feat(auth): support server-side Zalo phoneToken decoding with resilient... (!39) · Merge Requests · ThinhNC / finwise-miniapp-be

feat(auth): support server-side Zalo phoneToken decoding with resilient...

Features & Enhancements

1. Zalo Phone Token Resolution (Server-to-Server)

Updated ZaloLoginDto and zaloLoginSchema to support phoneToken returned by zmp-sdk's getPhoneNumber().
Implemented fetchZaloPhoneNumber() querying GET https://graph.zalo.me/v2.0/me/info with access_token, code (phoneToken), and secret_key (ZALO_APP_SECRET).
Automated phone number normalization (e.g., converting 84xxxxxxxxx or +84xxxxxxxxx to Vietnamese domestic standard 0xxxxxxxxx).

2. Resilient Hybrid Auth for Global Deployments (Fixes Zalo IP Error `-501`)

Handled Zalo Open API geographical restriction (error: -501: Personal information is limited due to IP address not inside Vietnam) when hosted on global cloud providers (Render/AWS/GCP).
Added graceful fallbacks allowing authentication via client-verified zaloId / deterministic identity while still resolving phone numbers when permissible.
Fixed response parsing logic where successful Zalo profile API calls (which do not return an error key) were previously falsely flagged as invalid credentials.

## Features & Enhancements

### 1. Zalo Phone Token Resolution (Server-to-Server)
- Updated `ZaloLoginDto` and `zaloLoginSchema` to support `phoneToken` returned by `zmp-sdk`'s `getPhoneNumber()`.
- Implemented `fetchZaloPhoneNumber()` querying `GET https://graph.zalo.me/v2.0/me/info` with `access_token`, `code` (`phoneToken`), and `secret_key` (`ZALO_APP_SECRET`).
- Automated phone number normalization (e.g., converting `84xxxxxxxxx` or `+84xxxxxxxxx` to Vietnamese domestic standard `0xxxxxxxxx`).

### 2. Resilient Hybrid Auth for Global Deployments (Fixes Zalo IP Error `-501`)
- Handled Zalo Open API geographical restriction (`error: -501: Personal information is limited due to IP address not inside Vietnam`) when hosted on global cloud providers (Render/AWS/GCP).
- Added graceful fallbacks allowing authentication via client-verified `zaloId` / deterministic identity while still resolving phone numbers when permissible.
- Fixed response parsing logic where successful Zalo profile API calls (which do not return an `error` key) were previously falsely flagged as invalid credentials.