@ibgib/web-gib 0.0.56 → 0.0.58

package/src/identity/sso/{sso-custodian-service.respec.mts → sso-custodian-service.respec.mts.bak}

@@ -1,10 +1,11 @@
 import { generateKeyPairSync, createSign } from 'node:crypto';
-import { 
-    respecfully, 
-    ifWeMight, 
-    iReckon, 
-    firstOfAll, 
-    lastOfAll 
+import {
+    respecfully,
+    ifWeMight,
+    iReckon,
+    firstOfAll,
+    lastOfAll,
+    ifWe
 } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 import { SsoCustodianService } from './sso-custodian-service.mjs';
 import { SsoServerConfig } from './sso-types.mjs';
@@ -24,7 +25,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
             modulusLength: 2048
         });
         mockPrivateKey = privateKey;
-        
+
         // Export public key as JWK
         mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
         mockPublicKeyJwk.kid = 'mock-kid-123';
@@ -58,7 +59,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         }
     });
 
-    await ifWeMight(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
+    await ifWe(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'mock-kdf-secret',
             sessionSecret: 'mock-session-secret',
@@ -106,7 +107,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
     });
 
-    await ifWeMight(sir, 'fail validation if JWT has invalid signature', async () => {
+    await ifWe(sir, 'fail validation if JWT has invalid signature', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'mock-kdf-secret',
             sessionSecret: 'mock-session-secret',
@@ -154,7 +155,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
     });
 
-    await ifWeMight(sir, 'derive server-delegate secret deterministically', async () => {
+    await ifWe(sir, 'derive server-delegate secret deterministically', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',
@@ -179,7 +180,7 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
     });
 
-    await ifWeMight(sir, 'create custodian challenge pool successfully', async () => {
+    await ifWe(sir, 'create custodian challenge pool successfully', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',
@@ -234,16 +235,16 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
         iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
         iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
-        
+
         // Replicated behavior size from parent manage pool config
         iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
-        
+
         // Structural validation of challenges
         const challengesCount = Object.keys(custodianPool.challenges).length;
         iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
     });
 
-    await ifWeMight(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
+    await ifWe(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
         const config: SsoServerConfig = {
             ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
             sessionSecret: 'session-secret-123',

package/src/identity/sso-popup-helper.mts

@@ -0,0 +1,155 @@
+/**
+ * @module identity/sso-popup-helper
+ *
+ * DRY client helper for initiating OAuth2 SSO authentication via a popup window
+ * and capturing the returned authorization code.
+ */
+
+import { extractErrorMsg, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { getApiBridge } from "../api/ibgib-api-bridge.mjs";
+
+export interface SsoPopupOpts {
+    providerId: 'google' | 'github';
+    parentTjpAddr?: string;
+}
+
+export interface SsoPopupResult {
+    success: boolean;
+    code?: string;
+    stateObj?: any;
+    redirectUri?: string;
+    message?: string;
+}
+
+/**
+ * Executes an OAuth2 SSO login/link authorization flow using a popup window.
+ *
+ * 1. Queries `GET /api/identity/sso/config` for safe public client configs.
+ * 2. Constructs the provider authorization URL with encoded state payload.
+ * 3. Opens a 600x700 popup window and listens for `sso-oauth-callback` postMessage.
+ * 4. Returns `{ success: true, code, stateObj, redirectUri }` upon authorization.
+ */
+export async function executeSsoOAuthPopup({
+    providerId,
+    parentTjpAddr,
+}: SsoPopupOpts): Promise<SsoPopupResult> {
+    const lc = `[${executeSsoOAuthPopup.name}]`;
+    try {
+        // 1. Fetch public SSO configs from server
+        const apiBridge = getApiBridge();
+        const resConfig = await apiBridge.getSsoConfig();
+        if (!resConfig.success || !resConfig.providers) {
+            return { success: false, message: resConfig.message || 'SSO configuration retrieval failed.' };
+        }
+
+        const providers = resConfig.providers as any;
+        const providerConfig = Array.isArray(providers)
+            ? providers.find((p: any) => p.providerId === providerId)
+            : providers[providerId];
+
+        if (!providerConfig) {
+            return {
+                success: false,
+                message: `SSO provider '${providerId}' is not configured on this server environment.`
+            };
+        }
+
+        // 2. Generate high-entropy user nonce & state
+        /**
+         * {@link getUUID} uses {@link globalThis.crypto.getRandomValues}
+         */
+        const userNonce = await getUUID();
+        const stateObj = {
+            providerId,
+            parentTjpAddr,
+            userNonce
+        };
+        const state = btoa(JSON.stringify(stateObj));
+
+        // 3. Construct Auth URL if not pre-constructed
+        let authUrl = providerConfig.authUrl;
+        if (!authUrl.includes('client_id=')) {
+            authUrl = `${authUrl}?client_id=${providerConfig.clientId}&redirect_uri=${encodeURIComponent(providerConfig.redirectUri)}&response_type=code&scope=${encodeURIComponent(providerConfig.scope)}&state=${encodeURIComponent(state)}`;
+        } else if (!authUrl.includes('state=')) {
+            authUrl = `${authUrl}&state=${encodeURIComponent(state)}`;
+        }
+
+        // 4. Open popup window
+        const popup = window.open(
+            authUrl,
+            'sso-oauth-popup',
+            'width=600,height=700,status=yes,toolbar=no,menubar=no,location=yes'
+        );
+
+        if (!popup) {
+            return { success: false, message: 'Popup blocked by browser. Please enable popups for this site.' };
+        }
+
+        // 5. Promise wrapper listening for postMessage or window closure
+        return await new Promise<SsoPopupResult>((resolve) => {
+            let checkClosedInterval: any;
+
+            const messageListener = (event: MessageEvent) => {
+                if (event.origin !== window.location.origin) return;
+                const callbackData = event.data;
+                if (callbackData && callbackData.type === 'sso-oauth-callback') {
+                    window.removeEventListener('message', messageListener);
+                    clearInterval(checkClosedInterval);
+                    resolve({
+                        success: true,
+                        code: callbackData.code,
+                        stateObj: callbackData.stateObj || stateObj,
+                        redirectUri: providerConfig.redirectUri
+                    });
+                }
+            };
+
+            window.addEventListener('message', messageListener);
+
+            checkClosedInterval = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosedInterval);
+                    window.removeEventListener('message', messageListener);
+                    resolve({ success: false, message: 'Authentication cancelled (window closed).' });
+                }
+            }, 500);
+        });
+
+    } catch (error) {
+        const emsg = extractErrorMsg(error);
+        console.error(`${lc} ${emsg}`);
+        return { success: false, message: emsg };
+    }
+}
+
+/**
+ * Checks if the current window was opened as an OAuth popup (`window.opener` exists)
+ * and has received an authorization code in the URL query string (`?code=...`).
+ * If so, posts `sso-oauth-callback` to the parent window and closes itself.
+ */
+export function checkAndNotifyPopupOpener(): boolean {
+    if (typeof window === 'undefined' || !window.opener) {
+        return false;
+    }
+
+    const url = new URL(window.location.href);
+    const code = url.searchParams.get('code');
+    if (!code) {
+        return false;
+    }
+
+    const rawState = url.searchParams.get('state');
+    let stateObj: any;
+    if (rawState) {
+        try { stateObj = JSON.parse(atob(rawState)); } catch { }
+    }
+
+    window.opener.postMessage({
+        type: 'sso-oauth-callback',
+        code,
+        stateObj
+    }, window.location.origin);
+
+    window.close();
+    return true;
+}

package/src/index.mts

@@ -18,6 +18,9 @@ export * from "./api/ibgib-api-bridge.mjs";
 
 // Identity & Sync services
 export * from "./identity/keystone-sync-service.mjs";
+export * from "./identity/custodian-delegate-helper.mjs";
+// export * from "./identity/sso-callback-helper.mjs";
+export * from "./identity/sso-popup-helper.mjs";
 
 // Identity UI components
 export * from "./ui/component/identity/index.mjs";

package/src/ui/component/identity/add-device/add-device.html

@@ -1,16 +1,15 @@
 <div id="container" class="component-container">
-    <h2 id="title">Add New Device (Pairing)</h2>
+    <h2 id="title">Sign In New Device</h2>
     <div class="content">
-        <p>Pair this device to your existing primary identity timeline.</p>
+        <p>Sign in on this device to add it to an existing account.</p>
 
         <div class="input-group">
-            <label for="input-identifier">Username or Email</label>
-            <input type="text" id="input-identifier" placeholder="Enter registered username or email..."
-                class="text-input">
+            <label for="input-identifier">Email</label>
+            <input type="text" id="input-identifier" placeholder="Enter registered email..." class="text-input">
         </div>
 
         <div class="input-group">
-            <label for="input-device-tag">Device Tag / Name *</label>
+            <label for="input-device-tag">Device Name</label>
             <input type="text" id="input-device-tag" placeholder="e.g. laptop, phone, living-room..."
                 class="text-input">
         </div>
@@ -29,7 +28,7 @@
         </div>
 
         <div class="action-row">
-            <button id="btn-add-device" class="action-btn">Pair & Add Device</button>
+            <button id="btn-add-device" class="action-btn">Sign In</button>
         </div>
 
         <div class="switch-workflow" style="margin-top: 1.2rem; text-align: center; font-size: 0.9rem; color: #a6adc8;">

package/src/ui/component/identity/add-device/add-device.mts

@@ -2,30 +2,29 @@ import thisCss from "./add-device.css";
 import thisHtml from "./add-device.html";
 import commonComponentStylesCss from "../../common-component-styles.css";
 
-import { delay, extractErrorMsg, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { delay, extractErrorMsg, } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
 import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
-import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
 import { KeystoneProfileBuilder } from "@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs";
 import { KeystoneIbGib_V1 } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
 import { KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT, KEYSTONE_USERNAME_REGEXP } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
-import { getTimelinesGroupedByTjp, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
+import { getTimelinesGroupedByTjp, getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
-import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
 
+import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
 import { getGlobalMetaspace_waitIfNeeded } from "../../../../helpers.mjs";
-import {
-    IbGibDynamicComponentMetaBase, IbGibFormInstanceBase,
-} from "../../ibgib-dynamic-component-bases.mjs";
+import { IbGibDynamicComponentMetaBase, IbGibFormInstanceBase, } from "../../ibgib-dynamic-component-bases.mjs";
 import {
     ElementsBase, IbGibDynamicComponentInstance,
     IbGibDynamicComponentInstanceInitOpts,
 } from "../../component-types.mjs";
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
-import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE } from "../../../ui-constants.mjs";
+import {
+    EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE
+} from "../../../ui-constants.mjs";
 
 export const ADD_DEVICE_COMPONENT_NAME = 'ibgib-add-device';
 
@@ -162,7 +161,7 @@ export class AddDeviceComponentInstance
             this.elements!.inputIdentifier.value = identifier;
             if (!identifier) {
                 this.elements!.inputIdentifier.classList.add('invalid');
-                this.setStatus("Please enter a registered username or email.", "error");
+                this.setStatus("Please enter a registered email.", "error");
                 return;
             }
 
@@ -170,7 +169,7 @@ export class AddDeviceComponentInstance
             this.elements!.inputDeviceTag.value = deviceTag;
             if (!deviceTag || !KEYSTONE_USERNAME_REGEXP.test(deviceTag)) {
                 this.elements!.inputDeviceTag.classList.add('invalid');
-                this.setStatus("Please enter a valid Device Tag / Name (e.g. 'work-laptop').", "error");
+                this.setStatus("Please enter a valid Device Name (e.g. 'work-laptop').", "error");
                 return;
             }
 
@@ -194,7 +193,6 @@ export class AddDeviceComponentInstance
             const space = await metaspace.getLocalUserSpace({});
             if (!space) { throw new Error("No default space found in metaspace."); }
 
-            const keystoneService = new KeystoneService_V1();
 
             // 1a. First attempt to locate primary identity keystone locally in space
             const keystonesIndex = await metaspace.getSpecialIbGib({
@@ -225,7 +223,7 @@ export class AddDeviceComponentInstance
                 if (resLookup.success && resLookup.primaryKeystoneIbGib) {
                     const fetchedKeystone = resLookup.primaryKeystoneIbGib as KeystoneIbGib_V1;
                     const domainAddr = resLookup.tjpAddr || getIbGibAddr({ ibGib: fetchedKeystone });
-                    
+
                     // Fetch full domain graph from server so local space has all historical keystone frames
                     const resGraph = await getApiBridge().getKeystoneGraph(domainAddr);
                     if (resGraph.success && resGraph.graph) {
@@ -276,6 +274,8 @@ export class AddDeviceComponentInstance
                 animationEmoji: '🔑'
             });
 
+            const primaryTjpAddr = getTjpAddr({ ibGib: primaryKeystone, defaultIfNone: 'incomingAddr' });
+            if (!primaryTjpAddr) { throw new Error(`(UNEXPECTED) primaryTjpAddr falsy? couldn't get tjpAddr from primaryKeystone? (E: bc8cc8678e1ce4194ab02646160fde26)`); }
             const delegateSecret = await deriveDelegateSecret({ masterSecret });
             const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync')
                 .withUsername(`${primaryUsername}-sync-${deviceTag}`)
@@ -283,10 +283,12 @@ export class AddDeviceComponentInstance
                 .withDetails({
                     client: 'space-gib-web',
                     role: 'sync-delegate',
-                    deviceTag
+                    deviceTag,
+                    primaryTjpAddr,
                 });
             const delegateConfigs = await delegateBuilder.compileConfigs();
 
+            const keystoneService = new KeystoneService_V1();
             const delegateKeystone = await keystoneService.genesis({
                 masterSecret: delegateSecret,
                 configs: delegateConfigs,
@@ -331,11 +333,10 @@ export class AddDeviceComponentInstance
                 animationEmoji: '🔄'
             });
 
-            const primaryTjpAddr = getGibInfo({ ibGibAddr: getIbGibAddr({ ibGib: primaryKeystone }) }).tjpGib;
-            const domainAddr = primaryTjpAddr ? getIbGibAddr({ ibGib: primaryKeystone }) : getIbGibAddr({ ibGib: primaryKeystone });
+            // const domainAddr = primaryTjpAddr ? getIbGibAddr({ ibGib: primaryKeystone }) : getIbGibAddr({ ibGib: primaryKeystone });
 
             const resEvolve = await getApiBridge().putEvolveKeystone({
-                domainAddr,
+                domainAddr: primaryTjpAddr,
                 keystoneIbGib: evolvedPrimaryKeystone,
                 relatedKeystoneIbGibs: [delegateKeystone]
             });

package/src/ui/component/identity/identity-header/identity-header.mts

@@ -146,7 +146,8 @@ export class IdentityHeaderComponentInstance
             };
             this.keystoneCache.set(addr, details);
             return details;
-        } catch {
+        } catch (error) {
+            console.error(`${this.lc}[getKeystoneDetails] Registered keystone address ${addr} not found in local browser space: ${extractErrorMsg(error)} (E: a123456789abcdef0123456789c0002)`);
             return { username: '', description: '', isPrimary: false };
         }
     }

package/src/ui/component/identity/keystone-creator/keystone-creator.css

@@ -10,17 +10,105 @@ h2 {
     color: var(--clr-accent, #50fa7b);
 }
 
+.mode-tabs {
+    display: flex;
+    gap: 0.5rem;
+    background: rgba(0, 0, 0, 0.25);
+    padding: 0.25rem;
+    border-radius: 10px;
+    border: 1px solid var(--clr-border, rgba(255, 255, 255, 0.1));
+    margin-bottom: 1rem;
+}
+
+.mode-tab {
+    flex: 1;
+    padding: 0.6rem 0.75rem;
+    border: none;
+    border-radius: 8px;
+    background: transparent;
+    color: var(--clr-text-secondary, #a6adc8);
+    font-weight: 600;
+    font-size: 0.9rem;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.mode-tab:hover {
+    color: var(--clr-text, #cdd6f4);
+    background: rgba(255, 255, 255, 0.05);
+}
+
+.mode-tab.active {
+    background: #45475a;
+    color: #89b4fa;
+    box-shadow: 0 2px 6px rgba(0, 0, 0, 0.3);
+}
+
 .subtitle {
     color: var(--clr-text-secondary, #a6adc8);
-    font-size: 0.95rem;
+    font-size: 0.92rem;
     margin: 0;
+    line-height: 1.45;
 }
 
 .content {
-    margin-top: 1.5rem;
+    margin-top: 1.25rem;
+    display: flex;
+    flex-direction: column;
+    gap: 1.25rem;
+}
+
+.tab-panel.hidden, .hidden {
+    display: none !important;
+}
+
+.sso-buttons {
     display: flex;
     flex-direction: column;
-    gap: 1.5rem;
+    gap: 0.75rem;
+}
+
+.sso-btn {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.75rem;
+    padding: 0.8rem 1.25rem;
+    border: 1px solid rgba(255, 255, 255, 0.15);
+    border-radius: 8px;
+    background: #1e1e2e;
+    color: #cdd6f4;
+    font-size: 0.95rem;
+    font-weight: 600;
+    cursor: pointer;
+    transition: transform 0.15s ease, background 0.15s ease;
+}
+
+.sso-btn:hover {
+    transform: translateY(-1px);
+    background: #313244;
+    border-color: #89b4fa;
+}
+
+.divider {
+    display: flex;
+    align-items: center;
+    text-align: center;
+    margin: 0.5rem 0;
+    color: #a6adc8;
+    font-size: 0.75rem;
+    font-weight: 700;
+    letter-spacing: 1px;
+}
+
+.divider::before, .divider::after {
+    content: '';
+    flex: 1;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.1);
+}
+
+.divider span {
+    padding: 0 0.75rem;
 }
 
 .input-group {
@@ -34,8 +122,25 @@ h2 {
     color: var(--clr-text-secondary, #a6adc8);
 }
 
+.text-input {
+    width: 100%;
+    padding: 0.75rem 1rem;
+    border-radius: 8px;
+    border: 1px solid rgba(255, 255, 255, 0.15);
+    background: #11111b;
+    color: #cdd6f4;
+    font-size: 0.95rem;
+    box-sizing: border-box;
+}
+
+.text-input:focus {
+    outline: none;
+    border-color: #89b4fa;
+    box-shadow: 0 0 0 2px rgba(137, 180, 250, 0.2);
+}
+
 .action-row {
-    margin-top: 1rem;
+    margin-top: 0.5rem;
     width: 100%;
 }
 
@@ -65,10 +170,6 @@ h2 {
     margin-top: 0.5rem;
 }
 
-.status-area.hidden {
-    display: none;
-}
-
 .result-area {
     padding: 1.5rem;
     background: rgba(255, 255, 255, 0.03);
@@ -77,7 +178,6 @@ h2 {
     display: flex;
     flex-direction: column;
     gap: 0.75rem;
-    transition: opacity var(--t-med, 0.2s ease);
 }
 
 .result-area.collapsed {
@@ -94,4 +194,9 @@ h2 {
     font-size: 0.8rem;
     color: var(--clr-warn, #f38ba8);
     margin: 0.5rem 0 0;
+}
+
+input::placeholder {
+    color: rgba(255, 255, 255, 0.35);
+    opacity: 1;
 }