{"_id":"@beedgtl/mobile-id","_rev":"1-25ef75aea0ba7967c74082012f19ea4b","name":"@beedgtl/mobile-id","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@beedgtl/mobile-id","version":"1.0.0","description":"Mobile ID Web SDK for B2B clients. This SDK allows to use authentication with a Mobile ID in DI mode.","author":{"name":"Beeline Digital, PJSC VimpelCom"},"license":"MIT","main":"dist/index.js","module":"dist/index.js","types":"dist/index.d.ts","type":"module","sideEffects":false,"engines":{"yarn":">=1.21.0","node":">=14.5.0"},"keywords":["beeline","vimpelcom","mobileid","mobile-id","beeline-mobileid","beeline-mobile-id"],"scripts":{"server":"nodemon dev/backend/index.js","start":"rimraf www/bundle && node scripts/dev.js -w","build":"rimraf dist && node scripts/build.js","prepack":"yarn build"},"dependencies":{"classnames":"^2.3.1"},"devDependencies":{"cors":"^2.8.5","create-serve":"^1.0.1","css-tree":"^2.0.1","csstype":"^3.0.10","esbuild":"^0.13.15","esbuild-css-modules-plugin":"^2.0.9","esbuild-plugin-svg":"^0.1.0","eslint":"^8.4.0","eslint-config-airbnb-base":"^15.0.0","eslint-plugin-import":"^2.25.3","express":"^4.17.1","nodemon":"^2.0.15","rimraf":"^3.0.2","typescript":"^4.5.2"},"gitHead":"3ef97b666b64bf09f3bd620ab5909e0035edda88","_id":"@beedgtl/mobile-id@1.0.0","_nodeVersion":"16.13.1","_npmVersion":"8.1.2","dist":{"integrity":"sha512-2U2C32yAuaNFEDIHMngfIhvjWe60Xopb2IgO5qIlrt5lGf8YH6+rXv5rTVCCmKCbNoDLVMDyc4MDfWZP2tI84w==","shasum":"ef3769a5b7c1f8f518ecfbef88a3aa23041aa28f","tarball":"https://registry.npmjs.org/@beedgtl/mobile-id/-/mobile-id-1.0.0.tgz","fileCount":7,"unpackedSize":40640,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJhvJkYCRA9TVsSAnZWagAAQwYP/iEGZyZhWTfhHeqq0wVs\nVGaw5cz6Wgi+ZfTM4laV8cJ4JzDQnNO871QSW2DN4EbqBbzSTQIuWID0nKOG\njFxz/DgDKXSOJPRPSXt9sltNQHEK/f2eTP4MF4w3eMccn2ckOgCQFntAapD1\n5mhWtXSskvZsdTE06jWwuMcWN4P0NLOU/mm3AoF9C2natwz4L1+UbQFZlc6F\noPVMoGxlzMTmLbTdBe+RKdpWCsekGuyrZJcO5NPj4tnNh8AlJ3TeRL4SwFM0\nU+jW+EKfD3MZ10GkNsHNiqm/BuNO5BvDubuB0FvzuK42PT+W7SB4X4tOCrAg\nFO0wJ2/HaeXBKEKBRgJN09FEiuo9UMRV/YIlcn463FwFld40f0bC79XzuITQ\nF7mKKSDKSVd9GyqP4RBlgPx198AqOKDkX7xV+4SYZzJI4QTKZMtHWmb3ASdP\nrB5VgTWrQz9oATBQXsZ11Aq0nn5/cAB+b/i1Ahca6PboAh1i4s6d+LyIw1OP\n5fZJNnrHu7gG3LjaEgI1dEv2pQfF0zkULXYZv6jKbevWVBdzXHZ0HaoLejFF\nuogmTwVb1bhBfORx6W1RIj+cb+qeIlqpqCxz3v1yIN48K4KPqnCv9xzPZDFj\nLC46QfCf+wQ2kyEL1y+LCEcreXwVi4TigoieNckSajhZqHMZ0cwCOK/4wmam\nzEIj\r\n=RaDL\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIHS8oqLphLfsUTD2NFP6f17H47kGxOJxL6FRG7cweLTtAiEA74e/ABobfiWhgXA6ObwbHEYcKxrSvGXpbHew1VWHB6w="}]},"_npmUser":{"name":"bee.divergent044","email":"PaVZakharov@beeline.ru"},"directories":{},"maintainers":[{"name":"bee.divergent044","email":"PaVZakharov@beeline.ru"},{"name":"imalyugin","email":"IMalyugin@beeline.ru"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/mobile-id_1.0.0_1639749912099_0.4808507753983151"},"_hasShrinkwrap":false}},"time":{"created":"2021-12-17T14:05:12.031Z","1.0.0":"2021-12-17T14:05:12.288Z","modified":"2022-04-04T18:09:48.641Z"},"maintainers":[{"name":"bee.divergent044","email":"PaVZakharov@beeline.ru"},{"name":"imalyugin","email":"IMalyugin@beeline.ru"}],"description":"Mobile ID Web SDK for B2B clients. This SDK allows to use authentication with a Mobile ID in DI mode.","keywords":["beeline","vimpelcom","mobileid","mobile-id","beeline-mobileid","beeline-mobile-id"],"author":{"name":"Beeline Digital, PJSC VimpelCom"},"license":"MIT","readme":"
\n \n \n

Beeline Mobile ID Web SDK

\n
\n\n![npm license](https://img.shields.io/npm/l/@beedgtl/mobile-id.svg?style=flat-square)\n![npm version](https://img.shields.io/npm/v/@beedgtl/mobile-id.svg?style=flat-square)\n[![install size](https://packagephobia.com/badge?p=@beedgtl/mobile-id)](https://packagephobia.com/result?p=@beedgtl/mobile-id)\n![npm downloads](https://img.shields.io/npm/dm/@beedgtl/mobile-id.svg?style=flat-square)\n\nBeeline Mobile ID Web SDK is a javascript package that allows web developers to easily integrate their web applications with the Mobile ID service. This module will allow you to add the authentication and enable the end user's personal data autofill functionality in your website.\n\n## Concept\nGeneral service interaction scenario:\n1. The User enters your website and chooses authorization over Mobile ID.\n2. The user is redirected to the Operator's page.\n3. The Operator sends a PUSH message to the user's device with a request to confirm\n authentication on your resource. If the User's device cannot receive a PUSH, an SMS-message will be sent, containing an authentication confirmation link.\n4. The user clicks \"Accept\" or \"OK\" (depending on the carrier) on the mobile\n phone.\n5. The user is redirected to your `redirect_uri` and request completion of the authentication process is sent.\n6. If user authentication was successful and \"Form auto-completion\" is provided by your price plan, a request for the user's personal data is sent by the SDK and fulfilled by the Operator.\n\n## Contact Us\nDo you need help? Contact Support: mobileid_support@beeline.ru\n\n## Browser Support\nBrowsers supporting the ECMAScript 2015 (ES6) standard\n\n| ![Chrome](https://raw.github.com/alrra/browser-logos/main/src/chrome/chrome_48x48.png) | ![Safari](https://raw.github.com/alrra/browser-logos/main/src/safari/safari_48x48.png) | ![Firefox](https://raw.github.com/alrra/browser-logos/main/src/firefox/firefox_48x48.png) | ![Opera](https://raw.github.com/alrra/browser-logos/main/src/opera/opera_48x48.png) | ![Samsung Internet](https://raw.github.com/alrra/browser-logos/main/src/samsung-internet/samsung-internet_48x48.png) | ![Edge](https://raw.github.com/alrra/browser-logos/main/src/edge/edge_48x48.png) | ![IE](https://raw.github.com/alrra/browser-logos/main/src/archive/internet-explorer_9-11/internet-explorer_9-11_48x48.png) |\n|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------:|\n| Latest ✔ | Latest ✔ | Latest ✔ | Latest ✔ | Latest ✔ | Latest ✔ | 11 ✗ Not supported |\n\n## Get Started\n### Registration\nTo start working with the service, you need to:\n\n1. Go through the registration process on the website https://mobileid.beeline.ru. You\n can register through your *Personal Account*, or fill out a questionnaire together\n with our manager:\n\n a. Decide on the connection method \n b. Choose a tariff:\n + **Sign In only**\n + **Autofill / base**\n + **Autofill / base and address**\n + **Autofill / full**\n\n c. Provide server-side implementation for a scheme with operator screens — **HTTPS Redirect URL** and **HTTPS JWKS URL** (for request personal data).\n\n2. Create an entry for a digital resource. As a result, you will get `client_id` and\n `client_secret`, `client_name` values (field of the form – *Application Name*), that will\n be attached to request from the Mobile ID platform to the operator that serves\n the subscriber's phone number.\n\n### Installation\nInstall a stable version via Yarn or npm:\n```sh\nyarn add @beedgtl/mobile-id\n# or\nnpm i @beedgtl/mobile-id\n```\n\n### Usage\n```js\n// add the module to your code\nimport { MobileIDClient } from '@beedgtl/mobile-id';\n```\nInitialize client with appropriate configuration:\n```js\nconst mobileIDClient = new MobileIDClient({\n credentials: {\n id: 'your_client_id',\n name: 'your_client_name',\n key: 'your_encoded_access_key',\n },\n redirectUrl: 'https://your-app.domain.ru/',\n scope: ['mc_authn'],\n acrValues: 3,\n onError: (error) => { /* Body of the error handler function */ },\n onSuccess: (tokenInfo, premiumInfo) => { /* Body of the success result handler function */ },\n});\n```\nNext, create button component and insert it in your DOM:\n```js\nimport { Text } from '@beedgtl/mobile-id';\n\nconst button = mobileIDClient.createButton('violet', 'xl', { text: Text.PRIMARY });\ndocument.querySelector('#root').appendChild(button);\n```\n\n### Important\n> ⚠️ If `redirectUrl` - your website redirect url, specified (as **redirect_uri**) during service provider account registration - **doesn't match** your login page url, you need to initialize MobileIDClient **again**.\n❗**The SDK configuration must be identical in both calls**\n\nFirst, initialize `MobileIDClient` on the login page.\n\n##### configuration.js\n```js\nexport const MOBID_CONF = {\n credentials: {\n id: 'your_client_id',\n name: 'your_client_name',\n key: 'your_encoded_access_key',\n },\n redirectUrl: 'https://your-app.domain.ru/root/profile',\n scope: ['mc_authn'],\n acrValues: 3,\n premium: true,\n onError: () => { /* Some fn */ },\n onSuccess: () => { /* Some fn */ }, \n};\n```\n##### login-page.js\n```js\nimport { MobileIDClient, Text } from '@beedgtl/mobile-id';\nimport { MOBID_CONF } from './configuration.js';\n\n// Login page route \n// For example, https://your-app.domain.ru/login\n\nconst mobileIDClient = new MobileIDClient(MOBID_CONF);\nconst button = mobileIDClient.createButton('bright', 'm', { text: Text.DEFAULT });\ndocument.querySelector('#root').appendChild(button);\n\nmobileIDClient.setMsisdn(someMsisdn);\n```\n\nSecond, initialize `MobileIDClient` on the redirectUrl route page\n\n##### profile-page.js\n```js\nimport { MobileIDClient } from '@beedgtl/mobile-id';\nimport { MOBID_CONF } from './configuration.js';\n\n// After login page route \n// For example, https://your-app.domain.ru/root/profile\n\nconst mobileIDClient = new MobileIDClient(MOBID_CONF);\n\n/* No need to create button yet */\n/* If authentication fails, an onError callback will be invoked */\n```\nIf `premium` option is `true` and authentication process completes successfully, but personal data request fails, then `onSuccess` and `onError` callbacks will be invoked together. At that `onSuccess` will be invoked with only one argument `MCToken` and `onError` will be invoked with `Error.method` set to `personalData`.\n\n### Result data\nAn example js object `tokenInfo` (passed as first argument of `onSuccess` callback):\n\n```js\n{\n accessToken: \"eyJhbGciOiJSUzI1NiIsImtpZCI6InM0aWo5Q1pwOVJNcGpwTFFISGlRSVJLcU9MSDEyZEFFNndGL1kyRloxNlU9IiwidHlwIjoiSldUIn0.eyJzdWIiOiJjYWIxMWJmZS1hMGJiLTQzZmUtYjVhNi1mNDUyODNiNDFjMTciLCJpYXQiOjE2MzcwNjIyMTEsImV4cCI6MTYzNzA2MjgxMSwianRpIjoiODFlOGI1MjItZDkwZS00MzMwLTg3NGYtZDUxMjcwZjdlZWFhIiwiYXpwIjoidmFzLXRlc3QiLCJhdWQiOiIiLCJpc3MiOiJodHRwczovL2FnZ3Jtb2JpbGVpZC5iZWVsaW5lLnJ1IiwibmJmIjoxNjM3MDYyMjExfQ.Bse3IH5Tvgdw1QcyYvNbt4iVWIU1mxw5Qmb0gvuX43INJIIVMc_WauCyw41t4mftAsvLn6pEHqGSge6OT3BraYbK_ZO0kgGbmLmdan_FTUTHZBzEVUO3JGJHs5jk9MzZQZUQPyupj9VcXXNrw9102e6EzCpZqe9_CQ2W-RWaAgWnwVZk1pYZi-rYeDxgoZEaMPpkx7u8qal2x6fNPBW68jNjg-cvlaPsZIy-ZD3otiOi0Fpq-HM0fofEa8Z4tDDapv3FPA5ahTB7CEU9Z6iwQ5qpeJSWv0SOYFvdCuOy7PBWVc-X7EuhaM_v4wtWnudmIEsKzg-o0fsGMIsTP5XkFA\",\n expiresIn: 599,\n scope: 'openid mc_identity_basic mc_authn', \n idToken: \"eyJhbGciOiJSUzI1NiIsImtpZCI6InM0aWo5Q1pwOVJNcGpwTFFISGlRSVJLcU9MSDEyZEFFNndGL1kyRloxNlU9IiwidHlwIjoiSldUIn0.eyJhdF9oYXNoIjoiZlQtX2gwcGFkWEtwSmxMVV90ckdlZyIsInN1YiI6ImNhYjExYmZlLWEwYmItNDNmZS1iNWE2LWY0NTI4M2I0MWMxNyIsImFtciI6IlNJTV9PSyIsImtpZCI6InNpZ0tleSIsImlzcyI6Imh0dHBzOi8vYWdncm1vYmlsZWlkLmJlZWxpbmUucnUiLCJhdWQiOiJ2YXMtdGVzdCIsImFjciI6MiwiYXpwIjoidmFzLXRlc3QiLCJhdXRoX3RpbWUiOjE2MzcwNjIyMTEsInJlY2lwaWVudCI6Imh0dHBzOi8vYWdncm1vYmlsZWlkLmJlZWxpbmUucnUvbm90aWZpY2F0aW9uIiwiaWF0IjoxNjM3MDYyMjExLCJleHAiOjE2MzcwNjI4MTEsImp0aSI6IjgzYjQ3Y2QyLTAwYjMtNGQxNS05MjA1LTgwODM2ZWJlZjYxNSIsIm5iZiI6MTYzNzA2MjIxMX0.UMMcw-QsEJw22VDHASJ7Vr0W4_u1jeFbTuK5auaIbW6qGaPlQI-FXJLFkM7KrDTtr1qD4CP1f9BLNy4xQ_Pzzlfqwpcq6sMfRB84kEVoVDujhDUEngbSDFvuvjsJGAJf3buWC-7I1q5_B_6XRiOHpiH-q31FDMAFsZf4uagK6432gHcA3pX947wsE42PVJYnhFB0zvM6SGryF933Jiy6b3SrNTQ9ztZEFWNzxaon4LtVDw9XyMdQR15ZJAylOJcMAHsiFEPUDJe997OfMgwFP0JgmGvjXVTix8GfsScbrngozPuDsmJv4Ee1s64iT7ca9VBkcBla4tH74R7z8q53jA\",\n}\n```\n\nAn example string of `premiumInfo` (passed as second argument of `onSuccess` callback):\n\n```\neyJ0eXAiOiJKV1QiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.Wk_DFYjpCnS_87LU1pf1Fzub9_SfRGei9twHi9GYT-MZeD8daYrUW-SJkfl6idH_2lRtRsfZiiXHo8QrSJi4NyQxi_4SD4P2FncJnLKe0gyUCCboc6IEfnpdw4D8kTaw0FLv8_MdeM0Wb1NKBV4CK52mVZSNcNj7KaXBaueByzbrS5Hf98bYxiPgRmYNL84xMMlEOuIJdZYBJOICVlXBXi63LDa75PzyuJQkKxlxdNX5c5F1lm4E\n```\n\n## Documentation\n### MobileIDClient constructor properties\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
PropertyRequiredTypeDescription
credentialsyesCredentialsCredential parameters of your service provider, issued during account registration. Credentials type definition is provided below
redirectUrlyesstringWebsite redirect url, specified (as redirect_uri) during service provider account registration
scopeyesArray<string>Access types, issued during service provider account registration.
⚠️ IMPORTANT, access type 'openid' set as default, don't need to pass this value in scope array.

Your Tariff Sign in only - requires scope to include mc_authn value
Your Tariff Autofill/base - to enable main tariff option, add mc_identity_basic value to array
Your Tariff Autofill/base and address - to enable main tariff option, add mc_identity_basic_address value to array
Your Tariff Autofill/full - to enable main tariff option, add mc_identity_full value to array
acrValuesno2 | 3 | 4Authentication method type. Defaults to 2
2 - authentication by Push acceptation (press OK button)
3 - authentication by PIN-code
4 - authentication by crypto key (mobile digital signature). Only supported by SIM cards with a crypto-applet
premiumnobooleanWhen set to true, the encrypted personal data will be fetched after successful user authentication. The result will be passed in onSuccess callback
msisdnnostringThe user phone number, format: eleven digits starts with '7' symbol (example '79001234567'). The user's phone number is unknown during MobileIDClient initialization, you can set this value later, before the MobileId button is clicked. For this call mobileIDClient.setMsisdn(msisdn)

But you can choose not to ask the user a phone number. Then the user will enter the phone number in the authentication process.
onErroryesfunctionInvoked when an error is encountered in the process of authentication or fetching personal data. Function API is seen below
onSuccessyesfunctionInvoked when a success result is encountered in the process of authentication and/or fetching personal data. Function API is seen below
\n\n### MobileIDClient methods and callbacks\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
FunctionMethod / CallbackArgumentsReturnsRemarks
onErrorcallbackErrorvoidError type definition is seen below
onSuccesscallback(MCToken, string | undefined)voidMCToken type definition is seen below. The received MCToken guarantees successful user authentication. Second argument is JWE string containing encrypted personal data
setMsisdnmethodstringvoidUser’s phone number, format ‘79001234567’
createButtonmethod(Theme, Size, ButtonConfig | undefined)HTMLButtonElement | nullCreates a styled button component. Returns `null` during server-side rendering
\n\n### Custom types\n#### Theme\n```ts\ntype Theme = 'light' | 'violet' | 'bright';\n```\n| --- | ``light`` | ``violet`` | ``bright`` |\n|:----------:|--------------------------------------------------------------------|--------------------------------------------------------------------|--------------------------------------------------------------------|\n| logo | ![](https://via.placeholder.com/15/5400ba/000000?text=+) `#5400ba` | ![](https://via.placeholder.com/15/ffffff/000000?text=+) `#fff` | ![](https://via.placeholder.com/15/333333/000000?text=+) `#333` |\n| text | ![](https://via.placeholder.com/15/333333/000000?text=+) `#333` | ![](https://via.placeholder.com/15/ffffff/000000?text=+) `#fff` | ![](https://via.placeholder.com/15/333333/000000?text=+) `#333` |\n| background | ![](https://via.placeholder.com/15/ffffff/000000?text=+) `#fff` | ![](https://via.placeholder.com/15/5400ba/000000?text=+) `#5400ba` | ![](https://via.placeholder.com/15/ffcb00/000000?text=+) `#ffcb00` |\n\n#### Size\nDifferences in padding, height, logo and font sizes. The button component has a width `100%`. Use a wrapper block if needed.\n```ts\ntype Size = 's' | 'm' | 'l' | 'xl';\n```\n\n#### ButtonConfig\n```ts\ninterface ButtonConfig {\n text?: string,\n isSubmit?: boolean,\n}\n```\n- `isSubmit` - when set to `true`, the button will be created with `type=\"submit\"`. Default: false (`type=\"button\"`)\n- `text` - when left empty or falsy, a simple circle-shaped button with a logo will be created. **Recommend**, use one of the available texts (see `enum Text`). If it isn't clear from context of the page, how the login will be performed, **recommend** add an explanatory caption under the button.\n\n#### Text\n```ts\nexport declare enum Text {\n DEFAULT = 'Войти по номеру телефона',\n PRIMARY = 'Войти с Мобильным ID',\n SECONDARY = 'Войти через Мобильный ID',\n}\n```\n\n#### Credentials\n```ts\ninterface Credentials {\n id: string, // client_id from service provider account\n key: string, // btoa(`${client_id}:${client_secret}`), client_secret from service provider account\n name: string, // client_name from service provider account\n}\n```\n\n#### MCToken\n```ts\ninterface MCToken {\n scope: string,\n idToken: string,\n expiresIn: number,\n accessToken: string,\n}\n```\n\n#### Error\n```ts\ninterface Error {\n error: string,\n errorDescription?: string,\n method: 'authentication' | 'personalData',\n}\n```\n\n## How to decrypt user's personal data\nTo work with encrypted data in the response from premium info, you must:\n\n1. Generate a pair of RSA keys (public and private) in JWK format with following parameters:\n + Key Size = 2048\n + Key Use = encryption\n + Algorithm = RSA-OAEP\n2. Place the public key on the **JWKS Url**\n3. Give the **JWKS Url** that contains **JWK** for encryption to the operator. There is a\n corresponding field in the application form for registration in the Mobile ID service\n4. Keep the private key secret and use it to decrypt the data received in the responses from\n premiuminfo endpoint\n\nTo generate a key, you can use the online service — https://mkjwk.org/.\nAn example of public key:\n```json\n{\n \"keys\": [\n {\n \"kty\": \"RSA\",\n \"e\": \"AQAB\",\n \"use\": \"enc\",\n \"kid\": \"UCGQkw55DlgzhRp88dkdOiTVn1EUtTTYFytL7GagOAA\",\n \"alg\": \"RSA-OAEP\",\n \"n\": \"24M0ceQ2gzUENyPi8lg98V1jNv727XOc5JC1oBMWt71BcWVgzEkHnfrJQ_iPIehj1103utBcB2nZzPW7bTo3vUAFuiJTIzIlpm6LBEAB6ayF2wBP_IBUppYcuIs0M0lvDPwGbahgYez0IoiJ8aNowg8g_C2tcUYMOAjKTfs13tqUUrzj5_Xkmw8ZlSciUWuVZdopMXuxWsOOfgOlKW_gCpiodTfSvnPXvdU1Wy6enopBP1ELDOWbvp-_5eGunPEmjWDFgPMCJUnLrUikki6UIwClMLYvnTDQ4ee_kH5zqZ0l_vgGE1cedXlzgTdByH0e9nY1d5a8AQbQfEHuEFoQ\"\n }\n ]\n}\n```\n\n### Public key description:\n\n| Field | Description |\n|-------|----------------------------------------------------------------------------------------------------------|\n| kty | The encryption algorithm. To work with the service — always \"RSA\" |\n| e | The exponent of the public key in the BASE64URL encoded format. To work with the service — always \"AQAB\" |\n| use | The method of \"use\". For encryption — \"enc\" |\n| kid | Key id (id) |\n| alg | Name of the encryption algorithm |\n| n | Public key module in BASE64 URL encoded format |\n\n### General procedure for processing the `premiumInfo` response\n\nThe content of the response is a JWE token consisting of 5 components:\n```\nBASE64URL(JWE Protected Header) + '.' +\nBASE64URL(JWE Encrypted Key) + '.' +\nBASE64URL(JWE Initialization Vector) + '.' +\nBASE64URL(JWE Ciphertext) + '.' +\nBASE64URL(JWE Authentication Tag)\n```\nThe definitions of the components can be found in the standard [RFC 7516 (section 2)](https://datatracker.ietf.org/doc/html/rfc7516#section-2).\n\n### Response body decryption\n\nThe response should be processed according to the standard [RFC 7516 (section 5.2)](https://datatracker.ietf.org/doc/html/rfc7516#section-5.2). Decryption should be performed using a private key according to the following algorithm:\n1. Extract and decode values from JWE from BASE64URL\n2. Calculate the Secret - **Content Encryption Key** —CEK) - decrypt the values of the JWE\n Encrypted Key with the Recipient's private key using the algorithm specified in the JWE\n Protected Header\n3. Calculate **plaintext** - decrypt the JWE Ciphertext by the method specified in the JWE\n Protected Header using the secret (*CEK*), initialization vector (*JWE InitializationVector*)\n and authentication Tag (*JWE Authentication Tag*)\n\nExample, JAVA decryption:\n```java\nimport org.forgerock.json.jose.common.JwtReconstruction;\nimport org.forgerock.json.jose.jwe.EncryptedJwt;\nimport org.forgerock.json.jose.jwk.RsaJWK;\n\nString encrypted; // premiuminfo response\nString jwkValue; // a string containing JWK\n\nRsaJWK jwk = RsaJWK.parse(jwkValue);\nEncryptedJwt jwt = new JwtReconstruction().reconstructJwt(encrypted, EncryptedJwt.class);\njwt.decrypt(jwk.toRSAPrivateKey());\n\nString result = jwt.getClaimsSet().toString();\n```\n\nExample, Node.js decryption:\n```js\nconst jose = require('node-jose');\n\nconst PID = 'premiumInfo_response_encrypted';\nconst privatekey = 'string containing JWK';\n\nconst decrypt = async (encData, privatekey) => {\n const keystore = jose.JWK.createKeyStore();\n \n const key = await keystore.add(privatekey, 'pem');\n const result = await jose.JWE.createDecrypt(key).decrypt(encData);\n const decriptPID = new TextDecoder().decode(result.payload);\n \n return decriptPID\n};\n\nconst decryptedData = decrypt(PID, privatekey);\n```\n","readmeFilename":"README.md"}