@isi-ui7/bos7-shared 0.2.2 → 0.2.4

package/src/auth7/delegated-proxy.ts

@@ -21,11 +21,59 @@ export interface DelegatedProxy {
 	delete<T>(path: string): Promise<{ ok: boolean; data?: T; error?: string }>;
 }
 
+/**
+ * Tenant identity headers forwarded to the upstream service. Header names
+ * match lib7-service-go v0.9.0 `middleware.HeaderActor*` constants so the
+ * VerifyAuditSignature middleware (and any audit logger) reads them via the
+ * same keys regardless of caller (BFF or workflow7).
+ *
+ * These five headers duplicate information already inside the delegated JWT
+ * claims, so they are NOT individually signed: the JWT's RS256 signature
+ * covers the underlying identity. They exist so downstream services (and
+ * audit log enrichers) don't have to JWT-decode just to enrich a log line
+ * with a human-readable username or branch_code.
+ */
+interface ActorHeaders {
+	'X-Actor-UserID': string;
+	'X-Actor-Username': string;
+	'X-Actor-OrgID': string;
+	'X-Actor-BranchID': string;
+	'X-Actor-BranchCode': string;
+}
+
+/**
+ * Decode a JWT payload without verifying. Safe for tokens that originate
+ * from the current trusted session — used purely to forward identity
+ * downstream. Returns an empty object on malformed input rather than throw.
+ */
+function decodeJwtPayloadUnsafe(token: string): Record<string, unknown> {
+	const parts = token.split('.');
+	if (parts.length < 2) return {};
+	try {
+		return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')) as Record<string, unknown>;
+	} catch {
+		return {};
+	}
+}
+
+function actorHeadersFromToken(userToken: string): ActorHeaders {
+	const p = decodeJwtPayloadUnsafe(userToken);
+	const str = (v: unknown): string => (typeof v === 'string' ? v : '');
+	return {
+		'X-Actor-UserID': str(p.sub),
+		'X-Actor-Username': str(p.preferred_username),
+		'X-Actor-OrgID': str(p.org_id),
+		'X-Actor-BranchID': str(p.branch_id),
+		'X-Actor-BranchCode': str(p.branch_code),
+	};
+}
+
 async function proxyRequest<T>(
 	method: string,
 	path: string,
 	delegatedToken: string,
 	baseUrl: string,
+	actorHeaders: ActorHeaders,
 	options: { query?: Record<string, string>; body?: unknown } = {},
 ): Promise<{ ok: boolean; data?: T; error?: string }> {
 	let url = `${baseUrl}${path}`;
@@ -37,6 +85,7 @@ async function proxyRequest<T>(
 		headers: {
 			'Content-Type': 'application/json',
 			Authorization: `Bearer ${delegatedToken}`,
+			...actorHeaders,
 		},
 		...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
 	});
@@ -58,7 +107,14 @@ async function proxyRequest<T>(
 /**
  * Exchange the user's access token for a delegated service token (RFC 8693),
  * then return a typed proxy client for backend calls.
- * The exchanged token is cached per (userToken, audience) — see token-exchange.ts.
+ *
+ * Identity headers are derived from the ORIGINAL user token (the source of
+ * truth for who initiated the request), not from the exchanged delegated
+ * token (whose `sub` may be remapped to a client_id depending on the auth7
+ * exchange policy).
+ *
+ * The exchanged token is cached per (userToken, audience) — see
+ * token-exchange.ts.
  */
 export async function createDelegatedProxy(
 	userToken: string,
@@ -67,14 +123,15 @@ export async function createDelegatedProxy(
 ): Promise<DelegatedProxy> {
 	const { backendUrl = BACKEND_URL, ...exchangeOpts } = options;
 	const { accessToken: delegatedToken } = await exchangeUserToken(userToken, audience, undefined, exchangeOpts);
+	const actorHeaders = actorHeadersFromToken(userToken);
 	return {
 		get: <T>(path: string, query?: Record<string, string>) =>
-			proxyRequest<T>('GET', path, delegatedToken, backendUrl, { query }),
+			proxyRequest<T>('GET', path, delegatedToken, backendUrl, actorHeaders, { query }),
 		post: <T>(path: string, body: unknown) =>
-			proxyRequest<T>('POST', path, delegatedToken, backendUrl, { body }),
+			proxyRequest<T>('POST', path, delegatedToken, backendUrl, actorHeaders, { body }),
 		put: <T>(path: string, body: unknown) =>
-			proxyRequest<T>('PUT', path, delegatedToken, backendUrl, { body }),
+			proxyRequest<T>('PUT', path, delegatedToken, backendUrl, actorHeaders, { body }),
 		delete: <T>(path: string) =>
-			proxyRequest<T>('DELETE', path, delegatedToken, backendUrl),
+			proxyRequest<T>('DELETE', path, delegatedToken, backendUrl, actorHeaders),
 	};
 }

package/src/auth7/index.ts

@@ -12,3 +12,5 @@ export * from './types';
 export * from './client';
 export { requireScope, scopeFromRequest } from './scope-guard';
 export type { ScopeLevel } from './scope-guard';
+export { handleSwitchBranchRequest } from './switch-branch-bff';
+export type { SwitchBranchBffOptions } from './switch-branch-bff';

package/src/auth7/switch-branch-bff.test.ts

@@ -0,0 +1,121 @@
+import { handleSwitchBranchRequest } from './switch-branch-bff';
+
+type CookieJar = Map<string, string>;
+
+function mockRequest(opts: {
+  cookies?: Record<string, string>;
+  body?: unknown;
+  host?: string;
+}): import('next/server').NextRequest {
+  const cookies = opts.cookies ?? {};
+  const host = opts.host ?? 'app.bank.co.id';
+  return {
+    cookies: {
+      get: (name: string) =>
+        cookies[name] !== undefined ? { value: cookies[name] } : undefined,
+    },
+    headers: {
+      get: (h: string) => (h.toLowerCase() === 'host' ? host : null),
+    },
+    json: async () => opts.body ?? {},
+  } as unknown as import('next/server').NextRequest;
+}
+
+function readSetCookies(res: Response): CookieJar {
+  const jar: CookieJar = new Map();
+  const raw = res.headers.get('set-cookie') ?? '';
+  // Next's mocked Response joins multiple Set-Cookie with comma — split conservatively.
+  for (const part of raw.split(/,(?=\s*[A-Za-z0-9_-]+=)/)) {
+    const [pair] = part.split(';');
+    const [name, value] = pair.split('=');
+    if (name && value !== undefined) jar.set(name.trim(), decodeURIComponent(value));
+  }
+  return jar;
+}
+
+describe('handleSwitchBranchRequest', () => {
+  const originalFetch = global.fetch;
+  afterEach(() => {
+    global.fetch = originalFetch;
+  });
+
+  it('returns 401 when access_token cookie is missing', async () => {
+    const req = mockRequest({ body: { branch_id: 'b1' } });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(401);
+  });
+
+  it('persists access_token, refresh_token, and session_id from the response', async () => {
+    global.fetch = async () =>
+      new Response(
+        JSON.stringify({
+          access_token: 'new-access',
+          refresh_token: 'new-refresh',
+          token_type: 'Bearer',
+          expires_in: 900,
+          session_id: 'sess-xyz',
+          branch_id: 'b1',
+          branch_code: 'BR01',
+          switched_at: '2026-06-01T00:00:00Z',
+        }),
+        { status: 200, headers: { 'Content-Type': 'application/json' } }
+      );
+
+    const req = mockRequest({
+      cookies: { access_token: 'old-access' },
+      body: { branch_id: 'b1' },
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(200);
+
+    const cookies = readSetCookies(res);
+    expect(cookies.get('access_token')).toBe('new-access');
+    expect(cookies.get('refresh_token')).toBe('new-refresh');
+    expect(cookies.get('session_id')).toBe('sess-xyz');
+    expect(cookies.get('bos7_branch')).toBe('b1');
+    expect(cookies.has('token_expires_at')).toBe(true);
+  });
+
+  it('does not set any cookies when upstream rejects', async () => {
+    global.fetch = async () =>
+      new Response(JSON.stringify({ error: 'forbidden' }), {
+        status: 403,
+        headers: { 'Content-Type': 'application/json' },
+      });
+
+    const req = mockRequest({
+      cookies: { access_token: 'old-access' },
+      body: { branch_id: 'b1' },
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(403);
+    const cookies = readSetCookies(res);
+    expect(cookies.has('access_token')).toBe(false);
+    expect(cookies.has('refresh_token')).toBe(false);
+    expect(cookies.has('session_id')).toBe(false);
+  });
+
+  it('skips bos7_branch cookie for localhost host', async () => {
+    global.fetch = async () =>
+      new Response(
+        JSON.stringify({
+          access_token: 'a',
+          refresh_token: 'r',
+          expires_in: 900,
+          session_id: 's',
+          branch_id: 'b1',
+        }),
+        { status: 200, headers: { 'Content-Type': 'application/json' } }
+      );
+
+    const req = mockRequest({
+      cookies: { access_token: 'old' },
+      body: { branch_id: 'b1' },
+      host: 'localhost:3000',
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    const cookies = readSetCookies(res);
+    expect(cookies.has('bos7_branch')).toBe(false);
+    expect(cookies.get('access_token')).toBe('a');
+  });
+});

package/src/auth7/switch-branch-bff.ts

@@ -0,0 +1,119 @@
+// switch-branch-bff.ts — Shared BFF handler for POST /api/auth/switch-branch
+//
+// Owns cookie persistence for the new session that auth7 issues on branch
+// switch. Before W17 (auth7 commit b74c3a1) the endpoint returned only an
+// access token; the old session+refresh stayed valid. Post-W17, auth7
+// revokes the previous session and re-issues access_token + refresh_token +
+// session_id together. The BFF must persist the new pair atomically,
+// otherwise silent refresh at the 15-min mark uses a revoked refresh_token
+// and forces re-login.
+
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+
+export interface SwitchBranchBffOptions {
+  auth7ApiUrl: string;
+  branchCookieDomain?: (host: string) => string | undefined;
+}
+
+function defaultBranchCookieDomain(host: string): string | undefined {
+  const h = host.split(':')[0];
+  const parts = h.split('.');
+  if (parts.length < 2 || h === 'localhost') return undefined;
+  return '.' + parts.slice(-2).join('.');
+}
+
+export async function handleSwitchBranchRequest(
+  request: NextRequest,
+  options: SwitchBranchBffOptions
+): Promise<NextResponse> {
+  const accessToken = request.cookies.get('access_token')?.value;
+  if (!accessToken) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  let body: { branch_id?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
+  }
+
+  let res: Response;
+  try {
+    res = await fetch(`${options.auth7ApiUrl}/auth/switch-branch`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${accessToken}`,
+      },
+      body: JSON.stringify(body),
+    });
+  } catch {
+    return NextResponse.json({ error: 'Failed to switch branch' }, { status: 502 });
+  }
+
+  const data = await res.json().catch(() => ({}));
+  const nextRes = NextResponse.json(data, { status: res.status });
+
+  if (!data || typeof data !== 'object' || !data.access_token) {
+    return nextRes;
+  }
+
+  const secure = process.env.NODE_ENV === 'production';
+  const expiresIn: number = data.expires_in ?? 3600;
+  const newExpiresAt = Date.now() + expiresIn * 1000;
+
+  nextRes.cookies.set('access_token', data.access_token, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: expiresIn,
+    path: '/',
+  });
+  nextRes.cookies.set('token_expires_at', newExpiresAt.toString(), {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: expiresIn,
+    path: '/',
+  });
+
+  if (data.refresh_token) {
+    nextRes.cookies.set('refresh_token', data.refresh_token, {
+      httpOnly: true,
+      secure,
+      sameSite: 'lax',
+      maxAge: 8 * 3600,
+      path: '/',
+    });
+  }
+
+  if (data.session_id) {
+    nextRes.cookies.set('session_id', data.session_id, {
+      httpOnly: true,
+      secure,
+      sameSite: 'lax',
+      maxAge: 8 * 3600,
+      path: '/',
+    });
+  }
+
+  const branchId = (body.branch_id as string | undefined) ?? data.branch_id;
+  if (branchId) {
+    const domainFn = options.branchCookieDomain ?? defaultBranchCookieDomain;
+    const rootDomain = domainFn(request.headers.get('host') || '');
+    if (rootDomain) {
+      nextRes.cookies.set('bos7_branch', branchId, {
+        httpOnly: false,
+        secure,
+        sameSite: 'lax',
+        maxAge: 8 * 3600,
+        path: '/',
+        domain: rootDomain,
+      });
+    }
+  }
+
+  return nextRes;
+}

package/src/crud-types.ts

@@ -44,6 +44,8 @@ export type CrudListSchema = {
   showSort?: boolean;
   /** Enable search bar. Defaults to true. */
   showSearch?: boolean;
+  /** Endpoint for LookupInput (defaults to apiPath if omitted). In Pattern B both DataTable and LookupInput share the same /query endpoint. */
+  lookupApiPath?: string;
   /**
    * Level 2: schema-driven confirmation modals for custom popup actions.
    * Keyed by popup menu item id. Actions not listed here fall through to onCustomAction (Level 1).

package/src/data-table/proxy.ts

@@ -0,0 +1,73 @@
+// Server-side only. Forwards a DataTable POST /query request to a backend service
+// using a delegated JWT (RFC 8693 token exchange).
+import { NextRequest, NextResponse } from "next/server";
+import { exchangeUserToken } from "../auth7/token-exchange";
+
+export interface ProxyBackendPostOptions {
+  backendUrl: string;
+  path: string;
+  audience: string;
+  accessTokenCookie?: string;
+}
+
+export async function proxyBackendPost(
+  req: NextRequest,
+  opts: ProxyBackendPostOptions,
+): Promise<NextResponse> {
+  const accessToken = req.cookies.get(opts.accessTokenCookie ?? "access_token")?.value;
+  const result = await exchangeUserToken(accessToken ?? "", opts.audience);
+  const body = await req.json();
+  const res = await fetch(`${opts.backendUrl}${opts.path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${result.accessToken}`,
+    },
+    body: JSON.stringify(body),
+    cache: "no-store",
+  });
+  const data = await res.json();
+  return NextResponse.json(data, { status: res.status });
+}
+
+export interface ProxyQueryRouteOptions extends ProxyBackendPostOptions {
+  /**
+   * Extra column type metadata to merge into the backend response's columnTypes.
+   * Useful when the BFF layer knows additional column types not present in the backend response.
+   * Optional — if omitted, backend response is forwarded as-is.
+   */
+  extraColumnTypes?: Record<string, string>;
+}
+
+/**
+ * Forwards a DataTable POST /query request to a backend Pattern B endpoint.
+ * Semantically identical to proxyBackendPost but signals "this is a query/lookup
+ * endpoint" — used by ServerDataTable and LookupInput interchangeably.
+ *
+ * If extraColumnTypes is provided, merges them into the response's columnTypes field.
+ */
+export async function proxyQueryRoute(
+  req: NextRequest,
+  opts: ProxyQueryRouteOptions,
+): Promise<NextResponse> {
+  if (!opts.extraColumnTypes) {
+    return proxyBackendPost(req, opts);
+  }
+  // Re-implement forward to avoid double body-stream consumption when merging columnTypes.
+  const accessToken = req.cookies.get(opts.accessTokenCookie ?? "access_token")?.value;
+  const result = await exchangeUserToken(accessToken ?? "", opts.audience);
+  const body = await req.json();
+  const res = await fetch(`${opts.backendUrl}${opts.path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${result.accessToken}`,
+    },
+    body: JSON.stringify(body),
+    cache: "no-store",
+  });
+  const data = await res.json() as Record<string, unknown>;
+  const existing = (data.columnTypes as Record<string, string>) ?? {};
+  data.columnTypes = { ...existing, ...opts.extraColumnTypes };
+  return NextResponse.json(data, { status: res.status });
+}

package/src/index.ts

@@ -18,3 +18,5 @@ export * from './crud-types';
 export * from './crud-hooks';
 export * from './form-types';
 export * from './i18n';
+export { proxyBackendPost, proxyQueryRoute } from './data-table/proxy';
+export type { ProxyBackendPostOptions, ProxyQueryRouteOptions } from './data-table/proxy';

package/src/shell/app-shell-layout.tsx

@@ -139,7 +139,13 @@ function BranchDropdown({
       <button type="button" className="profile-branch-dropdown__trigger" onClick={() => setOpen((v) => !v)} aria-expanded={open}>
         <span className="profile-branch-dropdown__current">
           <span className="profile-branch-section__label" style={{ margin: 0 }}>{t("ui7.branchLabel", "Cabang")}</span>
-          <span className="profile-branch-item__code">{currentBranch?.code || currentBranch?.name || "—"}</span>
+          <span className="profile-branch-item__code">
+            {currentBranch
+              ? (currentBranch.code && currentBranch.name && currentBranch.code !== currentBranch.name
+                  ? `${currentBranch.code} — ${currentBranch.name}`
+                  : (currentBranch.code || currentBranch.name || "—"))
+              : "—"}
+          </span>
         </span>
         <span className="profile-branch-dropdown__chevron" aria-hidden="true">{open ? "▲" : "▼"}</span>
       </button>
@@ -400,24 +406,49 @@ function ShellInner({
   const [currentBranch, setCurrentBranch] = useState<Branch | null>(null);
 
   useEffect(() => {
+    // API contract is snake_case (`branch_code`, `branch_name`); UI
+    // canonical fields are `code` and `name`. Map at the seam so downstream
+    // components stay clean. Empty branch_name falls back to branch_code as
+    // a visible label (rather than rendering an empty string).
+    type ApiBranch = {
+      id: string;
+      branch_code?: string;
+      branch_name?: string;
+      code?: string;
+      name?: string;
+      is_primary?: boolean;
+    };
+    const normalize = (b: ApiBranch): Branch => {
+      const code = b.branch_code ?? b.code ?? "";
+      const apiName = b.branch_name ?? b.name ?? "";
+      const name = apiName !== "" ? apiName : code;
+      return {
+        id: b.id,
+        name,
+        code,
+        is_primary: b.is_primary,
+        is_current: b.id === userBranchId,
+      };
+    };
+
     fetch("/api/auth/branches")
       .then((r) => (r.ok ? r.json() : null))
-      .then((d: { branches?: Branch[] } | null) => {
+      .then((d: { branches?: ApiBranch[] } | null) => {
         if (!d?.branches?.length) {
           if (userBranchId) {
-            const fallback = { id: userBranchId, name: userBranchId, code: userBranchId, is_current: true };
+            const fallback: Branch = { id: userBranchId, name: userBranchId, code: userBranchId, is_current: true };
             setBranches([fallback]);
             setCurrentBranch(fallback);
           }
           return;
         }
-        const normalized = d.branches.map((b: Branch) => ({ ...b, is_current: b.id === userBranchId }));
+        const normalized = d.branches.map(normalize);
         setBranches(normalized);
         setCurrentBranch(normalized.find((b) => b.is_current) ?? normalized[0]);
       })
       .catch(() => {
         if (userBranchId) {
-          const fallback = { id: userBranchId, name: userBranchId, code: userBranchId, is_current: true };
+          const fallback: Branch = { id: userBranchId, name: userBranchId, code: userBranchId, is_current: true };
           setBranches([fallback]);
           setCurrentBranch(fallback);
         }