@ibgib/web-gib 0.0.57 → 0.0.58

package/src/identity/sso-popup-helper.mts

@@ -0,0 +1,155 @@
+/**
+ * @module identity/sso-popup-helper
+ *
+ * DRY client helper for initiating OAuth2 SSO authentication via a popup window
+ * and capturing the returned authorization code.
+ */
+
+import { extractErrorMsg, getUUID } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { getApiBridge } from "../api/ibgib-api-bridge.mjs";
+
+export interface SsoPopupOpts {
+    providerId: 'google' | 'github';
+    parentTjpAddr?: string;
+}
+
+export interface SsoPopupResult {
+    success: boolean;
+    code?: string;
+    stateObj?: any;
+    redirectUri?: string;
+    message?: string;
+}
+
+/**
+ * Executes an OAuth2 SSO login/link authorization flow using a popup window.
+ *
+ * 1. Queries `GET /api/identity/sso/config` for safe public client configs.
+ * 2. Constructs the provider authorization URL with encoded state payload.
+ * 3. Opens a 600x700 popup window and listens for `sso-oauth-callback` postMessage.
+ * 4. Returns `{ success: true, code, stateObj, redirectUri }` upon authorization.
+ */
+export async function executeSsoOAuthPopup({
+    providerId,
+    parentTjpAddr,
+}: SsoPopupOpts): Promise<SsoPopupResult> {
+    const lc = `[${executeSsoOAuthPopup.name}]`;
+    try {
+        // 1. Fetch public SSO configs from server
+        const apiBridge = getApiBridge();
+        const resConfig = await apiBridge.getSsoConfig();
+        if (!resConfig.success || !resConfig.providers) {
+            return { success: false, message: resConfig.message || 'SSO configuration retrieval failed.' };
+        }
+
+        const providers = resConfig.providers as any;
+        const providerConfig = Array.isArray(providers)
+            ? providers.find((p: any) => p.providerId === providerId)
+            : providers[providerId];
+
+        if (!providerConfig) {
+            return {
+                success: false,
+                message: `SSO provider '${providerId}' is not configured on this server environment.`
+            };
+        }
+
+        // 2. Generate high-entropy user nonce & state
+        /**
+         * {@link getUUID} uses {@link globalThis.crypto.getRandomValues}
+         */
+        const userNonce = await getUUID();
+        const stateObj = {
+            providerId,
+            parentTjpAddr,
+            userNonce
+        };
+        const state = btoa(JSON.stringify(stateObj));
+
+        // 3. Construct Auth URL if not pre-constructed
+        let authUrl = providerConfig.authUrl;
+        if (!authUrl.includes('client_id=')) {
+            authUrl = `${authUrl}?client_id=${providerConfig.clientId}&redirect_uri=${encodeURIComponent(providerConfig.redirectUri)}&response_type=code&scope=${encodeURIComponent(providerConfig.scope)}&state=${encodeURIComponent(state)}`;
+        } else if (!authUrl.includes('state=')) {
+            authUrl = `${authUrl}&state=${encodeURIComponent(state)}`;
+        }
+
+        // 4. Open popup window
+        const popup = window.open(
+            authUrl,
+            'sso-oauth-popup',
+            'width=600,height=700,status=yes,toolbar=no,menubar=no,location=yes'
+        );
+
+        if (!popup) {
+            return { success: false, message: 'Popup blocked by browser. Please enable popups for this site.' };
+        }
+
+        // 5. Promise wrapper listening for postMessage or window closure
+        return await new Promise<SsoPopupResult>((resolve) => {
+            let checkClosedInterval: any;
+
+            const messageListener = (event: MessageEvent) => {
+                if (event.origin !== window.location.origin) return;
+                const callbackData = event.data;
+                if (callbackData && callbackData.type === 'sso-oauth-callback') {
+                    window.removeEventListener('message', messageListener);
+                    clearInterval(checkClosedInterval);
+                    resolve({
+                        success: true,
+                        code: callbackData.code,
+                        stateObj: callbackData.stateObj || stateObj,
+                        redirectUri: providerConfig.redirectUri
+                    });
+                }
+            };
+
+            window.addEventListener('message', messageListener);
+
+            checkClosedInterval = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(checkClosedInterval);
+                    window.removeEventListener('message', messageListener);
+                    resolve({ success: false, message: 'Authentication cancelled (window closed).' });
+                }
+            }, 500);
+        });
+
+    } catch (error) {
+        const emsg = extractErrorMsg(error);
+        console.error(`${lc} ${emsg}`);
+        return { success: false, message: emsg };
+    }
+}
+
+/**
+ * Checks if the current window was opened as an OAuth popup (`window.opener` exists)
+ * and has received an authorization code in the URL query string (`?code=...`).
+ * If so, posts `sso-oauth-callback` to the parent window and closes itself.
+ */
+export function checkAndNotifyPopupOpener(): boolean {
+    if (typeof window === 'undefined' || !window.opener) {
+        return false;
+    }
+
+    const url = new URL(window.location.href);
+    const code = url.searchParams.get('code');
+    if (!code) {
+        return false;
+    }
+
+    const rawState = url.searchParams.get('state');
+    let stateObj: any;
+    if (rawState) {
+        try { stateObj = JSON.parse(atob(rawState)); } catch { }
+    }
+
+    window.opener.postMessage({
+        type: 'sso-oauth-callback',
+        code,
+        stateObj
+    }, window.location.origin);
+
+    window.close();
+    return true;
+}

package/src/index.mts

@@ -18,6 +18,9 @@ export * from "./api/ibgib-api-bridge.mjs";
 
 // Identity & Sync services
 export * from "./identity/keystone-sync-service.mjs";
+export * from "./identity/custodian-delegate-helper.mjs";
+// export * from "./identity/sso-callback-helper.mjs";
+export * from "./identity/sso-popup-helper.mjs";
 
 // Identity UI components
 export * from "./ui/component/identity/index.mjs";

package/src/ui/component/identity/identity-header/identity-header.mts

@@ -146,7 +146,8 @@ export class IdentityHeaderComponentInstance
             };
             this.keystoneCache.set(addr, details);
             return details;
-        } catch {
+        } catch (error) {
+            console.error(`${this.lc}[getKeystoneDetails] Registered keystone address ${addr} not found in local browser space: ${extractErrorMsg(error)} (E: a123456789abcdef0123456789c0002)`);
             return { username: '', description: '', isPrimary: false };
         }
     }

package/src/ui/component/identity/keystone-creator/keystone-creator.css

@@ -10,17 +10,105 @@ h2 {
     color: var(--clr-accent, #50fa7b);
 }
 
+.mode-tabs {
+    display: flex;
+    gap: 0.5rem;
+    background: rgba(0, 0, 0, 0.25);
+    padding: 0.25rem;
+    border-radius: 10px;
+    border: 1px solid var(--clr-border, rgba(255, 255, 255, 0.1));
+    margin-bottom: 1rem;
+}
+
+.mode-tab {
+    flex: 1;
+    padding: 0.6rem 0.75rem;
+    border: none;
+    border-radius: 8px;
+    background: transparent;
+    color: var(--clr-text-secondary, #a6adc8);
+    font-weight: 600;
+    font-size: 0.9rem;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.mode-tab:hover {
+    color: var(--clr-text, #cdd6f4);
+    background: rgba(255, 255, 255, 0.05);
+}
+
+.mode-tab.active {
+    background: #45475a;
+    color: #89b4fa;
+    box-shadow: 0 2px 6px rgba(0, 0, 0, 0.3);
+}
+
 .subtitle {
     color: var(--clr-text-secondary, #a6adc8);
-    font-size: 0.95rem;
+    font-size: 0.92rem;
     margin: 0;
+    line-height: 1.45;
 }
 
 .content {
-    margin-top: 1.5rem;
+    margin-top: 1.25rem;
+    display: flex;
+    flex-direction: column;
+    gap: 1.25rem;
+}
+
+.tab-panel.hidden, .hidden {
+    display: none !important;
+}
+
+.sso-buttons {
     display: flex;
     flex-direction: column;
-    gap: 1.5rem;
+    gap: 0.75rem;
+}
+
+.sso-btn {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.75rem;
+    padding: 0.8rem 1.25rem;
+    border: 1px solid rgba(255, 255, 255, 0.15);
+    border-radius: 8px;
+    background: #1e1e2e;
+    color: #cdd6f4;
+    font-size: 0.95rem;
+    font-weight: 600;
+    cursor: pointer;
+    transition: transform 0.15s ease, background 0.15s ease;
+}
+
+.sso-btn:hover {
+    transform: translateY(-1px);
+    background: #313244;
+    border-color: #89b4fa;
+}
+
+.divider {
+    display: flex;
+    align-items: center;
+    text-align: center;
+    margin: 0.5rem 0;
+    color: #a6adc8;
+    font-size: 0.75rem;
+    font-weight: 700;
+    letter-spacing: 1px;
+}
+
+.divider::before, .divider::after {
+    content: '';
+    flex: 1;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.1);
+}
+
+.divider span {
+    padding: 0 0.75rem;
 }
 
 .input-group {
@@ -34,8 +122,25 @@ h2 {
     color: var(--clr-text-secondary, #a6adc8);
 }
 
+.text-input {
+    width: 100%;
+    padding: 0.75rem 1rem;
+    border-radius: 8px;
+    border: 1px solid rgba(255, 255, 255, 0.15);
+    background: #11111b;
+    color: #cdd6f4;
+    font-size: 0.95rem;
+    box-sizing: border-box;
+}
+
+.text-input:focus {
+    outline: none;
+    border-color: #89b4fa;
+    box-shadow: 0 0 0 2px rgba(137, 180, 250, 0.2);
+}
+
 .action-row {
-    margin-top: 1rem;
+    margin-top: 0.5rem;
     width: 100%;
 }
 
@@ -65,10 +170,6 @@ h2 {
     margin-top: 0.5rem;
 }
 
-.status-area.hidden {
-    display: none;
-}
-
 .result-area {
     padding: 1.5rem;
     background: rgba(255, 255, 255, 0.03);
@@ -77,7 +178,6 @@ h2 {
     display: flex;
     flex-direction: column;
     gap: 0.75rem;
-    transition: opacity var(--t-med, 0.2s ease);
 }
 
 .result-area.collapsed {
@@ -99,18 +199,4 @@ h2 {
 input::placeholder {
     color: rgba(255, 255, 255, 0.35);
     opacity: 1;
-}
-
-.section-code-verification {
-    margin-top: 1.5rem;
-    padding: 1.25rem;
-    border: 2px dashed #f59e0b;
-    background: rgba(245, 158, 11, 0.05);
-    box-shadow: 0 0 15px rgba(245, 158, 11, 0.2);
-    border-radius: 12px;
-    transition: all 0.3s ease;
-}
-
-.section-code-verification.hidden {
-    display: none;
 }

package/src/ui/component/identity/keystone-creator/keystone-creator.html

@@ -1,61 +1,123 @@
-<div id="container" class="component-container">
-    <h2 id="title">Create Account</h2>
-    <div class="content">
-        <p class="subtitle">Create your sovereign identity and register it to begin.</p>
-
-        <div class="input-group">
-            <label for="input-username">Username</label>
-            <input type="text" id="input-username" placeholder="Enter your username..." class="text-input">
-        </div>
-
-        <div class="input-group">
-            <label for="input-description">Description (Optional)</label>
-            <input type="text" id="input-description" placeholder="Enter an optional description..." class="text-input">
-        </div>
-
-        <div class="input-group">
-            <label for="input-email">Primary Email (Optional)</label>
-            <input type="email" id="input-email" placeholder="Enter your primary email address..." class="text-input">
-            <span class="privacy-note" style="font-size: 0.78rem; color: #a6adc8; margin-top: 0.25rem;">ℹ️ Primary email is optional and used for account discovery. If provided, it is linked to your public identity graph.</span>
-        </div>
-
-        <div class="input-group">
-            <label for="input-secret">Master Secret (Keep this private!)</label>
-            <input type="password" id="input-secret" placeholder="Enter your master secret..." class="secret-input">
-        </div>
-
-        <div class="checkbox-group" style="margin-bottom: 1.5rem; display: flex; align-items: center; gap: 0.5rem;">
-            <input type="checkbox" id="checkbox-make-active" checked style="cursor: pointer; width: 1rem; height: 1rem;">
-            <label for="checkbox-make-active" style="cursor: pointer; font-size: 0.9rem; user-select: none;">Make this the active identity</label>
-        </div>
-
-        <div class="action-row">
-            <button id="btn-generate" class="action-btn">Generate Identity Keystone</button>
-        </div>
-
-        <div class="switch-workflow" style="margin-top: 1.2rem; text-align: center; font-size: 0.9rem; color: #a6adc8;">
-            Already have an account? <button id="btn-switch-sign-in" class="link-btn" style="background: none; border: none; color: #89b4fa; font-weight: 600; cursor: pointer; text-decoration: underline; padding: 0; font-size: 0.9rem;">Sign In</button>
-        </div>
-
-        <div id="status-area" class="status-area hidden">
-            <p id="status-text" class="status-msg"></p>
-        </div>
-
-        <div id="section-code-verification" class="input-group hidden" style="margin-top: 1.5rem; padding: 1rem; border: 1px dashed #89b4fa; border-radius: 8px; background: rgba(137, 180, 250, 0.05);">
-            <label for="input-verify-code" style="font-weight: bold; color: #89b4fa;">✉️ Enter 6-Digit Email Verification Code</label>
-            <p style="font-size: 0.82rem; color: #a6adc8; margin-top: 0.25rem; margin-bottom: 0.75rem;">A 6-digit verification code was sent to your email. Enter it below to activate your identity:</p>
-            <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; align-items: center;">
-                <input type="text" id="input-verify-code" maxlength="6" placeholder="123456" class="text-input" style="font-family: monospace; font-size: 1.2rem; letter-spacing: 4px; text-align: center; max-width: 160px;">
-                <button id="btn-submit-code" class="action-btn" style="white-space: nowrap;">Verify Code</button>
-                <button id="btn-resend-code" class="action-btn" style="white-space: nowrap; background: #45475a; color: #cdd6f4;">Resend Code</button>
-            </div>
-        </div>
-
-        <div id="result-area" class="result-area collapsed">
-            <h3>New Keystone Generated!</h3>
-            <p class="address-label">Address:</p>
-            <code id="keystone-addr" class="keystone-addr"></code>
-            <p class="warning">⚠️ Store this address safely. It is your root identity for this space.</p>
-        </div>
-    </div>
+<div id="container" class="component-container">
+    <h2 id="title">Create Account</h2>
+
+    <!-- Mode Selector Tabs -->
+    <div class="mode-tabs">
+        <button id="tab-quick" class="mode-tab active">⚡ Quick (Passwordless)</button>
+        <button id="tab-password" class="mode-tab">🔑 Password-based</button>
+    </div>
+
+    <!-- Mode Subtitles -->
+    <p id="subtitle-quick" class="subtitle">⚡ Skip passwords — sign in with Google, GitHub, or an Email code. You can always set up a password later.</p>
+    <p id="subtitle-password" class="subtitle hidden">🔑 Full local ownership — your password never leaves your device. You can link Google or GitHub later.</p>
+
+    <div class="content">
+        <!-- ----------------------------------------------------------------- -->
+        <!-- Tab 1: Quick (Passwordless) Content                               -->
+        <!-- ----------------------------------------------------------------- -->
+        <div id="panel-quick" class="tab-panel">
+            <div class="sso-buttons">
+                <button id="btn-google-sso" class="sso-btn google-btn">
+                    <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.06H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.94l2.85-2.22.81-.63z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.06l3.66 2.84c.87-2.6 3.3-4.52 6.16-4.52z"/></svg>
+                    Continue with Google
+                </button>
+                <button id="btn-github-sso" class="sso-btn github-btn">
+                    <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0024 12c0-6.63-5.37-12-12-12z"/></svg>
+                    Continue with GitHub
+                </button>
+            </div>
+
+            <div class="divider">
+                <span>OR USE EMAIL CODE</span>
+            </div>
+
+            <div class="input-group">
+                <div style="display: flex; align-items: center; gap: 0.4rem;">
+                    <label for="input-quick-email">Use custom email sign-in</label>
+                    <button id="btn-email-info" class="info-icon-btn" title="Learn about custom email sign-in" style="background: none; border: none; cursor: pointer; padding: 0; font-size: 0.9rem; line-height: 1;">ℹ️</button>
+                </div>
+                <input type="email" id="input-quick-email" placeholder="Enter your email address..." class="text-input">
+            </div>
+
+            <div class="action-row" style="margin-top: 0.75rem;">
+                <button id="btn-quick-send-code" class="action-btn">Send 6-Digit Verification Code</button>
+            </div>
+
+            <div id="section-quick-otp" class="input-group hidden" style="margin-top: 1.25rem; padding: 1rem; border: 1px dashed #89b4fa; border-radius: 8px; background: rgba(137, 180, 250, 0.05);">
+                <label for="input-quick-otp" style="font-weight: bold; color: #89b4fa;">✉️ Enter 6-Digit Email Verification Code</label>
+                <p style="font-size: 0.82rem; color: #a6adc8; margin-top: 0.25rem; margin-bottom: 0.75rem;">Check your email for your 6-digit verification code:</p>
+                <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; align-items: center;">
+                    <input type="text" id="input-quick-otp" maxlength="6" placeholder="123456" class="text-input" style="font-family: monospace; font-size: 1.2rem; letter-spacing: 4px; text-align: center; max-width: 160px;">
+                    <button id="btn-quick-verify-code" class="action-btn" style="white-space: nowrap; width: auto;">Verify Code</button>
+                </div>
+            </div>
+        </div>
+
+        <!-- ----------------------------------------------------------------- -->
+        <!-- Tab 2: Password-based Content                                     -->
+        <!-- ----------------------------------------------------------------- -->
+        <div id="panel-password" class="tab-panel hidden">
+            <div class="input-group">
+                <label for="input-username">Username</label>
+                <input type="text" id="input-username" placeholder="Enter your username..." class="text-input">
+            </div>
+
+            <div class="input-group">
+                <label for="input-description">Description (Optional)</label>
+                <input type="text" id="input-description" placeholder="Enter an optional description..." class="text-input">
+            </div>
+
+            <div class="input-group">
+                <label for="input-email">Primary Email (Optional)</label>
+                <input type="email" id="input-email" placeholder="Enter your primary email address..." class="text-input">
+            </div>
+
+            <div class="input-group">
+                <label for="input-secret">Password (Keep this private!)</label>
+                <input type="password" id="input-secret" placeholder="Enter your password..." class="secret-input text-input">
+            </div>
+
+            <div class="checkbox-group" style="margin-top: 0.5rem; margin-bottom: 1rem; display: flex; align-items: center; gap: 0.5rem;">
+                <input type="checkbox" id="checkbox-make-active" checked style="cursor: pointer; width: 1rem; height: 1rem;">
+                <label for="checkbox-make-active" style="cursor: pointer; font-size: 0.9rem; user-select: none;">Make this the active identity</label>
+            </div>
+
+            <div class="action-row">
+                <button id="btn-generate" class="action-btn">Generate Identity Keystone</button>
+            </div>
+        </div>
+
+        <!-- ----------------------------------------------------------------- -->
+        <!-- Status & Verification Areas                                       -->
+        <!-- ----------------------------------------------------------------- -->
+        <div id="status-area" class="status-area hidden">
+            <p id="status-text" class="status-msg"></p>
+        </div>
+
+        <div id="section-code-verification" class="input-group hidden" style="margin-top: 1.5rem; padding: 1rem; border: 1px dashed #89b4fa; border-radius: 8px; background: rgba(137, 180, 250, 0.05);">
+            <label for="input-verify-code" style="font-weight: bold; color: #89b4fa;">✉️ Enter 6-Digit Email Verification Code</label>
+            <p style="font-size: 0.82rem; color: #a6adc8; margin-top: 0.25rem; margin-bottom: 0.75rem;">A 6-digit verification code was sent to your email. Enter it below to activate your identity:</p>
+            <div style="display: flex; gap: 0.5rem; flex-wrap: wrap; align-items: center;">
+                <input type="text" id="input-verify-code" maxlength="6" placeholder="123456" class="text-input" style="font-family: monospace; font-size: 1.2rem; letter-spacing: 4px; text-align: center; max-width: 160px;">
+                <button id="btn-submit-code" class="action-btn" style="white-space: nowrap;">Verify Code</button>
+                <button id="btn-resend-code" class="action-btn" style="white-space: nowrap; background: #45475a; color: #cdd6f4;">Resend Code</button>
+            </div>
+        </div>
+
+        <div id="result-area" class="result-area collapsed">
+            <h3>New Keystone Generated!</h3>
+            <p class="address-label">Address:</p>
+            <code id="keystone-addr" class="keystone-addr"></code>
+            <p class="warning">⚠️ Store this address safely. It is your root identity for this space.</p>
+        </div>
+
+        <div class="switch-workflow" style="margin-top: 1.2rem; text-align: center; font-size: 0.9rem; color: #a6adc8;">
+            Already have a device paired? <button id="btn-switch-sign-in" class="link-btn" style="background: none; border: none; color: #89b4fa; font-weight: 600; cursor: pointer; text-decoration: underline; padding: 0; font-size: 0.9rem;">Pair New Device</button>
+        </div>
+
+        <!-- Privacy Footer Note -->
+        <div class="privacy-footer" style="margin-top: 1rem; text-align: center; font-size: 0.78rem; color: #a6adc8; line-height: 1.4;">
+            ℹ️ Primary email addresses and identity keystones form part of the public graph for account discovery. Business data requires authorized sync delegates. Learn more in our <a id="link-privacy-policy" href="#privacy" style="color: #89b4fa; text-decoration: underline;">Privacy Policy</a>.
+        </div>
+    </div>
 </div>