@autobusal/providers 1.2.10 → 1.2.12

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@autobusal/providers` are documented here. This project
 adheres to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.12] - 2026-07-24
+
+### Fixed
+
+- The full user profile - name, email, and via the nested admin/operator/agent/subagent/employee/driver/visitor sub-object: phone, address, passport, date of birth, company/NIPT - was persisted verbatim to localStorage, readable at rest by any script on the origin. Only a display-only subset (id, name, name_display, type, status) is now persisted; the full object still lives in-memory during an active session exactly as before. A new bootstrap fetch (wired into Setup) re-hydrates the full profile once per app load using the same reduced signal, guarded so it never fires for a genuine guest.
+
+## [1.2.11] - 2026-07-19
+
+### Fixed
+
+- bff-mode 401 no longer logs the user out when the BFF confirms the session is still valid: the apiClient now rejects the failed request (letting react-query retry) instead of tearing down auth. A single account query 401ing (transient race or a flaky upstream call) previously bounced the user to /login even though they were logged in. Bearer mode unchanged.
 ## [1.2.10] - 2026-07-19
 
 ### Fixed

package/Queries/apiClient.ts

@@ -43,22 +43,21 @@ apiClient.interceptors.response.use(response => (
   if (error.response) {
     // if we have a 401, the session is gone, so we go to the logout page.
     if (error.response.status === 401 && window.location.pathname !== '/account/logout') {
-      // bff mode: auth is a server-side httpOnly cookie the BFF manages. A
-      // request that races the login/cookie hand-off (e.g. the account queries
-      // fired the instant the SPA lands on /account) can 401 transiently while
-      // the session is actually valid - and a blind logout here would drop the
-      // user straight back out. So confirm with the BFF first; if we are still
-      // authenticated, transparently retry the request once instead of logging
-      // out. bearer mode has no such race (the token is attached synchronously
-      // from localStorage) and falls straight through to logout.
-      if (isBffMode && error.config && !error.config._bffAuthRetried) {
+      // bff mode: auth is a server-side httpOnly cookie the BFF manages, so a
+      // single request's 401 does NOT reliably mean "logged out" the way a
+      // bearer 401 does - a query that momentarily races the login/cookie
+      // hand-off (or a flaky upstream call) can 401 while the session is still
+      // valid. A blind logout here drops the user straight back to /login. So
+      // confirm with the BFF: only tear the session down if it agrees we are no
+      // longer authenticated; otherwise just reject and let react-query retry -
+      // the user stays logged in. bearer mode has no such ambiguity (the token
+      // is attached synchronously from localStorage) and logs out immediately.
+      if (isBffMode) {
         try {
           const { data } = await apiClient.get('/session');
 
           if (data?.authenticated) {
-            error.config._bffAuthRetried = true;
-
-            return await apiClient(error.config);
+            return Promise.reject(error);
           }
         } catch {
           // /session unreachable - fall through to logout.

package/Setup/Setup.tsx

@@ -1,6 +1,7 @@
 import Preload from './Preload';
 import languages from './languages';
 import analytics from './analytics';
+import useUserBootstrap from './useUserBootstrap';
 import { useGetSettings, useGetMenu } from '../services';
 
 interface Props {
@@ -12,6 +13,7 @@ const Setup = ({ type, children }: Props): JSX.Element => {
   const { data } = useGetSettings();
 
   useGetMenu();
+  useUserBootstrap();
 
   languages(type, data.preferences.languages.default);
 

package/Setup/useUserBootstrap.ts

@@ -0,0 +1,52 @@
+import { useEffect } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import apiClient, { isBffMode } from '../Queries/apiClient';
+import { useUserStore } from '../stores/user';
+import { UserData } from '../types/users';
+
+// Edited: Ferjolt Ozuni - Date: 2026-07-24
+// The user store now only persists a display-only subset to localStorage
+// (see stores/user.ts) - the full profile (nested role data: phone, address,
+// passport, company, etc.) is no longer restored on a cold page load. This
+// hook re-fetches it once per app mount, so any component reading
+// `data.visitor.phone` etc. gets it back a moment after load instead of
+// instantly - the only user-visible change from this fix.
+//
+// This must NOT fire for a genuine guest: apiClient's response interceptor
+// treats any 401 as "session is gone" and redirects to /account/logout
+// (bearer mode immediately, bff mode after confirming via /session) - firing
+// this unconditionally would send every anonymous visitor there. It only
+// runs when there's an actual signal of a prior login: the bearer token
+// (bearer mode) or the redacted user stub this same store persists (bff
+// mode, where the token itself is an httpOnly cookie invisible to JS).
+const hasLoginSignal = (): boolean => (
+  (!isBffMode && localStorage.getItem('token') !== null)
+  || localStorage.getItem('user') !== null
+);
+
+const useUserBootstrap = (): void => {
+  const user = useUserStore();
+
+  const enabled = hasLoginSignal();
+
+  const { data } = useQuery<UserData>({
+    queryKey: ['account-bootstrap'],
+    queryFn: async () => (
+      await apiClient
+        .get('/api/account/refresh')
+        .then(response => response.data)
+    ),
+    enabled,
+    retry: false,
+    staleTime: Infinity
+  });
+
+  useEffect(() => {
+    if (data) {
+      user.save(data);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [data]);
+};
+
+export default useUserBootstrap;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.2.10",
+  "version": "1.2.12",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"

package/stores/user.ts

@@ -7,19 +7,45 @@ export interface UserStore {
   remove: () => void
 }
 
-const initial = localStorage.getItem('user') ? JSON.parse(localStorage.getItem('user') ?? '{}') : undefined;
+// Edited: Ferjolt Ozuni - Date: 2026-07-24
+// Bug: the full UserData object - name, email, and (via the nested
+// admin/operator/agent/subagent/employee/driver/visitor sub-object) phone,
+// address, passport, date of birth, company/NIPT - was persisted verbatim to
+// localStorage, readable at rest by any script on the origin (any XSS,
+// a malicious browser extension, disk/backup access on a shared machine).
+// Fix: only a display-only subset - enough to paint the UI immediately on
+// load - is ever written to disk. The full object still lives in the
+// in-memory store during an active session exactly as before (nothing
+// changes for any component reading `data.visitor.phone` etc. right after
+// login/activate/refresh); it's just never written to disk. A bootstrap
+// fetch (see Setup/useUserBootstrap.ts) re-hydrates the full in-memory
+// object shortly after app load using this same reduced signal.
+type PersistedUser = Pick<UserData, 'id' | 'name' | 'name_display' | 'type' | 'status'>;
+
+const STORAGE_KEY = 'user';
+
+const redact = (user: UserData): PersistedUser => ({
+  id: user.id,
+  name: user.name,
+  name_display: user.name_display,
+  type: user.type,
+  status: user.status
+});
+
+const stored = localStorage.getItem(STORAGE_KEY);
+const initial: PersistedUser | undefined = stored ? JSON.parse(stored) : undefined;
 
 export const useUserStore = create<UserStore>((set) => ({
-  data: initial,
+  data: initial as UserData | undefined,
   save: (user) => set(() => {
-    localStorage.setItem('user', JSON.stringify(user));
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(redact(user)));
 
     return {
       data: user
     };
   }),
   remove: () => set(() => {
-    localStorage.removeItem('user');
+    localStorage.removeItem(STORAGE_KEY);
 
     return {
       data: undefined