tap-to-pay part 1

2026-05-29 15:43:13 +05:00
parent 71e893faf8
commit 0f77216d2d
9 changed files with 813 additions and 5 deletions
@@ -82,6 +82,15 @@ data class BmlQrPayResult(
    val errorMessage: String = ""
 )

+data class BmlWalletToken(
+    val token: String,
+    val expiry: String,
+    val appCode: String,      // AID hex, e.g. "A0000000031010"
+    val serviceCode: String,
+    val data: String,
+    val validUntil: String    // "YYYY-MM-DD HH:mm:ss.SSS"
+)
+
 data class BmlForeignLimit(
    val type: String,
    val used: Double,
@@ -0,0 +1,79 @@
+package sh.sar.basedbank.api.bml
+
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONArray
+import org.json.JSONObject
+
+class BmlTapToPayClient {
+
+    private val client = newBmlApiClient()
+
+    /**
+     * Fetches up to [quantity] single-use payment tokens for [cardId].
+     * [otp] is a TOTP code generated from the stored BML OTP seed.
+     *
+     * Flow:
+     *   1. POST → code 99 (OTP required) or 0 (direct, unlikely)
+     *   2. POST with channel=token → code 22 (OTP generated on BML side, but we use TOTP)
+     *   3. POST with otp=TOTP → code 0, payload = token list
+     */
+    fun fetchTokens(
+        session: BmlSession,
+        cardId: String,
+        otp: String,
+        quantity: Int = 3
+    ): List<BmlWalletToken> {
+        val url = "$BML_BASE_URL/api/mobile/walletpayments/gettoken"
+
+        // Step 1: initiate
+        val base = JSONObject().apply {
+            put("type", "track2")
+            put("cardid", cardId)
+            put("quantity", quantity)
+        }
+        val step1 = post(session, url, base)
+        if (step1.optInt("code") == 0) return parseTokens(step1.optJSONArray("payload"))
+        if (step1.optInt("code") != 99) throw Exception(step1.optString("message", "Token request failed"))
+
+        // Step 2: request OTP channel (triggers BML to validate we can use TOTP)
+        val body2 = JSONObject(base.toString()).apply { put("channel", "token") }
+        val step2 = post(session, url, body2)
+        if (step2.optInt("code") != 22) throw Exception(step2.optString("message", "OTP channel request failed"))
+
+        // Step 3: submit TOTP
+        val body3 = JSONObject(body2.toString()).apply { put("otp", otp) }
+        val step3 = post(session, url, body3)
+        if (step3.optInt("code") != 0) throw Exception(step3.optString("message", "Token fetch failed"))
+
+        return parseTokens(step3.optJSONArray("payload"))
+    }
+
+    private fun post(session: BmlSession, url: String, body: JSONObject): JSONObject {
+        val req = okhttp3.Request.Builder()
+            .url(url)
+            .post(body.toString().toRequestBody("application/json".toMediaType()))
+            .header("Authorization", "Bearer ${session.accessToken}")
+            .header("User-Agent", BML_USER_AGENT)
+            .header("x-app-version", BML_APP_VERSION)
+            .build()
+        return client.newCall(req).execute().use { resp ->
+            JSONObject(resp.body?.string() ?: throw Exception("Empty response"))
+        }
+    }
+
+    private fun parseTokens(arr: JSONArray?): List<BmlWalletToken> {
+        arr ?: return emptyList()
+        return (0 until arr.length()).map { i ->
+            val o = arr.getJSONObject(i)
+            BmlWalletToken(
+                token       = o.getString("token"),
+                expiry      = o.getString("expiry"),
+                appCode     = o.getString("app_code"),
+                serviceCode = o.getString("service_code"),
+                data        = o.optString("data", ""),
+                validUntil  = o.optString("valid_until", "")
+            )
+        }
+    }
+}