@dragonmastery/dragoncore-vue 0.0.23 → 0.0.25

package/dist/userAuthorized-C09FHWGL.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"userAuthorized-C09FHWGL.js","names":[],"sources":["../src/middleware/userAuthorized.ts"],"sourcesContent":["import type { UserTypeValues } from '@dragonmastery/dragoncore-shared';\nimport type { NavigationGuard, RouteLocationRaw } from 'vue-router';\nimport { createAppBatch } from '../composables/useRpcAuth';\nimport { useEnv } from '../composables/useEnv';\nimport { useUserSessionStore } from '../composables/useUserSessionStore';\nimport { logger } from '../utils/logger';\n\nexport interface UserAuthorizedOptions {\n  /**\n   * List of user types allowed to access this route\n   * Same pattern as `visible_to` in route meta\n   */\n  allowedUserTypes: UserTypeValues[];\n\n  /**\n   * Where to redirect if user is not authorized\n   * Can be a route name, path, or route object\n   */\n  redirectTo?: RouteLocationRaw;\n\n  /**\n   * Login path for redirecting unauthenticated users\n   * Only used if requireAuth is true\n   */\n  loginPath?: string;\n\n  /**\n   * Whether to also check authentication (token refresh, etc.)\n   * Default: true\n   */\n  requireAuth?: boolean;\n}\n\n/**\n * Creates a navigation guard that checks both authentication and authorization\n * based on allowed user types.\n *\n * @example\n * // Only staff and super_admin can access\n * const staffOnly = createUserAuthorizedGuard({\n *   allowedUserTypes: ['staff', 'super_admin'],\n *   redirectTo: { name: 'Home' }\n * });\n *\n * @example\n * // All authenticated users can access\n * const authenticated = createUserAuthorizedGuard({\n *   allowedUserTypes: ['consumer', 'lead', 'staff', 'super_admin'],\n *   redirectTo: { name: 'Home' }\n * });\n */\nexport function createUserAuthorizedGuard(options: UserAuthorizedOptions): NavigationGuard {\n  const {\n    allowedUserTypes,\n    redirectTo = { name: 'Home' },\n    loginPath = '/auth/login',\n    requireAuth = true,\n  } = options;\n\n  return async (to, _from, next) => {\n    const userSession = useUserSessionStore();\n    const env = useEnv();\n\n    // Step 1: Check authentication if required\n    if (requireAuth) {\n      const hasAccessToken = !!userSession.accessToken;\n\n      if (hasAccessToken) {\n        const { accessTokenExpired, refreshTokenExpired } = userSession.isTokenExpired();\n\n        if (!accessTokenExpired) {\n          // Token is valid, proceed to authorization check\n        } else if (refreshTokenExpired) {\n          // Refresh token expired, redirect to login\n          logger.warn('[UserAuthorized] Refresh token expired, redirecting to login');\n          userSession.clearSession();\n          const returnUrl = to.fullPath;\n          next({\n            path: loginPath,\n            query: { returnUrl },\n          });\n          return;\n        } else {\n          // Access token expired, try refresh\n          logger.debug('[UserAuthorized] Access token expired, attempting refresh');\n          const refreshSuccessful = await userSession.refreshToken();\n\n          if (!refreshSuccessful) {\n            logger.error('[UserAuthorized] Token refresh failed, redirecting to login');\n            userSession.clearSession();\n            const returnUrl = to.fullPath;\n            next({\n              path: loginPath,\n              query: { returnUrl },\n            });\n            return;\n          }\n        }\n      } else {\n        // No access token, try refresh token flow\n        logger.debug('[UserAuthorized] No access token, attempting refresh token flow');\n        const refreshSuccessful = await userSession.refreshToken();\n\n        if (!refreshSuccessful) {\n          logger.debug('[UserAuthorized] No valid session found, redirecting to login');\n          userSession.clearSession();\n          const returnUrl = to.fullPath;\n          next({\n            path: loginPath,\n            query: { returnUrl },\n          });\n          return;\n        }\n      }\n    }\n\n    // Step 2: Check consent status\n    // Call getPendingConsents for fresh data - backend returns [] when CONSENT_FEATURE_ENABLED is false\n    if (to.path !== '/auth/consent-required') {\n      try {\n        const batch = createAppBatch();\n        const pending = await batch.users.getPendingConsents();\n        if (pending && pending.length > 0) {\n          logger.debug('[UserAuthorized] Pending consents found, redirecting to consent-required');\n          next({\n            path: '/auth/consent-required',\n            query: { returnUrl: to.fullPath, ...to.query },\n          });\n          return;\n        }\n      } catch (err) {\n        logger.warn('[UserAuthorized] Failed to check pending consents, continuing', { err });\n        // On auth/network error, let user proceed; they may hit CONSENT_REQUIRED on next API call\n      }\n    }\n\n    // Step 2.5: In strict mode, block unverified users from app entirely\n    if (\n      !to.path.startsWith('/auth/') &&\n      env.emailVerificationMode === 'strict'\n    ) {\n      const emailVerified = userSession.currentSession?.user?.email_verified ?? true;\n      if (!emailVerified) {\n        logger.debug('[UserAuthorized] Strict mode: unverified user, redirecting to verify-email');\n        next({ path: '/auth/verify-email', query: { returnUrl: to.fullPath } });\n        return;\n      }\n    }\n\n    // Step 3: Check authorization (user type)\n    const userType = userSession.currentSession?.user.user_type;\n\n    if (!userType) {\n      logger.warn('[UserAuthorized] No user type found, redirecting');\n      next(redirectTo);\n      return;\n    }\n\n    if (allowedUserTypes.includes(userType)) {\n      logger.debug(`[UserAuthorized] User type '${userType}' is authorized`);\n      next();\n    } else {\n      logger.warn(\n        `[UserAuthorized] User type '${userType}' is not authorized. Allowed: ${allowedUserTypes.join(', ')}`,\n      );\n      next(redirectTo);\n    }\n  };\n}\n\n/**\n * Pre-built guard: Staff and super admin only\n * Redirects non-staff users to the provided redirect path\n */\nexport function createStaffOnlyGuard(options?: {\n  redirectTo?: RouteLocationRaw;\n  loginPath?: string;\n}): NavigationGuard {\n  return createUserAuthorizedGuard({\n    allowedUserTypes: ['staff', 'super_admin'],\n    redirectTo: options?.redirectTo ?? { name: 'Home' },\n    loginPath: options?.loginPath,\n  });\n}\n\n/**\n * Pre-built guard: Super admin only\n * Redirects non-super-admin users to the provided redirect path\n */\nexport function createSuperAdminOnlyGuard(options?: {\n  redirectTo?: RouteLocationRaw;\n  loginPath?: string;\n}): NavigationGuard {\n  return createUserAuthorizedGuard({\n    allowedUserTypes: ['super_admin'],\n    redirectTo: options?.redirectTo ?? '/notfound',\n    loginPath: options?.loginPath,\n  });\n}\n\n/**\n * Pre-built guard: All authenticated users\n * Any logged-in user can access (consumer, lead, staff, or super_admin)\n */\nexport function createAuthenticatedGuard(options?: {\n  redirectTo?: RouteLocationRaw;\n  loginPath?: string;\n}): NavigationGuard {\n  return createUserAuthorizedGuard({\n    allowedUserTypes: ['consumer', 'lead', 'staff', 'super_admin'],\n    redirectTo: options?.redirectTo ?? { name: 'Home' },\n    loginPath: options?.loginPath,\n  });\n}\n\n/**\n * Pre-built guard: Lead, staff, and super admin\n * Consumers are not allowed\n */\nexport function createLeadOrStaffOnlyGuard(options?: {\n  redirectTo?: RouteLocationRaw;\n  loginPath?: string;\n}): NavigationGuard {\n  return createUserAuthorizedGuard({\n    allowedUserTypes: ['lead', 'staff', 'super_admin'],\n    redirectTo: options?.redirectTo ?? { name: 'Home' },\n    loginPath: options?.loginPath,\n  });\n}\n\n/**\n * Pre-configured guards with sensible defaults\n * Apps can use these directly or override with create*Guard functions\n */\n\n/**\n * Pre-configured: All authenticated users\n * Default redirect: Home, Default login: /auth/login\n */\nexport const userAuthenticated = createAuthenticatedGuard();\n\n/**\n * Pre-configured: Staff and super admin only\n * Default redirect: Home, Default login: /auth/login\n */\nexport const staffOnly = createStaffOnlyGuard();\n\n/**\n * Pre-configured: Super admin only\n * Default redirect: /notfound, Default login: /auth/login\n */\nexport const userIsSuperAdmin = createSuperAdminOnlyGuard();\n\n/**\n * Pre-configured: Lead, staff, and super admin\n * Default redirect: Home, Default login: /auth/login\n */\nexport const leadOrStaffOnly = createLeadOrStaffOnlyGuard();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,0BAA0B,SAAiD;CACzF,MAAM,EACJ,kBACA,aAAa,EAAE,MAAM,QAAQ,EAC7B,YAAY,eACZ,cAAc,SACZ;AAEJ,QAAO,OAAO,IAAI,OAAO,SAAS;EAChC,MAAM,cAAc,qBAAqB;EACzC,MAAM,MAAM,QAAQ;AAGpB,MAAI,YAGF,KAFuB,CAAC,CAAC,YAAY,aAEjB;GAClB,MAAM,EAAE,oBAAoB,wBAAwB,YAAY,gBAAgB;AAEhF,OAAI,CAAC,oBAAoB,YAEd,qBAAqB;AAE9B,WAAO,KAAK,+DAA+D;AAC3E,gBAAY,cAAc;IAC1B,MAAM,YAAY,GAAG;AACrB,SAAK;KACH,MAAM;KACN,OAAO,EAAE,WAAW;KACrB,CAAC;AACF;UACK;AAEL,WAAO,MAAM,4DAA4D;AAGzE,QAAI,CAFsB,MAAM,YAAY,cAAc,EAElC;AACtB,YAAO,MAAM,8DAA8D;AAC3E,iBAAY,cAAc;KAC1B,MAAM,YAAY,GAAG;AACrB,UAAK;MACH,MAAM;MACN,OAAO,EAAE,WAAW;MACrB,CAAC;AACF;;;SAGC;AAEL,UAAO,MAAM,kEAAkE;AAG/E,OAAI,CAFsB,MAAM,YAAY,cAAc,EAElC;AACtB,WAAO,MAAM,gEAAgE;AAC7E,gBAAY,cAAc;IAC1B,MAAM,YAAY,GAAG;AACrB,SAAK;KACH,MAAM;KACN,OAAO,EAAE,WAAW;KACrB,CAAC;AACF;;;AAON,MAAI,GAAG,SAAS,yBACd,KAAI;GAEF,MAAM,UAAU,MADF,gBAAgB,CACF,MAAM,oBAAoB;AACtD,OAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,WAAO,MAAM,2EAA2E;AACxF,SAAK;KACH,MAAM;KACN,OAAO;MAAE,WAAW,GAAG;MAAU,GAAG,GAAG;MAAO;KAC/C,CAAC;AACF;;WAEK,KAAK;AACZ,UAAO,KAAK,iEAAiE,EAAE,KAAK,CAAC;;AAMzF,MACE,CAAC,GAAG,KAAK,WAAW,SAAS,IAC7B,IAAI,0BAA0B,UAG9B;OAAI,EADkB,YAAY,gBAAgB,MAAM,kBAAkB,OACtD;AAClB,WAAO,MAAM,6EAA6E;AAC1F,SAAK;KAAE,MAAM;KAAsB,OAAO,EAAE,WAAW,GAAG,UAAU;KAAE,CAAC;AACvE;;;EAKJ,MAAM,WAAW,YAAY,gBAAgB,KAAK;AAElD,MAAI,CAAC,UAAU;AACb,UAAO,KAAK,mDAAmD;AAC/D,QAAK,WAAW;AAChB;;AAGF,MAAI,iBAAiB,SAAS,SAAS,EAAE;AACvC,UAAO,MAAM,+BAA+B,SAAS,iBAAiB;AACtE,SAAM;SACD;AACL,UAAO,KACL,+BAA+B,SAAS,gCAAgC,iBAAiB,KAAK,KAAK,GACpG;AACD,QAAK,WAAW;;;;;;;;AAStB,SAAgB,qBAAqB,SAGjB;AAClB,QAAO,0BAA0B;EAC/B,kBAAkB,CAAC,SAAS,cAAc;EAC1C,YAAY,SAAS,cAAc,EAAE,MAAM,QAAQ;EACnD,WAAW,SAAS;EACrB,CAAC;;;;;;AAOJ,SAAgB,0BAA0B,SAGtB;AAClB,QAAO,0BAA0B;EAC/B,kBAAkB,CAAC,cAAc;EACjC,YAAY,SAAS,cAAc;EACnC,WAAW,SAAS;EACrB,CAAC;;;;;;AAOJ,SAAgB,yBAAyB,SAGrB;AAClB,QAAO,0BAA0B;EAC/B,kBAAkB;GAAC;GAAY;GAAQ;GAAS;GAAc;EAC9D,YAAY,SAAS,cAAc,EAAE,MAAM,QAAQ;EACnD,WAAW,SAAS;EACrB,CAAC;;;;;;AAOJ,SAAgB,2BAA2B,SAGvB;AAClB,QAAO,0BAA0B;EAC/B,kBAAkB;GAAC;GAAQ;GAAS;GAAc;EAClD,YAAY,SAAS,cAAc,EAAE,MAAM,QAAQ;EACnD,WAAW,SAAS;EACrB,CAAC;;;;;;;;;;AAYJ,MAAa,oBAAoB,0BAA0B;;;;;AAM3D,MAAa,YAAY,sBAAsB;;;;;AAM/C,MAAa,mBAAmB,2BAA2B;;;;;AAM3D,MAAa,kBAAkB,4BAA4B"}