [[0, 2]]);
+            }, _callee1, null, [[0, 2]]);
           })), this.config.refreshInterval);
         }
 
@@ -760,80 +1416,252 @@
          */
 
         /**
-         * Effectuer une requête API
+         * Effectuer une requête API sécurisée
          */
       }, {
         key: "makeRequest",
         value: (function () {
-          var _makeRequest = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee8(endpoint, data) {
-            var _window$SunuIDConfig2;
-            var endpointPath, url, response, errorText, errorData, result, _t6;
-            return _regenerator().w(function (_context8) {
-              while (1) switch (_context8.p = _context8.n) {
+          var _makeRequest = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee10(endpoint, data) {
+            var _window$SunuIDConfig2,
+              _window$SunuIDConfig3,
+              _this5 = this;
+            var sanitizedData, endpointPath, url, retryCount, maxRetries, _loop, _ret;
+            return _regenerator().w(function (_context11) {
+              while (1) switch (_context11.n) {
                 case 0:
-                  // Utiliser l'endpoint depuis la configuration si disponible
-                  endpointPath = ((_window$SunuIDConfig2 = window.SunuIDConfig) === null || _window$SunuIDConfig2 === void 0 || (_window$SunuIDConfig2 = _window$SunuIDConfig2.endpoints) === null || _window$SunuIDConfig2 === void 0 ? void 0 : _window$SunuIDConfig2[endpoint.replace('/', '')]) || endpoint;
-                  url = "".concat(this.config.apiUrl).concat(endpointPath); // Log pour déboguer l'envoi du type
-                  if (data.type !== undefined) {
-                    console.log("\uD83C\uDF10 Envoi requ\xEAte API - Type: ".concat(data.type, ", Endpoint: ").concat(endpoint));
+                  if (this.isInitialized) {
+                    _context11.n = 1;
+                    break;
                   }
-                  _context8.p = 1;
-                  _context8.n = 2;
-                  return fetch(url, {
-                    method: 'POST',
-                    headers: {
-                      'Content-Type': 'application/json',
-                      'Authorization': "Bearer ".concat(this.config.clientId, ":").concat(this.config.secretId),
-                      'Accept': 'application/json'
-                    },
-                    body: JSON.stringify(_objectSpread2(_objectSpread2({}, data), {}, {
-                      client_id: this.config.clientId,
-                      secret_id: this.config.secretId
-                    }))
+                  this.logSecurityEvent('REQUEST_BEFORE_INIT', {
+                    endpoint: endpoint
                   });
-                case 2:
-                  response = _context8.v;
-                  if (response.ok) {
-                    _context8.n = 4;
+                  throw new Error('SDK non initialisé');
+                case 1:
+                  if (!this.config.secureInit) {
+                    _context11.n = 2;
+                    break;
+                  }
+                  this.config.requestCount++;
+                  if (!(this.config.requestCount > this.config.maxRequests)) {
+                    _context11.n = 2;
                     break;
                   }
-                  _context8.n = 3;
-                  return response.text();
+                  this.logSecurityEvent('API_REQUEST_LIMIT_EXCEEDED', {
+                    requestCount: this.config.requestCount,
+                    maxRequests: this.config.maxRequests
+                  });
+                  throw new Error('Limite de requêtes dépassée');
+                case 2:
+                  // Sanitisation des données
+                  sanitizedData = this.sanitizeRequestData(data); // Debug: Afficher les données envoyées
+                  console.log('🔍 Debug makeRequest - endpoint:', endpoint);
+                  console.log('🔍 Debug makeRequest - apiUrl:', this.config.apiUrl);
+                  console.log('🔍 Debug makeRequest - url:', "".concat(this.config.apiUrl).concat(endpoint));
+                  console.log('🔍 Debug makeRequest - data:', JSON.stringify(sanitizedData, null, 2));
+                  console.log('🔍 Debug makeRequest - secureInit:', this.config.secureInit);
+                  console.log('🔍 Debug makeRequest - isInitialized:', this.isInitialized);
+
+                  // Utiliser l'endpoint depuis la configuration si disponible
+                  endpointPath = ((_window$SunuIDConfig2 = window.SunuIDConfig) === null || _window$SunuIDConfig2 === void 0 || (_window$SunuIDConfig2 = _window$SunuIDConfig2.endpoints) === null || _window$SunuIDConfig2 === void 0 ? void 0 : _window$SunuIDConfig2[endpoint.replace('/', '')]) || endpoint;
+                  url = "".concat(this.config.apiUrl).concat(endpointPath); // Debug: Afficher l'URL finale
+                  console.log('🔍 URL finale construite:', url);
+                  console.log('🔍 EndpointPath:', endpointPath);
+                  console.log('🔍 SunuIDConfig endpoints:', JSON.stringify((_window$SunuIDConfig3 = window.SunuIDConfig) === null || _window$SunuIDConfig3 === void 0 ? void 0 : _window$SunuIDConfig3.endpoints));
+
+                  // Log de sécurité pour la requête
+                  this.logSecurityEvent('API_REQUEST_START', {
+                    endpoint: endpointPath,
+                    url: url,
+                    dataKeys: Object.keys(sanitizedData),
+                    secureInit: this.config.secureInit
+                  });
+                  retryCount = 0;
+                  maxRetries = this.config.maxRetries;
+                  _loop = /*#__PURE__*/_regenerator().m(function _loop() {
+                    var controller, timeoutId, headers, _response4, errorText, errorData, result, _t9;
+                    return _regenerator().w(function (_context10) {
+                      while (1) switch (_context10.p = _context10.n) {
+                        case 0:
+                          _context10.p = 0;
+                          controller = new AbortController();
+                          timeoutId = setTimeout(function () {
+                            return controller.abort();
+                          }, _this5.config.requestTimeout); // Headers minimaux (API SunuID n'accepte que les headers essentiels)
+                          headers = {
+                            'Content-Type': 'application/json'
+                          }; // Note: En mode sécurisé, les credentials sont dans le body
+                          // Pas besoin d'ajouter de header spécial pour éviter les problèmes CORS
+                          // if (this.config.secureInit && this.config.token) {
+                          //     headers['X-Secure-Token'] = this.config.token;
+                          // }
+                          _context10.n = 1;
+                          return fetch(url, {
+                            method: 'POST',
+                            headers: headers,
+                            body: JSON.stringify(sanitizedData),
+                            signal: controller.signal
+                          });
+                        case 1:
+                          _response4 = _context10.v;
+                          clearTimeout(timeoutId);
+                          if (_response4.ok) {
+                            _context10.n = 3;
+                            break;
+                          }
+                          _context10.n = 2;
+                          return _response4.text();
+                        case 2:
+                          errorText = _context10.v;
+                          try {
+                            errorData = JSON.parse(errorText);
+                          } catch (e) {
+                            errorData = {
+                              message: errorText
+                            };
+                          }
+                          _this5.logSecurityEvent('API_REQUEST_ERROR', {
+                            status: _response4.status,
+                            statusText: _response4.statusText,
+                            error: errorData.message
+                          });
+                          throw new Error(errorData.message || "Erreur HTTP: ".concat(_response4.status));
+                        case 3:
+                          _context10.n = 4;
+                          return _response4.json();
+                        case 4:
+                          result = _context10.v;
+                          _this5.logSecurityEvent('API_REQUEST_SUCCESS', {
+                            endpoint: endpointPath,
+                            responseKeys: Object.keys(result)
+                          });
+                          return _context10.a(2, {
+                            v: result
+                          });
+                        case 5:
+                          _context10.p = 5;
+                          _t9 = _context10.v;
+                          retryCount++;
+                          if (!(_t9.name === 'AbortError')) {
+                            _context10.n = 7;
+                            break;
+                          }
+                          _this5.logSecurityEvent('API_REQUEST_TIMEOUT', {
+                            retryCount: retryCount
+                          });
+                          if (!(retryCount > maxRetries)) {
+                            _context10.n = 6;
+                            break;
+                          }
+                          throw new Error('Timeout de la requête API');
+                        case 6:
+                          return _context10.a(2, 0);
+                        case 7:
+                          if (!(retryCount > maxRetries)) {
+                            _context10.n = 8;
+                            break;
+                          }
+                          _this5.logSecurityEvent('API_REQUEST_MAX_RETRIES', {
+                            retryCount: retryCount,
+                            error: _t9.message
+                          });
+                          throw _t9;
+                        case 8:
+                          _context10.n = 9;
+                          return new Promise(function (resolve) {
+                            return setTimeout(resolve, 1000 * retryCount);
+                          });
+                        case 9:
+                          return _context10.a(2);
+                      }
+                    }, _loop, null, [[0, 5]]);
+                  });
                 case 3:
-                  errorText = _context8.v;
-                  try {
-                    errorData = JSON.parse(errorText);
-                  } catch (e) {
-                    errorData = {
-                      message: errorText
-                    };
+                  if (!(retryCount <= maxRetries)) {
+                    _context11.n = 7;
+                    break;
                   }
-                  throw new Error(errorData.message || "Erreur HTTP: ".concat(response.status));
+                  return _context11.d(_regeneratorValues(_loop()), 4);
                 case 4:
-                  _context8.n = 5;
-                  return response.json();
+                  _ret = _context11.v;
+                  if (!(_ret === 0)) {
+                    _context11.n = 5;
+                    break;
+                  }
+                  return _context11.a(3, 3);
                 case 5:
-                  result = _context8.v;
-                  return _context8.a(2, result);
+                  if (!_ret) {
+                    _context11.n = 6;
+                    break;
+                  }
+                  return _context11.a(2, _ret.v);
                 case 6:
-                  _context8.p = 6;
-                  _t6 = _context8.v;
-                  console.error('Erreur API SunuID:', _t6);
-                  throw _t6;
+                  _context11.n = 3;
+                  break;
                 case 7:
-                  return _context8.a(2);
+                  return _context11.a(2);
               }
-            }, _callee8, this, [[1, 6]]);
+            }, _callee10, this);
           }));
-          function makeRequest(_x8, _x9) {
+          function makeRequest(_x1, _x10) {
             return _makeRequest.apply(this, arguments);
           }
           return makeRequest;
         }()
         /**
-         * Appliquer le thème
+         * Sanitisation des données de requête
          */
         )
+      }, {
+        key: "sanitizeRequestData",
+        value: function sanitizeRequestData(data) {
+          var sanitized = {};
+          for (var _i = 0, _Object$entries = Object.entries(data); _i < _Object$entries.length; _i++) {
+            var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
+              key = _Object$entries$_i[0],
+              value = _Object$entries$_i[1];
+            if (typeof value === 'string') {
+              sanitized[key] = this.sanitizeInput(value);
+            } else if (_typeof(value) === 'object' && value !== null) {
+              sanitized[key] = this.sanitizeRequestData(value);
+            } else {
+              sanitized[key] = value;
+            }
+          }
+
+          // Ajouter les credentials dans le body (API SunuID les attend ici)
+          // Utiliser les vraies valeurs (originales) si disponibles, sinon les valeurs directes
+          sanitized.client_id = this.config.originalClientId || this.config.clientId;
+          sanitized.secret_id = this.config.originalSecretId || this.config.secretId;
+
+          // Debug: Vérifier les credentials
+          console.log('🔍 Credentials dans sanitizeRequestData - clientId:', this.config.clientId);
+          console.log('🔍 Credentials dans sanitizeRequestData - secretId:', this.config.secretId ? '***' + this.config.secretId.slice(-4) : 'null');
+          console.log('🔍 Credentials dans sanitizeRequestData - sanitizedClientId:', sanitized.client_id);
+          console.log('🔍 Credentials dans sanitizeRequestData - sanitizedSecretId:', sanitized.secret_id ? '***' + sanitized.secret_id.slice(-4) : 'null');
+          console.log('🔍 Credentials dans sanitizeRequestData - data complet:', JSON.stringify(sanitized, null, 2));
+
+          // Debug: Vérifier les credentials
+          console.log('🔍 Credentials dans sanitizeRequestData - clientId:', this.config.clientId);
+          console.log('🔍 Credentials dans sanitizeRequestData - secretId:', this.config.secretId ? '***' + this.config.secretId.slice(-4) : 'null');
+          console.log('🔍 Credentials dans sanitizeRequestData - sanitizedClientId:', sanitized.client_id);
+          console.log('🔍 Credentials dans sanitizeRequestData - sanitizedSecretId:', sanitized.secret_id ? '***' + sanitized.secret_id.slice(-4) : 'null');
+          console.log('🔍 Credentials dans sanitizeRequestData - data complet:', JSON.stringify(sanitized, null, 2));
+          return sanitized;
+        }
+
+        /**
+         * Générer un ID de requête unique
+         */
+      }, {
+        key: "generateRequestId",
+        value: function generateRequestId() {
+          return 'req_' + Date.now() + '_' + Math.random().toString(36).substr(2, 9);
+        }
+
+        /**
+         * Appliquer le thème
+         */
       }, {
         key: "applyTheme",
         value: function applyTheme(theme) {
@@ -872,8 +1700,28 @@
             console.log('🌐 WebSocket déconnecté');
           }
           this.isInitialized = false;
+          this.logSecurityEvent('SDK_DESTROY');
           console.log('SunuID SDK détruit');
         }
+
+        /**
+         * Obtenir les logs de sécurité
+         */
+      }, {
+        key: "getSecurityLogs",
+        value: function getSecurityLogs() {
+          return window.SunuIDSecurityLogs || [];
+        }
+
+        /**
+         * Nettoyer les logs de sécurité
+         */
+      }, {
+        key: "clearSecurityLogs",
+        value: function clearSecurityLogs() {
+          window.SunuIDSecurityLogs = [];
+          this.logSecurityEvent('SECURITY_LOGS_CLEARED');
+        }
       }]);
     }(); // Exposer la classe globalement
     window.SunuID = SunuID;