@evenicanpm/storefront-core 2.3.1 → 2.4.1

package/src/lib/native-session.ts

@@ -0,0 +1,434 @@
+import { createHmac } from "node:crypto";
+import { auth } from "@evenicanpm/storefront-core/src/lib/auth";
+import { setTokenUtil } from "better-auth/oauth2";
+import { type NextRequest, NextResponse } from "next/server";
+
+type AuthSuccessResult = {
+	session: unknown;
+	user: {
+		id: string;
+		email?: string;
+		name?: string;
+		emailVerified?: boolean;
+		image?: string | null;
+	};
+	headers?: Record<string, string>;
+};
+
+type LoginTokenPayload = {
+	email?: string;
+	name?: string;
+	given_name?: string;
+	oid?: string;
+	sub?: string;
+};
+
+type SignupTokenPayload = LoginTokenPayload & {
+	preferred_username?: string;
+	emails?: string[];
+};
+
+type TokenEmailPayload = {
+	email?: string;
+	preferred_username?: string;
+	emails?: string[];
+};
+
+type SignupSessionOptions = {
+	firstName?: string;
+	lastName?: string;
+	accessToken?: string;
+	refreshToken?: string;
+	expiresInSeconds?: number;
+};
+
+type AuthContext = Awaited<typeof auth.$context>;
+
+function appendAuthHeaders(
+	response: NextResponse,
+	headers?: Record<string, string>,
+): void {
+	if (!headers) return;
+
+	for (const [key, value] of Object.entries(headers)) {
+		response.headers.append(key, value);
+	}
+}
+
+function createAuthResponse(authResult: AuthSuccessResult): NextResponse {
+	const response = NextResponse.json(
+		{
+			ok: true,
+			session: authResult.session,
+			user: authResult.user,
+		},
+		{ status: 200 },
+	);
+
+	appendAuthHeaders(response, authResult.headers);
+	return response;
+}
+
+function createSignedSessionToken(token: string, secret: string): string {
+	const signature = createHmac("sha256", secret).update(token).digest("base64");
+	return `${token}.${signature}`;
+}
+
+function serializeCookie(
+	name: string,
+	value: string,
+	attributes: {
+		domain?: string;
+		httpOnly?: boolean;
+		maxAge?: number;
+		path?: string;
+		sameSite?: string;
+		secure?: boolean;
+	},
+): string {
+	const parts = [`${name}=${value}`];
+	if (attributes.maxAge) parts.push(`Max-Age=${attributes.maxAge}`);
+	if (attributes.domain) parts.push(`Domain=${attributes.domain}`);
+	if (attributes.path) parts.push(`Path=${attributes.path}`);
+	if (attributes.httpOnly) parts.push("HttpOnly");
+	if (attributes.secure) parts.push("Secure");
+	if (attributes.sameSite) {
+		parts.push(
+			`SameSite=${attributes.sameSite[0]?.toUpperCase()}${attributes.sameSite.slice(1)}`,
+		);
+	}
+	return parts.join("; ");
+}
+
+function getEntraAccountId(
+	payload: { oid?: string; sub?: string },
+	userId: string,
+): string {
+	return String(payload.oid || payload.sub || userId);
+}
+
+function getTokenEmail(payload: TokenEmailPayload): string {
+	return (
+		payload.email ||
+		payload.preferred_username ||
+		(Array.isArray(payload.emails) ? payload.emails[0] : undefined) ||
+		""
+	)
+		.toString()
+		.trim()
+		.toLowerCase();
+}
+
+function getLocalAuthPassword(email: string): string {
+	const normalizedEmail = email.trim().toLowerCase();
+	const secret = process.env.BETTER_AUTH_SECRET || "native-auth";
+	return `NativeAuth!${createHmac("sha256", secret).update(normalizedEmail).digest("hex")}`;
+}
+
+function resolveTokenExpiry(expiresInSeconds?: number): Date | undefined {
+	if (typeof expiresInSeconds !== "number" || expiresInSeconds <= 0) {
+		return undefined;
+	}
+
+	return new Date(Date.now() + expiresInSeconds * 1000);
+}
+
+function buildSignupDisplayName(
+	firstName: string | undefined,
+	lastName: string | undefined,
+	payload: SignupTokenPayload,
+	fallbackEmail: string,
+): string {
+	const normalizedFirstName =
+		typeof firstName === "string" ? firstName.trim() : "";
+	const normalizedLastName =
+		typeof lastName === "string" ? lastName.trim() : "";
+	const providedName = [normalizedFirstName, normalizedLastName]
+		.filter(Boolean)
+		.join(" ");
+
+	return providedName || payload.name || payload.given_name || fallbackEmail;
+}
+
+async function ensureLocalCredentialAccount(
+	context: AuthContext,
+	email: string,
+	password: string,
+	name: string,
+): Promise<{
+	id: string;
+	email?: string;
+	name?: string;
+	emailVerified?: boolean;
+	image?: string | null;
+}> {
+	const existingUser = await context.internalAdapter.findUserByEmail(email, {
+		includeAccounts: true,
+	});
+
+	const passwordHash = await context.password.hash(password);
+	if (!existingUser?.user?.id) {
+		const createdUser = await context.internalAdapter.createUser({
+			email,
+			name,
+			emailVerified: true,
+			image: null,
+		});
+		await context.internalAdapter.linkAccount({
+			userId: createdUser.id,
+			providerId: "credential",
+			accountId: createdUser.id,
+			password: passwordHash,
+		});
+		return createdUser;
+	}
+
+	const credentialAccount = existingUser.accounts?.find(
+		(account: { providerId?: string; password?: string | null }) =>
+			account.providerId === "credential",
+	);
+
+	if (credentialAccount) {
+		await context.internalAdapter.updatePassword(
+			existingUser.user.id,
+			passwordHash,
+		);
+		return existingUser.user;
+	}
+
+	await context.internalAdapter.linkAccount({
+		userId: existingUser.user.id,
+		providerId: "credential",
+		accountId: existingUser.user.id,
+		password: passwordHash,
+	});
+	return existingUser.user;
+}
+
+async function createLocalAuthSession(
+	context: AuthContext,
+	user: {
+		id: string;
+		email?: string;
+		name?: string;
+		emailVerified?: boolean;
+		image?: string | null;
+	},
+): Promise<AuthSuccessResult | null> {
+	const session = await context.internalAdapter.createSession(user.id);
+	if (!session) {
+		return null;
+	}
+
+	const cookie = serializeCookie(
+		context.authCookies.sessionToken.name,
+		createSignedSessionToken(session.token, context.secret),
+		context.authCookies.sessionToken.attributes,
+	);
+
+	return {
+		session,
+		user,
+		headers: {
+			"set-cookie": cookie,
+		},
+	};
+}
+
+async function signInOrCreateLocalUser(
+	_request: NextRequest,
+	email: string,
+	name: string,
+): Promise<AuthSuccessResult | null> {
+	const localPassword = getLocalAuthPassword(email);
+	const context = await auth.$context;
+	const localUser = await ensureLocalCredentialAccount(
+		context,
+		email,
+		localPassword,
+		name,
+	);
+	return createLocalAuthSession(context, localUser);
+}
+
+async function persistEntraAccountTokens(
+	userId: string,
+	entraAccountId: string,
+	idToken: string,
+	accessToken?: string,
+	refreshToken?: string,
+	expiresInSeconds?: number,
+): Promise<void> {
+	try {
+		const tokenExpiry = resolveTokenExpiry(expiresInSeconds);
+		const ctx = await auth.$context;
+		const storedAccessToken = accessToken
+			? await setTokenUtil(accessToken, ctx)
+			: undefined;
+		const storedRefreshToken = refreshToken
+			? await setTokenUtil(refreshToken, ctx)
+			: undefined;
+		const existingAccounts = await ctx.internalAdapter.findAccounts(userId);
+		const existingEntraAccount = existingAccounts?.find(
+			(account: { id: string; providerId: string }) =>
+				account.providerId === "entra-external-id",
+		);
+		const tokenData = {
+			idToken,
+			...(storedAccessToken ? { accessToken: storedAccessToken } : {}),
+			...(storedRefreshToken ? { refreshToken: storedRefreshToken } : {}),
+			...(tokenExpiry ? { accessTokenExpiresAt: tokenExpiry } : {}),
+		};
+
+		if (existingEntraAccount) {
+			await ctx.internalAdapter.updateAccount(
+				existingEntraAccount.id,
+				tokenData,
+			);
+			return;
+		}
+
+		await ctx.internalAdapter.createAccount({
+			userId,
+			providerId: "entra-external-id",
+			accountId: entraAccountId,
+			...tokenData,
+		});
+	} catch (tokenErr) {
+		console.warn(
+			"[native-session] Failed to upsert entra account tokens:",
+			tokenErr,
+		);
+	}
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new Error("Invalid JWT format");
+	const payload = parts[1];
+	if (!payload) throw new Error("Invalid JWT payload");
+	return JSON.parse(Buffer.from(payload, "base64url").toString());
+}
+
+export async function createLoginSessionFromEntraTokens(
+	request: NextRequest,
+	idToken: string,
+	_password: string,
+	accessToken?: string,
+	refreshToken?: string,
+	expiresInSeconds?: number,
+) {
+	try {
+		const payload = decodeJwtPayload(idToken) as LoginTokenPayload;
+
+		const email = getTokenEmail(payload);
+		if (!email) {
+			return NextResponse.json(
+				{ error: "missing_email", message: "Email claim missing from token" },
+				{ status: 400 },
+			);
+		}
+
+		const authResult = await signInOrCreateLocalUser(
+			request,
+			email,
+			payload.name || payload.given_name || email,
+		);
+
+		if (!authResult) {
+			return NextResponse.json(
+				{
+					error: "login_failed",
+					message: "Unable to create or restore local session.",
+				},
+				{ status: 401 },
+			);
+		}
+
+		await persistEntraAccountTokens(
+			authResult.user.id,
+			getEntraAccountId(payload, authResult.user.id),
+			idToken,
+			accessToken,
+			refreshToken,
+			expiresInSeconds,
+		);
+
+		return createAuthResponse(authResult);
+	} catch (error) {
+		console.error("[native-session] Error creating login session:", error);
+		return NextResponse.json(
+			{ error: "failed_to_create_session", message: String(error) },
+			{ status: 500 },
+		);
+	}
+}
+
+export async function createSignupSessionFromEntraTokens(
+	_request: NextRequest,
+	assertedEmail: string,
+	_password: string,
+	idToken: string,
+	options: SignupSessionOptions = {},
+) {
+	try {
+		const { firstName, lastName, accessToken, refreshToken, expiresInSeconds } =
+			options;
+
+		const payload = decodeJwtPayload(idToken) as SignupTokenPayload;
+		const tokenEmail = getTokenEmail(payload);
+
+		if (!tokenEmail) {
+			return NextResponse.json(
+				{ error: "missing_email", message: "Email claim missing from token" },
+				{ status: 400 },
+			);
+		}
+
+		const normalizedAssertedEmail = assertedEmail.trim().toLowerCase();
+		if (normalizedAssertedEmail && normalizedAssertedEmail !== tokenEmail) {
+			return NextResponse.json(
+				{
+					error: "email_mismatch",
+					message: "Request email does not match token identity.",
+				},
+				{ status: 400 },
+			);
+		}
+
+		const context = await auth.$context;
+		const signUpResult = await createLocalAuthSession(
+			context,
+			await ensureLocalCredentialAccount(
+				context,
+				tokenEmail,
+				getLocalAuthPassword(tokenEmail),
+				buildSignupDisplayName(firstName, lastName, payload, tokenEmail),
+			),
+		);
+
+		if (!signUpResult) {
+			return NextResponse.json(
+				{ error: "signup_failed", message: "Failed to create user account" },
+				{ status: 400 },
+			);
+		}
+
+		await persistEntraAccountTokens(
+			signUpResult.user.id,
+			getEntraAccountId(payload, signUpResult.user.id),
+			idToken,
+			accessToken,
+			refreshToken,
+			expiresInSeconds,
+		);
+
+		return createAuthResponse(signUpResult);
+	} catch (error) {
+		console.error("[native-session] Error creating signup session:", error);
+		return NextResponse.json(
+			{ error: "failed_to_create_session", message: String(error) },
+			{ status: 500 },
+		);
+	}
+}

package/src/pages/account/addresses/address-form.tsx

@@ -11,6 +11,7 @@ import type { CountryRegionInfo } from "@msdyn365-commerce/retail-proxy";
 import {
 	Box,
 	Button,
+	CircularProgress,
 	FormControl,
 	InputLabel,
 	MenuItem,
@@ -25,7 +26,7 @@ import { withZodSchema } from "formik-validator-zod";
 import _ from "lodash";
 import { useRouter } from "next/navigation";
 import { useLocale, useTranslations } from "next-intl";
-import React, { createContext, useContext } from "react";
+import React, { createContext, useContext, useRef } from "react";
 import { z } from "zod";
 
 interface AddressFormValues {
@@ -71,6 +72,7 @@ const AddressForm = ({ address, children }: RootProps) => {
 
 	const { mutateAsync: createAddress } = useCreateAddress();
 	const { mutateAsync: updateAddress } = useUpdateAddress();
+	const isSubmittingRef = useRef(false);
 
 	const FormSchema = z.object({
 		Name: z.string().nonempty(t("Validation.required", { field: t("name") })),
@@ -99,6 +101,9 @@ const AddressForm = ({ address, children }: RootProps) => {
 	};
 
 	const handleSubmit = async (values: AddressFormValues) => {
+		if (isSubmittingRef.current) return;
+		isSubmittingRef.current = true;
+
 		let newAddress: Address = {
 			Name: values.Name,
 			Street: values.Street,
@@ -128,6 +133,7 @@ const AddressForm = ({ address, children }: RootProps) => {
 				severity: "error",
 			});
 			console.log(error);
+			isSubmittingRef.current = false;
 		}
 	};
 
@@ -291,8 +297,20 @@ AddressForm.Actions = ({ children }: { children?: React.ReactNode }) => {
 
 AddressForm.SubmitButton = () => {
 	const t = useTranslations("Address");
+	const ctx = useContext(FormContext);
+	const isSubmitting = ctx?.formik.isSubmitting ?? false;
 	return (
-		<Button type="submit" variant="contained" color="primary">
+		<Button
+			type="submit"
+			variant="contained"
+			color="primary"
+			disabled={isSubmitting}
+			startIcon={
+				isSubmitting ? (
+					<CircularProgress size={20} color="inherit" />
+				) : undefined
+			}
+		>
 			{t("save")}
 		</Button>
 	);

package/src/pages/account/profile/__tests__/profile-form.test.tsx

@@ -0,0 +1,173 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { NextIntlClientProvider } from "next-intl";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import ProfileForm from "../profile-form";
+
+const mockPush = vi.fn();
+const mockInvalidateQueries = vi.fn();
+const mockMutateAsync = vi.fn();
+
+vi.mock("next/navigation", () => ({
+	useRouter: () => ({
+		push: mockPush,
+	}),
+}));
+
+vi.mock("@tanstack/react-query", () => ({
+	useQueryClient: () => ({
+		invalidateQueries: (...args: unknown[]) => mockInvalidateQueries(...args),
+	}),
+}));
+
+vi.mock(
+	"@evenicanpm/storefront-core/src/api-manager/services/user/mutations/update-user",
+	() => ({
+		default: () => ({
+			mutateAsync: (...args: unknown[]) => mockMutateAsync(...args),
+		}),
+	}),
+);
+
+const user = {
+	AccountNumber: "CUST-001",
+	FirstName: "John",
+	LastName: "Doe",
+	Email: "john.doe@example.com",
+};
+
+const ProfileFormComponent = ProfileForm as unknown;
+
+const messages = {
+	Account: {
+		Profile: {
+			fieldFirstName: "First Name",
+			fieldLastName: "Last Name",
+			validationRequired: "{field} is required",
+			validationNameInvalidCharacters: "Invalid characters",
+			validationNameTooLong: "Too long",
+			btnSaveProfile: "Save Profile",
+			errorUpdateFailed: "Update failed",
+		},
+	},
+};
+
+const renderForm = (props?: {
+	onBeforeSave?: (values: {
+		firstName: string;
+		lastName: string;
+	}) => Promise<void>;
+	onSuccess?: () => void;
+}) =>
+	render(
+		<NextIntlClientProvider locale="en-US" messages={messages}>
+			<ProfileFormComponent
+				user={user}
+				onBeforeSave={props?.onBeforeSave}
+				onSuccess={props?.onSuccess}
+			>
+				<ProfileFormComponent.Fields>
+					<ProfileFormComponent.Field
+						name="firstName"
+						label="First Name"
+						autoComplete="given-name"
+						required
+					/>
+					<ProfileFormComponent.Field
+						name="lastName"
+						label="Last Name"
+						autoComplete="family-name"
+						required
+					/>
+				</ProfileFormComponent.Fields>
+				<ProfileFormComponent.Error />
+				<ProfileFormComponent.Actions>
+					<ProfileFormComponent.SubmitButton />
+				</ProfileFormComponent.Actions>
+			</ProfileFormComponent>
+		</NextIntlClientProvider>,
+	);
+
+describe("ProfileForm", () => {
+	beforeEach(() => {
+		vi.restoreAllMocks();
+		mockPush.mockReset();
+		mockInvalidateQueries.mockReset();
+		mockMutateAsync.mockReset();
+	});
+
+	it("renders initial values from user", () => {
+		renderForm();
+
+		expect(screen.getByLabelText(/First Name/i)).toHaveProperty(
+			"value",
+			"John",
+		);
+		expect(screen.getByLabelText(/Last Name/i)).toHaveProperty("value", "Doe");
+	});
+
+	it("does not submit when required fields are invalid", async () => {
+		renderForm();
+
+		fireEvent.change(screen.getByLabelText(/First Name/i), {
+			target: { value: "   " },
+		});
+		fireEvent.click(screen.getByRole("button", { name: "Save Profile" }));
+
+		await waitFor(() => {
+			expect(mockMutateAsync).not.toHaveBeenCalled();
+		});
+		expect(mockPush).not.toHaveBeenCalled();
+	});
+
+	it("calls onBeforeSave, updates user, invalidates query, and routes on success", async () => {
+		const onBeforeSave = vi.fn(async () => undefined);
+		mockMutateAsync.mockResolvedValue({});
+		renderForm({ onBeforeSave });
+
+		fireEvent.change(screen.getByLabelText(/First Name/i), {
+			target: { value: "  Jane  " },
+		});
+		fireEvent.change(screen.getByLabelText(/Last Name/i), {
+			target: { value: "  Smith  " },
+		});
+		fireEvent.click(screen.getByRole("button", { name: "Save Profile" }));
+
+		await waitFor(() => {
+			expect(onBeforeSave).toHaveBeenCalledWith({
+				firstName: "Jane",
+				lastName: "Smith",
+			});
+		});
+		expect(mockMutateAsync).toHaveBeenCalledWith({
+			AccountNumber: "",
+			Email: "john.doe@example.com",
+			FirstName: "Jane",
+			LastName: "Smith",
+		});
+		expect(mockInvalidateQueries).toHaveBeenCalledWith({ queryKey: ["me"] });
+		expect(mockPush).toHaveBeenCalledWith("/account/profile");
+	});
+
+	it("uses onSuccess callback instead of router push when provided", async () => {
+		const onSuccess = vi.fn();
+		mockMutateAsync.mockResolvedValue({});
+		renderForm({ onSuccess });
+
+		fireEvent.click(screen.getByRole("button", { name: "Save Profile" }));
+
+		await waitFor(() => {
+			expect(onSuccess).toHaveBeenCalled();
+		});
+		expect(mockPush).not.toHaveBeenCalled();
+	});
+
+	it("renders submit error message when update fails", async () => {
+		mockMutateAsync.mockRejectedValue(new Error("save failed"));
+		renderForm();
+
+		fireEvent.click(screen.getByRole("button", { name: "Save Profile" }));
+
+		expect(await screen.findByText("save failed")).toBeTruthy();
+		expect(mockPush).not.toHaveBeenCalled();
+	});
+});