- Reset TPIN: empty-body initiate -> OTP -> encrypted new TPIN via
/tpin/reset/*, from a Services tile, search, and "Forgot your TPIN?"
on the transfer's TPIN sheet (returns to the same transfer review)
- Handle every documented code: SESSION_INVALID signs out, TPIN_NOT_SET
offers Create TPIN, CBS customer/account/org refusals stop the flow,
outages retry from the start, expired or spent OTP/token restarts,
policy VALIDATION_ERROR stays on the new-TPIN step
- Secrets live in screen state only and are dropped as each step ends
- Countdowns use the envelope timestamp, kept aside by the interceptor,
so a wrong device clock cannot skew OTP or token expiry
- New TPINs refuse any three-digit run (1235, 5987), for create too
- Dev API logger redacts the session token, OTPs, PINs, encrypted
payloads and one-time tokens
- Tests: request bodies, RSA-OAEP SHA-256 payload decrypted with Node,
fresh nonce on key retry, server-clock deadlines, log redaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
