Authenticate User

curl -X POST "https://dev.api.baanx.com/v1/auth/login" \
  -H "x-client-key: your-client-key" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "SecurePassword123!"
  }'

async function loginWithOTP(email, password) {
  // Step 1: Initial login attempt
  let response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
    method: 'POST',
    headers: {
      'x-client-key': 'your-client-key',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({ email, password })
  });

  let data = await response.json();

  // Step 2: If OTP required, send OTP and retry
  if (data.isOtpRequired) {
    const userId = data.userId;

    // Send OTP code to user's phone
    await fetch('https://dev.api.baanx.com/v1/auth/login/otp', {
      method: 'POST',
      headers: {
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ userId })
    });

    // Get OTP code from user (show input form)
    const otpCode = await promptUserForOTP();

    // Retry login with OTP code
    response = await fetch('https://dev.api.baanx.com/v1/auth/login', {
      method: 'POST',
      headers: {
        'x-client-key': 'your-client-key',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ email, password, otpCode })
    });

    data = await response.json();
  }

  return data;
}

import { z } from 'zod';

const LoginResponseSchema = z.object({
  accessToken: z.string().nullable(),
  userId: z.string().uuid(),
  isOtpRequired: z.boolean(),
  phoneNumber: z.string().nullable(),
  phase: z.string().nullable(),
  verificationState: z.string().nullable(),
  isLinked: z.boolean()
});

type LoginResponse = z.infer<typeof LoginResponseSchema>;

class AuthenticationError extends Error {
  constructor(
    message: string,
    public code: string,
    public statusCode: number,
    public retryable: boolean = false
  ) {
    super(message);
    this.name = 'AuthenticationError';
  }
}

class LoginService {
  private readonly apiBase: string;
  private readonly clientKey: string;
  private readonly maxRetries = 3;
  private readonly timeoutMs = 30000;

  constructor(apiBase: string, clientKey: string) {
    this.apiBase = apiBase;
    this.clientKey = clientKey;
  }

  async login(
    email: string,
    password: string,
    otpCode?: string
  ): Promise<LoginResponse> {
    const body = { email, password, ...(otpCode && { otpCode }) };

    try {
      const response = await this.fetchWithTimeout(
        `${this.apiBase}/v1/auth/login`,
        {
          method: 'POST',
          headers: {
            'x-client-key': this.clientKey,
            'Content-Type': 'application/json'
          },
          body: JSON.stringify(body)
        }
      );

      const data = await response.json();

      if (!response.ok) {
        throw this.handleErrorResponse(response.status, data);
      }

      return LoginResponseSchema.parse(data);

    } catch (error) {
      if (error instanceof AuthenticationError) {
        throw error;
      }

      throw new AuthenticationError(
        'Network error during login',
        'NETWORK_ERROR',
        0,
        true
      );
    }
  }

  async sendOtp(userId: string): Promise<void> {
    const response = await this.fetchWithTimeout(
      `${this.apiBase}/v1/auth/login/otp`,
      {
        method: 'POST',
        headers: {
          'x-client-key': this.clientKey,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ userId })
      }
    );

    if (!response.ok) {
      const data = await response.json();
      throw this.handleErrorResponse(response.status, data);
    }
  }

  async loginWithOtpFlow(
    email: string,
    password: string,
    otpCallback: () => Promise<string>
  ): Promise<LoginResponse> {
    const initialResponse = await this.login(email, password);

    if (!initialResponse.isOtpRequired) {
      return initialResponse;
    }

    await this.sendOtp(initialResponse.userId);

    const otpCode = await otpCallback();

    return await this.login(email, password, otpCode);
  }

  private async fetchWithTimeout(
    url: string,
    options: RequestInit
  ): Promise<Response> {
    const controller = new AbortController();
    const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);

    try {
      const response = await fetch(url, {
        ...options,
        signal: controller.signal
      });
      return response;
    } finally {
      clearTimeout(timeoutId);
    }
  }

  private handleErrorResponse(
    status: number,
    data: any
  ): AuthenticationError {
    switch (status) {
      case 401:
        return new AuthenticationError(
          'Invalid credentials',
          'INVALID_CREDENTIALS',
          401,
          false
        );

      case 403:
        return new AuthenticationError(
          data.message || 'Account locked',
          'ACCOUNT_LOCKED',
          403,
          false
        );

      case 422:
        return new AuthenticationError(
          data.message || 'Validation error',
          'VALIDATION_ERROR',
          422,
          false
        );

      case 429:
        return new AuthenticationError(
          'Too many attempts',
          'RATE_LIMITED',
          429,
          true
        );

      default:
        return new AuthenticationError(
          data.message || 'Authentication failed',
          'UNKNOWN_ERROR',
          status,
          status >= 500
        );
    }
  }
}

// Usage Example
const loginService = new LoginService(
  'https://dev.api.baanx.com',
  'your-client-key'
);

async function handleLogin(email: string, password: string) {
  try {
    const response = await loginService.loginWithOtpFlow(
      email,
      password,
      async () => {
        return await promptUserForOtp();
      }
    );

    if (response.phase !== null) {
      console.log('User needs to complete onboarding:', response.phase);
      redirectToOnboarding(response.phase);
      return;
    }

    if (!response.accessToken) {
      throw new Error('No access token received');
    }

    console.log('Login successful');
    storeToken(response.accessToken);
    redirectToApp();

  } catch (error) {
    if (error instanceof AuthenticationError) {
      handleAuthError(error);
    } else {
      console.error('Unexpected error:', error);
    }
  }
}

function handleAuthError(error: AuthenticationError) {
  switch (error.code) {
    case 'INVALID_CREDENTIALS':
      showError('Invalid email or password');
      offerPasswordReset();
      break;

    case 'ACCOUNT_LOCKED':
      showError('Account is locked. Please contact support.');
      showSupportLink();
      break;

    case 'RATE_LIMITED':
      showError('Too many attempts. Please wait and try again.');
      break;

    case 'NETWORK_ERROR':
      if (error.retryable) {
        showError('Connection issue. Retrying...');
        retryLogin();
      }
      break;

    default:
      showError('Login failed. Please try again.');
  }
}

function promptUserForOtp(): Promise<string> {
  return new Promise((resolve) => {
    // Show OTP input modal
    const modal = showOtpModal();
    modal.onSubmit((code: string) => resolve(code));
  });
}

function storeToken(token: string) {
  sessionStorage.setItem('accessToken', token);
  sessionStorage.setItem('tokenIssuedAt', Date.now().toString());
}

function redirectToOnboarding(phase: string) {
  window.location.href = `/onboarding/${phase.toLowerCase()}`;
}

function redirectToApp() {
  window.location.href = '/dashboard';
}

function showError(message: string) {
  console.error(message);
}

function offerPasswordReset() {
  console.log('Showing password reset link');
}

function showSupportLink() {
  console.log('Showing support contact information');
}

function retryLogin() {
  console.log('Retrying login...');
}

function showOtpModal() {
  return {
    onSubmit: (callback: (code: string) => void) => {
      setTimeout(() => callback('123456'), 1000);
    }
  };
}