@frockbot/plugin-auth 0.0.0 → 0.1.1

package/frockbot.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 3,
+  "id": "auth",
+  "displayName": "Authentication",
+  "version": "0.0.1",
+  "compatibility": { "frockbot": ">=0.0.1" },
+  "dependencies": { "ui-theme": ">=0.0.1" },
+  "contributions": {
+    "client": {
+      "entry": "./client",
+      "mounts": [{ "slot": "root", "order": 20000 }],
+      "outlets": ["authenticated-root"]
+    },
+    "desktop": {
+      "entry": "./desktop",
+      "execution": "trusted-main",
+      "commands": []
+    }
+  },
+  "permissions": ["identity:authenticate"]
+}

package/package.json

@@ -1,14 +1,45 @@
 {
   "name": "@frockbot/plugin-auth",
-  "version": "0.0.0",
-  "description": "Placeholder reserving this name for trusted publishing. Superseded by the first release.",
-  "license": "UNLICENSED",
+  "version": "0.1.1",
+  "private": false,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./client": "./src/client/index.ts",
+    "./desktop": "./src/desktop.ts",
+    "./shared": "./src/shared.ts",
+    "./manifest": "./src/manifest.ts",
+    "./frockbot.json": "./frockbot.json",
+    "./package.json": "./package.json"
+  },
+  "frockbot": {
+    "manifest": "./frockbot.json"
+  },
+  "scripts": {
+    "test": "bun test src",
+    "typecheck": "vue-tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "@better-auth/electron": "1.7.2",
+    "@frockbot/client-core": "0.1.1",
+    "better-auth": "1.7.2",
+    "cordis": "4.0.0-rc.8",
+    "vue": "3.5.41"
+  },
+  "devDependencies": {
+    "@frockbot/plugin-testkit": "0.1.1",
+    "@types/bun": "1.4.0",
+    "@types/node": "26.2.0",
+    "typescript": "5.9.3",
+    "vite": "8.2.2",
+    "vue-tsc": "3.3.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/timoconnellaus/frockbot.git",
     "directory": "packages/plugin-auth"
-  },
-  "publishConfig": {
-    "access": "public"
   }
 }

package/src/client/AuthGate.vue

@@ -0,0 +1,174 @@
+<script setup lang="ts">
+import { authSessionClientKey } from "../shared.js";
+import { computed, inject, onBeforeUnmount, onMounted, ref } from "vue";
+import { hostedAuthClient } from "./browser.js";
+import { developmentLoginUrl, isLoopbackHost } from "./development-login";
+
+const providedSession = inject(authSessionClientKey);
+if (!providedSession) throw new Error("auth session client was not provided");
+const session = providedSession;
+
+const signingIn = ref(false);
+const error = ref<string>();
+const user = computed(() =>
+  session.projection.value.status === "authenticated"
+    ? session.projection.value.user
+    : null,
+);
+const loading = computed(() => session.projection.value.status === "loading");
+const isDesktop = computed(() => Boolean(window.frockbotDesktop));
+const isLocalDevelopment = computed(() =>
+  isLoopbackHost(window.location.hostname),
+);
+const unsubscribers: Array<() => void> = [];
+let electronRedirectTimer: ReturnType<
+  typeof hostedAuthClient.ensureElectronRedirect
+> | null = null;
+
+function electronAuthQuery(): Record<string, string> | null {
+  const params = new URLSearchParams(window.location.search);
+  const clientId = params.get("client_id");
+  const state = params.get("state");
+  const codeChallenge = params.get("code_challenge");
+  return clientId && state && codeChallenge
+    ? {
+        client_id: clientId,
+        state,
+        code_challenge: codeChallenge,
+      }
+    : null;
+}
+
+async function refreshSession(): Promise<void> {
+  try {
+    await session.refresh();
+    error.value = undefined;
+  } catch (cause) {
+    error.value =
+      cause instanceof Error ? cause.message : "Could not check your session";
+  }
+}
+
+async function loadUser(): Promise<void> {
+  await session.refresh();
+  const query = electronAuthQuery();
+  if (
+    query &&
+    session.projection.value.status === "authenticated" &&
+    session.projection.value.mode === "better-auth"
+  ) {
+    signingIn.value = true;
+    const transfer = await hostedAuthClient.electron.transferUser({
+      fetchOptions: { query },
+    });
+    if (transfer.error) throw new Error(transfer.error.message);
+  }
+}
+
+function signInForDevelopment(): void {
+  window.location.assign(developmentLoginUrl(new URL(window.location.href)));
+}
+
+async function signIn(): Promise<void> {
+  signingIn.value = true;
+  error.value = undefined;
+  try {
+    if (isDesktop.value) {
+      await window.requestAuth();
+      return;
+    }
+    const query = electronAuthQuery();
+    const callbackURL = new URL("/", window.location.origin);
+    if (query) {
+      for (const [key, value] of Object.entries(query)) {
+        callbackURL.searchParams.set(key, value);
+      }
+    }
+    const callback = callbackURL.toString();
+    const result = await hostedAuthClient.signIn.social({
+      provider: "google",
+      callbackURL: callback,
+      newUserCallbackURL: callback,
+      errorCallbackURL: callback,
+      fetchOptions: query ? { query } : undefined,
+    });
+    if (result.error) throw new Error(result.error.message);
+  } catch (cause) {
+    error.value = cause instanceof Error ? cause.message : "Sign-in failed";
+    signingIn.value = false;
+  }
+}
+
+onMounted(async () => {
+  try {
+    if (isDesktop.value) {
+      unsubscribers.push(
+        window.onAuthenticated(() => {
+          signingIn.value = false;
+          void refreshSession();
+        }),
+        window.onUserUpdated(() => {
+          void refreshSession();
+        }),
+        window.onAuthError((context) => {
+          error.value = context.message ?? "Sign-in failed";
+          signingIn.value = false;
+        }),
+      );
+    } else if (electronAuthQuery()) {
+      electronRedirectTimer = hostedAuthClient.ensureElectronRedirect();
+    }
+    await loadUser();
+  } catch (cause) {
+    error.value =
+      cause instanceof Error ? cause.message : "Could not check your session";
+  }
+});
+
+onBeforeUnmount(() => {
+  for (const unsubscribe of unsubscribers) unsubscribe();
+  if (electronRedirectTimer) clearTimeout(electronRedirectTimer);
+});
+</script>
+
+<template>
+  <k-slot v-if="user" name="authenticated-root" />
+  <main v-else class="auth-screen">
+    <section class="auth-card" aria-labelledby="auth-title">
+      <div class="auth-mark" aria-hidden="true">⌁</div>
+      <p class="auth-eyebrow">FrockBot</p>
+      <h1 id="auth-title">Welcome back</h1>
+      <p class="auth-copy">
+        Sign in in your browser to keep credentials out of the desktop renderer.
+      </p>
+      <div v-if="loading" class="auth-loading" aria-live="polite">
+        Checking your session…
+      </div>
+      <div v-else class="auth-actions">
+        <button
+          v-if="isLocalDevelopment"
+          class="dev-button"
+          type="button"
+          :disabled="signingIn"
+          @click="signInForDevelopment"
+        >
+          Continue as local developer
+        </button>
+        <button
+          class="google-button"
+          type="button"
+          :disabled="signingIn"
+          @click="signIn"
+        >
+          <span class="google-g" aria-hidden="true">G</span>
+          {{ signingIn ? "Waiting for browser…" : "Continue with Google" }}
+        </button>
+      </div>
+      <p v-if="error" class="auth-error" role="alert">{{ error }}</p>
+      <p v-if="isDesktop && signingIn" class="auth-hint">
+        Finish signing in in the browser. You can safely return to FrockBot when
+        it closes.
+      </p>
+    </section>
+  </main>
+</template>

package/src/client/browser.ts

@@ -0,0 +1,70 @@
+import { electronProxyClient } from "@better-auth/electron/proxy";
+import { createAuthClient } from "better-auth/client";
+import { createHostedAuthAdapter } from "./hosted-session.js";
+import { createAuthSessionClient } from "./session.js";
+
+export const hostedAuthClient = createAuthClient({
+  plugins: [
+    electronProxyClient({
+      clientID: "frockbot-desktop",
+      protocol: { scheme: "com.frockbot.desktop" },
+    }),
+  ],
+});
+
+function errorProjection(error: { message?: string } | null | undefined) {
+  return error ? { message: error.message } : null;
+}
+
+function embeddedAuthMode(): "anonymous" | "better-auth" | "development" {
+  const mode = document.body.dataset.frockbotAuthMode;
+  if (
+    mode !== "anonymous" &&
+    mode !== "better-auth" &&
+    mode !== "development"
+  ) {
+    throw new Error("Hosted auth mode is invalid");
+  }
+  return mode;
+}
+
+function embeddedIsAdmin(): boolean {
+  const value = document.body.dataset.frockbotIsAdmin;
+  if (value !== "true" && value !== "false") {
+    throw new Error("Hosted admin projection is invalid");
+  }
+  return value === "true";
+}
+
+export function createBrowserAuthSessionClient() {
+  const desktop = window.frockbotDesktop
+    ? {
+        getUser: () => window.getUser(),
+        signOut: () => window.signOut(),
+      }
+    : undefined;
+  const adapter = createHostedAuthAdapter({
+    location: new URL(window.location.href),
+    embeddedUserId: document.body.dataset.frockbotUserId,
+    embeddedMode: embeddedAuthMode(),
+    embeddedIsAdmin: embeddedIsAdmin(),
+    desktop,
+    betterAuth: {
+      getSession: async () => {
+        const result = await hostedAuthClient.getSession();
+        return {
+          data: result.data ? { user: result.data.user } : null,
+          error: errorProjection(result.error),
+        };
+      },
+      signOut: async () => {
+        const result = await hostedAuthClient.signOut();
+        return {
+          data: result.data,
+          error: errorProjection(result.error),
+        };
+      },
+    },
+  });
+  return createAuthSessionClient(adapter);
+}

package/src/client/development-login.ts

@@ -0,0 +1,24 @@
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
+
+export const DEVELOPMENT_USER_ID = "development";
+
+export function isLoopbackHost(hostname: string): boolean {
+  return LOOPBACK_HOSTS.has(hostname.toLowerCase());
+}
+
+export function developmentUserFromUrl(url: URL): string | undefined {
+  if (!isLoopbackHost(url.hostname)) return undefined;
+  return url.searchParams.get("as_user") === DEVELOPMENT_USER_ID
+    ? DEVELOPMENT_USER_ID
+    : undefined;
+}
+
+export function developmentLoginUrl(url: URL): string {
+  try {
+    const loginUrl = new URL(url.href);
+    loginUrl.searchParams.set("as_user", DEVELOPMENT_USER_ID);
+    return loginUrl.toString();
+  } catch {
+    return url.toString();
+  }
+}

package/src/client/hosted-session.test.ts

@@ -0,0 +1,185 @@
+import { describe, expect, test } from "bun:test";
+import { createHostedAuthAdapter } from "./hosted-session.js";
+
+const user = { id: "alice", name: "Alice", email: "alice@example.com" };
+
+function browser(
+  overrides: Partial<Parameters<typeof createHostedAuthAdapter>[0]> = {},
+) {
+  return createHostedAuthAdapter({
+    location: new URL("https://frockbot.test/"),
+    embeddedUserId: "alice",
+    embeddedMode: "better-auth",
+    embeddedIsAdmin: true,
+    betterAuth: {
+      getSession: () => Promise.resolve({ data: { user }, error: null }),
+      signOut: () => Promise.resolve({ data: { success: true }, error: null }),
+    },
+    ...overrides,
+  });
+}
+
+describe("hosted auth adapter", () => {
+  test("projects Better Auth and returns authoritative anonymous sign-out", async () => {
+    let signOuts = 0;
+    const adapter = browser({
+      betterAuth: {
+        getSession: () => Promise.resolve({ data: { user }, error: null }),
+        signOut: () => {
+          signOuts += 1;
+          return Promise.resolve({ data: { success: true }, error: null });
+        },
+      },
+    });
+
+    expect(await adapter.read()).toEqual({
+      schemaVersion: 1,
+      status: "authenticated",
+      mode: "better-auth",
+      user: { ...user, isAdmin: true },
+    });
+    expect(await adapter.signOut()).toEqual({
+      schemaVersion: 1,
+      status: "anonymous",
+    });
+    expect(signOuts).toBe(1);
+  });
+
+  test("uses the trusted desktop bridge", async () => {
+    let signOuts = 0;
+    const adapter = browser({
+      desktop: {
+        getUser: () => Promise.resolve(user),
+        signOut: () => {
+          signOuts += 1;
+          return Promise.resolve();
+        },
+      },
+    });
+
+    expect(await adapter.read()).toMatchObject({
+      status: "authenticated",
+      mode: "desktop",
+      user: { ...user, isAdmin: true },
+    });
+    expect(await adapter.signOut()).toEqual({
+      schemaVersion: 1,
+      status: "anonymous",
+    });
+    expect(signOuts).toBe(1);
+  });
+
+  test("projects explicit and persisted development identity separately", async () => {
+    const direct = browser({
+      location: new URL("http://localhost:8787/?as_user=development"),
+    });
+    expect(await direct.read()).toMatchObject({
+      status: "authenticated",
+      mode: "development",
+      user: { id: "development" },
+    });
+    await expect(direct.signOut()).rejects.toThrow(
+      "Development identity cannot be signed out",
+    );
+
+    let desktopSignOuts = 0;
+    const directInDesktop = browser({
+      location: new URL("http://localhost:8787/?as_user=development"),
+      desktop: {
+        getUser: () => Promise.resolve(user),
+        signOut: () => {
+          desktopSignOuts += 1;
+          return Promise.resolve();
+        },
+      },
+    });
+    await expect(directInDesktop.signOut()).rejects.toThrow(
+      "Development identity cannot be signed out",
+    );
+    expect(desktopSignOuts).toBe(0);
+
+    const persisted = browser({
+      location: new URL("http://localhost:8787/"),
+      embeddedUserId: "development",
+      embeddedMode: "development",
+      betterAuth: {
+        getSession: () => Promise.resolve({ data: null, error: null }),
+        signOut: () => Promise.resolve({ data: null, error: null }),
+      },
+    });
+    expect(await persisted.read()).toMatchObject({
+      status: "authenticated",
+      mode: "development",
+    });
+  });
+
+  test("keeps embedded development authority ahead of desktop and Better Auth", async () => {
+    let desktopReads = 0;
+    let desktopSignOuts = 0;
+    let sessionReads = 0;
+    let betterAuthSignOuts = 0;
+    const adapter = browser({
+      embeddedUserId: "development",
+      embeddedMode: "development",
+      desktop: {
+        getUser: () => {
+          desktopReads += 1;
+          return Promise.resolve(user);
+        },
+        signOut: () => {
+          desktopSignOuts += 1;
+          return Promise.resolve();
+        },
+      },
+      betterAuth: {
+        getSession: () => {
+          sessionReads += 1;
+          return Promise.resolve({ data: { user }, error: null });
+        },
+        signOut: () => {
+          betterAuthSignOuts += 1;
+          return Promise.resolve({ data: { success: true }, error: null });
+        },
+      },
+    });
+
+    expect(await adapter.read()).toEqual({
+      schemaVersion: 1,
+      status: "authenticated",
+      mode: "development",
+      user: {
+        id: "development",
+        name: "Local developer",
+        email: "dev@localhost",
+        isAdmin: true,
+      },
+    });
+    expect(desktopReads).toBe(0);
+    expect(sessionReads).toBe(0);
+    await expect(adapter.signOut()).rejects.toThrow(
+      "Development identity cannot be signed out",
+    );
+    expect(desktopSignOuts).toBe(0);
+    expect(betterAuthSignOuts).toBe(0);
+  });
+
+  test("surfaces Better Auth failure without fabricating success", async () => {
+    const adapter = browser({
+      betterAuth: {
+        getSession: () => Promise.resolve({ data: { user }, error: null }),
+        signOut: () =>
+          Promise.resolve({
+            data: null,
+            error: { message: "server unavailable" },
+          }),
+      },
+    });
+    await expect(adapter.signOut()).rejects.toThrow("server unavailable");
+  });
+
+  test("projects only the gateway-owned admin boolean", async () => {
+    expect(await browser({ embeddedIsAdmin: false }).read()).toMatchObject({
+      user: { id: "alice", isAdmin: false },
+    });
+  });
+});

package/src/client/hosted-session.ts

@@ -0,0 +1,157 @@
+import { developmentUserFromUrl } from "./development-login.js";
+
+interface AuthUserLike {
+  id?: unknown;
+  name?: unknown;
+  email?: unknown;
+}
+
+interface BetterAuthResult {
+  data?: { user?: AuthUserLike } | null | unknown;
+  error?: { message?: string } | null;
+}
+
+export interface HostedBetterAuthAdapter {
+  getSession(): Promise<BetterAuthResult>;
+  signOut(): Promise<BetterAuthResult>;
+}
+
+export interface HostedDesktopAuthAdapter {
+  getUser(): Promise<AuthUserLike | null>;
+  signOut(): Promise<void>;
+}
+
+export interface HostedAuthAdapterInput {
+  location: URL;
+  embeddedUserId?: string;
+  embeddedMode?: "anonymous" | "better-auth" | "development";
+  embeddedIsAdmin?: boolean;
+  betterAuth: HostedBetterAuthAdapter;
+  desktop?: HostedDesktopAuthAdapter;
+}
+
+function userProjection(
+  user: AuthUserLike,
+  isAdmin: boolean,
+  fallbackName = "FrockBot user",
+) {
+  if (typeof user.id !== "string" || user.id.length === 0) {
+    throw new Error("Authenticated user id is invalid");
+  }
+  return {
+    id: user.id,
+    name:
+      typeof user.name === "string" && user.name.length > 0
+        ? user.name
+        : fallbackName,
+    email: typeof user.email === "string" ? user.email : "",
+    isAdmin,
+  };
+}
+
+function embeddedDevelopmentUser(
+  input: HostedAuthAdapterInput,
+): string | undefined {
+  if (
+    input.embeddedMode !== "development" ||
+    !input.embeddedUserId ||
+    input.embeddedUserId === "anonymous"
+  ) {
+    return undefined;
+  }
+  return input.embeddedUserId;
+}
+
+function developmentProjection(userId: string, isAdmin: boolean) {
+  return {
+    schemaVersion: 1 as const,
+    status: "authenticated" as const,
+    mode: "development" as const,
+    user: {
+      id: userId,
+      name: "Local developer",
+      email: "dev@localhost",
+      isAdmin,
+    },
+  };
+}
+
+function betterAuthUser(result: BetterAuthResult): AuthUserLike | undefined {
+  if (result.error) {
+    throw new Error(result.error.message || "Could not check your session");
+  }
+  if (
+    typeof result.data !== "object" ||
+    result.data === null ||
+    !("user" in result.data)
+  ) {
+    return undefined;
+  }
+  const user = result.data.user;
+  return typeof user === "object" && user !== null
+    ? (user as AuthUserLike)
+    : undefined;
+}
+
+export function createHostedAuthAdapter(input: HostedAuthAdapterInput) {
+  return {
+    async read(): Promise<unknown> {
+      const developmentUser = developmentUserFromUrl(input.location);
+      if (developmentUser) {
+        return developmentProjection(
+          developmentUser,
+          input.embeddedIsAdmin === true,
+        );
+      }
+
+      const embeddedDevelopment = embeddedDevelopmentUser(input);
+      if (embeddedDevelopment) {
+        return developmentProjection(
+          embeddedDevelopment,
+          input.embeddedIsAdmin === true,
+        );
+      }
+
+      if (input.desktop) {
+        const user = await input.desktop.getUser();
+        return user
+          ? {
+              schemaVersion: 1,
+              status: "authenticated",
+              mode: "desktop",
+              user: userProjection(user, input.embeddedIsAdmin === true),
+            }
+          : { schemaVersion: 1, status: "anonymous" };
+      }
+
+      const user = betterAuthUser(await input.betterAuth.getSession());
+      if (user) {
+        return {
+          schemaVersion: 1,
+          status: "authenticated",
+          mode: "better-auth",
+          user: userProjection(user, input.embeddedIsAdmin === true),
+        };
+      }
+      return { schemaVersion: 1, status: "anonymous" };
+    },
+
+    async signOut(): Promise<unknown> {
+      if (
+        developmentUserFromUrl(input.location) ||
+        embeddedDevelopmentUser(input)
+      ) {
+        throw new Error("Development identity cannot be signed out");
+      }
+      if (input.desktop) {
+        await input.desktop.signOut();
+      } else {
+        const result = await input.betterAuth.signOut();
+        if (result.error) {
+          throw new Error(result.error.message || "Sign-out failed");
+        }
+      }
+      return { schemaVersion: 1, status: "anonymous" };
+    },
+  };
+}

package/src/client/index.ts

@@ -0,0 +1,15 @@
+/// <reference path="../env.d.ts" />
+
+import type { ClientPlugin, ClientPluginContext } from "@frockbot/client-core";
+import { authSessionClientKey } from "../shared.js";
+import AuthGate from "./AuthGate.vue";
+import { createBrowserAuthSessionClient } from "./browser.js";
+import "@frockbot/client-core/fonts.css";
+import "./styles.css";
+
+export const authClientPlugin: ClientPlugin = (ctx: ClientPluginContext) => [
+  ctx.provide(authSessionClientKey, createBrowserAuthSessionClient()),
+  ctx.slot({ slot: "root", order: 20_000, component: AuthGate }),
+];
+
+export default authClientPlugin;