@dloizides/auth-client 2.1.0 → 3.0.0

package/dist/index.mjs

@@ -1057,6 +1057,121 @@ var AuthApiClient = class {
   }
 };
 
+// src/bff/BffAuthClient.ts
+var CSRF_HEADER = "X-BFF-Csrf";
+var CSRF_HEADER_VALUE = "1";
+var JSON_CONTENT_TYPE = "application/json";
+var ENDPOINTS = {
+  login: "/bff/login",
+  logout: "/bff/logout",
+  me: "/bff/me",
+  register: "/bff/register",
+  forgotPassword: "/bff/forgot-password",
+  resetPassword: "/bff/reset-password"
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function extractUser(data) {
+  if (!isRecord(data)) {
+    return null;
+  }
+  const envelope = data;
+  return isRecord(envelope.user) ? envelope.user : null;
+}
+var BffAuthClient = class {
+  constructor(options) {
+    this.http = options.http;
+    this.baseUrl = (options.baseUrl ?? "").replace(/\/$/, "");
+  }
+  /**
+   * `POST /bff/login` — the BFF does ROPC against Keycloak server-side, stores
+   * the tokens in its Redis vault, and sets the httpOnly session cookie.
+   * Returns the sanitised user. Throws on a non-2xx response.
+   */
+  async login(request) {
+    const data = await this.postState(ENDPOINTS.login, request, "login");
+    const user = extractUser(data);
+    if (user === null) {
+      throw new Error("login: BFF response missing user");
+    }
+    return user;
+  }
+  /**
+   * `POST /bff/logout` — the BFF calls KC end-session, deletes the Redis
+   * session, and clears the cookie. Non-fatal: a failed logout still leaves
+   * the SPA logged out client-side. Throws only on a non-2xx response.
+   */
+  async logout() {
+    await this.postState(ENDPOINTS.logout, void 0, "logout");
+  }
+  /**
+   * `GET /bff/me` — the live session's sanitised user, or `null` when there is
+   * no session (the BFF answers `401`). Used at app load to bootstrap auth
+   * state in place of the old token-in-storage check.
+   */
+  async getCurrentUser() {
+    const response = await this.http({
+      url: `${this.baseUrl}${ENDPOINTS.me}`,
+      method: "GET",
+      headers: { Accept: JSON_CONTENT_TYPE },
+      credentials: "include"
+    });
+    if (!response.ok) {
+      return null;
+    }
+    return extractUser(response.data);
+  }
+  /**
+   * `POST /bff/register` — the BFF proxies registration to TenantService and,
+   * on success, establishes a session exactly like `login`. Returns the user.
+   */
+  async register(request) {
+    const data = await this.postState(ENDPOINTS.register, request, "register");
+    const user = extractUser(data);
+    if (user === null) {
+      throw new Error("register: BFF response missing user");
+    }
+    return user;
+  }
+  /**
+   * `POST /bff/forgot-password` — proxied to TenantService. The backend
+   * returns 200 unconditionally (no email enumeration); anything else throws.
+   */
+  async forgotPassword(request) {
+    await this.postState(ENDPOINTS.forgotPassword, request, "forgot-password");
+  }
+  /**
+   * `POST /bff/reset-password` — proxied to TenantService. Throws on a non-2xx
+   * response (e.g. `400` for an invalid / expired token).
+   */
+  async resetPassword(request) {
+    await this.postState(ENDPOINTS.resetPassword, request, "reset-password");
+  }
+  /**
+   * Shared POST for every state-changing `/bff/*` call: same-origin, cookie
+   * included, `X-BFF-Csrf` header attached. Throws a labelled error on non-2xx.
+   */
+  async postState(path, body, label) {
+    const headers = {
+      "Content-Type": JSON_CONTENT_TYPE,
+      Accept: JSON_CONTENT_TYPE,
+      [CSRF_HEADER]: CSRF_HEADER_VALUE
+    };
+    const response = await this.http({
+      url: `${this.baseUrl}${path}`,
+      method: "POST",
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      credentials: "include"
+    });
+    if (!response.ok) {
+      throw new Error(`${label} failed with status ${String(response.status)}`);
+    }
+    return response.data;
+  }
+};
+
 // src/utils/normalizeKeycloakUser.ts
 function isNonEmptyString(value) {
   return typeof value === "string" && value !== "";
@@ -1167,6 +1282,6 @@ function decodeUtf8(binary) {
   return new TextDecoder("utf-8").decode(bytes);
 }
 
-export { AuthApiClient, AuthClient, AuthEventEmitter, BiometricGate, BrowserStorageTokenStorage, CookieTokenStorage, InMemoryTokenStorage, InactivityTracker, KeycloakRoles, RefreshInterceptor, SecureStoreTokenStorage, buildAuthorizationCodeBody, buildAuthorizationEndpoint, buildAuthorizationUrl, buildIssuerUrl, buildLogoutEndpoint, buildRefreshTokenBody, buildTokenEndpoint, buildUserInfoEndpoint, clearDiscoveryCache, computeExpiresAt, createFetchHttpClient, decodeJwt, deriveCodeChallenge, exchangeAuthorizationCode, extractAuthCode, fetchDiscoveryDocument, generateCodeVerifier, generatePkcePair, isKeycloakRole, isTokenExpired, normalizeKeycloakUser, normalizeTokenResponse, parseBaseUrlFromIssuer, parseRealmFromIssuer, refreshAccessToken, tokenResponseToAuthTokens };
+export { AuthApiClient, AuthClient, AuthEventEmitter, BffAuthClient, BiometricGate, BrowserStorageTokenStorage, CookieTokenStorage, InMemoryTokenStorage, InactivityTracker, KeycloakRoles, RefreshInterceptor, SecureStoreTokenStorage, buildAuthorizationCodeBody, buildAuthorizationEndpoint, buildAuthorizationUrl, buildIssuerUrl, buildLogoutEndpoint, buildRefreshTokenBody, buildTokenEndpoint, buildUserInfoEndpoint, clearDiscoveryCache, computeExpiresAt, createFetchHttpClient, decodeJwt, deriveCodeChallenge, exchangeAuthorizationCode, extractAuthCode, fetchDiscoveryDocument, generateCodeVerifier, generatePkcePair, isKeycloakRole, isTokenExpired, normalizeKeycloakUser, normalizeTokenResponse, parseBaseUrlFromIssuer, parseRealmFromIssuer, refreshAccessToken, tokenResponseToAuthTokens };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map