@fishawack/lab-velocity 2.0.0-beta.6 → 2.0.0-beta.61

package/_Build/vue/modules/AuthModule/js/clear-cookies.js

@@ -0,0 +1,34 @@
+import axios from "axios";
+
+/**
+ * Clears all cookies by:
+ * 1. Calling the server endpoint to expire HttpOnly cookies (remember token, session)
+ *    across all parent domain variants
+ * 2. Clearing all client-accessible cookies via document.cookie as a fallback
+ */
+export default async function clearCookies() {
+    try {
+        await axios.post("/hydrate/clear-cookies");
+    } catch {
+        /* endpoint may not exist on older backends */
+    }
+
+    const hostname = location.hostname;
+    const parts = hostname.split(".");
+    const domains = [hostname];
+
+    for (let i = 0; i < parts.length - 1; i++) {
+        domains.push("." + parts.slice(i).join("."));
+    }
+
+    document.cookie.split(";").forEach((cookie) => {
+        const name = cookie.split("=")[0].trim();
+        if (!name) return;
+
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+
+        domains.forEach((domain) => {
+            document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;domain=${domain}`;
+        });
+    });
+}

package/_Build/vue/modules/AuthModule/js/guest-request.js

@@ -0,0 +1,32 @@
+"use strict";
+import axios from "axios";
+
+/**
+ * Wraps a form POST to a guest-only route with automatic logged-in detection.
+ *
+ * If the server redirects to /hydrate/logged-in (because a stale session
+ * exists), the helper dispatches a logout, fetches a fresh CSRF cookie,
+ * and retries the original request once.
+ *
+ * @param {object}   options
+ * @param {object}   options.form   - form-backend-validation Form instance
+ * @param {string}   options.url    - endpoint to POST to
+ * @param {string}   [options.method] - HTTP method (default: "post")
+ * @param {import('vuex').Store} options.store - Vuex store (for dispatch("logout"))
+ * @returns {Promise<object>} resolved response data
+ */
+export async function guestRequest({ form, url, method = "post", store }) {
+    const res = await form[method](url);
+
+    if (res && res["logged-in"]) {
+        try {
+            await store.dispatch("logout");
+        } catch (_) {}
+
+        await axios.get("/sanctum/csrf-cookie");
+
+        return await form[method](url);
+    }
+
+    return res;
+}

package/_Build/vue/modules/AuthModule/js/impersonation-banner.js

@@ -0,0 +1,102 @@
+"use strict";
+
+import { createApp, h, ref } from "vue";
+
+let bannerApp = null;
+let bannerContainer = null;
+let storeRef = null;
+const currentUser = ref(null);
+
+function mountBanner() {
+    if (bannerApp) return;
+
+    bannerContainer = document.createElement("div");
+    document.body.insertBefore(bannerContainer, document.body.firstChild);
+
+    bannerApp = createApp({
+        setup() {
+            function stop() {
+                storeRef.dispatch("stopImpersonating");
+            }
+
+            return () =>
+                h(
+                    "div",
+                    {
+                        style: {
+                            background: "#c0392b",
+                            color: "#fff",
+                            display: "flex",
+                            alignItems: "center",
+                            justifyContent: "center",
+                            gap: "16px",
+                            padding: "12px 16px",
+                            fontSize: "14px",
+                            fontFamily: "sans-serif",
+                        },
+                    },
+                    [
+                        h(
+                            "span",
+                            `Impersonating: ${currentUser.value?.name} (${currentUser.value?.email})`,
+                        ),
+                        h(
+                            "button",
+                            {
+                                onClick: stop,
+                                style: {
+                                    background: "#fff",
+                                    color: "#c0392b",
+                                    border: "none",
+                                    padding: "4px 12px",
+                                    borderRadius: "4px",
+                                    cursor: "pointer",
+                                    fontWeight: "bold",
+                                },
+                            },
+                            "Stop impersonating",
+                        ),
+                    ],
+                );
+        },
+    });
+
+    bannerApp.mount(bannerContainer);
+}
+
+function unmountBanner() {
+    if (!bannerApp) return;
+
+    bannerApp.unmount();
+    bannerContainer?.remove();
+    bannerApp = null;
+    bannerContainer = null;
+}
+
+export function syncImpersonationBanner(user) {
+    currentUser.value = user;
+
+    if (user?.impersonating_as) {
+        mountBanner();
+    } else {
+        unmountBanner();
+    }
+}
+
+export function setImpersonationStore(store) {
+    storeRef = store;
+}
+
+export function ImpersonationPlugin(store) {
+    setImpersonationStore(store);
+
+    // Handle persisted state on load (vuex-persistedstate bypasses mutations)
+    syncImpersonationBanner(store.state.auth?.user ?? store.state.user);
+
+    // Handle all future setUser mutations
+    store.subscribe((mutation) => {
+        if (mutation.type === "auth/setUser" || mutation.type === "setUser") {
+            syncImpersonationBanner(mutation.payload);
+        }
+    });
+}

package/_Build/vue/modules/AuthModule/js/router.js

@@ -3,8 +3,22 @@
 import { h } from "vue";
 import { RouterView } from "vue-router";
 
+import { routes as resourceRoutes } from "../../resource/index.js";
+
+import defaultUserResource from "../routes/PUsers/resource.js";
+import defaultCompanyResource from "../routes/PCompanies/resource.js";
+import defaultTeamResource from "../routes/PTeams/resource.js";
+import defaultIntegrationResource from "../routes/PIntegrations/resource.js";
+
 // Admin routes export - minimal auth flow (headless login only)
-export function adminRoutes(node) {
+export function adminRoutes(node, overrides = {}) {
+    const {
+        userResource = defaultUserResource,
+        companyResource = defaultCompanyResource,
+        teamResource = defaultTeamResource,
+        integrationResource = defaultIntegrationResource,
+    } = overrides;
+
     return [
         {
             path: "/auth",
@@ -37,96 +51,25 @@ export function adminRoutes(node) {
                         : require("../routes/logincallback.vue").default,
                     name: "auth.callback",
                 },
-            ],
-        },
-        {
-            path: "/users",
-            component: node
-                ? ""
-                : require("../adminRoutes/PUsers/parent.vue").default,
-            children: [
                 {
-                    path: "",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PUsers/Children/index.vue")
-                              .default,
-                    name: "users.index",
-                },
-                {
-                    path: "create",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PUsers/Children/create.vue")
-                              .default,
-                    name: "users.create",
-                },
-                {
-                    path: ":id",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PUsers/Children/show.vue")
-                              .default,
-                    name: "users.show",
-                },
-                {
-                    path: ":id/edit",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PUsers/Children/edit.vue")
-                              .default,
-                    name: "users.edit",
-                },
-            ],
-        },
-        {
-            path: "/companies",
-            component: node
-                ? ""
-                : require("../adminRoutes/PCompanies/parent.vue").default,
-            children: [
-                {
-                    path: "",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PCompanies/Children/index.vue")
-                              .default,
-                    name: "companies.index",
-                },
-                {
-                    path: "create",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PCompanies/Children/create.vue")
-                              .default,
-                    name: "companies.create",
-                },
-                {
-                    path: ":id",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PCompanies/Children/show.vue")
-                              .default,
-                    name: "companies.show",
-                },
-                {
-                    path: ":id/edit",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PCompanies/Children/edit.vue")
-                              .default,
-                    name: "companies.edit",
-                },
-                {
-                    path: ":id/upload",
-                    component: node
-                        ? ""
-                        : require("../adminRoutes/PCompanies/Children/Upload/upload.vue")
-                              .default,
-                    name: "companies.upload",
+                    path: "verify",
+                    component: require("../routes/verify.vue").default,
+                    name: "auth.verify",
                 },
             ],
         },
+        ...resourceRoutes(node, ...userResource),
+        ...resourceRoutes(node, ...companyResource, [
+            ...resourceRoutes(node, teamResource[0], {
+                ...teamResource[1],
+                routeName: "companies.teams",
+            }),
+        ]),
+        ...resourceRoutes(node, teamResource[0], {
+            ...teamResource[1],
+            routeName: "teams",
+        }),
+        ...resourceRoutes(node, ...integrationResource),
     ];
 }
 
@@ -241,50 +184,84 @@ export function routes(node) {
 }
 
 export function beforeEach(router, store) {
+    let initialLoad = true;
+
+    // These routes must always be reachable regardless of auth/verification state.
+    // Without this, force_password_change or unverified state can trap the user with
+    // no way to log out or complete an SSO callback.
+    const ALWAYS_ALLOW = new Set(["auth.logout", "auth.callback"]);
+
     router.beforeEach(async (to, from, next) => {
-        // If authenticated query param is present, assume authentication has happened elsewhere and attempt to fetch user data
-        if (to.query.authenticated && !store.getters.authenticated) {
+        // Refresh user state on initial page load (handles cross-app state sync)
+        // or when authenticated query param is present (bypass/redirect flow)
+        if (
+            (store.getters.authenticated && initialLoad) ||
+            to.query.authenticated
+        ) {
             await store.dispatch("getUser", {
                 errors: (e) => console.error(e),
             });
         }
 
+        initialLoad = false;
+
         const { user, redirect } = store.state.auth;
+        const isGuestRoute = to.matched.some((d) => d.meta.guest) === true;
 
-        // User verification handling and redirect if user alrady verified but accessing an expired verification route
+        // Logout and SSO callback must always be reachable — prevents every
+        // possible "stuck" scenario caused by state-based redirects below.
+        if (ALWAYS_ALLOW.has(to.name)) {
+            return next();
+        }
+
+        // Redirect already-verified users away from verification routes
         if (
             to.query.verified ||
             (to.name === "auth.expired-verification" && user?.email_verified_at)
         ) {
-            next({ name: "auth.success-verify" });
-        } else if (store.getters.authenticated) {
-            // User is authenticated - check permissions and redirect appropriately
-            if (user.force_password_change && to.name !== "auth.force-reset") {
-                // User needs to change password - redirect to force reset
-                next({ name: "auth.force-reset" });
-            } else if (to.name === "auth.login") {
-                // Already logged in user hitting login
-                next({ name: redirect });
-            } else if (
+            return next({ name: "auth.success-verify" });
+        }
+
+        if (store.getters.authenticated) {
+            // 1. Email verification is the highest priority redirect.
+            //    Must come before force_password_change — there is no point forcing
+            //    a password change on an account that hasn't been verified yet.
+            //    Guest routes, auth.verify and auth.expired-verification are exempt
+            //    so the user can always complete or re-request verification.
+            if (
                 !user?.email_verified_at &&
-                to.matched.some((d) => d.meta.guest) !== true
+                !isGuestRoute &&
+                to.name !== "auth.verify" &&
+                to.name !== "auth.expired-verification"
             ) {
-                // User needs email verification and trying to access protected route
-                next({ name: "auth.verify" });
-            } else {
-                // User is authenticated and authorized - proceed
-                next();
+                return next({ name: "auth.verify" });
             }
-        } else {
-            // User is not authenticated - handle guest routes and login redirects
-            if (to.matched.some((d) => d.meta.guest) === true) {
-                // Route allows guest access - proceed
-                next();
-            } else {
-                // Protected route requires authentication - redirect to standard login
-                next({ name: "auth.login" });
+
+            // 2. Force password change applies only after verification is satisfied.
+            //    Guest routes are exempt so the user can still navigate within /auth
+            //    (e.g. auth.verify, auth.expired-verification) without looping.
+            if (
+                user?.force_password_change &&
+                !isGuestRoute &&
+                to.name !== "auth.force-reset"
+            ) {
+                return next({ name: "auth.force-reset" });
+            }
+
+            // 3. Redirect an already-authenticated user away from the login page
+            if (to.name === "auth.login") {
+                return next({ name: redirect });
             }
+
+            return next();
+        }
+
+        // Unauthenticated: allow guest routes, otherwise redirect to login
+        if (isGuestRoute) {
+            return next();
         }
+
+        return next({ name: "auth.login" });
     });
 }
 

package/_Build/vue/modules/AuthModule/js/store.js

@@ -7,6 +7,9 @@ const store = {
             intended: null,
             user: null,
             redirect: process.env.HYDRATE_REDIRECT ?? "index",
+            logo: process.env.HYDRATE_LOGO ?? "example-logo",
+            logoReverse:
+                process.env.HYDRATE_LOGO_REVERSE ?? process.env.HYDRATE_LOGO,
             contact:
                 process.env.HYDRATE_CONTACT ?? "mailto:det@avalerehealth.com",
         };
@@ -15,12 +18,18 @@ const store = {
     getters: {
         authenticated: (state) => !!state.user,
         can: (state) => (permission) => {
-            return state.user?.permissions
-                .map(({ name }) => name)
-                .includes(permission);
+            const arr = Array.isArray(permission) ? permission : [permission];
+            const userPermissions = state.user?.permissions.map(
+                ({ name }) => name,
+            );
+
+            return arr.every((name) => userPermissions?.includes(name));
         },
         hasRole: (state) => (role) => {
-            return state.user?.roles.map(({ name }) => name).includes(role);
+            const arr = Array.isArray(role) ? role : [role];
+            const userRoles = state.user?.roles.map(({ name }) => name);
+
+            return arr.every((name) => userRoles?.includes(name));
         },
     },
 
@@ -38,7 +47,7 @@ const store = {
     },
 
     actions: {
-        getUser({ commit }, { errors, query = "", params }) {
+        getUser({ commit }, { errors = console.log, query = "", params } = {}) {
             return axios
                 .get(`/api/users/self${query}`, {
                     params,
@@ -51,11 +60,19 @@ const store = {
                 .catch(errors);
         },
 
-        logout({ commit }, { errors }) {
+        logout({ commit }) {
             commit("setUser", null);
 
             return axios.post("/logout");
         },
+
+        stopImpersonating({ commit }) {
+            return axios.post("/api/users/impersonate/stop").then((res) => {
+                commit("setUser", res.data.data);
+
+                return res.data.data;
+            });
+        },
     },
 };