@grasp-labs/ds-microfrontends-integration 0.10.1 → 0.11.1

package/README.md

@@ -220,7 +220,7 @@ npm install
 
 ### Dev auth middleware
 
-`devAuthMiddleware` adds a quick login screen to your local Express setup and reuses the returned token for every backend call. Mount it before anything that proxies to your APIs so outbound requests get `Authorization: Bearer <token>` automatically.
+`devAuthMiddleware` provides an optional login page for local development and injects `Authorization: Bearer <token>` for backend calls when a token is available. Mount it before anything that proxies to your APIs so outbound requests receive the token automatically.
 
 ```ts
 import express from "express";
@@ -229,11 +229,20 @@ import { devAuthMiddleware } from "@grasp-labs/ds-microfrontends-integration/dev
 const app = express();
 
 app.use(devAuthMiddleware());
+
+// Or with custom options:
+app.use(
+  devAuthMiddleware({
+    loginPagePath: "/__login", // Path for the login page
+    afterLoginRedirectPath: "/", // Where to redirect after login
+    authServerLoginUrl: "https://auth-dev.grasp-daas.com/rest-auth/login/", // Auth server endpoint
+  }),
+);
 ```
 
-Skip the form entirely by setting `DEV_AUTH_TOKEN` (env var or `.env` file) before starting the server. Need a token? Call the dev auth endpoint with your usual credentials and copy the `access_token`.
+The login page is available at `/__login` (configurable via `loginPagePath`). Navigate there manually when you need to authenticate. Alternatively, set `DEV_AUTH_TOKEN` (env var or `.env` file) before starting the server to skip the login form entirely.
 
-After a successful login, the middleware redirects to `process.env.VITE_BASE_PATH` when set, otherwise `/` (override via `redirectAfterLoginPathTo` if needed).
+After a successful login, the middleware redirects to `process.env.VITE_BASE_PATH` when set, otherwise `/` (override via `afterLoginRedirectPath` if needed).
 
 ### Scripts
 

package/dist/dev/express-auth-middleware.d.ts

@@ -1,22 +1,22 @@
 import { Request, Response, NextFunction } from 'express';
 export type DevLoginOptions = {
     /**
-     * Path segment or absolute path for the login page. Values are trimmed and
-     * automatically prefixed with "/" when missing (e.g. "__login" => "/__login").
+     * Path segment or absolute path for the login page. Automatically prefixed
+     * with "/" when missing (e.g. "__login" => "/__login").
      * @default "/__login"
      */
-    loginPath?: string;
+    loginPagePath?: string;
     /**
      * Location to redirect to after successful authentication. The same
-     * normalization rules apply as for {@link loginPath}.
+     * normalization rules apply as for {@link loginPagePath}.
      * @default process.env.VITE_BASE_PATH || "/"
      */
-    redirectAfterLoginPathTo?: string;
+    afterLoginRedirectPath?: string;
     /**
-     * Fully qualified URL of the backend dev auth login endpoint.
+     * Fully qualified URL of the auth server login endpoint.
      * @default "https://auth-dev.grasp-daas.com/rest-auth/login/"
      */
-    authEndpoint?: string;
+    authServerLoginUrl?: string;
 };
 /**
  * Simple Express middleware that forces a one-page dev login and then injects
@@ -37,7 +37,7 @@ export type DevLoginOptions = {
  * app.use(devAuthMiddleware());
  * ```
  */
-export declare function devAuthMiddleware(options?: DevLoginOptions): (req: Request, res: Response, next: NextFunction) => Promise<any>;
+export declare function devAuthMiddleware(options?: DevLoginOptions): (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
 /**
  * Simple in-memory token store backed by process.env.
  * Preloading `DEV_AUTH_TOKEN` (e.g. via a `.env` file or shell env var) skips the login flow entirely.
@@ -45,5 +45,4 @@ export declare function devAuthMiddleware(options?: DevLoginOptions): (req: Requ
 export declare const DEV_AUTH_TOKEN: {
     readonly get: () => string | undefined;
     readonly set: (token: string) => void;
-    readonly exists: () => boolean;
 };

package/dist/dev/express-auth-middleware.js

@@ -1,6 +1,6 @@
-import { urlencoded as b } from "express";
-function w(e) {
-  const t = e.loginPath, r = e.errorMessage ?? "", n = y(r);
+import { urlencoded as g } from "express";
+function m(e) {
+  const o = e.loginPath, r = e.errorMessage ?? "", n = f(r);
   return `<!DOCTYPE html>
 <html lang="en">
   <head>
@@ -99,7 +99,7 @@ function w(e) {
         <p>Provide credentials to unlock the dev server</p>
       </div>
 
-      <form method="POST" action="${t}">
+      <form method="POST" action="${o}">
         <input type="text" placeholder="Email" name="email" required />
         <input
           type="password"
@@ -116,9 +116,9 @@ function w(e) {
   </body>
 </html>`;
 }
-function y(e) {
-  return e.replace(/[&<>"']/g, (t) => {
-    switch (t) {
+function f(e) {
+  return e.replace(/[&<>"']/g, (o) => {
+    switch (o) {
       case "&":
         return "&amp;";
       case "<":
@@ -130,72 +130,79 @@ function y(e) {
       case "'":
         return "&#39;";
       default:
-        return t;
+        return o;
     }
   });
 }
-function v(e = {}) {
-  const {
-    loginPath: t = "/__login",
-    redirectAfterLoginPathTo: r = process.env.VITE_BASE_PATH || "/",
-    authEndpoint: n = "https://auth-dev.grasp-daas.com/rest-auth/login/"
-  } = e, o = g(t, "loginPath"), c = g(
-    r,
-    "redirectAfterLoginPathTo"
-  ), m = k();
-  return async (s, i, p) => {
-    if (l.exists())
-      return s.path === o ? i.redirect(c) : (s.headers.authorization = `Bearer ${l.get()}`, p());
-    if (s.path !== o)
-      return i.redirect(o);
-    if (s.method === "GET")
-      return d(i, o);
-    if (s.method === "POST") {
-      try {
-        await m(s, i);
-      } catch (a) {
-        return p(a);
-      }
-      const { email: u, password: h } = s.body ?? {};
-      if (!u || !h)
-        return d(i, o, "Email and password are required.");
-      try {
-        const { access_token: a } = await x({
-          email: u,
-          password: h,
-          authEndpoint: n
-        });
-        return l.set(a), i.redirect(303, c);
-      } catch (a) {
-        const f = `${a instanceof Error ? a.message : String(a)}`;
-        return d(i, o, f);
-      }
-    }
-    return i.status(405).send("Method Not Allowed");
-  };
+function T(e = {}) {
+  const o = b(e);
+  return k(o), async (r, n, t) => r.path === o.loginPagePath ? r.method === "GET" ? d(n, o.loginPagePath) : r.method === "POST" ? y(o, r, n, t) : n.status(405).send("Method Not Allowed") : P(r, t);
 }
-function g(e, t) {
-  const r = e.trim();
-  if (!r)
-    throw new Error(
-      `devAuthMiddleware ${t} must be a non-empty string`
-    );
-  return r.startsWith("/") ? r : `/${r}`;
+function b(e) {
+  const o = (r) => r.startsWith("/") ? r : `/${r}`;
+  return {
+    loginPagePath: o(e.loginPagePath ?? "/__login"),
+    afterLoginRedirectPath: o(
+      e.afterLoginRedirectPath ?? process.env.VITE_BASE_PATH ?? "/"
+    ),
+    authServerLoginUrl: e.authServerLoginUrl ?? "https://auth-dev.grasp-daas.com/rest-auth/login/"
+  };
 }
-function d(e, t, r) {
+function d(e, o, r) {
   return e.type("html").send(
-    w({
-      loginPath: t,
+    m({
+      loginPath: o,
       errorMessage: r
     })
   );
 }
-function k() {
-  const e = b({ extended: !0 });
-  return (t, r) => new Promise((n, o) => {
-    e(t, r, (c) => {
-      if (c) {
-        o(c);
+function k({ loginPagePath: e }) {
+  const o = "\x1B[33m", r = "\x1B[34m", n = "\x1B[2m", t = "\x1B[0m", a = "─".repeat(50), s = `${o}┌${a}┐${t}`, c = `${o}└${a}┘${t}`, i = process.env.HOST ?? "localhost", l = process.env.PORT ?? "XXXX", p = `${r}http://${i}:${l}${e}${t}`, h = [
+    s,
+    "",
+    "  🔐 Dev Auth Middleware Active",
+    "",
+    `  Login: ${p}`,
+    "",
+    `  ${n}Tip: Set DEV_AUTH_TOKEN env var to skip login${t}`,
+    "",
+    c
+  ];
+  console.log(h.join(`
+`));
+}
+async function y({
+  authServerLoginUrl: e,
+  loginPagePath: o,
+  afterLoginRedirectPath: r
+}, n, t, a) {
+  try {
+    await w(n, t);
+  } catch (i) {
+    return a(i);
+  }
+  const { email: s, password: c } = n.body ?? {};
+  if (!s || !c)
+    return d(t, o, "Email and password are required.");
+  try {
+    const { access_token: i } = await x({
+      email: s,
+      password: c,
+      authServerLoginUrl: e
+    });
+    return u.set(i), t.redirect(303, r);
+  } catch (i) {
+    const l = `${i instanceof Error ? i.message : String(i)}`;
+    return d(t, o, l);
+  }
+}
+const w = v();
+function v() {
+  const e = g({ extended: !0 });
+  return (o, r) => new Promise((n, t) => {
+    e(o, r, (a) => {
+      if (a) {
+        t(a);
         return;
       }
       n();
@@ -204,8 +211,8 @@ function k() {
 }
 async function x({
   email: e,
-  password: t,
-  authEndpoint: r
+  password: o,
+  authServerLoginUrl: r
 }) {
   const n = await fetch(r, {
     method: "POST",
@@ -214,7 +221,7 @@ async function x({
     },
     body: JSON.stringify({
       email: e,
-      password: t,
+      password: o,
       remember_me: !0
     })
   });
@@ -222,21 +229,28 @@ async function x({
     throw new Error(
       `Authentication failed with status ${n.status} and response: ${await n.text()}`
     );
-  const o = await n.json();
-  if (!("access_token" in o && "refresh_token" in o))
+  const t = await n.json();
+  if (!("access_token" in t && "refresh_token" in t))
     throw new Error(
-      `Authentication response is missing access_token or refresh_token: ${JSON.stringify(o, null, 2)}`
+      `Authentication response is missing access_token or refresh_token: ${JSON.stringify(t, null, 2)}`
     );
-  return o;
+  return t;
 }
-const l = {
-  get: () => process.env.DEV_AUTH_TOKEN,
+const u = {
+  get: () => {
+    const e = process.env.DEV_AUTH_TOKEN?.trim();
+    if (e && e.length > 0)
+      return e;
+  },
   set: (e) => {
     process.env.DEV_AUTH_TOKEN = e;
-  },
-  exists: () => typeof process.env.DEV_AUTH_TOKEN == "string" && process.env.DEV_AUTH_TOKEN.length > 0
+  }
 };
+async function P(e, o) {
+  const r = u.get();
+  return r && (e.headers.authorization = `Bearer ${r}`), o();
+}
 export {
-  l as DEV_AUTH_TOKEN,
-  v as devAuthMiddleware
+  u as DEV_AUTH_TOKEN,
+  T as devAuthMiddleware
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grasp-labs/ds-microfrontends-integration",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",