@aurabase/aurabase-js 0.3.0

package/packages/core/src/stores/LocalAuthStore.ts

@@ -0,0 +1,199 @@
+import { BaseAuthStore } from './BaseAuthStore'
+import type { User } from '../types'
+
+interface CookieOptions {
+  path?: string
+  domain?: string
+  maxAge?: number
+  secure?: boolean
+  sameSite?: 'Strict' | 'Lax' | 'None'
+  httpOnly?: boolean
+}
+
+interface StoredAuth {
+  token: string | null
+  refreshToken: string | null
+  user: User | null
+}
+
+/**
+ * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
+ */
+export class LocalAuthStore extends BaseAuthStore {
+  /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
+  override readonly persistent = true
+  private readonly key: string
+
+  constructor(key = 'aurabase_auth') {
+    super()
+    this.key = key
+    this._loadFromStorage()
+  }
+
+  // -- Overrides --------------------------------------------------------------
+
+  override save(token: string, refreshToken: string, user: User): void {
+    super.save(token, refreshToken, user)
+    this._persist()
+  }
+
+  override clear(): void {
+    super.clear()
+    this._removeStorage()
+    this._removePkceVerifiers()
+  }
+
+  /**
+   * Supprime de localStorage tous les artefacts d'auth éphémères sur disque :
+   *  - `code_verifier` PKCE (`aura-<projectId>-pkce-code-verifier`),
+   *  - marqueur d'initiation OAuth implicit (`aura-<projectId>-oauth-implicit-initiated`,
+   *    SEC-F3). Un `signOut`/`clear()` ne doit laisser aucun résidu réutilisable (parité
+   * `@supabase/ssr` : ces artefacts sont éphémères). On itère les clés préfixées pour
+   * couvrir un store partagé entre plusieurs projets, sans dépendre du `projectId` courant.
+   */
+  private _removePkceVerifiers(): void {
+    if (typeof localStorage === 'undefined') return
+    try {
+      const toRemove: string[] = []
+      for (let i = 0; i < localStorage.length; i++) {
+        const k = localStorage.key(i)
+        if (k && /^aura-.*-(pkce-code-verifier|oauth-implicit-initiated)$/.test(k)) toRemove.push(k)
+      }
+      for (const k of toRemove) localStorage.removeItem(k)
+    } catch {
+      // blocked / unavailable — ignore
+      this._emitStorageBlocked('removePkceVerifiers')
+    }
+  }
+
+  // -- Generic key/value storage (override : persistance localStorage) --------
+  // CRITIQUE pour le flux PKCE : le `code_verifier` doit survivre au redirect
+  // pleine page vers le provider OAuth et retour — un store purement mémoire
+  // ne survivrait pas à ce cycle de navigation.
+
+  override setItem(key: string, value: string): void {
+    super.setItem(key, value)
+    if (typeof localStorage === 'undefined') return
+    try {
+      localStorage.setItem(key, value)
+    } catch {
+      // quota exceeded or blocked — ignore
+      this._emitStorageBlocked('setItem')
+    }
+  }
+
+  override getItem(key: string): string | null {
+    if (typeof localStorage === 'undefined') return super.getItem(key)
+    try {
+      const v = localStorage.getItem(key)
+      if (v !== null) return v
+    } catch {
+      // blocked — fall through to in-memory
+      this._emitStorageBlocked('getItem')
+    }
+    return super.getItem(key)
+  }
+
+  override removeItem(key: string): void {
+    super.removeItem(key)
+    if (typeof localStorage === 'undefined') return
+    try {
+      localStorage.removeItem(key)
+    } catch {
+      // blocked — ignore
+      this._emitStorageBlocked('removeItem')
+    }
+  }
+
+  // -- Cookie helpers (SSR) ---------------------------------------------------
+
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Looks for the key matching `this.key`.
+   */
+  loadFromCookie(cookieString: string): void {
+    const prefix = `${this.key}=`
+    const entry = cookieString
+      .split(';')
+      .map((c) => c.trim())
+      .find((c) => c.startsWith(prefix))
+    if (!entry) return
+
+    try {
+      const raw = decodeURIComponent(entry.slice(prefix.length))
+      const parsed: StoredAuth = JSON.parse(raw)
+      if (parsed.token && parsed.refreshToken && parsed.user) {
+        super.save(parsed.token, parsed.refreshToken, parsed.user)
+      }
+    } catch {
+      // malformed cookie — ignore
+    }
+  }
+
+  /**
+   * Serialize current auth state into a `Set-Cookie` value.
+   */
+  exportToCookie(options: CookieOptions = {}): string {
+    const data: StoredAuth = {
+      token: this.token,
+      refreshToken: this.refreshToken,
+      user: this.user,
+    }
+    const encoded = encodeURIComponent(JSON.stringify(data))
+    const parts = [`${this.key}=${encoded}`]
+
+    if (options.path) parts.push(`Path=${options.path}`)
+    if (options.domain) parts.push(`Domain=${options.domain}`)
+    if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`)
+    if (options.secure) parts.push('Secure')
+    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`)
+    if (options.httpOnly) parts.push('HttpOnly')
+
+    return parts.join('; ')
+  }
+
+  // -- Private ----------------------------------------------------------------
+
+  private _loadFromStorage(): void {
+    if (typeof localStorage === 'undefined') return
+    try {
+      const raw = localStorage.getItem(this.key)
+      if (!raw) return
+      const parsed: StoredAuth = JSON.parse(raw)
+      if (parsed.token && parsed.refreshToken && parsed.user) {
+        // Use super.save to trigger listeners + set fields, then persist is a no-op
+        // since we just loaded. But calling super.save is fine — it will also call
+        // _triggerChange which is acceptable on initial load.
+        super.save(parsed.token, parsed.refreshToken, parsed.user)
+      }
+    } catch {
+      // corrupted storage — ignore
+      this._emitStorageBlocked('loadFromStorage')
+    }
+  }
+
+  private _persist(): void {
+    if (typeof localStorage === 'undefined') return
+    const data: StoredAuth = {
+      token: this.token,
+      refreshToken: this.refreshToken,
+      user: this.user,
+    }
+    try {
+      localStorage.setItem(this.key, JSON.stringify(data))
+    } catch {
+      // quota exceeded or blocked — ignore
+      this._emitStorageBlocked('persist')
+    }
+  }
+
+  private _removeStorage(): void {
+    if (typeof localStorage === 'undefined') return
+    try {
+      localStorage.removeItem(this.key)
+    } catch {
+      // blocked — ignore
+      this._emitStorageBlocked('removeStorage')
+    }
+  }
+}