@almadar/orb 16.9.0 → 17.0.0

package/shells/almadar-shell/packages/client/src/config/mockAuth.ts

@@ -0,0 +1,257 @@
+/**
+ * Mock auth — a working sign-up / sign-in when Firebase is not configured.
+ *
+ * Without credentials `requireAuth()` throws and every sign-in reports "not
+ * configured", so a generated app cannot be signed into at all. That matters
+ * beyond convenience: `@user.id` and `@user.role` are what ownership scoping and
+ * role gates resolve against, so with no viewer every "only mine" list is empty
+ * and every role gate takes its negative branch — the app can only be seen as
+ * nobody. Bypassed the moment real Firebase credentials are present.
+ */
+
+import {
+  DEFAULT_VIEWER,
+  encodeDevIdentityToken,
+  findPersonaInRoster,
+  isFieldValue,
+  type FieldValue,
+  type UserContext,
+} from '@almadar/core';
+
+export interface MockUser {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  role?: string;
+  getIdToken(): Promise<string>;
+}
+
+type Listener = (user: MockUser | null) => void;
+
+const STORAGE_KEY = 'almadar.mockAuth.session';
+const REGISTERED_KEY = 'almadar.mockAuth.registered';
+
+/** The role a brand-new or unknown account gets — never `admin`. */
+const DEFAULT_ROLE = 'member';
+
+/** Empty in dev (the Vite proxy forwards /api); the full server URL in prod. */
+const API_BASE: string =
+  typeof import.meta.env.VITE_API_URL === 'string' ? import.meta.env.VITE_API_URL : '';
+
+const listeners = new Set<Listener>();
+const rosterListeners = new Set<() => void>();
+let current: MockUser | null = null;
+let registered: UserContext[] = [];
+let roster: UserContext[] = [];
+
+function toMockUser(p: UserContext): MockUser {
+  return {
+    uid: p.id,
+    email: typeof p.email === 'string' ? p.email : null,
+    displayName: typeof p.name === 'string' ? p.name : null,
+    photoURL: null,
+    role: typeof p.role === 'string' ? p.role : undefined,
+    // The server trusts this only under ALLOW_DEV_AUTH_BYPASS; it carries the
+    // whole persona so server-side `@user.role` matches the client's.
+    getIdToken: () => Promise.resolve(encodeDevIdentityToken(p)),
+  };
+}
+
+/** A stored account, validated field by field — never trust localStorage shape. */
+function readPersona(raw: FieldValue | undefined): UserContext | null {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw) || raw instanceof Date) {
+    return null;
+  }
+  const record: { [key: string]: FieldValue | undefined } = { ...raw };
+  const id = record['id'];
+  if (typeof id !== 'string' || id.length === 0) return null;
+  const persona: UserContext = { id };
+  for (const key of ['email', 'name', 'role'] as const) {
+    const value = record[key];
+    if (typeof value === 'string' && isFieldValue(value)) persona[key] = value;
+  }
+  return persona;
+}
+
+function readRegistered(): UserContext[] {
+  try {
+    const raw = localStorage.getItem(REGISTERED_KEY);
+    if (!raw) return [];
+    const parsed: FieldValue = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(readPersona).filter((p): p is UserContext => p !== null);
+  } catch {
+    return [];
+  }
+}
+
+function writeRegistered(list: UserContext[]): void {
+  registered = list;
+  try {
+    localStorage.setItem(REGISTERED_KEY, JSON.stringify(list));
+  } catch {
+    /* storage unavailable — the session stays in memory for this tab */
+  }
+}
+
+/**
+ * The app's personas, fetched from its own server.
+ *
+ * They are the LIVE seeded rows of the app's `[identity]` entity, not a
+ * hardcoded list and not a re-derivation: `@user.id` is what ownership scoping
+ * compares against, so a persona whose id is not literally one of those rows
+ * owns nothing and every "only mine" list renders empty — indistinguishable
+ * from a working filter over no data.
+ *
+ * An app that declares no `[identity]` entity has no roster to serve, so the
+ * shell's own default viewer stands in and sign-in still works.
+ */
+async function loadRoster(): Promise<void> {
+  try {
+    const response = await fetch(`${API_BASE}/api/personas`);
+    if (response.ok) {
+      const data = (await response.json()) as { personas?: UserContext[] };
+      roster = Array.isArray(data.personas) ? data.personas : [];
+    }
+  } catch {
+    /* server unreachable — fall through to the default viewer */
+  }
+  if (roster.length === 0) roster = [DEFAULT_VIEWER];
+  for (const fn of rosterListeners) fn();
+}
+
+function allAccounts(): UserContext[] {
+  return [...roster, ...registered];
+}
+
+function emit(): void {
+  for (const fn of listeners) fn(current);
+}
+
+function persist(user: MockUser | null): void {
+  try {
+    if (user) localStorage.setItem(STORAGE_KEY, JSON.stringify({ uid: user.uid }));
+    else localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* storage unavailable */
+  }
+}
+
+/**
+ * Load the app's roster, then restore a persisted session. Safe to call more
+ * than once.
+ *
+ * The roster is awaited first because a restored session names a persona by id:
+ * resolved before the rows arrive, every stored session would silently fail to
+ * restore and the app would open signed out.
+ */
+export async function initMockAuth(): Promise<void> {
+  registered = readRegistered();
+  await loadRoster();
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return;
+    const parsed: FieldValue = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return;
+    if (parsed instanceof Date) return;
+    const session: { [key: string]: FieldValue | undefined } = { ...parsed };
+    const uid = session['uid'];
+    if (typeof uid !== 'string') return;
+    const found = allAccounts().find((a) => a.id === uid);
+    if (found) {
+      current = toMockUser(found);
+      emit();
+    }
+  } catch {
+    /* ignore a corrupt session */
+  }
+}
+
+/** Every persona that can be signed into — for the dev persona picker. */
+export function listMockAccounts(): readonly UserContext[] {
+  return allAccounts();
+}
+
+/**
+ * Subscribe to roster arrival. The roster loads over HTTP after first paint, so
+ * the persona picker renders empty and must be told when the rows land — the
+ * auth listener cannot carry it, since the signed-out viewer does not change.
+ */
+export function onMockRosterChanged(fn: () => void): () => void {
+  rosterListeners.add(fn);
+  return () => {
+    rosterListeners.delete(fn);
+  };
+}
+
+function newAccount(email: string, displayName?: string): UserContext {
+  return {
+    id: `user-${allAccounts().length + 1}`,
+    email,
+    name: displayName ?? email.split('@')[0] ?? email,
+    role: DEFAULT_ROLE,
+  };
+}
+
+function byEmail(email: string): UserContext | undefined {
+  return allAccounts().find(
+    (a) => typeof a.email === 'string' && a.email.toLowerCase() === email.toLowerCase(),
+  );
+}
+
+function signInAs(account: UserContext): MockUser {
+  current = toMockUser(account);
+  persist(current);
+  emit();
+  return current;
+}
+
+export const mockAuth = {
+  get currentUser(): MockUser | null {
+    return current;
+  },
+
+  onAuthStateChanged(fn: Listener): () => void {
+    listeners.add(fn);
+    // Match Firebase: the listener fires immediately with the current state.
+    fn(current);
+    return () => listeners.delete(fn);
+  },
+
+  /** Any password is accepted; an unknown email signs in as a new end-user. */
+  signInWithEmail(email: string, _password: string): Promise<MockUser> {
+    return Promise.resolve(signInAs(byEmail(email) ?? newAccount(email)));
+  },
+
+  signUpWithEmail(email: string, _password: string, displayName?: string): Promise<MockUser> {
+    if (byEmail(email)) {
+      return Promise.reject(new Error('An account with that email already exists'));
+    }
+    const account = newAccount(email, displayName);
+    writeRegistered([...registered, account]);
+    return Promise.resolve(signInAs(account));
+  },
+
+  /** Sign in directly as a named persona — the dev persona switch. */
+  signInAsPersona(idOrRole: string): Promise<MockUser> {
+    const account =
+      findPersonaInRoster(roster, idOrRole) ??
+      registered.find((a) => a.id === idOrRole || a.role === idOrRole);
+    if (!account) {
+      return Promise.reject(
+        new Error(
+          `Unknown persona "${idOrRole}". Known: ${allAccounts().map((a) => `${a.id}/${String(a.role)}`).join(', ')}`,
+        ),
+      );
+    }
+    return Promise.resolve(signInAs(account));
+  },
+
+  signOut(): Promise<void> {
+    current = null;
+    persist(null);
+    emit();
+    return Promise.resolve();
+  },
+};

package/shells/almadar-shell/packages/client/src/features/auth/AuthContext.tsx

@@ -0,0 +1,152 @@
+import React, { createContext, useContext, useEffect, useState } from 'react';
+import { auth, initializeFirebase } from '../../config/firebase';
+import { initMockAuth, mockAuth } from '../../config/mockAuth';
+import { authService } from './authService';
+import { AuthContextType, AuthViewer } from './types';
+
+const AuthContext = createContext<AuthContextType | undefined>(undefined);
+
+export const useAuthContext = () => {
+  const context = useContext(AuthContext);
+  if (context === undefined) {
+    throw new Error('useAuthContext must be used within an AuthProvider');
+  }
+  return context;
+};
+
+interface AuthProviderProps {
+  children: React.ReactNode;
+}
+
+export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
+  const [user, setUser] = useState<AuthViewer | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let unsubscribe: (() => void) | undefined;
+
+    initializeFirebase().then(() => {
+      // No Firebase config — subscribe to the persona-backed mock instead of
+      // rendering signed-out forever, so the app can be viewed as each persona.
+      if (!auth) {
+        // Subscribe first: the listener fires immediately with the current
+        // (signed-out) state so the app paints, then again once the roster has
+        // arrived and a persisted session is restored.
+        unsubscribe = mockAuth.onAuthStateChanged((mockUser) => {
+          setUser(mockUser);
+          setLoading(false);
+        });
+        void initMockAuth();
+        return;
+      }
+      unsubscribe = auth.onAuthStateChanged((firebaseUser) => {
+        setUser(firebaseUser);
+        setLoading(false);
+      });
+    });
+
+    return () => unsubscribe?.();
+  }, []);
+
+  const clearError = () => setError(null);
+
+  const signInWithGoogle = async () => {
+    try {
+      setLoading(true);
+      clearError();
+      await authService.signInWithGoogle();
+    } catch (err) {
+      setLoading(false);
+      const firebaseErr = err as { code?: string; message?: string };
+      const isCancel =
+        firebaseErr.code === 'auth/popup-closed-by-user' ||
+        firebaseErr.code === 'auth/cancelled-popup-request' ||
+        firebaseErr.code === 'auth/popup-blocked';
+      if (!isCancel) {
+        setError(firebaseErr.message ?? 'Google sign-in failed');
+      }
+    }
+  };
+
+  const signInWithEmail = async (email: string, password: string) => {
+    try {
+      setLoading(true);
+      clearError();
+      await authService.signInWithEmail(email, password);
+    } catch (err) {
+      setLoading(false);
+      setError((err as { message?: string }).message ?? 'Sign-in failed');
+    }
+  };
+
+  const signUpWithEmail = async (email: string, password: string, displayName?: string) => {
+    try {
+      setLoading(true);
+      clearError();
+      await authService.signUpWithEmail(email, password, displayName);
+    } catch (err) {
+      setLoading(false);
+      setError((err as { message?: string }).message ?? 'Sign-up failed');
+    }
+  };
+
+  const sendSignInLinkToEmail = async (email: string) => {
+    try {
+      setLoading(true);
+      clearError();
+      const actionCodeSettings = {
+        url: `${window.location.origin}/login`,
+        handleCodeInApp: true,
+      };
+      await authService.sendSignInLinkToEmail(email, actionCodeSettings);
+      setLoading(false);
+    } catch (err) {
+      setLoading(false);
+      setError((err as { message?: string }).message ?? 'Failed to send sign-in link');
+    }
+  };
+
+  const signInWithEmailLink = async (email: string, emailLink: string) => {
+    try {
+      setLoading(true);
+      clearError();
+      await authService.signInWithEmailLink(email, emailLink);
+    } catch (err) {
+      setLoading(false);
+      setError((err as { message?: string }).message ?? 'Email link sign-in failed');
+    }
+  };
+
+  const isSignInWithEmailLink = (emailLink: string): boolean => {
+    return authService.isSignInWithEmailLink(emailLink);
+  };
+
+  const signOut = async () => {
+    try {
+      setLoading(true);
+      await authService.signOut();
+      setUser(null);
+      setLoading(false);
+    } catch (err) {
+      setLoading(false);
+      setError((err as { message?: string }).message ?? 'Sign-out failed');
+    }
+  };
+
+  const value: AuthContextType = {
+    user,
+    loading,
+    error,
+    signInWithGoogle,
+    signOut,
+    signInWithEmail,
+    signUpWithEmail,
+    sendSignInLinkToEmail,
+    signInWithEmailLink,
+    isSignInWithEmailLink,
+    clearError,
+  };
+
+  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+};

package/shells/almadar-shell/packages/client/src/features/auth/authService.ts

@@ -0,0 +1,104 @@
+import {
+  signInWithPopup,
+  GoogleAuthProvider,
+  signInWithEmailAndPassword,
+  createUserWithEmailAndPassword,
+  updateProfile,
+  signOut as firebaseSignOut,
+  sendSignInLinkToEmail as firebaseSendSignInLinkToEmail,
+  isSignInWithEmailLink as firebaseIsSignInWithEmailLink,
+  signInWithEmailLink as firebaseSignInWithEmailLink,
+  ActionCodeSettings,
+} from 'firebase/auth';
+import { auth, isAuthEnabled, requireAuth } from '../../config/firebase';
+import { mockAuth } from '../../config/mockAuth';
+
+// With no Firebase credentials the real calls throw "not configured", which
+// leaves a generated app impossible to sign into — and therefore impossible to
+// view as anyone, since @user.id/@user.role drive ownership and role gates.
+// Route to the persona-backed mock in exactly that case.
+const useMock = (): boolean => !isAuthEnabled();
+
+const googleProvider = new GoogleAuthProvider();
+
+export const authService = {
+  // Google Sign In
+  signInWithGoogle: async () => {
+    // No popup to show without Firebase — sign in as the seeded end-user.
+    if (useMock()) return mockAuth.signInAsPersona('member');
+    try {
+      const result = await signInWithPopup(requireAuth(), googleProvider);
+      return result.user;
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  // Email/Password Sign In
+  signInWithEmail: async (email: string, password: string) => {
+    if (useMock()) return mockAuth.signInWithEmail(email, password);
+    try {
+      const result = await signInWithEmailAndPassword(requireAuth(), email, password);
+      return result.user;
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  // Email/Password Sign Up
+  signUpWithEmail: async (email: string, password: string, displayName?: string) => {
+    if (useMock()) return mockAuth.signUpWithEmail(email, password, displayName);
+    try {
+      const result = await createUserWithEmailAndPassword(requireAuth(), email, password);
+
+      if (displayName) {
+        await updateProfile(result.user, { displayName });
+      }
+
+      return result.user;
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  // Sign Out
+  signOut: async () => {
+    if (useMock()) return mockAuth.signOut();
+    try {
+      await firebaseSignOut(requireAuth());
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  // Email Link Authentication
+  sendSignInLinkToEmail: async (email: string, actionCodeSettings: ActionCodeSettings) => {
+    try {
+      await firebaseSendSignInLinkToEmail(requireAuth(), email, actionCodeSettings);
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  isSignInWithEmailLink: (emailLink: string): boolean => {
+    // Predicate evaluated during Login render — degrade, don't throw,
+    // when auth is unconfigured: it simply isn't an email-link sign-in.
+    if (!auth) return false;
+    return firebaseIsSignInWithEmailLink(auth, emailLink);
+  },
+
+  signInWithEmailLink: async (email: string, emailLink: string) => {
+    try {
+      const result = await firebaseSignInWithEmailLink(requireAuth(), email, emailLink);
+      return result.user;
+    } catch (error) {
+      throw error;
+    }
+  },
+
+  /** Sign in as a named seeded persona (dev only; no-op with real Firebase). */
+  signInAsPersona: async (idOrRole: string) => {
+    if (useMock()) return mockAuth.signInAsPersona(idOrRole);
+    throw new Error('Persona sign-in is a dev-only affordance; real auth is configured');
+  },
+};