@dashadmin/dash-admin 1.3.73 → 1.3.74-srcfree.2

package/src/contexts/auth/DASHAuthenticationService.tsx

@@ -1,915 +0,0 @@
-/**
- * Lightweight authentication service for public app
- * This service handles authentication without react-admin dependencies
- */
-
-import { createAxiosInstance } from 'dash-axios-hook';
-import { getCookie, setCookie } from '../../utils/cookies';
-import { getEnv } from '../../config/DASHAdminSystemConstants';
-import { AuthPersistenceService, syncLocalStorageToDeviceStore, clearDeviceStoreAuth } from 'dash-auth';
-import { setAuthEvent } from './AuthContext';
-import {DASHAppConstants} from 'dash-constants';
-
-import {DASHAdminSystemConstants} from  'dash-constants'
-
-import { dashStorage } from 'dash-utils';
-
-import { DASH_REDUX_ACTIONS, dispatchToRedux } from 'dash-admin-state';
-import { ACTION_UPDATE_AUTH } from 'dash-admin-state/src/redux/reducers/Auth';
-export interface DASHAuthenticationServiceLoginCredentials {
-    username: string;
-    password: string;
-    redirect?: string;
-    meta?: any;
-}
-
-export interface DASHAuthenticationServiceAuthResponse {
-    success: boolean;
-    token?: string;
-    user?: any;
-    auth?: any;
-    refreshToken?: string;
-    error?: string;
-    redirectAfterLogin?: string;
-}
-
-/*
-@TechDebt: refresh token strategy not implemented neither in backend or frontend.
-*/
-class DASHAuthenticationService {
-    private axiosInstance: any;
-    private readonly REDIRECT_STORAGE_KEY = 'redirectAfterLogin';
-
-    constructor() {
-        // Initialize axios instance in constructor
-        this.axiosInstance = createAxiosInstance();
-    }
-
-    // Method to recreate axios instance with new options if needed
-    reinitializeAxios(options?: any) {
-        this.axiosInstance = createAxiosInstance(options);
-    }
-
-    // Helper to sanitize redirect URLs for Electron file:// paths
-    private sanitizeRedirectUrl(url: string): string {
-        if (!url) return '/';
-        
-        // Check if this looks like a Windows file path (common in Electron)
-        // e.g., "/C:/Program Files/..." or "C:/..." or file:// URLs
-        const isWindowsFilePath = /^\/[A-Za-z]:\/|^[A-Za-z]:\/|^file:\/\//i.test(url);
-
-        // Check if we are in an Electron/HashRouter environment
-        const isElectron = window.location.protocol === 'file:' || 
-                          getEnv('IS_ELECTRON') === 'true' || 
-                          getEnv('IS_ELECTRON') === true;
-
-        // Fix for Electron: If it is a file:// URL (or Windows path) AND contains a hash, 
-        // implies we want to preserve the internal route (e.g. file:///.../index.html#/dashboard)
-        if (isWindowsFilePath || url.includes('index.html')) {
-            if (url.includes('#')) {
-                const parts = url.split('#');
-                if (parts.length > 1 && parts[1]) {
-                    const route = parts[1];
-                    console.log('Detected file/electron path with hash, extracting route:', route);
-                    return '#' + route;
-                }
-            }
-        }
-        
-        if (isWindowsFilePath) {
-            console.log('Detected Windows file path in redirect, resetting to #/');
-            return '#/';
-        }
-        
-        // Check for common Electron file patterns
-        if (url.includes('/resources/app/') || url.includes('/dist/index.html') || url.includes('Program Files')) {
-            console.log('Detected Electron app path in redirect, resetting to #/');
-            return '#/';
-        }
-
-        // If we are in Electron and the URL is a standard path (e.g. /selfservice/qr) without a hash,
-        // force the hash prefix so HashRouter handles it correctly.
-        if (isElectron && url.startsWith('/') && !url.startsWith('#')) {
-             console.log('Detected Electron environment with standard path, adding hash prefix:', url);
-             return '#' + url;
-        }
-        
-        return url;
-    }
-
-    // Method to set pending redirect URL
-    setPendingRedirect(url: string): void {
-        // Guard: Skip if redirect is root path (causes infinite redirect loops)
-        if (!url || url === '/' || url === '#/' || url === '#') {
-            console.log('Skipping pending redirect for root path:', url);
-            return;
-        }
-        const sanitizedUrl = this.sanitizeRedirectUrl(url);
-        // Double-check sanitized URL isn't root either
-        if (sanitizedUrl === '/' || sanitizedUrl === '#/' || sanitizedUrl === '#') {
-            console.log('Skipping pending redirect for sanitized root path:', sanitizedUrl);
-            return;
-        }
-        console.log('Setting pending redirect:', url, '→', sanitizedUrl);
-        dashStorage.setItem(this.REDIRECT_STORAGE_KEY, sanitizedUrl);
-    }
-
-    // Method to get pending redirect URL
-    getPendingRedirect(): string | null {
-        return dashStorage.getItem(this.REDIRECT_STORAGE_KEY);
-    }
-
-    // Method to clear pending redirect URL
-
-    clearPendingRedirect(): void {
-        console.log('Clearing pending redirect');
-        dashStorage.removeItem(this.REDIRECT_STORAGE_KEY);
-    }
-
-    // Helper to get redirect URL from user's first role with a configured redirect
-    private getRoleRedirect(user: any): string | null {
-        const roles = user?.roles;
-        if (Array.isArray(roles) && roles.length > 0) {
-            // Return the first role's redirect if defined
-            for (const role of roles) {
-                if (role.redirect) {
-                    console.log('Found role redirect:', role.name, '->', role.redirect);
-                    return role.redirect;
-                }
-            }
-        }
-        return null;
-    }
-
-    // Method to determine final redirect URL (backend takes precedence over localStorage)
-    // persistRedirect: if true, saves to storage (use during login). If false, just returns the value (use during app init).
-    private determineRedirectUrl(backendRedirect?: string, persistRedirect: boolean = true): string | null {
-
-        let val = null;
-        // Backend redirect takes precedence
-        if (backendRedirect) {
-            console.log('Using backend redirect:', backendRedirect, '(persist:', persistRedirect, ')');
-            val = backendRedirect;
-            if (persistRedirect) {
-                this.setPendingRedirect(val);
-                return this.getPendingRedirect();
-            }
-            return this.sanitizeRedirectUrl(val);
-        }
-
-        // Fall back to localStorage redirect
-        const localStorageRedirect = this.getPendingRedirect();
-        if (localStorageRedirect) {
-            console.log('Using localStorage redirect:', localStorageRedirect);
-            return localStorageRedirect;
-        }
-
-        val = getEnv("APP_DEFAULT_REDIRECT");
-        if (persistRedirect) {
-            this.setPendingRedirect(val);
-            return this.getPendingRedirect();
-        }
-
-        return this.sanitizeRedirectUrl(val);
-    }
-
-    /**
-     * Syncs the local "which tenant is this session scoped to" storage from
-     * the backend's own resolution, on every auth response — login, token
-     * init, refresh, and the persisted-auth fallback all call this so none of
-     * them can drift out of sync with what the other three do.
-     *
-     * `auth.active_tenant_id` (see TenancyContextService on the backend) is
-     * always authoritative now: a plain tenant-scoped user gets their own
-     * tenant, a TenancyAdmin managing one tenant gets that one automatically,
-     * and a TenancyAdmin managing several gets whatever they last explicitly
-     * picked via TenantSwitcher (persisted server-side) — or null, which is a
-     * real, intentional "prefers the tenancy-wide view" state, not "unset".
-     * Trusting the backend outright (no `!dashStorage.getItem(...)` guard)
-     * is what makes a preference set on one device actually show up on
-     * another — the entire point of persisting it server-side instead of
-     * only in this browser's storage.
-     */
-    private syncActiveTenant(auth: any): void {
-        const impersonationEnabled = JSON.parse(
-            DASHAdminSystemConstants.system.ENABLE_TENANT_IMPERSONATION.toString(),
-        );
-
-        if (!impersonationEnabled || !auth?.user?.tenant_id) {
-            return;
-        }
-
-        dashStorage.setItem('tenant_id', auth.user.tenant_id);
-        dashStorage.setItem('user_id', auth.user.id);
-
-        const activeTenantId = auth.auth?.active_tenant_id;
-        if (activeTenantId) {
-            dashStorage.setItem('active_tenant_id', activeTenantId);
-        } else {
-            dashStorage.removeItem('active_tenant_id');
-        }
-    }
-
-    // Update the login method to dispatch to Redux directly
-    async login(credentials: DASHAuthenticationServiceLoginCredentials): Promise<DASHAuthenticationServiceAuthResponse> {
-        console.log("=== DASH AUTH SERVICE LOGIN START ===");
-        console.log("Credentials:", { username: credentials.username, password: "***", redirect: credentials.redirect, meta: credentials.meta });
-
-        if (!(credentials.username && credentials.password)) {
-            console.log("❌ Missing credentials");
-            return Promise.resolve({
-                success: false,
-                error: 'Username and password are required'
-            });
-        }
-
-        try {
-            console.log("Making login request to /login");
-
-            const loginResponse = await this.axiosInstance.post('/login', {
-                email: credentials.username,
-                password: credentials.password,
-                redirect: credentials.redirect,
-                meta: credentials.meta
-            });
-
-            console.log("Login response status:", loginResponse.status);
-            console.log("Login response data:", loginResponse.data);
-
-
-
-            if (loginResponse.status >= 200 && loginResponse.status <= 299) {
-                console.log("✅ Login response successful");
-
-                // ✅ Extract redirectTo from backend response FIRST
-                const backendRedirectTo = loginResponse.data.redirectTo;
-
-                console.log("🎯 Backend redirectTo:", backendRedirectTo);
-
-                const today = new Date();
-                const expires = new Date();
-                expires.setDate(today.getDate() + 2);
-
-                // Check if we have token data
-                if (loginResponse.data && loginResponse.data.token) {
-
-                    console.log("Setting token in storage");
-                    //setCookie('token', loginResponse.data.token, { expires });
-                    dashStorage.setItem('token', loginResponse.data.token);
-                    
-                    // Handle refresh token (backend uses snake_case: refresh_token)
-                    const refreshToken = loginResponse.data?.refresh_token || loginResponse.data?.refreshToken;
-                    if (refreshToken) {
-                        console.log("Setting refresh token in storage");
-                        dashStorage.setItem('refreshToken', refreshToken);
-                    }
-                    
-                    if (loginResponse.data?.meta) {
-                        console.log("Setting app");
-                        dashStorage.setItem('app', loginResponse.data.meta.app);
-                    }
-
-                    await syncLocalStorageToDeviceStore();
-
-                } else {
-                    console.warn("⚠️ No token in login response");
-                }
-
-                try {
-                    console.log("Getting auth data from:", getEnv('APP_GETAUTH_ENDPOINT'));
-
-                    // Get complete auth data
-                    const authResponse = await this.axiosInstance.get(getEnv('APP_GETAUTH_ENDPOINT'));
-                    console.log("Auth response status:", authResponse.status);
-                    console.log("Auth response data:", authResponse.data);
-
-                    const auth = authResponse.data;
-
-                    // ✅ Use backend redirectTo as the primary redirect
-                    let finalRedirect = backendRedirectTo;
-
-                    // Only fall back to other redirects if backend didn't provide one
-                    if (!finalRedirect) {
-                        // Check auth response redirect, then check role redirects
-                        const roleRedirect = this.getRoleRedirect(auth.user);
-                        const authRedirect = auth.redirect || auth.user?.redirect || roleRedirect || null;
-                        console.log("Auth response redirect:", authRedirect, "(role redirect:", roleRedirect, ")");
-
-                        if (authRedirect) {
-                            finalRedirect = authRedirect;
-                        } else if (credentials.redirect && credentials.redirect !== '/login') {
-                            finalRedirect = credentials.redirect;
-                        } else {
-                            finalRedirect = getEnv("APP_DEFAULT_REDIRECT") || '/';
-                        }
-                    }
-
-                    console.log("🎯 Final redirect determined:", finalRedirect);
-
-                    // Use AuthPersistenceService to save auth data
-                    AuthPersistenceService.saveAuth(auth);
-
-                    // Sync dash-user-locale with tenant's primary language or user preference
-                    const languageCode = auth.auth?.tenantSettings?.primary_language_code || auth.user?.preferences?.locale;
-                    if (languageCode) {
-                        localStorage.setItem('dash-user-locale', languageCode);
-                        // Dispatch event to trigger I18nBridgeContext locale change
-                        window.dispatchEvent(new CustomEvent('dash:locale-change', { 
-                            detail: { locale: languageCode } 
-                        }));
-                        console.log('🌐 DASHAuthService: Dispatched locale change event:', languageCode);
-                    }
-
-                    // Set basic localStorage for react-admin compatibility
-                    dashStorage.setItem('authenticated', 'true');
-                    dashStorage.setItem('user', JSON.stringify(auth.user));
-                    dashStorage.setItem(
-                        'roles',
-                        auth.user?.roles
-                            ? JSON.stringify(auth.user.roles)
-                            : JSON.stringify(DASHAppConstants.system.GUEST_ROLE),
-                    );
-
-                    // Handle tenant impersonation if enabled, including which
-                    // tenant this session starts scoped to.
-                    this.syncActiveTenant(auth);
-
-                    const resultObject = {
-                        authenticated: true,
-                        user: auth.user,
-                        auth: auth.auth,
-                        token: loginResponse.data.token || dashStorage.getItem('token'),
-                        roles: auth.user?.roles
-                    }
-
-                    // Dispatch directly to Redux instead of using setAuthEvent
-                    console.log('🔄 DASHAuthenticationService: Dispatching to Redux:', resultObject);
-                    dispatchToRedux(
-                        DASH_REDUX_ACTIONS.updateAuth(ACTION_UPDATE_AUTH, {
-                            user: resultObject.user,
-                            authenticated: resultObject.authenticated,
-                            auth: resultObject.auth,
-                        })
-                    );
-
-                     await syncLocalStorageToDeviceStore();
-                    console.log("✅ Login completed successfully");
-                    return Promise.resolve({
-                        success: true,
-                        token: resultObject.token,
-                        user: resultObject.user,
-                        auth: resultObject.auth,
-                        redirectAfterLogin: finalRedirect, // ✅ Use the backend redirectTo
-                    });
-                } catch (error) {
-                     await syncLocalStorageToDeviceStore();
-                    console.error('❌ Error getting auth data:', error);
-                    this.logoutFromStorage("login get auth error");
-                    return Promise.resolve({
-                        success: false,
-                        error: 'Failed to get user authentication data'
-                    });
-                }
-            } else {
-                 await syncLocalStorageToDeviceStore();
-                console.log("❌ Login response status not successful:", loginResponse.status);
-                this.logoutFromStorage("login status error logout");
-                return Promise.reject({
-                    success: false,
-                    error: `Login failed with status: ${loginResponse.status}`
-                });
-            }
-        } catch (error: any) {
-             await syncLocalStorageToDeviceStore();
-            console.error('❌ Login error:', error);
-            console.error('Error details:', {
-                message: error?.message,
-                response: error?.response?.data,
-                status: error?.response?.status
-            });
-            this.logoutFromStorage("login error logout");
-             await syncLocalStorageToDeviceStore();
-            return Promise.reject({
-                success: false,
-                error: error?.response?.data?.message || error?.message || 'Login failed'
-            });
-        }
-
-        
-    }
-
-    // Update the initializeFromToken method to dispatch to Redux directly
-    async initializeFromToken(): Promise<DASHAuthenticationServiceAuthResponse> {
-        const token = dashStorage.getItem('token');
-
-        if (!token) {
-            return {
-                success: false,
-                error: 'No token found'
-            };
-        }
-
-        try {
-            console.log('Initializing auth from existing token...');
-
-            // Get complete auth data using existing token
-            const { data: auth } = await this.axiosInstance.get(getEnv('APP_GETAUTH_ENDPOINT'));
-
-            // Extract redirect from backend auth response, including role redirects
-            const roleRedirect = this.getRoleRedirect(auth.user);
-            const backendRedirect = auth.redirect || auth.user?.redirect || roleRedirect || null;
-            console.log("Backend redirect found during token initialization:", backendRedirect, "(role redirect:", roleRedirect, ")");
-
-            // Use AuthPersistenceService to save auth data
-            AuthPersistenceService.saveAuth(auth);
-
-            // Set basic localStorage for react-admin compatibility
-            dashStorage.setItem('authenticated', 'true');
-            dashStorage.setItem('user', JSON.stringify(auth.user));
-            dashStorage.setItem(
-                'roles',
-                auth.user?.roles
-                    ? JSON.stringify(auth.user.roles)
-                    : JSON.stringify(DASHAppConstants.system.GUEST_ROLE),
-            );
-
-            // Handle tenant impersonation if enabled, including which tenant
-            // this session is scoped to.
-            this.syncActiveTenant(auth);
-            if (auth.user?.tenant_id) {
-                setCookie('tenant_id', auth.user.tenant_id);
-                setCookie('user_id', auth.user.id);
-            }
-
-            const resultObject = {
-                authenticated: true,
-                user: auth.user,
-                auth: auth.auth,
-                token: token,
-                roles: auth.user?.roles
-            };
-
-            // Dispatch directly to Redux instead of using setAuthEvent
-            console.log('🔄 DASHAuthenticationService: Dispatching token init to Redux:', resultObject);
-            dispatchToRedux(
-                DASH_REDUX_ACTIONS.updateAuth(ACTION_UPDATE_AUTH, {
-                    user: resultObject.user,
-                    authenticated: resultObject.authenticated,
-                    auth: resultObject.auth,
-                })
-            );
-
-            console.log('Auth initialized successfully from existing token');
-             await syncLocalStorageToDeviceStore();
-            // Determine final redirect URL - don't persist during token init (only during actual login)
-            const redirectAfterLogin = this.determineRedirectUrl(backendRedirect, false);
-
-            return {
-                success: true,
-                token: token,
-                user: auth.user,
-                auth: auth.auth,
-                redirectAfterLogin: redirectAfterLogin
-            };
-        } catch (error) {
-            console.error('Error initializing auth from token:', error);
-            this.logoutFromStorage("initialize from token error");
-             await syncLocalStorageToDeviceStore();
-            return {
-                success: false,
-                error: 'Failed to initialize authentication from token'
-            };
-        }
-    }
-
-    async refreshToken(refreshToken: string): Promise<DASHAuthenticationServiceAuthResponse> {
-        try {
-            console.log('[DASHAuthService] Attempting to refresh token...');
-            
-            const response = await this.axiosInstance.post('/auth/refresh', {
-                refresh_token: refreshToken
-            });
-
-            if (response.status >= 200 && response.status <= 299) {
-                const data = response.data;
-
-                // Update stored auth data using the same pattern as login
-                if (data.token) {
-                    dashStorage.setItem('token', data.token);
-                    console.log('[DASHAuthService] Access token updated');
-                }
-                
-                if (data.refresh_token) {
-                    dashStorage.setItem('refreshToken', data.refresh_token);
-                    console.log('[DASHAuthService] Refresh token rotated');
-                }
-                
-                await syncLocalStorageToDeviceStore();
-                
-                console.log('[DASHAuthService] Token refresh successful');
-                
-                return {
-                    success: true,
-                    token: data.token,
-                    refreshToken: data.refresh_token,
-                    user: data.user
-                };
-            } else {
-                console.warn('[DASHAuthService] Token refresh returned non-success status:', response.status);
-                return {
-                    success: false,
-                    error: 'Token refresh failed'
-                };
-            }
-        } catch (error: any) {
-            console.error('[DASHAuthService] Token refresh error:', error);
-            
-            // Check if it's a 401 error (refresh token expired/invalid)
-            if (error?.response?.status === 401) {
-                console.log('[DASHAuthService] Refresh token is invalid or expired');
-                // Clear auth state since refresh token is no longer valid
-                this.logoutFromStorage('refresh_token_expired');
-            }
-            
-            return {
-                success: false,
-                error: error?.response?.data?.message || error?.message || 'Network error occurred'
-            };
-        }
-    }
-
-    private logoutFromStorage = async (reason: string) => {
-        console.log("logoutFromStorage", reason);
-
-        // Clear pending redirect on logout
-        //this.clearPendingRedirect();
-        // Store current path as pending redirect
-
-
-
-        // Use the centralized persistence service instead of manual cleanup
-        AuthPersistenceService.markAsLoggedOut();
-
-        // Clear auth data from device store (Electron/Capacitor)
-        // This is crucial - it removes token/user from electron-store so they
-        // don't get restored on next app launch
-        await clearDeviceStoreAuth();
-
-        // Keep only the IPC service cleanup
-        const { DashIPCService } = window as any;
-        DashIPCService && DashIPCService.action('stop-bg-service');
-    };
-
-    async checkAuth(): Promise<boolean> {
-        // First check localStorage for basic auth state
-        const isAuthenticated = JSON.parse(dashStorage.getItem('authenticated') || 'false');
-        const user = JSON.parse(dashStorage.getItem('user') || 'null');
-
-        if (isAuthenticated && user?.id) {
-            // Also check if we have valid persisted auth data
-            const persistedAuth = AuthPersistenceService.getAuth();
-            if (persistedAuth) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-
-    async getIdentity(): Promise<any> {
-        const token = dashStorage.getItem('token');
-        if (!token) {
-            throw new Error('No token present');
-        }
-
-        try {
-            const { data: auth } = await this.axiosInstance.get(getEnv('APP_GETAUTH_ENDPOINT'));
-
-            dashStorage.setItem(
-                'roles',
-                auth.user?.roles
-                    ? JSON.stringify(auth.user.roles)
-                    : JSON.stringify(DASHAppConstants.system.GUEST_ROLE),
-            );
-            dashStorage.setItem('authenticated', 'true');
-            dashStorage.setItem('user', JSON.stringify(auth.user));
-
-            // Handle tenant impersonation if enabled, including which tenant
-            // this session is scoped to.
-            this.syncActiveTenant(auth);
-
-             await syncLocalStorageToDeviceStore();
-
-            return auth;
-        } catch (error) {
-            this.logoutFromStorage("get identity error logout");
-            throw error;
-        }
-    }
-
-    // Rest of your methods remain the same...
-    async shouldRefreshToken(): Promise<boolean> {
-        const token = dashStorage.getItem('token');
-        if (!token) return false;
-
-        const refreshToken = dashStorage.getItem('refreshToken');
-        return !!refreshToken;
-    }
-
-    async handleTokenRefresh(): Promise<boolean> {
-        const refreshToken = dashStorage.getItem('refreshToken');
-        if (!refreshToken) return false;
-
-        try {
-            const refreshResponse = await this.refreshToken(refreshToken);
-            if (refreshResponse.success) {
-
-                // Update localStorage with new token
-                dashStorage.setItem('token', refreshResponse.token!);
-                if (refreshResponse.refreshToken) {
-                    dashStorage.setItem('refreshToken', refreshResponse.refreshToken);
-                }
-                 await syncLocalStorageToDeviceStore();
-                return true;
-            }
-        } catch (error) {
-            console.error('Token refresh failed:', error);
-            this.logoutFromStorage("token refresh failed");
-        }
-        return false;
-    }
-
-    // Method to check if we should initialize from token on app load
-    async shouldInitializeFromToken(forceGetAuth?: boolean): Promise<boolean> {
-
-        if (forceGetAuth) { return true };
-
-        const token = dashStorage.getItem('token');
-        const isAuthenticated = JSON.parse(dashStorage.getItem('authenticated') || 'false');
-        const user = dashStorage.getItem('user');
-
-        // If we have a token but are not fully authenticated, we should initialize
-        return !!(token && (!isAuthenticated || !user));
-    }
-
-    // Update the initializeApp method to dispatch to Redux directly
-    async initializeApp(forceGetAuth?: boolean): Promise<DASHAuthenticationServiceAuthResponse> {
-        
-      
-        console.log('Initializing DASH app authentication...');
-        const USES_GET_AUTH = true; // TODO: add the get auth to the env and retrieve it through getEnv. nevertheless all apps uses getAuth. 
-
-        const shouldInit = await this.shouldInitializeFromToken(forceGetAuth);
-
-        if (shouldInit) {
-            console.log('Token found but not fully authenticated, initializing...');
-            return await this.initializeFromToken();
-        } else {
-            const token = dashStorage.getItem('token');
-            const isAuthenticated = JSON.parse(dashStorage.getItem('authenticated') || 'false');
-            const user = dashStorage.getItem('user');
-
-            if (token && isAuthenticated && user) {
-                console.log('Already authenticated, checking if auth refresh needed');
-
-                // If shouldGetAuth is true, refresh auth data to get latest tenant/user info
-                if (USES_GET_AUTH) {
-                    try {
-                        console.log('Refreshing auth data for latest tenant/user information...');
-
-                        // Get fresh auth data
-                        const authResponse = await this.axiosInstance.get(getEnv('APP_GETAUTH_ENDPOINT'));
-                        console.log("Fresh auth response:", authResponse.data);
-
-                        const auth = authResponse.data;
-
-                        // Extract redirect from backend auth response, including role redirects
-                        const roleRedirect = this.getRoleRedirect(auth.user);
-                        const backendRedirect = auth.redirect || auth.user?.redirect || roleRedirect || null;
-                        console.log("Backend redirect found during app initialization:", backendRedirect, "(role redirect:", roleRedirect, ")");
-
-                        // Update stored auth data
-                        AuthPersistenceService.saveAuth(auth);
-
-                        // Sync dash-user-locale with fresh tenant/user preference
-                        const languageCode = auth.auth?.tenantSettings?.primary_language_code || auth.user?.preferences?.locale;
-                        if (languageCode) {
-                            localStorage.setItem('dash-user-locale', languageCode);
-                            // Dispatch event to trigger I18nBridgeContext locale change
-                            window.dispatchEvent(new CustomEvent('dash:locale-change', { 
-                                detail: { locale: languageCode } 
-                            }));
-                            console.log('🌐 DASHAuthService: Dispatched locale change event (app init):', languageCode);
-                        }
-
-                        // Update localStorage with fresh data
-                        dashStorage.setItem('user', JSON.stringify(auth.user));
-                        dashStorage.setItem(
-                            'roles',
-                            auth.user?.roles
-                                ? JSON.stringify(auth.user.roles)
-                                : JSON.stringify(DASHAppConstants.system.GUEST_ROLE),
-                        );
-
-                        // Handle tenant impersonation with fresh data, including
-                        // which tenant this session is scoped to.
-                        this.syncActiveTenant(auth);
-
-                        const resultObject = {
-                            authenticated: true,
-                            user: auth.user,
-                            auth: auth.auth,
-                            token: token,
-                            roles: auth.user?.roles
-                        };
-
-                        // Dispatch directly to Redux with fresh data
-                        console.log('🔄 DASHAuthenticationService: Dispatching fresh auth to Redux:', resultObject);
-                        dispatchToRedux(
-                            DASH_REDUX_ACTIONS.updateAuth(ACTION_UPDATE_AUTH, {
-                                user: resultObject.user,
-                                authenticated: resultObject.authenticated,
-                                auth: resultObject.auth,
-                            })
-                        );
-
-                        // Determine final redirect URL (backend takes precedence)
-                        // Don't persist redirect during app init - only during actual login
-                        const redirectAfterLogin = this.determineRedirectUrl(backendRedirect, false);
-
-                        console.log('Auth data refreshed successfully');
-
-                         await syncLocalStorageToDeviceStore();
-
-                        return {
-                            success: true,
-                            token: token,
-                            user: auth.user,
-                            auth: auth.auth,
-                            redirectAfterLogin: redirectAfterLogin
-                        };
-
-                    } catch (error) {
-                        console.error('Error refreshing auth data:', error);
-
-                        // If refresh fails, fall back to existing data but don't fail the initialization
-                        console.log('Falling back to existing auth data');
-
-                        const existingUser = JSON.parse(user);
-                        const persistedAuth = AuthPersistenceService.getAuth();
-
-                        // Dispatch existing data to Redux
-                        console.log('🔄 DASHAuthenticationService: Dispatching existing auth to Redux');
-                        dispatchToRedux(
-                            DASH_REDUX_ACTIONS.updateAuth(ACTION_UPDATE_AUTH, {
-                                user: existingUser,
-                                authenticated: true,
-                                auth: persistedAuth?.auth || null,
-                            })
-                        );
-
-                        // Still check for localStorage redirect as fallback
-                        // Don't persist redirect during app init - only during actual login
-                        const redirectAfterLogin = this.determineRedirectUrl(undefined, false);
-
-                        await syncLocalStorageToDeviceStore();
-
-                        return {
-                            success: true,
-                            token: token,
-                            user: existingUser,
-                            auth: persistedAuth?.auth || null,
-                            redirectAfterLogin: redirectAfterLogin
-                        };
-                    }
-                } else {
-                    console.log('No auth refresh needed, using existing data');
-
-                    const existingUser = JSON.parse(user);
-                    const persistedAuth = AuthPersistenceService.getAuth();
-
-                    // Dispatch existing data to Redux
-                    console.log('🔄 DASHAuthenticationService: Dispatching existing auth to Redux');
-                    dispatchToRedux(
-                        DASH_REDUX_ACTIONS.updateAuth(ACTION_UPDATE_AUTH, {
-                            user: existingUser,
-                            authenticated: true,
-                            auth: persistedAuth?.auth || null,
-                        })
-                    );
-
-                    // Still check for pending redirect even if not refreshing auth
-                    // Don't persist redirect during app init - only during actual login
-                    const redirectAfterLogin = this.determineRedirectUrl(undefined, false);
-
-                    await syncLocalStorageToDeviceStore();
-
-                    return {
-                        success: true,
-                        token: token,
-                        user: existingUser,
-                        auth: persistedAuth?.auth || null,
-                        redirectAfterLogin: redirectAfterLogin
-                    };
-                }
-            } else {
-                console.log('No valid authentication found');
-                 await syncLocalStorageToDeviceStore();
-                return {
-                    success: false,
-                    error: 'No valid authentication found'
-                };
-            }
-        }
-
-
-    }
-
-    // Method to integrate with React Admin
-    async loginWithReactAdmin(credentials: DASHAuthenticationServiceLoginCredentials, reactAdminLogin?: any): Promise<void> {
-        debugger;
-        const effectiveLogin = reactAdminLogin || this.login;
-        const authResponse = await effectiveLogin(credentials);
-        return authResponse;
-        /*if (authResponse.success) {
-            // Use React Admin's login with custom auth data
-            await reactAdminLogin({
-                customAuthData: {
-                    token: authResponse.token,
-                    user: authResponse.user,
-                    auth: authResponse.auth,
-                    refreshToken: authResponse.refreshToken,
-                    redirectAfterLogin: authResponse.redirectAfterLogin
-                }
-            });
-        } else {
-            throw new Error(authResponse.error || 'Login failed');
-        }*/
-    }
-
-    // Function to get initial auth state with persisted values
-    getInitialAuthState = () => {
-        try {
-            // Get persisted auth data
-            const persistedAuth = AuthPersistenceService.getAuth();
-            const storedUser = AuthPersistenceService.getUser();
-            const storedToken = AuthPersistenceService.getToken();
-            const isAuthenticated = JSON.parse(dashStorage.getItem('authenticated') || 'false');
-
-            console.log('🔍 DASHLightApp: Initializing auth state with persisted data:', {
-                hasPersistedAuth: !!persistedAuth,
-                hasStoredUser: !!storedUser,
-                hasStoredToken: !!storedToken,
-                isAuthenticated,
-                storedUser: storedUser ? `${storedUser.name || storedUser.email} (${storedUser.id})` : null,
-                persistedAuthStructure: persistedAuth ? Object.keys(persistedAuth) : null
-            });
-
-            // If we have valid persisted auth data, use it
-            if (isAuthenticated && storedUser && storedToken && persistedAuth) {
-                console.log('✅ DASHLightApp: Using persisted auth state');
-                const authState = {
-                    authenticated: true,
-                    user: storedUser, // This should be the actual user object
-                    auth: persistedAuth.auth || null, // This should be the actual auth object
-                };
-
-                console.log('🔍 DASHLightApp: Constructed auth state:', {
-                    authenticated: authState.authenticated,
-                    user: authState.user ? `${authState.user.name || authState.user.email} (${authState.user.id})` : null,
-                    auth: authState.auth ? 'present' : null
-                });
-
-                return authState;
-            }
-
-            // If we have a token but not full auth data, we'll let DASHAuthenticationService handle initialization
-            if (storedToken && !isAuthenticated) {
-                console.log('🔄 DASHLightApp: Token found but not authenticated, will initialize later');
-                return {
-                    authenticated: false,
-                    user: null,
-                    auth: null,
-                };
-            }
-
-            console.log('ℹ️ DASHLightApp: No valid persisted auth found, using default auth state');
-            return {
-                authenticated: false,
-                user: null,
-                auth: null
-            };
-        } catch (error) {
-            console.error('❌ DASHLightApp: Error getting initial auth state:', error);
-            return {
-                authenticated: false,
-                user: null,
-                auth: null
-            };
-        }
-    };
-
-
-}
-
-export default new DASHAuthenticationService();