From c15a78a675d3f01d83832456b55d62255cfa4d08 Mon Sep 17 00:00:00 2001 From: Diego Rivera Date: Fri, 6 Sep 2024 01:09:34 +0200 Subject: [PATCH] Add SIM Swap sample code --- catalog/simswap/samplecode.md | 469 ++++++++++++++++++++++++++++++++++ 1 file changed, 469 insertions(+) create mode 100644 catalog/simswap/samplecode.md diff --git a/catalog/simswap/samplecode.md b/catalog/simswap/samplecode.md new file mode 100644 index 0000000..6c1014d --- /dev/null +++ b/catalog/simswap/samplecode.md @@ -0,0 +1,469 @@ +--- +title: Sample code +excerpt: The following samples show how to use the [Open Gateway SIM Swap API](https://opengateway.telefonica.com/en/apis/sim-swap), for fraud prevention purposes, in order to check if a given mobile line, identified by its phone number, has gotten a SIM card swap lately. +category: 66aa4f941e51e7000fa353ce +--- + +The following code shows, for didactic purposes, a hypothetical SDK, in several programming languages, from a generic Open Gateway's channel partner, also known as aggregator. The final implementation will depend on the channel partner's development tools offering. Note that channel partners' Open Gateway SDKs are just code modules wrapping authentication and API calls providing an interface in your app's programming for convenience. + +Sample code on how to consume the API without an SDK, directly with HTTP requests, is also provided, and it is common and valid no matter what your partner is, thanks to the CAMARA standardization. If you do not use an SDK you need to code the HTTP calls and additional stuff like encoding your credentials, calling authorization endpoints, handling tokens, etc. You can check our sample [Postman collection](https://bxbucket.blob.core.windows.net/bxbucket/opengateway-web/uploads/OpenGateway.postman_collection.json) as a reference. + +### Table of contents +- [Backend flow](#backend-flow) + - [Authentication](#authentication) + - [API usage](#api-usage) +- [Frontend flow](#frontend-flow) + - [Authentication](#authentication-1) + - [Requesting the authorization code from the frontend](#requesting-the-authorization-code-from-the-frontend) + - [Getting the access token from the callback endpoint at the backend](#getting-the-access-token-from-the-callback-endpoint-at-the-backend) + - [API usage](#api-usage-1) + +## Code samples + +### Backend flow + +Most likely, this API will be consumed in a backend flow, since it is the application owner not the end-user who wants to take advantage of its functionality. The authentication protocol used in Open Gateway for backend flows is the OIDC standard CIBA (Client Initiated Backchannel Authentication). You can check the CAMARA documentation on this flow [here](https://github.com/camaraproject/IdentityAndConsentManagement/blob/release-0.1.0/documentation/CAMARA-API-access-and-user-consent.md#ciba-flow-backend-flow). + +First step is to instantiate the SIM Swap service class included in the corresponding SDK. By providing your app's credentials to the class constructor, it handles the CIBA authentication on its behalf. Providing the phone number as well, as an identifier of the line to be checked for SIM swaps, allows authorization to be 3-legged and enables end-user consent management, and will let your app to just effectively use the API in a single line of code below. + +#### Authentication + +Since Open Gateway authentication is 3-legged, meaning it identifies the application, the operator and the operator's subscriber, who is also the end-user holder of the mobile line, each check for a different phone number needs its own SDK class instantiation, or access token if not using an SDK. + +```node Generic SDK for Node.js +import { ClientCredentials, SIMSwap } from "aggregator/opengateway-sdk" + +const credentials: ClientCredentials( + clientId: 'my-app-id', + clientSecret: 'my-app-secret' +) + +const CUSTOMER_PHONE_NUMBER = '+34555555555' + +const simswapClient = new SIMSwap(credentials, null, CUSTOMER_PHONE_NUMBER) +``` +```java Generic SDK for Java +import aggregator.opengatewaysdk.ClientCredentials; +import aggregator.opengatewaysdk.SIMSwap; + +ClientCredentials credentials = new ClientCredentials( + "my-app-id", + "my-app-secret" +); + +final String customerPhoneNumber = "+34555555555"; + +SIMSwap simswapClient = new SIMSwap(credentials, null, customerPhoneNumber); +``` +```python Generic SDK for Python +from aggregator_opengateway_sdk import ClientCredentials, SIMSwap + +credentials = ClientCredentials( + clientid='my-app-id', + clientsecret='my-app-secret' +) + +customer_phone_number = '+34555555555' + +simswap_client = SIMSwap(client=credentials, phone_number=customer_phone_number) +``` +```ecmascript HTTP using JavaScript (ES6) +// First step: +// Perform an authorization request + +let customerPhoneNumber = "+34555555555"; + +let clientId = "my-app-id"; +let clientSecret = "my-app-secret"; +let appCredentials = btoa(`${clientId}:${clientSecret}`); +let apiPurpose = "dpv:FraudPreventionAndDetection#sim-swap"; + +const myHeaders = new Headers(); +myHeaders.append("Content-Type", "application/x-www-form-urlencoded"); +myHeaders.append("Authorization", `Basic ${appCredentials}`); + +const urlencoded = new URLSearchParams(); +urlencoded.append("login_hint", `phone_number:${customerPhoneNumber}`); +urlencoded.append("purpose", apiPurpose); + +const requestOptions = { + method: "POST", + headers: myHeaders, + body: urlencoded +}; + +let authReqId; + +fetch("https://opengateway.aggregator.com/bc-authorize", requestOptions) + .then(response => response.json()) + .then(result => { + authReqId = result.auth_req_id; + }) + +// Second step: +// Requesting an access token with the auth_req_id included in the result above + +const myHeaders = new Headers(); +myHeaders.append("Content-Type", "application/x-www-form-urlencoded"); +myHeaders.append("Authorization", `Basic ${appCredentials}`); + +const urlencoded = new URLSearchParams(); +urlencoded.append("grant_type", "urn:openid:params:grant-type:ciba"); +urlencoded.append("auth_req_id", authReqId); + +const requestOptions = { + method: "POST", + headers: myHeaders, + body: urlencoded +}; + +let accessToken; + +fetch("https://opengateway.aggregator.com/token", requestOptions) + .then(response => response.json()) + .then(result => { + accessToken = result.access_token; + }) +``` +```java HTTP using Java +// First step: +// Perform an authorization request + +String customerPhoneNumber = "+34555555555"; + +String clientId = "my-app-id"; +String clientSecret = "my-app-secret"; +String appCredentials = clientId + ":" + clientSecret; +String credentials = Base64.getEncoder().encodeToString(appCredentials.getBytes(StandardCharsets.UTF_8)); +String apiPurpose = "dpv:FraudPreventionAndDetection#sim-swap"; + +HttpClient client = HttpClient.newHttpClient(); + +Map data = new HashMap<>(); +data.put("login_hint", "phone_number:" + customerPhoneNumber); +data.put("purpose", apiPurpose); + +StringBuilder requestBody = new StringBuilder(); +for (Map.Entry entry : data.entrySet()) { + if (requestBody.length() > 0) { + requestBody.append("&"); + } + requestBody.append(URLEncoder.encode(entry.getKey().toString(), StandardCharsets.UTF_8)); + requestBody.append("="); + requestBody.append(URLEncoder.encode(entry.getValue().toString(), StandardCharsets.UTF_8)); +} + +HttpRequest request = HttpRequest.newBuilder() + .uri(URI.create("https://opengateway.aggregator.com/bc-authorize")) + .header("Content-Type", "application/x-www-form-urlencoded") + .header("Authorization", "Basic " + credentials) + .POST(BodyPublishers.ofString(requestBody.toString())) + .build(); + +HttpResponse response = client.send(request, BodyHandlers.ofString()); +JSONObject jsonResponse = new JSONObject(response.body()); +String authReqId = jsonResponse.getString("auth_req_id"); + +// Second step: +// Requesting an access token with the auth_req_id included in the result above + +Map data = new HashMap<>(); +data.put("grant_type", "urn:openid:params:grant-type:ciba"); +data.put("auth_req_id", authReqId); + +StringBuilder requestBody = new StringBuilder(); +for (Map.Entry entry : data.entrySet()) { + if (requestBody.length() > 0) { + requestBody.append("&"); + } + requestBody.append(URLEncoder.encode(entry.getKey().toString(), StandardCharsets.UTF_8)); + requestBody.append("="); + requestBody.append(URLEncoder.encode(entry.getValue().toString(), StandardCharsets.UTF_8)); +} + +HttpRequest request = HttpRequest.newBuilder() + .uri(URI.create("https://opengateway.aggregator.com/token")) + .header("Content-Type", "application/x-www-form-urlencoded") + .header("Authorization", "Basic " + credentials) + .POST(BodyPublishers.ofString(requestBody.toString())) + .build(); + +HttpResponse response = client.send(request, BodyHandlers.ofString()); +JSONObject jsonResponse = new JSONObject(response.body()); +String accessToken = jsonResponse.getString("access_token"); +``` +```python HTTP using Python +# First step: +# Perform an authorization request + +customer_phone_number = "+34555555555" + +client_id = "my-app-id" +client_secret = "my-app-secret" +app_credentials = f"{client_id}:{client_secret}" +credentials = base64.b64encode(app_credentials.encode('utf-8')).decode('utf-8') +api_purpose = "dpv:FraudPreventionAndDetection#sim-swap" + +headers = { + "Content-Type": "application/x-www-form-urlencoded", + "Authorization": f"Basic {credentials}" +} + +data = { + "login_hint": f"phone_number:{customer_phone_number}", + "purpose": api_purpose +} + +response = requests.post( + "https://opengateway.aggregator.com/bc-authorize", + headers=headers, + data=data +) + +auth_req_id = response.json().get("auth_req_id") + +# Second step: +# Requesting an access token with the auth_req_id included in the result above + +headers = { + "Content-Type": "application/x-www-form-urlencoded", + "Authorization": f"Basic {credentials}" +} + +data = { + "grant_type": "urn:openid:params:grant-type:ciba", + "auth_req_id": auth_req_id +} + +response = requests.post( + "https://opengateway.aggregator.com/token", + headers=headers, + data=data +) + +access_token = response.json().get("access_token") +``` + +#### API usage + +Once your app is authenticated it only takes a single line of code to use the service API and effectively get a result. + +```node Generic SDK for Node.js +let result = await simswapClient.retrieveDate() + +console.log(`SIM was swapped: ${result.toLocaleString('en-GB', { timeZone: 'UTC' })}`) +``` +```java Generic SDK for Java +CompletableFuture resultFuture = simswapClient.retrieveDate(); + +resultFuture.thenAccept(result -> { + System.out.println("SIM was swapped: " + DateTimeFormatter.ISO_LOCAL_DATE.format(result)); +}) +``` +```python Generic SDK for Python +result = await simswap_client.retrieve_date() + +print(f"SIM was swapped: {result.strftime('%B %d, %Y, %I:%M:%S %p')}") +``` +```ecmascript HTTP using JavaScript (ES6) +const myHeaders = new Headers(); +myHeaders.append("Content-Type", "application/json"); +myHeaders.append("Authorization", `Bearer ${accessToken}`); + +const requestBody = JSON.stringify({ + "phoneNumber": customerPhoneNumber // as set in the authentication step +}); + +const requestOptions = { + method: "POST", + headers: myHeaders, + body: requestBody +}; + +fetch("https://opengateway.aggregator.com/sim-swap/v0/retrieve-date", requestOptions) + .then(response => response.json()) + .then(result => { + console.log(`SIM was swapped: ${result.latestSimChange}`) + }) +``` +```java HTTP using Java +JSONObject requestBody = new JSONObject(); +requestBody.put("phoneNumber", customerPhoneNumber); // as set in the authentication step + +HttpRequest request = HttpRequest.newBuilder() + .uri(URI.create("https://opengateway.aggregator.com/sim-swap/v0/retrieve-date")) + .header("Content-Type", "application/json") + .header("Authorization", "Bearer " + accessToken) + .POST(BodyPublishers.ofString(requestBody.toString())) + .build(); + +HttpResponse response = client.send(request, BodyHandlers.ofString()); +JSONObject jsonResponse = new JSONObject(response.body()); +String swapDate = jsonResponse.getString("latestSimChange"); + +System.out.println("SIM was swapped: " + DateTimeFormatter.ISO_LOCAL_DATE.format(swapDate)); +``` +```python HTTP using Python +headers = { + "Content-Type": "application/json", + "Authorization": f"Bearer {access_token}" +} + +data = { + "phoneNumber": customer_phone_number, # as set in the authentication step +} + +response = requests.post( + "https://opengateway.aggregator.com/sim-swap/v0/retrieve-date", + headers=headers, + json=data +) + +result = response.json() +print(f"SIM was swapped: {result.get('latestSimChange').strftime('%B %d, %Y, %I:%M:%S %p')}") +``` + +### Frontend flow + +Although it is not common to face a use case for SIM Swap where the user device is involved in the flow and, at the same time, it is easier to get the phone number on the frontend that on the backend, or it is more precise in terms of data quality on each end, if you wanted to start the service API consumption from a frontend application, you would need to implement the OIDC's Authorization Code Flow instead of CIBA. This flow implies your application providing a callback URL that you will need to publish online hosted on your backend server, and in which your application's backend will get a `code` authorizing it to use the Open Gateway APIs for your end-user. + +This flow allows the mobile network operator to effectively identify the user by resolving the IP address of their device, running your application, by getting an HTTP redirection and returning a `code` that will reach out to your callback URL. You can check the CAMARA documentation on the Authorization Code Flow [here](https://github.com/camaraproject/IdentityAndConsentManagement/blob/release-0.1.0/documentation/CAMARA-API-access-and-user-consent.md#authorization-code-flow-frontend-flow). + +From this point, your application, from its backend, will request an access token, and use it to call the service API. + +#### Authentication + +Some Channel Partners may provide you with frontend SDKs to handle the Authorization Code Flow on your application's behalf, providing some extra features like checking your end-user's device network interface to avoid problems caused from it being connected to a WiFi network, for instance, since this flow relies on the mobile line connectivity for the operator to identify the end-user and authorize your application. + +The following samples show how to implement the flow without a frontend SDK with these premises: +* Application's frontend performs an HTTP request to get a `code`, and provides a `redirect_uri` it wants such `code` to be redirected to. +* Application's frontend will receive an HTTP redirect (status 302) and needs to be able to handle it. If it is a web application running on a web browser, the browser will natively follow the redirection. If it is not, in depends on the coding language and/or HTTP module or library used, or on its settings, how the flow will follow all the way to your application's backend through the mobile network operator authentication server. +* Application's backend receives the `code` from this HTTP redirection, by publishing an endpoint in the given `redirect_uri`, and then exchanges it for an access token. The latter can be achieved by using a backend SDK as shown in the [Backend flow](#backend-flow). + +The authentication protocol used in Open Gateway for frontend flows is the OIDC standard Authorization Code Flow. You can check the CAMARA documentation on this flow [here](https://github.com/camaraproject/IdentityAndConsentManagement/blob/release-0.1.0/documentation/CAMARA-API-access-and-user-consent.md#authorization-code-flow-frontend-flow). + +#### Requesting the authorization code from the frontend + +The following samples show how your application can trigger the authentication flow from the frontend either from code or by submitting a simple HTML form. The same can be achieved from code in any other programming language with the ability to perform HTTP requests: + +```ecmascript HTTP using JavaScript (ES6) +let userPhoneNumber = "+34555555555"; + +let clientId = "my-app-id"; +let clientSecret = "my-app-secret"; +let apiPurpose = "dpv:FraudPreventionAndDetection#sim-swap"; +let myCallbackEndpoint = "https://my_app_server/simswap-callback"; + +const params = { + client_id: clientId, + response_type: "code", + purpose: apiPurpose, + redirect_uri: myCallbackEndpoint, + state: userPhoneNumber // Using `state` as the parameter that is always forwarded to the redirect_uri +}; + +// Create the query string +const queryString = new URLSearchParams(params).toString(); + +// URL with query string +const url = `https://opengateway.aggregator.com/authorize?${queryString}`; + +const requestOptions = { + method: "GET", + redirect: "follow" +}; + +fetch(url, requestOptions); +``` +```html HTML form + + + + + + + + API Request Form + + +

SIM swap date check

+
+ + + + + + + + + +
+ + +``` + +#### Getting the access token from the callback endpoint at the backend + +Samples represent how to publish the callback URL in Python or Node.js, so the code from the Auth Code Flow can be received. The same can be achieved in any other language with capabilities to run an HTTP server and listen for the redirect from the authentication flow: + +```python Generic SDK for Python +from flask import Flask, request, jsonify +from aggregator_opengateway_sdk import ClientCredentials, SIMSwap + +credentials = ClientCredentials( + clientid='my-app-id', + clientsecret='my-app-secret' +) + +app = Flask(__name__) + +@app.route('/simswap-callback', methods=['GET']) +def callback(): + code = request.args.get('code', '') + phone_number = request.args.get('state', '') + simswap_client = SIMSwap(client=credentials, auth_code=code) + +if __name__ == '__main__': + app.run() +``` +```node Generic SDK for Node.js +import { ClientCredentials, SIMSwap } from "aggregator/opengateway-sdk" +import express from "express" + +const credentials: ClientCredentials( + clientId: 'my-app-id', + clientSecret: 'my-app-secret' +) + +const app = express() +const port = 3000 + +app.get('/simswap-callback', (req, res) => { + const code = req.query.code + const phoneNumber = req.query.state + const simswapClient = new SIMSwap(credentials, code) +}) + +app.listen(port, () => { + console.log(`SIM Swap callback URL is running`); +}) +``` + +#### API usage + +Once your app is authenticated it only takes a single line of code to use the service API and effectively get a result. + +```python Generic SDK for Python +result = await simswap_client.retrieve_date(phone_number) + +print(f"SIM was swapped: {result.strftime('%B %d, %Y, %I:%M:%S %p')}") +``` +```node Generic SDK for Node.js +let result = await simswapClient.retrieveDate(phoneNumber) + +console.log(`SIM was swapped: ${result.toLocaleString('en-GB', { timeZone: 'UTC' })}`) +```