azuwlaa/android
1
0
Fork 0
forked from thijooree/android
Code Pull Requests Activity

update docs

Browse Source
This commit is contained in:
shihaam
2026-06-13 21:30:12 +05:00
parent 281864347e
commit a8cd22cbe1
51 changed files with 1830 additions and 469 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/thijooree/03-login.md
+26 -21
View File
@@ -30,40 +30,45 @@ Tapping a card navigates to `CredentialsFragment` with the selected bank pre-set
## Credentials — `CredentialsFragment`
### Shared Fields
For MIB and BML the form also includes an **OTP seed** field. The user can:
- Paste the raw base32 / `otpauth://` seed directly into `etOtpSeed`
- Tap the QR scan button (`btnScanOtpSeed`) to launch the [QR scanner](25-qr-scanner.md); the result is parsed by `util/OtpauthParser` and written to `etOtpSeed`. If the QR contains multiple entries the user picks one via a dialog (`CredentialsFragment.kt:67-84`).
A live TOTP preview card under the field updates every second so the user can confirm the seed is correct before submitting. The seed is required for MIB and BML login button activation (`updateLoginButtonState()`).
### MIB Login
Fields:
- Username
- Password
Fields: Username, Password, OTP seed.
Flow on submit:
1. `MibLoginFlow.login()` — performs Diffie-Hellman key exchange, then authenticates with Blowfish/ECB-encrypted credentials
2. On success, fetches `operatingProfiles` — the list of CIF profiles (Individual, Sole Propr, etc.)
3. Each profile is stored as a `MibAccount` with `bank = "MIB"` and `cifType` from the API
4. Sessions are stored in `BasedBankApp.mibSessions`
1. `MibLoginFlow.login(username, passwordHash, otpSeed)` — Diffie-Hellman key exchange, then Blowfish/ECB-encrypted credentials
2. On success, fetches `operatingProfiles` — the list of CIF profiles
3. Each profile is stored as a `BankAccount` with `bank = "MIB"` and `cifType` from the API
4. `MibProfileClient().fetchPersonalProfile(session)` is called post-login to retrieve and persist the full account-holder name (used by the OTP screen and elsewhere)
5. Sessions are stored in `BasedBankApp.mibSessions`
### BML Login
Fields:
- Username (customer ID)
- Password
Fields: Username (customer ID), Password, OTP seed.
Flow on submit:
1. `BmlLoginFlow.login()` — OAuth password grant → access token + refresh token
2. Fetches dashboard → list of CASA accounts + cards
3. Each account/card stored as `MibAccount` with `bank = "BML"`
4. Tokens stored in `BasedBankApp.bmlSessions`
Flow on submit (`CredentialsFragment.kt:272-326`):
1. `BmlLoginFlow.login(username, password, otpSeed)` — returns a list of `BmlProfile`
2. For each non-business profile, `flow.activateProfile(profile, loginTag)` runs; `BmlActivationResult.Success` populates `bmlAccounts` and stores a per-profile session
3. Business profiles are skipped at login (user can enable them later via [Settings → Logins](14-settings.md#bml-business-profile-activation); that path returns `BmlActivationResult.NeedsBusinessOtp` and runs the OTP-channel flow)
4. Credentials saved via `store.saveBmlCredentials(loginId, username, password, otpSeed)`
5. Tokens stored per profile in `BasedBankApp.bmlSessions`
### Fahipay Login
Fields:
- Mobile number (7-digit local, auto-prefixed with +960)
- Password
Fields: Mobile / ID-card, Password. Two-step TOTP — after the password is accepted the same screen re-uses itself to collect the TOTP, with `fahipayAwaitingTotp = true` (`CredentialsFragment.kt:60`) controlling the UI state.
Flow on submit:
1. `FahipayLoginFlow.login()` — authenticates against Fahipay API
2. On success, stores `authID` + `__Secure-sess` cookie
3. Single wallet account stored with `bank = "FAHIPAY"`
2. Server responds with a TOTP challenge; user enters the code
3. On success, stores `authID` + `__Secure-sess` cookie
4. Single wallet account stored with `bank = "FAHIPAY"`
---
@@ -71,7 +76,7 @@ Flow on submit:
Each MIB login can have multiple CIF profiles (e.g., an individual and a business account under the same username). Each profile appears as a separate entry in the accounts list and can be toggled independently in Settings → Logins.
BML and Fahipay each yield a single profile per login.
BML can yield multiple profiles per login (personal + business). Fahipay yields a single profile.
Adding the same bank login a second time merges its profiles into the existing login rather than creating a duplicate.