Skip to content

F
finwise-miniapp-be
Merged
Opened by ThinhNC@ThinhNC
Report abuse

feat(auth): integrate Zalo login via phone number and HMAC-SHA256 verification

Summary

Implements seamless Zalo Mini App authentication via phone number and Zalo Profile Graph API with HMAC-SHA256 signature verification (appsecret_proof).

Key Changes

  • Auth Endpoint: Added POST /api/v1/auth/zalo-login for Zalo access token & phone number authentication.
  • Zalo Graph API Integration: Added fetchZaloProfile with appsecret_proof calculation using crypto.createHmac('sha256', ZALO_APP_SECRET) adhering to Zalo Platform security guidelines.
  • Account Linking & Provisioning:
    • Automatically identifies existing users by phone number.
    • Provisions new active users when the phone number is not yet registered.
    • Links Zalo ID to user_socials table for social account mapping.
  • Validation & DTO: Added ZaloLoginDto, ZaloProfileResponse, and zaloLoginSchema with strict Vietnamese phone number regex validation.
  • Testing: Added comprehensive integration test suite in tests/zalo-auth.test.ts.