@isi-ui7/bos7-shared 0.2.0

package/src/auth7/client.ts

@@ -0,0 +1,248 @@
+// lib/auth7/client.ts — Auth7 API client for frontend
+
+import type { TokenSet, UserProfile } from './types';
+
+function requireEnv(name: string): string {
+  const v = (process.env as Record<string, string | undefined>)[name];
+  if (!v) throw new Error(`[bos7] ${name} env var is required`);
+  return v;
+}
+
+function getRedirectUri(): string {
+  if (typeof window !== 'undefined') {
+    return `${window.location.origin}/api/auth/callback`;
+  }
+  return '';
+}
+
+async function generateCodeVerifier(): Promise<string> {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64URLEncode(array);
+}
+
+async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest('SHA-256', data);
+  return base64URLEncode(new Uint8Array(digest));
+}
+
+function base64URLEncode(buffer: Uint8Array): string {
+  return btoa(String.fromCharCode(...buffer))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+}
+
+function generateState(): string {
+  const array = new Uint8Array(16);
+  crypto.getRandomValues(array);
+  return base64URLEncode(array);
+}
+
+export async function buildAuthorizationUrl(): Promise<{
+  url: string;
+  codeVerifier: string;
+  state: string;
+}> {
+  const AUTH7_URL = requireEnv('NEXT_PUBLIC_AUTH7_URL');
+  const CLIENT_ID = requireEnv('AUTH7_CLIENT_ID');
+
+  const codeVerifier = await generateCodeVerifier();
+  const codeChallenge = await generateCodeChallenge(codeVerifier);
+  const state = generateState();
+
+  const redirectUri = getRedirectUri();
+  const scope = 'openid profile email roles offline_access';
+
+  const params = new URLSearchParams({
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    response_type: 'code',
+    scope,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+  });
+
+  const url = `${AUTH7_URL}/oauth2/authorize?${params.toString()}`;
+
+  return { url, codeVerifier, state };
+}
+
+export async function exchangeCodeForTokens(
+  code: string,
+  codeVerifier: string
+): Promise<TokenSet> {
+  const AUTH7_URL = requireEnv('NEXT_PUBLIC_AUTH7_URL');
+  const CLIENT_ID = requireEnv('AUTH7_CLIENT_ID');
+
+  const redirectUri = getRedirectUri();
+
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: CLIENT_ID,
+    code_verifier: codeVerifier,
+  });
+
+  const response = await fetch(`${AUTH7_URL}/oauth2/token`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: body.toString(),
+  });
+
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error_description || error.error || 'Token exchange failed');
+  }
+
+  return response.json();
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function refreshAccessToken(_refreshToken: string): Promise<TokenSet> {
+  const response = await fetch('/api/auth/refresh', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+  });
+
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || 'Token refresh failed');
+  }
+
+  // The refresh route sets new cookies — we need to return the new token data
+  // so AuthProvider can update its state
+  const token = getStoredTokens();
+  return {
+    access_token: token.accessToken || '',
+    token_type: 'Bearer',
+    expires_in: 900,
+    scope: '',
+  };
+}
+
+export async function revokeToken(token: string): Promise<void> {
+  const AUTH7_URL = requireEnv('NEXT_PUBLIC_AUTH7_URL');
+  const CLIENT_ID = requireEnv('AUTH7_CLIENT_ID');
+
+  const body = new URLSearchParams({
+    token,
+    token_type_hint: 'access_token',
+    client_id: CLIENT_ID,
+  });
+
+  await fetch(`${AUTH7_URL}/oauth2/revoke`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: body.toString(),
+  });
+}
+
+export async function getUserInfo(accessToken: string): Promise<UserProfile> {
+  const response = await fetch('/api/auth/me', {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error('Failed to get user info');
+  }
+
+  return response.json();
+}
+
+export function isTokenExpired(expiresAt: number): boolean {
+  const bufferTime = 5 * 60 * 1000;
+  return expiresAt <= Date.now() + bufferTime;
+}
+
+export function storeTokensToCookies(tokens: TokenSet): void {
+  const expiresAt = Date.now() + tokens.expires_in * 1000;
+
+  document.cookie = `access_token=${tokens.access_token}; path=/; max-age=${tokens.expires_in}; samesite=lax`;
+  document.cookie = `token_expires_at=${expiresAt}; path=/; max-age=${tokens.expires_in}; samesite=lax`;
+  document.cookie = `token_scope=${tokens.scope}; path=/; max-age=${tokens.expires_in}; samesite=lax`;
+
+  if (tokens.refresh_token) {
+    document.cookie = `refresh_token=${tokens.refresh_token}; path=/; max-age=${8 * 3600}; samesite=lax`;
+  }
+
+  if (tokens.id_token) {
+    document.cookie = `id_token=${tokens.id_token}; path=/; max-age=${tokens.expires_in}; samesite=lax`;
+  }
+}
+
+export function clearTokensFromCookies(): void {
+  const cookies = [
+    'access_token',
+    'refresh_token',
+    'id_token',
+    'token_expires_at',
+    'token_scope',
+    'auth7_pkce_verifier',
+    'auth7_oauth_state',
+    'auth7_return_url',
+  ];
+
+  cookies.forEach((name) => {
+    document.cookie = `${name}=; path=/; max-age=0; samesite=lax`;
+  });
+}
+
+export function getStoredTokens(): { accessToken: string | null; refreshToken: string | null; expiresAt: number } {
+  const getCookie = (name: string): string | null => {
+    const value = `; ${document.cookie}`;
+    const parts = value.split(`; ${name}=`);
+    if (parts.length === 2) {
+      return parts.pop()?.split(';').shift() || null;
+    }
+    return null;
+  };
+
+  const accessToken = getCookie('access_token');
+  const refreshToken = getCookie('refresh_token');
+  const expiresAtStr = getCookie('token_expires_at');
+  const expiresAt = expiresAtStr ? parseInt(expiresAtStr, 10) : 0;
+
+  return { accessToken, refreshToken, expiresAt };
+}
+
+export function storeOAuthParams(codeVerifier: string, state: string, returnUrl: string): void {
+  document.cookie = `auth7_pkce_verifier=${codeVerifier}; path=/; max-age=600; samesite=lax`;
+  document.cookie = `auth7_oauth_state=${state}; path=/; max-age=600; samesite=lax`;
+  document.cookie = `auth7_return_url=${encodeURIComponent(returnUrl)}; path=/; max-age=600; samesite=lax`;
+}
+
+export function getOAuthParams(): { codeVerifier: string | null; state: string | null; returnUrl: string | null } {
+  const getCookie = (name: string): string | null => {
+    const value = `; ${document.cookie}`;
+    const parts = value.split(`; ${name}=`);
+    if (parts.length === 2) {
+      return parts.pop()?.split(';').shift() || null;
+    }
+    return null;
+  };
+
+  return {
+    codeVerifier: getCookie('auth7_pkce_verifier'),
+    state: getCookie('auth7_oauth_state'),
+    returnUrl: getCookie('auth7_return_url') ? decodeURIComponent(getCookie('auth7_return_url')!) : null,
+  };
+}
+
+export function clearOAuthParams(): void {
+  document.cookie = 'auth7_pkce_verifier=; path=/; max-age=0; samesite=lax';
+  document.cookie = 'auth7_oauth_state=; path=/; max-age=0; samesite=lax';
+  document.cookie = 'auth7_return_url=; path=/; max-age=0; samesite=lax';
+}

package/src/auth7/delegated-proxy.ts

@@ -0,0 +1,80 @@
+// lib/auth7/delegated-proxy.ts — RFC 8693 delegated proxy helper for BFF routes
+// Server-side only.
+//
+// Usage in a BFF API route:
+//
+//   const proxy = await createDelegatedProxy(accessToken, 'core7-service-enterprise');
+//   const { ok, data } = await proxy.get<MyData>('/v1/customers');
+
+import { exchangeUserToken, ExchangeOptions } from './token-exchange';
+
+const BACKEND_URL = process.env.BACKEND_URL ?? '';
+
+export interface DelegatedProxyOptions extends ExchangeOptions {
+	backendUrl?: string;
+}
+
+export interface DelegatedProxy {
+	get<T>(path: string, query?: Record<string, string>): Promise<{ ok: boolean; data?: T; error?: string }>;
+	post<T>(path: string, body: unknown): Promise<{ ok: boolean; data?: T; error?: string }>;
+	put<T>(path: string, body: unknown): Promise<{ ok: boolean; data?: T; error?: string }>;
+	delete<T>(path: string): Promise<{ ok: boolean; data?: T; error?: string }>;
+}
+
+async function proxyRequest<T>(
+	method: string,
+	path: string,
+	delegatedToken: string,
+	baseUrl: string,
+	options: { query?: Record<string, string>; body?: unknown } = {},
+): Promise<{ ok: boolean; data?: T; error?: string }> {
+	let url = `${baseUrl}${path}`;
+	if (options.query && Object.keys(options.query).length > 0) {
+		url += '?' + new URLSearchParams(options.query).toString();
+	}
+	const res = await fetch(url, {
+		method,
+		headers: {
+			'Content-Type': 'application/json',
+			Authorization: `Bearer ${delegatedToken}`,
+		},
+		...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
+	});
+	if (!res.ok) {
+		try {
+			const errBody = await res.json() as { error?: { message?: string; code?: string } };
+			const msg = errBody?.error?.message ?? errBody?.error?.code ?? `backend ${method} ${path} failed: ${res.status}`;
+			return { ok: false, error: msg };
+		} catch {
+			return { ok: false, error: `backend ${method} ${path} failed: ${res.status}` };
+		}
+	}
+	if (res.status === 204 || res.headers.get('content-length') === '0') {
+		return { ok: true };
+	}
+	return { ok: true, data: (await res.json()) as T };
+}
+
+/**
+ * Exchange the user's access token for a delegated service token (RFC 8693),
+ * then return a typed proxy client for backend calls.
+ * The exchanged token is cached per (userToken, audience) — see token-exchange.ts.
+ */
+export async function createDelegatedProxy(
+	userToken: string,
+	audience: string,
+	options: DelegatedProxyOptions = {},
+): Promise<DelegatedProxy> {
+	const { backendUrl = BACKEND_URL, ...exchangeOpts } = options;
+	const { accessToken: delegatedToken } = await exchangeUserToken(userToken, audience, undefined, exchangeOpts);
+	return {
+		get: <T>(path: string, query?: Record<string, string>) =>
+			proxyRequest<T>('GET', path, delegatedToken, backendUrl, { query }),
+		post: <T>(path: string, body: unknown) =>
+			proxyRequest<T>('POST', path, delegatedToken, backendUrl, { body }),
+		put: <T>(path: string, body: unknown) =>
+			proxyRequest<T>('PUT', path, delegatedToken, backendUrl, { body }),
+		delete: <T>(path: string) =>
+			proxyRequest<T>('DELETE', path, delegatedToken, backendUrl),
+	};
+}

package/src/auth7/hooks/useAuth.ts

@@ -0,0 +1,21 @@
+// lib/auth7/hooks/useAuth.ts — useAuth hook for auth operations
+
+'use client';
+
+import { useAuthContext } from '../provider';
+
+export function useAuth() {
+  const { isAuthenticated, isLoading, user, accessToken, error, login, logout, refreshSession } =
+    useAuthContext();
+
+  return {
+    isAuthenticated,
+    isLoading,
+    user,
+    accessToken,
+    error,
+    login,
+    logout,
+    refreshSession,
+  };
+}

package/src/auth7/hooks/useSession.ts

@@ -0,0 +1,75 @@
+// lib/auth7/hooks/useSession.ts — useSession hook for session management
+
+'use client';
+
+import { useEffect, useState, useCallback } from 'react';
+import { useAuthContext } from '../provider';
+import { getStoredTokens, isTokenExpired, refreshAccessToken, storeTokensToCookies } from '../client';
+
+
+interface UseSessionReturn {
+  isAuthenticated: boolean;
+  isLoading: boolean;
+  user: ReturnType<typeof useAuthContext>['user'];
+  needsRefresh: boolean;
+  refreshSession: () => Promise<void>;
+  timeUntilExpiry: number | null;
+}
+
+export function useSession(): UseSessionReturn {
+  const auth = useAuthContext();
+  const [needsRefresh, setNeedsRefresh] = useState(false);
+  const [timeUntilExpiry, setTimeUntilExpiry] = useState<number | null>(null);
+
+  useEffect(() => {
+    if (!auth.isAuthenticated || !auth.accessToken) {
+      return;
+    }
+
+    const { expiresAt } = getStoredTokens();
+    if (isTokenExpired(expiresAt)) {
+      setNeedsRefresh(true);
+      return;
+    }
+
+    const interval = setInterval(() => {
+      const { expiresAt: newExpiresAt } = getStoredTokens();
+      const remaining = newExpiresAt - Date.now();
+
+      if (remaining <= 0) {
+        setNeedsRefresh(true);
+        clearInterval(interval);
+      } else {
+        setTimeUntilExpiry(remaining);
+      }
+    }, 60000);
+
+    return () => clearInterval(interval);
+  }, [auth.isAuthenticated, auth.accessToken]);
+
+  const refreshSession = useCallback(async () => {
+    const { refreshToken } = getStoredTokens();
+    if (!refreshToken) {
+      auth.login();
+      return;
+    }
+
+    try {
+      const tokens = await refreshAccessToken(refreshToken);
+      storeTokensToCookies(tokens);
+
+      refreshSession();
+    } catch {
+      auth.logout();
+    }
+  }, [auth]);
+
+  return {
+    isAuthenticated: auth.isAuthenticated,
+    isLoading: auth.isLoading,
+    user: auth.user,
+    needsRefresh,
+    refreshSession,
+    timeUntilExpiry,
+  };
+}

package/src/auth7/index.ts

@@ -0,0 +1,14 @@
+// lib/auth7/index.ts — Auth7 client exports
+
+export { AuthProvider, useAuthContext } from './provider';
+export { useAuth } from './hooks/useAuth';
+export { useSession } from './hooks/useSession';
+export { getServiceToken, clearServiceTokenCache } from './service-account';
+export { exchangeUserToken, clearExchangeCache } from './token-exchange';
+export type { TokenExchangeResult, ExchangeOptions } from './token-exchange';
+export { createDelegatedProxy } from './delegated-proxy';
+export type { DelegatedProxy, DelegatedProxyOptions } from './delegated-proxy';
+export * from './types';
+export * from './client';
+export { requireScope, scopeFromRequest } from './scope-guard';
+export type { ScopeLevel } from './scope-guard';

package/src/auth7/provider.tsx

@@ -0,0 +1,256 @@
+// lib/auth7/provider.tsx — AuthProvider React context for auth7 integration
+
+'use client';
+
+import { createContext, useContext, useEffect, useState, useCallback, type ReactNode } from 'react';
+import type { AuthState } from './types';
+
+interface AuthContextValue extends AuthState {
+  login: () => Promise<void>;
+  logout: () => Promise<void>;
+  refreshSession: () => Promise<void>;
+}
+
+const AuthContext = createContext<AuthContextValue | null>(null);
+const LOGOUT_MARKER_COOKIE = 'bos7_logout_at';
+
+
+function getRedirectUri(): string {
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL;
+  if (appUrl) {
+    const base = appUrl.replace(/\/+$/, '');
+    return `${base}/api/auth/callback`;
+  }
+  if (typeof window !== 'undefined') {
+    const url = new URL(window.location.origin);
+    if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+      return `http://${url.host}/api/auth/callback`;
+    }
+    return `${url.origin}/api/auth/callback`;
+  }
+  return '';
+}
+
+function getPostLogoutRedirectUri(): string {
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL;
+  if (appUrl) {
+    const base = appUrl.replace(/\/+$/, '');
+    return `${base}/`;
+  }
+  if (typeof window !== 'undefined') {
+    const url = new URL(window.location.origin);
+    if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+      return `http://${url.host}/`;
+    }
+    return `${url.origin}/`;
+  }
+  return '/';
+}
+
+async function generateCodeVerifier(): Promise<string> {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return btoa(String.fromCharCode(...array))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+}
+
+async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest('SHA-256', data);
+  return btoa(String.fromCharCode(...new Uint8Array(digest)))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+}
+
+function generateState(): string {
+  const array = new Uint8Array(16);
+  crypto.getRandomValues(array);
+  return btoa(String.fromCharCode(...array))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+}
+
+function getCookieValue(name: string): string | null {
+  if (typeof document === 'undefined') return null;
+  const prefix = `${name}=`;
+  const found = document.cookie.split('; ').find((entry) => entry.startsWith(prefix));
+  return found ? decodeURIComponent(found.slice(prefix.length)) : null;
+}
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [state, setState] = useState<AuthState>({
+    isAuthenticated: false,
+    isLoading: true,
+    user: null,
+    accessToken: null,
+    error: null,
+  });
+  const [lastLogoutMarker, setLastLogoutMarker] = useState<string | null>(null);
+
+  const initializeSession = useCallback(async () => {
+    try {
+      // Use BFF endpoint — reads httpOnly access_token cookie server-side.
+      // document.cookie cannot see httpOnly cookies in production or HTTPS local.
+      let meRes = await fetch('/api/auth/me');
+
+      if (meRes.status === 401) {
+        // Try silent refresh via BFF (reads httpOnly refresh_token server-side).
+        const refreshRes = await fetch('/api/auth/refresh', { method: 'POST' });
+        if (refreshRes.ok) {
+          meRes = await fetch('/api/auth/me');
+        }
+      }
+
+      if (meRes.ok) {
+        const userInfo = await meRes.json();
+        setState({
+          isAuthenticated: true,
+          isLoading: false,
+          user: userInfo,
+          accessToken: null,
+          error: null,
+        });
+      } else {
+        setState({ isAuthenticated: false, isLoading: false, user: null, accessToken: null, error: null });
+      }
+    } catch {
+      setState({ isAuthenticated: false, isLoading: false, user: null, accessToken: null, error: null });
+    }
+  }, []);
+
+  useEffect(() => {
+    initializeSession();
+    setLastLogoutMarker(getCookieValue(LOGOUT_MARKER_COOKIE));
+  }, [initializeSession]);
+
+  // Cross-app logout broadcast handler: marker cookie `bos7_logout_at`
+  // (domain=.bos7.local) di-set oleh BFF /api/auth/logout di app manapun.
+  // Saat marker berubah, force-clear state lokal — tidak menunggu /api/auth/me
+  // karena auth7 OAuth2 logout tidak invalidate JWT (token tetap valid sampai
+  // exp), sehingga userinfo proxy masih return 200. Tanpa force-clear, tab
+  // lain tetap tampak authenticated meskipun SSO logout sudah terjadi.
+  const handleLogoutMarker = useCallback((marker: string) => {
+    setLastLogoutMarker(marker);
+    setState({ isAuthenticated: false, isLoading: false, user: null, accessToken: null, error: null });
+    // Best-effort: bersihkan httpOnly cookie access_token/refresh_token via BFF
+    // supaya request lanjutan ke /api/auth/me tidak silent-authenticate ulang.
+    void fetch('/api/auth/logout', { method: 'POST' }).catch(() => null);
+  }, []);
+
+  useEffect(() => {
+    const handleVisibilityChange = () => {
+      if (!document.hidden) {
+        const marker = getCookieValue(LOGOUT_MARKER_COOKIE);
+        if (marker && marker !== lastLogoutMarker) {
+          handleLogoutMarker(marker);
+          return;
+        }
+        initializeSession();
+      }
+    };
+    document.addEventListener('visibilitychange', handleVisibilityChange);
+    return () => document.removeEventListener('visibilitychange', handleVisibilityChange);
+  }, [initializeSession, lastLogoutMarker, handleLogoutMarker]);
+
+  useEffect(() => {
+    if (!state.isAuthenticated) return;
+    const interval = window.setInterval(() => {
+      const marker = getCookieValue(LOGOUT_MARKER_COOKIE);
+      if (marker && marker !== lastLogoutMarker) {
+        handleLogoutMarker(marker);
+        return;
+      }
+      void initializeSession();
+    }, 30000);
+    return () => window.clearInterval(interval);
+  }, [state.isAuthenticated, initializeSession, lastLogoutMarker, handleLogoutMarker]);
+
+  const login = useCallback(async () => {
+    try {
+      const AUTH7_URL = process.env.NEXT_PUBLIC_AUTH7_URL;
+      const CLIENT_ID = process.env.NEXT_PUBLIC_AUTH7_CLIENT_ID;
+      if (!AUTH7_URL) throw new Error('[bos7] NEXT_PUBLIC_AUTH7_URL env var is required');
+      if (!CLIENT_ID) throw new Error('[bos7] NEXT_PUBLIC_AUTH7_CLIENT_ID env var is required');
+
+      const codeVerifier = await generateCodeVerifier();
+      const codeChallenge = await generateCodeChallenge(codeVerifier);
+      const state = generateState();
+      const redirectUri = getRedirectUri();
+
+      const returnUrl = typeof window !== 'undefined' ? window.location.pathname : '/';
+
+      document.cookie = `auth7_pkce_verifier=${codeVerifier}; path=/; max-age=600; samesite=lax`;
+      document.cookie = `auth7_oauth_state=${state}; path=/; max-age=600; samesite=lax`;
+      document.cookie = `auth7_return_url=${encodeURIComponent(returnUrl)}; path=/; max-age=600; samesite=lax`;
+
+      const params = new URLSearchParams({
+        client_id: CLIENT_ID,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: 'openid profile email roles offline_access',
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+      });
+
+      window.location.href = `${AUTH7_URL}/login?${params.toString()}`;
+    } catch (err) {
+      setState((prev) => ({ ...prev, error: (err as Error).message }));
+    }
+  }, []);
+
+  const logout = useCallback(async () => {
+    const AUTH7_URL = process.env.NEXT_PUBLIC_AUTH7_URL;
+    const CLIENT_ID = process.env.NEXT_PUBLIC_AUTH7_CLIENT_ID;
+    if (!AUTH7_URL) throw new Error('[bos7] NEXT_PUBLIC_AUTH7_URL env var is required');
+    if (!CLIENT_ID) throw new Error('[bos7] NEXT_PUBLIC_AUTH7_CLIENT_ID env var is required');
+    // BFF /api/auth/logout clears httpOnly cookies server-side.
+    await fetch('/api/auth/logout', { method: 'POST' }).catch(() => null);
+    const logoutUrl = `${AUTH7_URL}/oauth2/logout?client_id=${CLIENT_ID}&post_logout_redirect_uri=${encodeURIComponent(getPostLogoutRedirectUri())}`;
+    window.location.href = logoutUrl;
+  }, []);
+
+  const refreshSession = useCallback(async () => {
+    try {
+      const refreshRes = await fetch('/api/auth/refresh', { method: 'POST' });
+      if (!refreshRes.ok) {
+        await login();
+        return;
+      }
+      const meRes = await fetch('/api/auth/me');
+      if (!meRes.ok) {
+        await login();
+        return;
+      }
+      const userInfo = await meRes.json();
+      setState({
+        isAuthenticated: true,
+        isLoading: false,
+        user: userInfo,
+        accessToken: null,
+        error: null,
+      });
+    } catch {
+      await login();
+    }
+  }, [login]);
+
+  return (
+    <AuthContext.Provider value={{ ...state, login, logout, refreshSession }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuthContext(): AuthContextValue {
+  const context = useContext(AuthContext);
+  if (!context) {
+    throw new Error('useAuthContext must be used within AuthProvider');
+  }
+  return context;
+}