@ciromaciel/auth-react 1.2.0 → 1.3.0

package/dist/index.js

@@ -112,6 +112,28 @@ function forgetAccount(email) {
   return next;
 }
 
+/**
+ * Replaces the local copy with the list the worker returned.
+ *
+ * The worker's list is the one every panel shares, so when it has accounts it
+ * wins: an account removed on another panel must not come back from this
+ * panel's stale copy. An EMPTY answer does not wipe the local one — it is what
+ * a browser that signed in before the shared list existed gets, and those
+ * shortcuts are still true.
+ *
+ * @returns the list to show
+ */
+function adoptRecentAccounts(remote) {
+  if (!Array.isArray(remote) || remote.length === 0) return listRecentAccounts();
+  const next = remote.filter(account => account && typeof account.email === 'string' && account.email.includes('@')).map(account => ({
+    email: normalizeEmail(account.email),
+    method: typeof account.method === 'string' && account.method ? account.method : 'code',
+    lastUsedAt: Number(account.lastUsedAt) || 0
+  })).sort((a, b) => b.lastUsedAt - a.lastUsedAt).slice(0, MAX_RECENT_ACCOUNTS);
+  writeRecentAccounts(next);
+  return next;
+}
+
 /** Records the provider this tab is leaving for. */
 function markSocialDeparture(provider) {
   try {
@@ -693,6 +715,64 @@ const updateProfile = async data => {
   });
 };
 
+/*--- Recent accounts ------------------------------------------------------*/
+
+/*
+ * The server's copy of this browser's sign-in shortcuts.
+ *
+ * `localStorage` is per origin, so a list kept only there stayed on the panel
+ * where the person signed in. The worker keeps it in an HttpOnly cookie on its
+ * own host, which every panel of the application reaches — and answers only to
+ * the origins the application allows (`routes/recent-accounts.js`).
+ *
+ * All three fail soft: the shortcuts are a convenience, and a network error or
+ * an origin the worker refuses must never cost the sign-in. `null` means "no
+ * answer", which the screen reads as "keep what you have".
+ */
+
+/** The list for this application, or `null` when the worker did not answer. */
+const fetchRecentAccounts = async () => {
+  try {
+    const response = await api('/auth/recent-accounts');
+    return Array.isArray(response?.items) ? response.items : null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Records the account of the CURRENT session. The worker reads the email from
+ * the session, never from here. `keepalive` because the screen is usually
+ * navigating away at this very moment.
+ */
+const saveRecentAccount = async (method = 'code') => {
+  try {
+    const response = await api('/auth/recent-accounts', {
+      method: 'POST',
+      body: JSON.stringify({
+        method
+      }),
+      keepalive: true
+    });
+    return Array.isArray(response?.items) ? response.items : null;
+  } catch {
+    return null;
+  }
+};
+
+/** Takes one account off this browser's list, on every panel. */
+const deleteRecentAccount = async email => {
+  try {
+    await api(`/auth/recent-accounts/${encodeURIComponent(email)}`, {
+      method: 'DELETE',
+      keepalive: true
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 /*--- Social sign-in -------------------------------------------------------*/
 
 /**
@@ -801,6 +881,9 @@ const consumeSocialToken = () => {
   if (provider) {
     const email = decodeJWT(token)?.email;
     if (email) rememberAccount(email, provider);
+    // The shared copy, so the other panels learn it too. Not awaited: the
+    // token is already stored, and the sign-in must not wait on a shortcut.
+    saveRecentAccount(provider);
   }
   params.delete('token');
   const rest = params.toString();
@@ -2784,6 +2867,32 @@ function SignIn({
     // eslint-disable-next-line react-hooks/exhaustive-deps -- redirectOrigins enters through the serialized key above
   }, [authLoading, user, authenticatedRedirect, handleRedirect, redirectOriginsKey, navigate]);
 
+  /*
+   * The shared list, from the worker.
+   *
+   * The local copy renders at once; this replaces it when the answer
+   * arrives. That is what makes an account used on the Auth panel appear
+   * on Hoster: `localStorage` never crosses between the two origins.
+   *
+   * If the person has already started typing an email, the list does not
+   * yank the form away from under them — it only feeds the "Contas salvas"
+   * link, one click away.
+   */
+  react.useEffect(() => {
+    if (!recentAccounts) return;
+    let isActive = true;
+    fetchRecentAccounts().then(remote => {
+      if (!isActive || remote === null) return;
+      const next = adoptRecentAccounts(remote);
+      if (form$1.isDirty()) setIsChoosingOther(true);
+      setAccounts(next);
+    });
+    return () => {
+      isActive = false;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- once per mount, like the local read
+  }, [recentAccounts]);
+
   // Step 1 — ask for the code.
   const handleRequest = async values => {
     if (sending) return false;
@@ -2843,6 +2952,9 @@ function SignIn({
   const handleForget = account => {
     const next = forgetAccount(account.email);
     setAccounts(next);
+    // On every panel, not just this one. The local removal above already
+    // took it off this screen, so a failure here costs nothing visible.
+    deleteRecentAccount(account.email);
     if (next.length === 0) setIsManaging(false);
   };
 
@@ -2871,7 +2983,10 @@ function SignIn({
       // Only now, with a session: an email that never received a valid
       // code never becomes a suggestion. Written before the redirect,
       // which may unmount this screen.
-      if (recentAccounts) setAccounts(rememberAccount(sentTo, 'code'));
+      if (recentAccounts) {
+        setAccounts(rememberAccount(sentTo, 'code'));
+        saveRecentAccount('code');
+      }
       const target = handleRedirect ? getRedirectFromLocation(redirectOrigins) : null;
       if (target) applyRedirect(target, navigate);
       onSuccess?.(result?.user ?? null, {
@@ -4121,6 +4236,7 @@ exports.TOKEN_STORAGE_KEY = TOKEN_STORAGE_KEY;
 exports.UserInformation = UserInformation;
 exports.UserProfile = UserProfile;
 exports.Wordmark = Wordmark;
+exports.adoptRecentAccounts = adoptRecentAccounts;
 exports.announceIdentityChange = announceIdentityChange;
 exports.applyRedirect = applyRedirect;
 exports.clearIdentitySwitching = clearIdentitySwitching;
@@ -4128,7 +4244,9 @@ exports.configure = configure;
 exports.consumeSocialError = consumeSocialError;
 exports.consumeSocialToken = consumeSocialToken;
 exports.decodeJWT = decodeJWT;
+exports.deleteRecentAccount = deleteRecentAccount;
 exports.endImpersonation = endImpersonation;
+exports.fetchRecentAccounts = fetchRecentAccounts;
 exports.forgetAccount = forgetAccount;
 exports.getApiUrl = getApiUrl;
 exports.getApplicationInfo = getApplicationInfo;
@@ -4150,6 +4268,7 @@ exports.requestCode = requestCode;
 exports.resolveRedirect = resolveRedirect;
 exports.revokeOtherSessions = revokeOtherSessions;
 exports.revokeSession = revokeSession;
+exports.saveRecentAccount = saveRecentAccount;
 exports.setStoredToken = setStoredToken;
 exports.shouldSignOutOn401 = shouldSignOutOn401;
 exports.signOut = signOut;