@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/core/src/stores/LocalAuthStore.ts

@@ -1,199 +0,0 @@
-import { BaseAuthStore } from './BaseAuthStore'
-import type { User } from '../types'
-
-interface CookieOptions {
-  path?: string
-  domain?: string
-  maxAge?: number
-  secure?: boolean
-  sameSite?: 'Strict' | 'Lax' | 'None'
-  httpOnly?: boolean
-}
-
-interface StoredAuth {
-  token: string | null
-  refreshToken: string | null
-  user: User | null
-}
-
-/**
- * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
- */
-export class LocalAuthStore extends BaseAuthStore {
-  /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
-  override readonly persistent = true
-  private readonly key: string
-
-  constructor(key = 'aurabase_auth') {
-    super()
-    this.key = key
-    this._loadFromStorage()
-  }
-
-  // -- Overrides --------------------------------------------------------------
-
-  override save(token: string, refreshToken: string, user: User): void {
-    super.save(token, refreshToken, user)
-    this._persist()
-  }
-
-  override clear(): void {
-    super.clear()
-    this._removeStorage()
-    this._removePkceVerifiers()
-  }
-
-  /**
-   * Supprime de localStorage tous les artefacts d'auth éphémères sur disque :
-   *  - `code_verifier` PKCE (`aura-<projectId>-pkce-code-verifier`),
-   *  - marqueur d'initiation OAuth implicit (`aura-<projectId>-oauth-implicit-initiated`,
-   *    SEC-F3). Un `signOut`/`clear()` ne doit laisser aucun résidu réutilisable (parité
-   * `@supabase/ssr` : ces artefacts sont éphémères). On itère les clés préfixées pour
-   * couvrir un store partagé entre plusieurs projets, sans dépendre du `projectId` courant.
-   */
-  private _removePkceVerifiers(): void {
-    if (typeof localStorage === 'undefined') return
-    try {
-      const toRemove: string[] = []
-      for (let i = 0; i < localStorage.length; i++) {
-        const k = localStorage.key(i)
-        if (k && /^aura-.*-(pkce-code-verifier|oauth-implicit-initiated)$/.test(k)) toRemove.push(k)
-      }
-      for (const k of toRemove) localStorage.removeItem(k)
-    } catch {
-      // blocked / unavailable — ignore
-      this._emitStorageBlocked('removePkceVerifiers')
-    }
-  }
-
-  // -- Generic key/value storage (override : persistance localStorage) --------
-  // CRITIQUE pour le flux PKCE : le `code_verifier` doit survivre au redirect
-  // pleine page vers le provider OAuth et retour — un store purement mémoire
-  // ne survivrait pas à ce cycle de navigation.
-
-  override setItem(key: string, value: string): void {
-    super.setItem(key, value)
-    if (typeof localStorage === 'undefined') return
-    try {
-      localStorage.setItem(key, value)
-    } catch {
-      // quota exceeded or blocked — ignore
-      this._emitStorageBlocked('setItem')
-    }
-  }
-
-  override getItem(key: string): string | null {
-    if (typeof localStorage === 'undefined') return super.getItem(key)
-    try {
-      const v = localStorage.getItem(key)
-      if (v !== null) return v
-    } catch {
-      // blocked — fall through to in-memory
-      this._emitStorageBlocked('getItem')
-    }
-    return super.getItem(key)
-  }
-
-  override removeItem(key: string): void {
-    super.removeItem(key)
-    if (typeof localStorage === 'undefined') return
-    try {
-      localStorage.removeItem(key)
-    } catch {
-      // blocked — ignore
-      this._emitStorageBlocked('removeItem')
-    }
-  }
-
-  // -- Cookie helpers (SSR) ---------------------------------------------------
-
-  /**
-   * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
-   */
-  loadFromCookie(cookieString: string): void {
-    const prefix = `${this.key}=`
-    const entry = cookieString
-      .split(';')
-      .map((c) => c.trim())
-      .find((c) => c.startsWith(prefix))
-    if (!entry) return
-
-    try {
-      const raw = decodeURIComponent(entry.slice(prefix.length))
-      const parsed: StoredAuth = JSON.parse(raw)
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        super.save(parsed.token, parsed.refreshToken, parsed.user)
-      }
-    } catch {
-      // malformed cookie — ignore
-    }
-  }
-
-  /**
-   * Serialize current auth state into a `Set-Cookie` value.
-   */
-  exportToCookie(options: CookieOptions = {}): string {
-    const data: StoredAuth = {
-      token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user,
-    }
-    const encoded = encodeURIComponent(JSON.stringify(data))
-    const parts = [`${this.key}=${encoded}`]
-
-    if (options.path) parts.push(`Path=${options.path}`)
-    if (options.domain) parts.push(`Domain=${options.domain}`)
-    if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`)
-    if (options.secure) parts.push('Secure')
-    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`)
-    if (options.httpOnly) parts.push('HttpOnly')
-
-    return parts.join('; ')
-  }
-
-  // -- Private ----------------------------------------------------------------
-
-  private _loadFromStorage(): void {
-    if (typeof localStorage === 'undefined') return
-    try {
-      const raw = localStorage.getItem(this.key)
-      if (!raw) return
-      const parsed: StoredAuth = JSON.parse(raw)
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        // Use super.save to trigger listeners + set fields, then persist is a no-op
-        // since we just loaded. But calling super.save is fine — it will also call
-        // _triggerChange which is acceptable on initial load.
-        super.save(parsed.token, parsed.refreshToken, parsed.user)
-      }
-    } catch {
-      // corrupted storage — ignore
-      this._emitStorageBlocked('loadFromStorage')
-    }
-  }
-
-  private _persist(): void {
-    if (typeof localStorage === 'undefined') return
-    const data: StoredAuth = {
-      token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user,
-    }
-    try {
-      localStorage.setItem(this.key, JSON.stringify(data))
-    } catch {
-      // quota exceeded or blocked — ignore
-      this._emitStorageBlocked('persist')
-    }
-  }
-
-  private _removeStorage(): void {
-    if (typeof localStorage === 'undefined') return
-    try {
-      localStorage.removeItem(this.key)
-    } catch {
-      // blocked — ignore
-      this._emitStorageBlocked('removeStorage')
-    }
-  }
-}