@ethisyscore/extension-runtime 1.30.0 → 1.31.0

package/dist/plugin/index.d.ts

@@ -623,4 +623,47 @@ interface UseFrontendSessionTokenResult {
  */
 declare function useFrontendSessionToken(transport: McpTransport): UseFrontendSessionTokenResult;
 
-export { BridgeClientContext, type ClientPushChannel, ClientPushContext, type ClientPushEvent, type ClientPushSubscribeOptions, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type HostIdentity, HostIdentityContext, type HostIdentityUser, type HostPermission, type ItemsResponse, LocalePayload, McpTransport, PluginRealtimeContext, type PluginRealtimeSource, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseClientPushSubscriptionOptions, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };
+/**
+ * Pure JWT-payload decode helper (WI 5160 — F-AUTH-SEAM FE face).
+ *
+ * Extracts and JSON-parses the middle (payload) segment of a compact JWT.
+ * URL-safe base64url characters (`-` → `+`, `_` → `/`) are normalised and
+ * missing `=` padding is restored before passing to `atob`.
+ *
+ * This helper is intentionally side-effect-free and React-free so it can be
+ * unit-tested without a DOM environment.
+ *
+ * **Security note:** this function does NOT validate the JWT signature —
+ * the host already validated the token at mint time. The FE only reads claims.
+ *
+ * @param token A compact-serialised JWT (`header.payload.signature`) or null.
+ * @returns The parsed payload object, or `{}` if the token is absent, malformed,
+ *          has fewer than 3 segments, or the payload is not valid JSON.
+ */
+declare function decodeJwtPayload(token: string | null): Record<string, unknown>;
+
+interface UseAuthResult {
+    /** The caller's user ID from the FE-session JWT, or null while loading / on error. */
+    currentUserId: string | null;
+    /**
+     * Returns true if the caller has the given short-code permission.
+     * Always returns false while the token is loading or absent (fail-closed).
+     *
+     * @param shortCode The exact permission short code, e.g. `"timeslip.read"`.
+     */
+    hasPermission(shortCode: string): boolean;
+    /** True while the first fetch (or a silent refresh) is in-flight. */
+    isLoading: boolean;
+    /** Set when the bridge rejects; null otherwise. */
+    error: Error | null;
+}
+/**
+ * Returns the caller's identity and permission gate derived from the
+ * FE-session token.
+ *
+ * @param transport The {@link McpTransport} to use. Typically the context
+ * transport from the extension runtime provider.
+ */
+declare function useAuth(transport: McpTransport): UseAuthResult;
+
+export { BridgeClientContext, type ClientPushChannel, ClientPushContext, type ClientPushEvent, type ClientPushSubscribeOptions, type CreatePortMcpTransportOptions, type CreateRemoteRootOptions, type DeclarativePluginConfig, type EthisysPluginConfig, ExtensionRuntimeProvider, type ExtensionRuntimeProviderProps, type HostIdentity, HostIdentityContext, type HostIdentityUser, type HostPermission, type ItemsResponse, LocalePayload, McpTransport, PluginRealtimeContext, type PluginRealtimeSource, PortBridgeClient, type PortShim, type RemoteRoot, ThemePayload, type UseAuthResult, type UseClientPushSubscriptionOptions, type UseFrontendSessionTokenResult, type UseMcpQueryOptions, type UseMcpQueryResult, type UseMcpResourceOptions, type UseMcpResourceResult, type UseMcpToolOptions, type UseMcpToolResult, createPortMcpTransport, createRemoteRoot, decodeJwtPayload, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useAuth, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };

package/dist/plugin/index.js

@@ -751,6 +751,46 @@ function useFrontendSessionToken(transport) {
   return { token, isLoading, error };
 }
 
-export { BridgeClientContext, ClientPushContext, ExtensionRuntimeProvider, HostIdentityContext, PluginRealtimeContext, createPortBridgeClient, createPortMcpTransport, createRemoteRoot, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };
+// src/plugin/decodeJwtPayload.ts
+function decodeJwtPayload(token) {
+  if (token === null || token === "") {
+    return {};
+  }
+  const segments = token.split(".");
+  if (segments.length < 3) {
+    return {};
+  }
+  const payloadSegment = segments[1];
+  try {
+    const base64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "===".slice(0, (4 - base64.length % 4) % 4);
+    const json = atob(padded);
+    const parsed = JSON.parse(json);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function useAuth(transport) {
+  const { token, isLoading, error } = useFrontendSessionToken(transport);
+  const { currentUserId, permissionSet } = useMemo(() => {
+    const claims = decodeJwtPayload(token);
+    const userId = (typeof claims["user_id"] === "string" && claims["user_id"] !== "" ? claims["user_id"] : null) ?? (typeof claims["sub"] === "string" && claims["sub"] !== "" ? claims["sub"] : null);
+    const permissionsRaw = typeof claims["permissions"] === "string" ? claims["permissions"] : "";
+    const set = permissionsRaw.length > 0 ? new Set(permissionsRaw.split(" ").filter((s) => s.length > 0)) : /* @__PURE__ */ new Set();
+    return { currentUserId: userId, permissionSet: set };
+  }, [token]);
+  return {
+    currentUserId,
+    hasPermission: (shortCode) => permissionSet.has(shortCode),
+    isLoading,
+    error
+  };
+}
+
+export { BridgeClientContext, ClientPushContext, ExtensionRuntimeProvider, HostIdentityContext, PluginRealtimeContext, createPortBridgeClient, createPortMcpTransport, createRemoteRoot, decodeJwtPayload, defineDeclarativePlugin, defineEthisysPlugin, unwrapItems, useAuth, useBridgeClient, useBridgeLocale, useBridgeTheme, useClientPushSubscription, useFrontendSessionToken, useHostIdentity, useMcpQuery, useMcpResource, useMcpTool, usePluginRealtimeSource };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map