Authenticate User

curl -X POST "https://dev.api.baanx.com/v1/auth/login" \
  -H "x-client-key: your-client-key" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePassword123!"
  }'

const response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
  method: 'POST',
  headers: {
    'x-client-key': 'your-client-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'user@example.com',
    password: 'SecurePassword123!'
  })
});

const data = await response.json();

if (data.isOtpRequired) {
  console.log('OTP required. Send to:', data.phoneNumber);
  // Call /v1/auth/login/otp and retry with otpCode
} else {
  console.log('Access token:', data.accessToken);
  // Store token for API requests
  localStorage.setItem('access_token', data.accessToken);
}

import requests

response = requests.post(
    'https://dev.api.baanx.com/v1/auth/login',
    headers={
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
    },
    json={
        'email': 'user@example.com',
        'password': 'SecurePassword123!'
    }
)

data = response.json()

if response.status_code == 200:
    if data.get('isOtpRequired'):
        print(f"OTP required. Send to: {data.get('phoneNumber')}")
        # Call /v1/auth/login/otp and retry with otpCode
    else:
        print(f"Access token: {data['accessToken']}")
        # Store token for API requests
        session['access_token'] = data['accessToken']
else:
    print(f"Login failed: {data.get('message')}")

interface LoginRequest {
  email: string;
  password: string;
  otpCode?: string;
}

interface LoginResponse {
  accessToken: string;
  userId: string;
  isOtpRequired: boolean;
  phoneNumber?: string;
  phase?: string | null;
  verificationState?: string;
  isLinked: boolean;
}

async function login(credentials: LoginRequest): Promise<LoginResponse> {
  const response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
    method: 'POST',
    headers: {
      'x-client-key': 'your-client-key',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify(credentials)
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(error.message || 'Login failed');
  }

  const data: LoginResponse = await response.json();

  if (data.isOtpRequired && !credentials.otpCode) {
    throw new Error('OTP_REQUIRED');
  }

  return data;
}

async function loginWithOTP(email, password) {
  // Step 1: Initial login attempt
  let response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
    method: 'POST',
    headers: {
      'x-client-key': 'your-client-key',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({ email, password })
  });

  let data = await response.json();

  // Step 2: If OTP required, send OTP and retry
  if (data.isOtpRequired) {
    const userId = data.userId;

    // Send OTP code to user's phone
    await fetch('https://dev.api.baanx.com/v1/auth/login/otp', {
      method: 'POST',
      headers: {
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ userId })
    });

    // Get OTP code from user (show input form)
    const otpCode = await promptUserForOTP();

    // Retry login with OTP code
    response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
      method: 'POST',
      headers: {
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ email, password, otpCode })
    });

    data = await response.json();
  }

  return data;
}

import requests

def login_with_otp(email: str, password: str) -> dict:
    base_url = 'https://dev.api.baanx.com'
    headers = {
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
    }

    # Step 1: Initial login attempt
    response = requests.post(
        f'{base_url}/v1/auth/login',
        headers=headers,
        json={'email': email, 'password': password}
    )

    data = response.json()

    # Step 2: If OTP required, send OTP and retry
    if data.get('isOtpRequired'):
        user_id = data['userId']

        # Send OTP code to user's phone
        requests.post(
            f'{base_url}/v1/auth/login/otp',
            headers=headers,
            json={'userId': user_id}
        )

        # Get OTP code from user
        otp_code = input(f"Enter OTP sent to {data.get('phoneNumber')}: ")

        # Retry login with OTP code
        response = requests.post(
            f'{base_url}/v1/auth/login',
            headers=headers,
            json={'email': email, 'password': password, 'otpCode': otp_code}
        )

        data = response.json()

    return data

import { z } from 'zod';

const LoginResponseSchema = z.object({
  accessToken: z.string().nullable(),
  userId: z.string().uuid(),
  isOtpRequired: z.boolean(),
  phoneNumber: z.string().nullable(),
  phase: z.string().nullable(),
  verificationState: z.string().nullable(),
  isLinked: z.boolean()
});

type LoginResponse = z.infer<typeof LoginResponseSchema>;

class AuthenticationError extends Error {
  constructor(
    message: string,
    public code: string,
    public statusCode: number,
    public retryable: boolean = false
  ) {
    super(message);
    this.name = 'AuthenticationError';
  }
}

class LoginService {
  private readonly apiBase: string;
  private readonly clientKey: string;
  private readonly maxRetries = 3;
  private readonly timeoutMs = 30000;

  constructor(apiBase: string, clientKey: string) {
    this.apiBase = apiBase;
    this.clientKey = clientKey;
  }

  async login(
    email: string,
    password: string,
    otpCode?: string
  ): Promise<LoginResponse> {
    const body = { email, password, ...(otpCode && { otpCode }) };

    try {
      const response = await this.fetchWithTimeout(
        `${this.apiBase}/v1/auth/login`,
        {
          method: 'POST',
          headers: {
            'x-client-key': this.clientKey,
            'Content-Type': 'application/json'
          },
          body: JSON.stringify(body)
        }
      );

      const data = await response.json();

      if (!response.ok) {
        throw this.handleErrorResponse(response.status, data);
      }

      return LoginResponseSchema.parse(data);

    } catch (error) {
      if (error instanceof AuthenticationError) {
        throw error;
      }

      throw new AuthenticationError(
        'Network error during login',
        'NETWORK_ERROR',
        0,
        true
      );
    }
  }

  async sendOtp(userId: string): Promise<void> {
    const response = await this.fetchWithTimeout(
      `${this.apiBase}/v1/auth/login/otp`,
      {
        method: 'POST',
        headers: {
          'x-client-key': this.clientKey,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ userId })
      }
    );

    if (!response.ok) {
      const data = await response.json();
      throw this.handleErrorResponse(response.status, data);
    }
  }

  async loginWithOtpFlow(
    email: string,
    password: string,
    otpCallback: () => Promise<string>
  ): Promise<LoginResponse> {
    const initialResponse = await this.login(email, password);

    if (!initialResponse.isOtpRequired) {
      return initialResponse;
    }

    await this.sendOtp(initialResponse.userId);

    const otpCode = await otpCallback();

    return await this.login(email, password, otpCode);
  }

  private async fetchWithTimeout(
    url: string,
    options: RequestInit
  ): Promise<Response> {
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);

    try {
      const response = await fetch(url, {
        ...options,
        signal: controller.signal
      });
      return response;
    } finally {
      clearTimeout(timeoutId);
    }
  }

  private handleErrorResponse(
    status: number,
    data: any
  ): AuthenticationError {
    switch (status) {
      case 401:
        return new AuthenticationError(
          'Invalid credentials',
          'INVALID_CREDENTIALS',
          401,
          false
        );

      case 403:
        return new AuthenticationError(
          data.message || 'Account locked',
          'ACCOUNT_LOCKED',
          403,
          false
        );

      case 422:
        return new AuthenticationError(
          data.message || 'Validation error',
          'VALIDATION_ERROR',
          422,
          false
        );

      case 429:
        return new AuthenticationError(
          'Too many attempts',
          'RATE_LIMITED',
          429,
          true
        );

      default:
        return new AuthenticationError(
          data.message || 'Authentication failed',
          'UNKNOWN_ERROR',
          status,
          status >= 500
        );
    }
  }
}

// Usage Example
const loginService = new LoginService(
  'https://dev.api.baanx.com',
  'your-client-key'
);

async function handleLogin(email: string, password: string) {
  try {
    const response = await loginService.loginWithOtpFlow(
      email,
      password,
      async () => {
        return await promptUserForOtp();
      }
    );

    if (response.phase !== null) {
      console.log('User needs to complete onboarding:', response.phase);
      redirectToOnboarding(response.phase);
      return;
    }

    if (!response.accessToken) {
      throw new Error('No access token received');
    }

    console.log('Login successful');
    storeToken(response.accessToken);
    redirectToApp();

  } catch (error) {
    if (error instanceof AuthenticationError) {
      handleAuthError(error);
    } else {
      console.error('Unexpected error:', error);
    }
  }
}

function handleAuthError(error: AuthenticationError) {
  switch (error.code) {
    case 'INVALID_CREDENTIALS':
      showError('Invalid email or password');
      offerPasswordReset();
      break;

    case 'ACCOUNT_LOCKED':
      showError('Account is locked. Please contact support.');
      showSupportLink();
      break;

    case 'RATE_LIMITED':
      showError('Too many attempts. Please wait and try again.');
      break;

    case 'NETWORK_ERROR':
      if (error.retryable) {
        showError('Connection issue. Retrying...');
        retryLogin();
      }
      break;

    default:
      showError('Login failed. Please try again.');
  }
}

function promptUserForOtp(): Promise<string> {
  return new Promise((resolve) => {
    // Show OTP input modal
    const modal = showOtpModal();
    modal.onSubmit((code: string) => resolve(code));
  });
}

function storeToken(token: string) {
  sessionStorage.setItem('accessToken', token);
  sessionStorage.setItem('tokenIssuedAt', Date.now().toString());
}

function redirectToOnboarding(phase: string) {
  window.location.href = `/onboarding/${phase.toLowerCase()}`;
}

function redirectToApp() {
  window.location.href = '/dashboard';
}

function showError(message: string) {
  console.error(message);
}

function offerPasswordReset() {
  console.log('Showing password reset link');
}

function showSupportLink() {
  console.log('Showing support contact information');
}

function retryLogin() {
  console.log('Retrying login...');
}

function showOtpModal() {
  return {
    onSubmit: (callback: (code: string) => void) => {
      setTimeout(() => callback('123456'), 1000);
    }
  };
}

import time
import requests
from typing import Optional, Callable, TypedDict
from enum import Enum
from dataclasses import dataclass

class LoginPhase(str, Enum):
    ACCOUNT = "ACCOUNT"
    PHONE_NUMBER = "PHONE_NUMBER"
    PERSONAL_INFORMATION = "PERSONAL_INFORMATION"
    PHYSICAL_ADDRESS = "PHYSICAL_ADDRESS"
    MAILING_ADDRESS = "MAILING_ADDRESS"

class VerificationState(str, Enum):
    UNVERIFIED = "UNVERIFIED"
    PENDING = "PENDING"
    VERIFIED = "VERIFIED"
    REJECTED = "REJECTED"

class LoginResponse(TypedDict, total=False):
    accessToken: Optional[str]
    userId: str
    isOtpRequired: bool
    phoneNumber: Optional[str]
    phase: Optional[str]
    verificationState: Optional[str]
    isLinked: bool

@dataclass
class AuthenticationError(Exception):
    message: str
    code: str
    status_code: int
    retryable: bool = False

class LoginService:
    TOKEN_LIFETIME_SECONDS = 6 * 60 * 60

    def __init__(self, api_base: str, client_key: str):
        self.api_base = api_base
        self.client_key = client_key
        self.session = requests.Session()
        self.session.headers.update({
            'x-client-key': client_key,
            'Content-Type': 'application/json'
        })

    def login(
        self,
        email: str,
        password: str,
        otp_code: Optional[str] = None
    ) -> LoginResponse:
        body = {'email': email, 'password': password}
        if otp_code:
            body['otpCode'] = otp_code

        try:
            response = self.session.post(
                f'{self.api_base}/v1/auth/login',
                json=body,
                timeout=30
            )

            data = response.json()

            if not response.ok:
                raise self._handle_error_response(response.status_code, data)

            return data

        except requests.exceptions.Timeout:
            raise AuthenticationError(
                'Request timed out',
                'TIMEOUT',
                0,
                retryable=True
            )
        except requests.exceptions.ConnectionError:
            raise AuthenticationError(
                'Connection failed',
                'CONNECTION_ERROR',
                0,
                retryable=True
            )

    def send_otp(self, user_id: str) -> None:
        response = self.session.post(
            f'{self.api_base}/v1/auth/login/otp',
            json={'userId': user_id},
            timeout=30
        )

        if not response.ok:
            data = response.json()
            raise self._handle_error_response(response.status_code, data)

    def login_with_otp_flow(
        self,
        email: str,
        password: str,
        otp_callback: Callable[[], str]
    ) -> LoginResponse:
        initial_response = self.login(email, password)

        if not initial_response.get('isOtpRequired'):
            return initial_response

        self.send_otp(initial_response['userId'])

        print(f"OTP sent to {initial_response.get('phoneNumber')}")
        otp_code = otp_callback()

        return self.login(email, password, otp_code)

    def _handle_error_response(
        self,
        status_code: int,
        data: dict
    ) -> AuthenticationError:
        message = data.get('message', 'Authentication failed')

        error_map = {
            401: ('INVALID_CREDENTIALS', False),
            403: ('ACCOUNT_LOCKED', False),
            422: ('VALIDATION_ERROR', False),
            429: ('RATE_LIMITED', True),
        }

        code, retryable = error_map.get(
            status_code,
            ('UNKNOWN_ERROR', status_code >= 500)
        )

        return AuthenticationError(message, code, status_code, retryable)

# Usage Example
def main():
    login_service = LoginService(
        'https://dev.api.baanx.com',
        'your-client-key'
    )

    try:
        response = login_service.login_with_otp_flow(
            'user@example.com',
            'SecurePassword123!',
            otp_callback=lambda: input('Enter OTP code: ')
        )

        # Check onboarding status
        if response.get('phase'):
            print(f"Complete onboarding phase: {response['phase']}")
            return

        # Check token
        if not response.get('accessToken'):
            raise Exception('No access token received')

        print('Login successful!')
        store_token(response['accessToken'])

    except AuthenticationError as error:
        handle_auth_error(error)
    except Exception as error:
        print(f'Unexpected error: {error}')

def handle_auth_error(error: AuthenticationError):
    if error.code == 'INVALID_CREDENTIALS':
        print('Invalid email or password')
        offer_password_reset()

    elif error.code == 'ACCOUNT_LOCKED':
        print('Account is locked. Please contact support.')
        show_support_link()

    elif error.code == 'RATE_LIMITED':
        print('Too many attempts. Please wait and try again.')

    elif error.code in ('TIMEOUT', 'CONNECTION_ERROR') and error.retryable:
        print('Connection issue. Please try again.')

    else:
        print(f'Login failed: {error.message}')

def store_token(token: str):
    print(f'Storing token: {token[:20]}...')

def offer_password_reset():
    print('Password reset link offered')

def show_support_link():
    print('Support contact: support@example.com')

if __name__ == '__main__':
    main()