@carlonicora/nextjs-jsonapi 6.5.0 → 6.7.0

package/src/features/account-deletion/utils/__tests__/account-deletion-notice.spec.ts

@@ -0,0 +1,40 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { consumeAccountDeletionCancelled, markAccountDeletionCancelled } from "../account-deletion-notice";
+
+describe("account-deletion notice flag", () => {
+  beforeEach(() => {
+    window.sessionStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    window.sessionStorage.clear();
+  });
+
+  it("consume returns true once after mark, then false", () => {
+    expect(consumeAccountDeletionCancelled()).toBe(false);
+
+    markAccountDeletionCancelled();
+
+    expect(consumeAccountDeletionCancelled()).toBe(true);
+    expect(consumeAccountDeletionCancelled()).toBe(false);
+  });
+
+  it("survives a throwing sessionStorage", () => {
+    const throwing = {
+      getItem: () => {
+        throw new Error("blocked");
+      },
+      setItem: () => {
+        throw new Error("blocked");
+      },
+      removeItem: () => {
+        throw new Error("blocked");
+      },
+    };
+    vi.stubGlobal("sessionStorage", throwing);
+
+    expect(() => markAccountDeletionCancelled()).not.toThrow();
+    expect(consumeAccountDeletionCancelled()).toBe(false);
+  });
+});

package/src/features/account-deletion/utils/account-deletion-notice.ts

@@ -0,0 +1,27 @@
+/**
+ * One-shot flag between the login that cancelled a pending account deletion and
+ * the first page after it, which shows AccountDeletionCancelledNotice. Kept in
+ * sessionStorage so it survives the redirect (and the full reload of the
+ * Discord / Google path) but not the tab. Storage can be missing or throw
+ * (private mode, blocked site data): the notice is then simply not shown.
+ */
+export const ACCOUNT_DELETION_CANCELLED_KEY = "nja:accountDeletionCancelled";
+
+export function markAccountDeletionCancelled(): void {
+  try {
+    sessionStorage.setItem(ACCOUNT_DELETION_CANCELLED_KEY, "1");
+  } catch {
+    // Storage unavailable: no notice.
+  }
+}
+
+export function consumeAccountDeletionCancelled(): boolean {
+  try {
+    const value = sessionStorage.getItem(ACCOUNT_DELETION_CANCELLED_KEY);
+    if (value === null) return false;
+    sessionStorage.removeItem(ACCOUNT_DELETION_CANCELLED_KEY);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/features/account-deletion/utils/index.ts

@@ -0,0 +1 @@
+export * from "./account-deletion-notice";

package/src/features/auth/components/forms/Cookies.tsx

@@ -3,6 +3,7 @@
 import { useEffect, useState } from "react";
 import { JsonApiHydratedDataInterface, Modules, rehydrate } from "../../../../core";
 import { useI18nRouter } from "../../../../i18n";
+import { markAccountDeletionCancelled } from "../../../account-deletion/utils/account-deletion-notice";
 import { UserInterface } from "../../../user";
 import { useCurrentUserContext } from "../../../user/contexts";
 import { AuthInterface } from "../../data";
@@ -18,6 +19,8 @@ export function Cookies({ dehydratedAuth, page }: { dehydratedAuth: JsonApiHydra
     async function saveTokenOnServer() {
       await AuthService.saveToken({ dehydratedAuth });
       const auth: AuthInterface = rehydrate(Modules.Auth, dehydratedAuth) as AuthInterface;
+      // Discord / Google path: the flag is on the Auth document from the code exchange.
+      if (auth.deletionCancelled) markAccountDeletionCancelled();
       setUser(auth.user as UserInterface);
       setHasSaved(true);
 

package/src/features/auth/components/forms/TwoFactorChallenge.tsx

@@ -18,6 +18,7 @@ import {
   TabsList,
   TabsTrigger,
 } from "../../../../shadcnui";
+import { markAccountDeletionCancelled } from "../../../account-deletion/utils/account-deletion-notice";
 import { UserInterface } from "../../../user";
 import { useCurrentUserContext } from "../../../user/contexts";
 import { useAuthContext } from "../../contexts";
@@ -46,6 +47,7 @@ export function TwoFactorChallenge() {
   }
 
   const handleSuccess = (auth: AuthInterface) => {
+    if (auth.deletionCancelled) markAccountDeletionCancelled();
     setPendingTwoFactor(undefined);
     setUser(auth.user);
 

package/src/features/auth/data/__tests__/auth.spec.ts

@@ -0,0 +1,36 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import { ApiRequestDataTypeInterface } from "../../../../core/interfaces/ApiRequestDataTypeInterface";
+import { ModuleRegistry } from "../../../../core/registry/ModuleRegistry";
+import { Auth } from "../auth";
+
+// Auth.rehydrate() resolves Modules.User through the real ModuleRegistry (the
+// argument of `_readIncluded`), so it must be registered even though these
+// fixtures carry no included user.
+const registerIfAbsent = (key: string, module: ApiRequestDataTypeInterface) => {
+  try {
+    ModuleRegistry.get(key as any);
+  } catch {
+    ModuleRegistry.register(key, module);
+  }
+};
+
+beforeAll(() => {
+  registerIfAbsent("Auth", { name: "auth", model: Auth } as any);
+  registerIfAbsent("User", { name: "users", model: class {} } as any);
+});
+
+const rehydrateWith = (attributes: Record<string, any>) =>
+  new Auth().rehydrate({
+    jsonApi: { type: "auth", id: "auth-1", attributes: { token: "t", refreshToken: "r", ...attributes } },
+    included: [],
+  } as any);
+
+describe("Auth", () => {
+  describe("rehydrate", () => {
+    it("deletionCancelled true when the attribute is true, false otherwise", () => {
+      expect(rehydrateWith({ deletionCancelled: true }).deletionCancelled).toBe(true);
+      expect(rehydrateWith({ deletionCancelled: false }).deletionCancelled).toBe(false);
+      expect(rehydrateWith({}).deletionCancelled).toBe(false);
+    });
+  });
+});

package/src/features/auth/data/__tests__/pending-registration.spec.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { PendingRegistration } from "../pending-registration";
+
+const hydrate = (attributes: Record<string, any>) =>
+  new PendingRegistration().rehydrate({
+    jsonApi: { type: "pending-registrations", id: "pending-1", attributes },
+    included: [],
+  } as any);
+
+describe("PendingRegistration.rehydrate()", () => {
+  it("rehydrates every attribute", () => {
+    const pending = hydrate({
+      name: "Aria",
+      email: "aria@example.com",
+      avatar: "https://cdn.example.com/aria.png",
+      provider: "discord",
+      hasPass: true,
+      emailInUse: true,
+    });
+
+    expect(pending.id).toBe("pending-1");
+    expect(pending.name).toBe("Aria");
+    expect(pending.email).toBe("aria@example.com");
+    expect(pending.avatar).toBe("https://cdn.example.com/aria.png");
+    expect(pending.provider).toBe("discord");
+    expect(pending.hasPass).toBe(true);
+    expect(pending.emailInUse).toBe(true);
+  });
+
+  it("leaves avatar undefined and defaults hasPass/emailInUse to false when absent", () => {
+    const pending = hydrate({ name: "Aria", email: "aria@example.com", provider: "google" });
+
+    expect(pending.avatar).toBeUndefined();
+    expect(pending.hasPass).toBe(false);
+    expect(pending.emailInUse).toBe(false);
+  });
+});

package/src/features/auth/data/auth.interface.ts

@@ -35,4 +35,6 @@ export interface AuthInterface extends ApiDataInterface {
   get token(): string;
   get refreshToken(): string;
   get user(): UserInterface;
+  /** True on the session created by the login that cancelled a pending account deletion. */
+  get deletionCancelled(): boolean;
 }

package/src/features/auth/data/auth.service.ts

@@ -9,8 +9,10 @@ import {
   rehydrate,
 } from "../../../core";
 import { JsonApiDelete, JsonApiGet, JsonApiPost } from "../../../unified";
+import { markAccountDeletionCancelled } from "../../account-deletion/utils/account-deletion-notice";
 import { UserInterface } from "../../user";
 import { getTokenHandler } from "../config";
+import { PendingRegistrationInterface } from "./pending-registration.interface";
 import { TwoFactorChallengeInterface } from "./two-factor-challenge.interface";
 
 export class AuthService extends AbstractService {
@@ -44,6 +46,9 @@ export class AuthService extends AbstractService {
     // Normal auth response
     const auth = apiResponse.data as AuthInterface;
 
+    // Login returns only the user to Login.tsx, so the flag is read here.
+    if (auth.deletionCancelled) markAccountDeletionCancelled();
+
     // Use injected token handler if configured
     const handler = getTokenHandler();
     if (handler) {
@@ -172,6 +177,24 @@ export class AuthService extends AbstractService {
     }
   }
 
+  /**
+   * Reads an OAuth sign-up waiting for consent. Throws an Error carrying
+   * `status` (404 when the pending registration expired); callers catch it.
+   */
+  static async findPendingRegistration(params: { pendingId: string }): Promise<PendingRegistrationInterface> {
+    return this.callApi<PendingRegistrationInterface>({
+      type: Modules.PendingRegistration,
+      method: HttpMethod.GET,
+      endpoint: new EndpointCreator({
+        endpoint: Modules.Auth,
+        id: "oauth",
+        childEndpoint: Modules.PendingRegistration,
+        childId: params.pendingId,
+      }).generate(),
+      suppressGlobalError: true,
+    });
+  }
+
   static async completeOAuthRegistration(params: {
     pendingId: string;
     termsAcceptedAt: string;

package/src/features/auth/data/auth.ts

@@ -6,6 +6,12 @@ export class Auth extends AbstractApiData implements AuthInterface {
   private _token?: string;
   private _refreshToken?: string;
   private _user?: UserInterface;
+  private _deletionCancelled: boolean = false;
+
+  /** True on the session created by the login that cancelled a pending account deletion. */
+  get deletionCancelled(): boolean {
+    return this._deletionCancelled;
+  }
 
   get token(): string {
     if (!this._token) throw new Error("Token is not defined");
@@ -27,6 +33,7 @@ export class Auth extends AbstractApiData implements AuthInterface {
 
     this._token = data.jsonApi.attributes.token ?? undefined;
     this._refreshToken = data.jsonApi.attributes.refreshToken ?? undefined;
+    this._deletionCancelled = data.jsonApi.attributes.deletionCancelled === true;
 
     this._user = this._readIncluded(data, "user", Modules.User) as UserInterface;
 

package/src/features/auth/data/index.ts

@@ -22,3 +22,5 @@ export * from "./passkey-verify-login";
 export * from "./two-factor-enable";
 export * from "./two-factor-challenge";
 export * from "./backup-code-verify";
+export * from "./pending-registration.interface";
+export * from "./pending-registration";

package/src/features/auth/data/pending-registration.interface.ts

@@ -0,0 +1,10 @@
+import { ApiDataInterface } from "../../../core";
+
+export interface PendingRegistrationInterface extends ApiDataInterface {
+  get name(): string;
+  get email(): string;
+  get avatar(): string | undefined;
+  get provider(): string;
+  get hasPass(): boolean;
+  get emailInUse(): boolean;
+}

package/src/features/auth/data/pending-registration.ts

@@ -0,0 +1,57 @@
+import { AbstractApiData, JsonApiHydratedDataInterface, Modules } from "../../../core";
+import { PendingRegistrationInterface } from "./pending-registration.interface";
+
+export class PendingRegistration extends AbstractApiData implements PendingRegistrationInterface {
+  private _name?: string;
+  private _email?: string;
+  private _avatar?: string;
+  private _provider?: string;
+  private _hasPass?: boolean;
+  private _emailInUse?: boolean;
+
+  get name(): string {
+    return this._name ?? "";
+  }
+
+  get email(): string {
+    return this._email ?? "";
+  }
+
+  get avatar(): string | undefined {
+    return this._avatar;
+  }
+
+  get provider(): string {
+    return this._provider ?? "";
+  }
+
+  get hasPass(): boolean {
+    return this._hasPass ?? false;
+  }
+
+  get emailInUse(): boolean {
+    return this._emailInUse ?? false;
+  }
+
+  rehydrate(data: JsonApiHydratedDataInterface): this {
+    super.rehydrate(data);
+    this._name = data.jsonApi.attributes.name;
+    this._email = data.jsonApi.attributes.email;
+    this._avatar = data.jsonApi.attributes.avatar ?? undefined;
+    this._provider = data.jsonApi.attributes.provider;
+    this._hasPass = data.jsonApi.attributes.hasPass ?? false;
+    this._emailInUse = data.jsonApi.attributes.emailInUse ?? false;
+    return this;
+  }
+
+  /** Read-only resource: the payload only identifies it. */
+  createJsonApi(data: { id: string }) {
+    return {
+      data: {
+        type: Modules.PendingRegistration.name,
+        id: data.id,
+        attributes: {},
+      },
+    };
+  }
+}

package/src/features/auth/pending-registration.module.ts

@@ -0,0 +1,9 @@
+import { ModuleFactory } from "../../permissions";
+import { PendingRegistration } from "./data/pending-registration";
+
+export const PendingRegistrationModule = (factory: ModuleFactory) =>
+  factory({
+    name: "pending-registrations",
+    pageUrl: "/auth/consent",
+    model: PendingRegistration,
+  });

package/src/features/user/contexts/UserContext.tsx

@@ -8,6 +8,10 @@ import { usePageUrlGenerator } from "../../../hooks";
 import { BreadcrumbItemData } from "../../../interfaces";
 import { Action } from "../../../permissions";
 import { getRoleId } from "../../../roles";
+import {
+  AccountDeletionAdminTrigger,
+  isAccountDeletionEnabled,
+} from "../../account-deletion/components/AccountDeletionAdminTrigger";
 import { UserDeleter, UserEditor, UserReactivator, UserResentInvitationEmail } from "../components/forms";
 import { UserInterface } from "../data";
 import { useCurrentUserContext } from "./CurrentUserContext";
@@ -83,6 +87,10 @@ export const UserProvider = ({ children, dehydratedUser }: UserProviderProps) =>
           functions.push(<UserResentInvitationEmail key={`UserResentInvitationEmail`} user={user} />);
 
         functions.push(<UserDeleter key={`UserDeleter`} user={user} />);
+
+        // Opt-in: only apps that registered AccountDeletionModule, platform administrators only.
+        if (hasRole(getRoleId().Administrator) && isAccountDeletionEnabled())
+          functions.push(<AccountDeletionAdminTrigger key={`AccountDeletionAdminTrigger`} user={user} />);
       }
 
       functions.push(<UserEditor key={`UserEditor`} user={user} propagateChanges={setUser} />);