@decido/shell-auth 1.0.0

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@decido/shell-auth",
+  "version": "1.0.0",
+  "description": "Decido OS Shell Authentication & Obfuscated Persistence Core",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "directories": {
+    "src": "src"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "dependencies": {
+    "idb-keyval": "^6.2.1",
+    "zustand": "^4.5.2",
+    "@decido/tauri-bridge": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "UNLICENSED",
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts*\"",
+    "build": "tsup src/index.ts --format esm --dts --minify --clean"
+  }
+}

package/src/index.ts

@@ -0,0 +1,131 @@
+import { create } from 'zustand';
+import { persist, createJSONStorage } from 'zustand/middleware';
+import { secureStorage } from './secureStorage';
+
+export type UserRole = 'creator' | 'admin' | 'user' | 'demo' | 'developer';
+export type LicenseType = 'personal' | 'enterprise';
+
+export interface LicenseTarget {
+    type: LicenseType;
+    id: string;
+    name: string;
+    enabledPlugins?: string[];
+    systemPrompt?: string;
+    swarmKey?: string;
+    websocketRelayUrl?: string;
+}
+
+export interface AuthState {
+    isAuthenticated: boolean;
+    userRole: UserRole | null;
+    userName: string | null;
+
+    availableLicenses: LicenseTarget[];
+    activeContext: LicenseTarget | null;
+    hasCompletedWelcome: boolean;
+    hasSeenTour: boolean;
+
+    login: (role: UserRole, name: string, licenses?: LicenseTarget[]) => void;
+    joinSwarm: (token: string) => Promise<boolean>;
+    setActiveContext: (licenseId: string) => void;
+    setHasCompletedWelcome: (val: boolean) => void;
+    setHasSeenTour: (val: boolean) => void;
+    logout: () => void;
+}
+
+export const useAuthStore = create<AuthState>()(
+    persist(
+        (set, get) => ({
+            isAuthenticated: false,
+            userRole: null,
+            userName: null,
+            availableLicenses: [],
+            activeContext: null,
+            hasCompletedWelcome: false,
+            hasSeenTour: false,
+
+            login: (role, name, licenses) => {
+                const defaultLicenses: LicenseTarget[] = licenses || [{
+                    type: 'personal',
+                    id: 'personal',
+                    name: `${name}'s Private Space`
+                }];
+
+                set({
+                    isAuthenticated: true,
+                    userRole: role,
+                    userName: name,
+                    availableLicenses: defaultLicenses,
+                    activeContext: defaultLicenses.length === 1 ? defaultLicenses[0] : null
+                });
+            },
+
+            joinSwarm: async (token: string) => {
+                try {
+                    const base64Url = token.split('.')[1];
+                    const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
+                    const jsonPayload = decodeURIComponent(atob(base64).split('').map(function (c) {
+                        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
+                    }).join(''));
+
+                    const payload = JSON.parse(jsonPayload);
+
+                    if (!payload.tenantId || !payload.name) return false;
+
+                    const newTarget: LicenseTarget = {
+                        type: payload.type || 'enterprise',
+                        id: payload.tenantId,
+                        name: payload.name,
+                        swarmKey: payload.swarm_key,
+                        websocketRelayUrl: payload.ws_url
+                    };
+
+                    const { availableLicenses } = get();
+                    if (!availableLicenses.find(l => l.id === newTarget.id)) {
+                        set({
+                            availableLicenses: [...availableLicenses, newTarget],
+                            activeContext: newTarget
+                        });
+                    } else {
+                        set({ activeContext: newTarget });
+                    }
+                    return true;
+                } catch (e) {
+                    console.error("Failed to join swarm from token", e);
+                    return false;
+                }
+            },
+
+            setActiveContext: (licenseId: string) => {
+                const { availableLicenses } = get();
+                const target = availableLicenses.find(l => l.id === licenseId) || null;
+                set({ activeContext: target });
+            },
+
+            setHasCompletedWelcome: (val: boolean) => {
+                set({ hasCompletedWelcome: val });
+            },
+
+            setHasSeenTour: (val: boolean) => {
+                set({ hasSeenTour: val });
+            },
+
+            logout: () => set({
+                isAuthenticated: false,
+                userRole: null,
+                userName: null,
+                availableLicenses: [],
+                activeContext: null,
+                hasCompletedWelcome: false,
+                hasSeenTour: false
+            }),
+        }),
+        {
+            name: 'decido-auth-storage',
+            storage: createJSONStorage(() => secureStorage)
+        }
+    )
+);
+
+// Re-export secureStorage helper just in case it's needed externally
+export * from './secureStorage';

package/src/secureStorage.ts

@@ -0,0 +1,61 @@
+import { get, set, del } from 'idb-keyval';
+import { StateStorage } from 'zustand/middleware';
+import { secure } from '@decido/tauri-bridge';
+import { isTauri } from '@decido/tauri-bridge';
+
+// Basic obfuscation wrapper for pure SSR/Web Fallback
+const obfuscate = (data: string): string => {
+    if (typeof btoa === 'undefined') return data; 
+    return btoa(encodeURIComponent(data));
+};
+
+const deobfuscate = (data: string): string => {
+    if (typeof atob === 'undefined') return data;
+    try {
+        return decodeURIComponent(atob(data));
+    } catch {
+        return data; 
+    }
+};
+
+export const secureStorage: StateStorage = {
+    getItem: async (name: string): Promise<string | null> => {
+        try {
+            if (isTauri()) {
+                const val = await secure.secureVault.getItem(name);
+                if (val !== null) return val;
+            }
+            // WEB Fallback
+            const val = await get(name);
+            if (!val) return null;
+            return deobfuscate(val);
+        } catch (err) {
+            console.error(`[SecureStorage] Failed to get item ${name}`, err);
+            return null;
+        }
+    },
+    setItem: async (name: string, value: string): Promise<void> => {
+        try {
+            if (isTauri()) {
+                await secure.secureVault.setItem(name, value);
+                return; // Do not leak to indexedDB
+            }
+            // WEB Fallback
+            const obfuscated = obfuscate(value);
+            await set(name, obfuscated);
+        } catch (err) {
+            console.error(`[SecureStorage] Failed to set item ${name}`, err);
+        }
+    },
+    removeItem: async (name: string): Promise<void> => {
+        try {
+            if (isTauri()) {
+                await secure.secureVault.removeItem(name);
+                // Also clean legacy web fallback just in case
+            }
+            await del(name);
+        } catch (err) {
+            console.error(`[SecureStorage] Failed to remove item ${name}`, err);
+        }
+    },
+};

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+        "strict": true,
+    "outDir": "dist",
+    "declaration": true,
+    "declarationMap": true,
+    "lib": ["DOM", "DOM.Iterable", "ESNext"],
+    "module": "ESNext",
+    "target": "ESNext",
+    "moduleResolution": "bundler"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}