forked from thijooree/android
238 lines
13 KiB
Markdown
238 lines
13 KiB
Markdown
# MIB API v1 to v2 Upgrade Tracking
|
||
|
||
This document tracks all MIB API calls used by thijooree and their upgrade status from v1 to v2.
|
||
|
||
---
|
||
|
||
## Summary
|
||
|
||
**Total API Endpoints:** 28+
|
||
**Categories:** 8
|
||
**Last Updated:** 2026-10-22
|
||
|
||
---
|
||
|
||
## API Endpoints by Category
|
||
|
||
### 1. Authentication & Login (Encrypted API)
|
||
|
||
| API Code | Endpoint | Purpose | Used By | Status |
|
||
|----------|----------|---------|---------|--------|
|
||
| `sfunc=r` + `S40` | Key Exchange (Init) | First-time device registration | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=i` + `S40` | Key Exchange (Login) | Regular login session setup | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `C41` | Registration Init | Initialize device registration flow | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `C42` | OTP Verification | Verify one-time password after registration | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `A41` | Main Login | Submit username/password credentials | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `A44` | Get User Salt | Retrieve user salt for password hashing | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `P47` | Switch Profile | Activate different user profile | `MibLoginFlow.kt` | ✅ |
|
||
| `sfunc=n` + `A80` | Accounts | Refresh account list/balances for active profile (same shape as P47 `accountBalance`) | — (not used yet) | ℹ️ |
|
||
| `sfunc=n` + `A83` | GIA Accounts | `{start:1,end:30,statusType:0,includeCount:0}` | — (not used) | ℹ️ |
|
||
| `sfunc=n` + `A47` | Pending approvals | `{status:"P",start:0,end:30,includeCount:1}` (business profiles) | — (not used) | ℹ️ |
|
||
| `sfunc=n` + `P41` | Profile image | `{imageHash}` → base64 JPEG in `profileImage` | — (not used yet) | ℹ️ |
|
||
| `sfunc=n` + `B46` | Beneficiary image | `{imageHash}` → base64 JPEG in `profileImage` | — (not used yet) | ℹ️ |
|
||
| `sfunc=i` + `P80` | Promo banners | Encrypted with **key1**, not session key | — (not used) | ℹ️ |
|
||
|
||
---
|
||
|
||
### 2. Beneficiary & Contact Management
|
||
|
||
v2 moved all contact calls to the encrypted API (`sfunc=n`). Bank IDs/names/SWIFT come from `B49` (login).
|
||
|
||
| v1 endpoint | v2 route | Request | Used By | Status |
|
||
|-------------|----------|---------|---------|--------|
|
||
| `/ajaxBeneficiary/getCategories` | `B41` | Categories come back in every `B41` response as `categories[]` — no separate call | `MibContactsClient.kt`, `HomeActivity.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxBeneficiary/main` | `B41` | `{start,end,benefType:"A",search:"",includeCount:1,searchCategoryId:0,sortBenef:""}` — selects 1-based `rnum` between start/end inclusive; last row has `last:"1"` | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxBeneficiary/createLocalBeneficiary` | `B43` | `{benefName,benefAccount,bankNo,nickName,transferCy,categoryId,image?,bankName,bankSwift}` — nickname > ~20 chars → `invalid nick name` | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | 🔧 implemented (BML captured; MIB-internal bankName/swift from B49, not captured) |
|
||
| — (new) | `B52` | Update: B43 fields + `benefNo`, `imageChanged:"0"/"1"`, `image` when changed | `MibContactsClient.kt`, `AddContactSheetFragment.kt` (edit mode), `ContactDetailsSheetFragment.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxBeneficiary/deleteBeneficiary` | `B48` | `{benefNo}` | `MibContactsClient.kt`, `ContactManager.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxBeneficiary/getProfileImage` | `B46` | `{imageHash}` → `profileImage` base64 JPEG | `MibContactsClient.kt` + image loaders | 🔧 implemented — needs device test |
|
||
| — | `B40` | Account name lookup `{search}` → `[{benefName,benefAccount,bankCode,benefBankName}]` | — (check against transfer lookups) | ℹ️ |
|
||
| — | `T63` | Currencies + rates | — (not used) | ℹ️ |
|
||
|
||
----------|---------|---------|--------|
|
||
| `/ajaxBeneficiary/getCategories` | Fetch beneficiary category list | `MibContactsClient.kt` | ☐ |
|
||
| `/ajaxBeneficiary/main` | List all contacts (paginated) | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | ☐ |
|
||
| `/ajaxBeneficiary/createLocalBeneficiary` | Add new beneficiary | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | ☐ |
|
||
| `/ajaxBeneficiary/deleteBeneficiary` | Remove beneficiary | `MibContactsClient.kt`, `ContactsFragment.kt` | ☐ |
|
||
| `/ajaxBeneficiary/getProfileImage` | Get contact profile picture | `MibContactsClient.kt` | ☐ |
|
||
|
||
---
|
||
|
||
### 3. Fund Transfers
|
||
|
||
v2 moved transfers and all destination lookups to the encrypted API (`sfunc=n`). Failures come back as HTTP 400 with an encrypted body.
|
||
|
||
| v1 endpoint | v2 route | Request / notes | Used By | Status |
|
||
|-------------|----------|-----------------|---------|--------|
|
||
| `/ajaxTransfer/transferInternal` | `T50` | `{benefName,benefNo:"0",fromAccountNo,benefAccountNo,transferCy,benefCurrencyCode,amount,bankNo:"2",purpose,otp,otpType:"3"}` → `data[0].{date,trxId,availableBalance}` + `accountBalance[]` | `MibTransferClient.kt`, `MibTransferHandler.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxTransfer/transferLocal` | `T51` | Same as T50 with `bankNo:"3"` → `data[0].{date,trxId}` ("Local transfer completed successfully via Favara") | `MibTransferClient.kt`, `MibTransferHandler.kt` | 🔧 implemented — needs device test |
|
||
| `/ajaxBeneficiary/getAccountName` | `B40` | `{search}` → `data[0].{benefName,benefAccount,bankCode,benefBankName,transferCy?,transferCyDesc?}`; `bankCode` is `"MIB"` or a BIC (`MADVMVMV`, `MALBMVMV`); empty `data` = not found | `MibTransferClient.kt` | 🔧 implemented — needs device test |
|
||
| `/AjaxAlias/getIPSAccount` | `B40` | as above | `MibTransferClient.kt` | 🔧 implemented — needs device test |
|
||
| `/AjaxAlias/getAlias` | `B40` | as above; phone must be bare 7 digits (`+960 …` returns empty); Favara ID needs uppercase `A` (`a239225` fails) | `MibTransferClient.kt` | 🔧 implemented — needs device test |
|
||
| — | `T71` / `T66` / `T63` / `T70` | AML limits / USD sell rate / currencies / upload settings | — (not used) | ℹ️ |
|
||
|
||
**Transfer errors seen:**
|
||
- `reasonCode 213` "Invalid OTP" (`data[0].otpId`) and `reasonCode 707` "That OTP is already used!" → thijooree waits for the next TOTP window and retries once, then shows the error.
|
||
- `reasonCode 201` "Transaction currency does not match From Account currency!"
|
||
|
||
----------|---------|---------|--------|
|
||
| `/ajaxTransfer/transferInternal` | MIB-to-MIB internal transfer (Bank code 2) | `MibTransferClient.kt`, `TransferFragment.kt` | ☐ |
|
||
| `/ajaxTransfer/transferLocal` | Transfer to BML account (Bank code 3) | `MibTransferClient.kt`, `TransferFragment.kt` | ☐ |
|
||
| `/ajaxBeneficiary/getAccountName` | Lookup MIB account (17-digit format) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |
|
||
| `/AjaxAlias/getIPSAccount` | Lookup IPS/BML account (15-digit format) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |
|
||
| `/AjaxAlias/getAlias` | Lookup Favara alias (shortcodes, IDs, email) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |
|
||
|
||
---
|
||
|
||
### 4. Debit Card Operations
|
||
|
||
| Endpoint | Purpose | Used By | Status |
|
||
|----------|---------|---------|--------|
|
||
| `/ajaxDebitCard/fetchCardInfos` | Retrieve list of debit cards | `MibCardsClient.kt`, `PayWithCardFragment.kt` | ✅ host switched, tested |
|
||
| `/ajaxDebitCard/freeze` | Freeze/block debit card | `MibCardsClient.kt` | ✅ host switched, tested |
|
||
| `/ajaxDebitCard/unfreeze` | Unfreeze/unblock debit card | `MibCardsClient.kt` | ✅ host switched, tested |
|
||
|
||
---
|
||
|
||
### 5. Transaction History
|
||
|
||
| Endpoint | Purpose | Used By | Status |
|
||
|----------|---------|---------|--------|
|
||
| ~~`/ajaxAccounts/trxHistory`~~ → `sfunc=n` + `A84` | Fetch account transaction history (paginated). v2 moved this to the encrypted API: `{accountNo,start:0,end:19,includeCount:true,trxType:0,sortTrx:"date",sortDir:"desc"}` (0-based inclusive), response fields unchanged, `total_count` present | `MibHistoryClient.kt`, `HistoryFetcher.kt`, `TransferHistoryFragment.kt` | ✅ implemented, tested incl. paging |
|
||
|
||
---
|
||
|
||
### 6. Activity & Audit Logs
|
||
|
||
| Endpoint | Purpose | Used By | Status |
|
||
|----------|---------|---------|--------|
|
||
| `/aProfile/getPagedActivityHistory` | Fetch activity alerts and audit logs (paginated) | `MibActivityHistoryClient.kt` | ☐ |
|
||
|
||
---
|
||
|
||
### 7. User Profile
|
||
|
||
| v1 endpoint | v2 source | Notes | Used By | Status |
|
||
|-------------|-----------|-------|---------|--------|
|
||
| `GET /personalProfile` (HTML scrape) | `A41` login response | `fullName`, `email` | `MibLoginFlow.kt` | 🔧 implemented — needs device test |
|
||
| — | `POST /ajaxAlias/getAliasTypes` (`-wv-v2`, empty body) | `data[].{id,aliasTypeName,suggestedAlias}`: `0` mobile, `1` email, `3` National ID. Tied to the active profile, so the personal profile (`profileType 0`) is selected first. Fetched at login and cached. | `MibProfileClient.kt`, `SettingsLoginsFragment.kt` | 🔧 implemented — needs device test |
|
||
| — | `POST /ajaxAlias/main` | Registered Favara aliases (`AlsBfy`, `CdtrAcct`, `AdrLine`, …) | — (not used) | ℹ️ |
|
||
|
||
----------|---------|---------|--------|
|
||
| `GET /personalProfile` | HTML scrape: fullName, username, email, mobile, enrolled date | `MibProfileClient.kt` | ☐ |
|
||
|
||
---
|
||
|
||
### 8. Financing & Loans
|
||
|
||
| Endpoint | Purpose | Used By | Status |
|
||
|----------|---------|---------|--------|
|
||
| `GET /financing?dashurl=1` | Fetch financing/loan deals (HTML parsing) | `MibFinancingClient.kt` | ✅ works on `-wv-v2` |
|
||
|
||
---
|
||
|
||
### 9. Session Management
|
||
|
||
| Endpoint | Purpose | Used By | Status |
|
||
|----------|---------|---------|--------|
|
||
| `POST /aProfile/keepAlive` | Periodic session keep-alive (empty body) | `HomeActivity.kt` | 🔧 host switched (seen on `-wv-v2` in HAR, 419 after expiry) — needs device test |
|
||
|
||
---
|
||
|
||
## Implementation Files Reference
|
||
|
||
### Core MIB API Clients
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibLoginFlow.kt` - Authentication
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibTransferClient.kt` - Transfers & account lookup
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibContactsClient.kt` - Contacts/beneficiaries
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibCardsClient.kt` - Card operations
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibHistoryClient.kt` - Transaction history
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibActivityHistoryClient.kt` - Activity logs
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibProfileClient.kt` - User profile
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibFinancingClient.kt` - Financing
|
||
|
||
### Security & Utilities
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibCrypto.kt` - AES encryption/decryption
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibNonce.kt` - Nonce generation (anti-replay)
|
||
- `app/src/main/java/sh/sar/basedbank/api/mib/MibModels.kt` - Data models
|
||
- `app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt` - Credential storage
|
||
|
||
### Parsers & Handlers
|
||
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibHistoryParser.kt`
|
||
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibAccountParser.kt`
|
||
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibContactParser.kt`
|
||
- `app/src/main/java/sh/sar/basedbank/ui/home/transfer/MibTransferHandler.kt`
|
||
|
||
---
|
||
|
||
## Base URLs
|
||
|
||
| Type | URL |
|
||
|------|-----|
|
||
| **Encrypted API** | `https://faisamobilex-smvc-v2.mib.com.mv/index/` |
|
||
| **WebView/Data** | `https://faisamobilex-wv-v2.mib.com.mv` (v1: `faisamobilex-wv`) |
|
||
|
||
---
|
||
|
||
## Authentication & Security
|
||
|
||
### Session Headers
|
||
```
|
||
Cookie: mbmodel=AND-1.0; xxid=<session_id>; IBSID=<session_id>; mbnonce=<nonce>; time-tracker=597
|
||
X-Requested-With: XMLHttpRequest
|
||
Accept: */*
|
||
Origin: https://faisamobilex-wv-v2.mib.com.mv
|
||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||
```
|
||
|
||
### Session Expiry Detection
|
||
- HTTP `419` status code
|
||
- JSON `reasonCode == "505"` in encrypted response
|
||
- Auto-recovery: re-login and retry (once)
|
||
|
||
### Password Hashing (PGF03)
|
||
```
|
||
pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))
|
||
```
|
||
|
||
---
|
||
|
||
## Upgrade Checklist
|
||
|
||
### Core Implementation
|
||
- [x] Update encrypted API endpoint URL
|
||
- [x] Update User-Agent header
|
||
- [x] Add X-Request-ID header
|
||
- [x] Verify Blowfish encryption compatibility
|
||
- [x] Test device registration flow
|
||
- [x] Test regular login flow
|
||
- [x] Test OTP verification
|
||
- [x] Test profile switching
|
||
|
||
### WebView Endpoints (Pending)
|
||
- [x] Switch all WebView clients to `faisamobilex-wv-v2` host and `mbmodel=AND-1.0` cookie
|
||
- [x] Capture beneficiary management — moved to encrypted `B4x`/`B52`, implemented
|
||
- [ ] Test contacts on device (list, add with/without photo, edit, delete, images)
|
||
- [x] Capture transfer endpoints — moved to encrypted `T50`/`T51`/`B40`, implemented with OTP retry
|
||
- [ ] Test transfers on device (MIB→MIB, MIB→BML, lookups incl. Favara alias)
|
||
- [x] Capture debit card endpoints (`/ajaxDebitCard/*`) — unchanged apart from host
|
||
- [x] Test debit card endpoints on device
|
||
- [x] Capture transaction history — moved to encrypted `A84`, implemented
|
||
- [x] Test transaction history on device (incl. page 2)
|
||
- [ ] Test activity history (`/aProfile/getPagedActivityHistory`)
|
||
- [x] Capture user profile — `/personalProfile` scrape replaced by A41 + `getAliasTypes`
|
||
- [ ] Test login details (name, email, mobile, ID card) on device
|
||
- [x] Test financing (`/financing?dashurl=1`) — works on `-wv-v2`
|
||
- [ ] Test session keep-alive (`/aProfile/keepAlive`)
|
||
|
||
### Validation
|
||
- [ ] Verify all account balances display correctly
|
||
- [ ] Verify error handling (419, 505) and auto-recovery
|
||
- [ ] Verify all data formats match expectations
|
||
- [ ] Full end-to-end user flow test
|
||
|
||
---
|
||
|
||
**Implementation:** 2026-10-22 ✅
|
||
**WebView Testing:** In progress
|