Abin ToppoandClaude Opus 5.5
f1def81eb7
- Create TPIN: current MPIN -> OTP -> encrypted TPIN via /tpin/create/*, from Services and from the transfer screen on TPIN_NOT_SET - IMPS initiate now sends encryptedTpin instead of encryptedMpin; handles INVALID_TPIN and TPIN_NOT_SET - Share one RSA-OAEP encryption and key-retry path for MPIN and TPIN - Forgot MPIN on sign-in and Reset MPIN in the Security Center - Fund transfer history list and detail, reachable from Home - Brand logo on sign-in and palette updates Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
47 lines
2.2 KiB
TypeScript
47 lines
2.2 KiB
TypeScript
/**
|
|
* Host running the CBS backend. Swagger for it is at `/swagger-ui/index.html`.
|
|
*
|
|
* This has to be an address the *phone* can reach, which is not the same thing
|
|
* as one that works in a browser on the dev machine: a VM-only or
|
|
* different-subnet address resolves fine on the laptop and is simply invisible
|
|
* to the handset, and that failure reads like the app being broken. `localhost`
|
|
* is wrong for the same reason — on a device it means the device itself.
|
|
*
|
|
* This is a named host on an internal domain, not an IP, so it resolves only
|
|
* where the DNS that serves `.lincpay` is reachable — the office network or
|
|
* the VPN. A handset on mobile data, or on a guest network without that
|
|
* resolver, fails to resolve it at all and the app looks like the backend is
|
|
* down. Note there is no port here: this host answers on the default 80, unlike
|
|
* the `:8089` LAN addresses this build was aimed at before.
|
|
*
|
|
* Plain HTTP, so it depends on cleartext traffic being allowed for this host
|
|
* specifically. Both platforms gate that by host and neither tells the app why
|
|
* a blocked request failed, so a change here has to be checked against:
|
|
*
|
|
* - here,
|
|
* - `android/app/src/main/res/xml/network_security_config.xml`,
|
|
* - `NSExceptionDomains` in `ios/BankCBS/Info.plist` — a bare IP literal is
|
|
* already covered there by `NSAllowsLocalNetworking`, but a *named* host
|
|
* is not and needs its own entry.
|
|
*/
|
|
const API_ORIGIN = 'http://mobile-banking-backend.lincpay';
|
|
|
|
export const env = {
|
|
/** CBS backend origin. */
|
|
apiOrigin: API_ORIGIN,
|
|
/** Every documented endpoint lives under this prefix. */
|
|
apiBaseUrl: `${API_ORIGIN}/api/v1`,
|
|
/** Organisation the app is branded for; sent at registration and at sign-in. */
|
|
orgId: '107295',
|
|
/**
|
|
* Modules with no backend behind them yet — cards, loans, insurance, deposits,
|
|
* the dashboard and the agent app — still resolve from fixtures. Registration,
|
|
* sign-in, accounts/MMID and payees always call the live API regardless.
|
|
*/
|
|
useMockServer: true,
|
|
/** Server-enforced idle window; any authenticated call refreshes it. */
|
|
sessionTimeoutMs: 300_000,
|
|
/** How long before the idle cut-off the user is warned. */
|
|
sessionWarningMs: 60_000,
|
|
};
|