@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/services/AuthService.ts

@@ -11,16 +11,19 @@
 import { type SupabaseClient, type User, type Session, AuthError, type AuthChangeEvent, type Session as SupabaseSession } from '@supabase/supabase-js';
 import type { SessionRestorationState } from '../types/auth';
 import { BaseService } from './base/BaseService';
-import { IAuthService, AuthResult } from './interfaces/IAuthService';
+import { IAuthService, type AuthSessionData } from './interfaces/IAuthService';
+import { ok, err, type ApiResult } from '../types/api-result';
+import { toApiError } from '../utils/security/auth-utils';
 import { logger } from '../utils/core/logger';
 
-type AuthStateSubscription = {
-  data: {
-    subscription: {
-      unsubscribe: () => void;
-    };
-  };
-};
+// Unused type - kept for potential future use
+// type AuthStateSubscription = {
+//   data: {
+//     subscription: {
+//       unsubscribe: () => void;
+//     };
+//   };
+// };
 
 export class AuthService extends BaseService implements IAuthService {
   private static instanceCount = 0;
@@ -89,12 +92,12 @@ export class AuthService extends BaseService implements IAuthService {
   }
 
   // Auth methods
-  async signIn(email: string, password?: string): Promise<AuthResult> {
+  async signIn(email: string, password?: string): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
     try {
@@ -107,25 +110,19 @@ export class AuthService extends BaseService implements IAuthService {
         this.authError = error;
         this.user = null;
         this.session = null;
-      } else {
-        this.authError = null;
-        this.user = data.user;
-        this.session = data.session;
-        
-        // Clear persistence immediately on successful login
-        // This prevents dialogs/forms/datatables from auto-opening with stale state
-        // We clear here synchronously before components can mount and check persisted state
-        // Also clear old unscoped keys to prevent data leakage
-        if (!this.wasAuthenticatedRef && data.user) {
-          this.clearPersistenceOnLogin(null, true);
-          this.wasAuthenticatedRef = true;
-        }
+        this.notify();
+        return err(toApiError(error));
+      }
+      this.authError = null;
+      this.user = data.user;
+      this.session = data.session;
+      if (!this.wasAuthenticatedRef && data.user) {
+        this.clearPersistenceOnLogin(null, true);
+        this.wasAuthenticatedRef = true;
       }
-      
       this.notify();
-      return { user: data.user, session: data.session, error };
+      return ok({ user: data.user, session: data.session });
     } catch (error) {
-      // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError 
         ? error 
         : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
@@ -133,16 +130,16 @@ export class AuthService extends BaseService implements IAuthService {
       this.user = null;
       this.session = null;
       this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
-  async signUp(email: string, password: string): Promise<AuthResult> {
+  async signUp(email: string, password: string): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
     try {
@@ -155,24 +152,19 @@ export class AuthService extends BaseService implements IAuthService {
         this.authError = error;
         this.user = null;
         this.session = null;
-      } else {
-        this.authError = null;
-        this.user = data.user;
-        this.session = data.session;
-        
-        // Clear persistence immediately on successful signup/login
-        // This prevents dialogs/forms/datatables from auto-opening with stale state
-        // Also clear old unscoped keys to prevent data leakage
-        if (!this.wasAuthenticatedRef && data.user) {
-          this.clearPersistenceOnLogin(null, true);
-          this.wasAuthenticatedRef = true;
-        }
+        this.notify();
+        return err(toApiError(error));
+      }
+      this.authError = null;
+      this.user = data.user;
+      this.session = data.session;
+      if (!this.wasAuthenticatedRef && data.user) {
+        this.clearPersistenceOnLogin(null, true);
+        this.wasAuthenticatedRef = true;
       }
-      
       this.notify();
-      return { user: data.user, session: data.session, error };
+      return ok({ user: data.user, session: data.session });
     } catch (error) {
-      // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError 
         ? error 
         : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
@@ -180,156 +172,153 @@ export class AuthService extends BaseService implements IAuthService {
       this.user = null;
       this.session = null;
       this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
-  async signOut(): Promise<AuthResult> {
+  async signOut(): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
-    try {
-      const { error } = await this.supabaseClient.auth.signOut();
-      
-      // Clear sessionStorage on logout
+    const clearLocalState = (): void => {
+      this.authError = null;
+      this.user = null;
+      this.session = null;
       try {
         sessionStorage.clear();
       } catch (storageError) {
-        // Ignore storage errors (e.g., in private browsing mode)
         logger.warn('AuthService', 'Failed to clear sessionStorage', { error: storageError });
       }
-      
+      this.notify();
+    };
+
+    try {
+      const { error } = await this.supabaseClient.auth.signOut();
       if (error) {
-        this.authError = error;
-      } else {
-        this.authError = null;
-        this.user = null;
-        this.session = null;
+        logger.warn('AuthService', 'signOut (global) failed, clearing local state and trying local scope', {
+          message: error.message,
+          status: (error as { status?: number }).status,
+        });
+        clearLocalState();
+        const { error: localError } = await this.supabaseClient.auth.signOut({ scope: 'local' });
+        if (localError) {
+          logger.warn('AuthService', 'signOut (local) also failed', { message: localError.message });
+        }
+        return err(toApiError(error));
       }
-      
-      this.notify();
-      return { user: null, session: null, error };
+      clearLocalState();
+      return ok({ user: null, session: null });
     } catch (error) {
-      // Clear sessionStorage even on error
+      logger.warn('AuthService', 'signOut threw, clearing local state and trying local scope', {
+        message: error instanceof Error ? error.message : String(error),
+      });
+      clearLocalState();
       try {
-        sessionStorage.clear();
-      } catch (storageError) {
-        // Ignore storage errors (e.g., in private browsing mode)
-        logger.warn('AuthService', 'Failed to clear sessionStorage', { error: storageError });
+        await this.supabaseClient.auth.signOut({ scope: 'local' });
+      } catch (_localError) {
+        // Ignore
       }
-      
-      // Convert regular Error to AuthError if needed
-      const authError = error instanceof AuthError 
-        ? error 
+      const authError = error instanceof AuthError
+        ? error
         : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
       this.authError = authError;
-      this.user = null;
-      this.session = null;
-      this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
-  async resetPassword(email: string): Promise<AuthResult> {
+  async resetPassword(email: string): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
     try {
       const { error } = await this.supabaseClient.auth.resetPasswordForEmail(email);
-      
       if (error) {
         this.authError = error;
-      } else {
-        this.authError = null;
+        this.notify();
+        return err(toApiError(error));
       }
-      
+      this.authError = null;
       this.notify();
-      return { user: null, session: null, error };
+      return ok({ user: this.user, session: this.session });
     } catch (error) {
-      // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError 
         ? error 
         : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
       this.authError = authError;
       this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
-  async updatePassword(password: string): Promise<AuthResult> {
+  async updatePassword(password: string): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
     try {
       const { error } = await this.supabaseClient.auth.updateUser({
         password,
       });
-      
       if (error) {
         this.authError = error;
-      } else {
-        this.authError = null;
+        this.notify();
+        return err(toApiError(error));
       }
-      
+      this.authError = null;
       this.notify();
-      return { user: null, session: null, error };
+      return ok({ user: this.user, session: this.session });
     } catch (error) {
-      const authError = error as AuthError;
+      const authError = error instanceof AuthError 
+        ? error 
+        : (error as AuthError);
       this.authError = authError;
       this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
-  async refreshSession(): Promise<AuthResult> {
+  async refreshSession(): Promise<ApiResult<AuthSessionData>> {
     if (!this.supabaseClient) {
       const error = new AuthError('Supabase client not available');
       this.authError = error;
       this.notify();
-      return { user: null, session: null, error };
+      return err(toApiError(error));
     }
 
     try {
       const { data, error } = await this.supabaseClient.auth.refreshSession();
-      
       if (error) {
         this.authError = error;
         this.user = null;
         this.session = null;
+        this.notify();
+        return err(toApiError(error));
+      }
+      this.authError = null;
+      if (data?.user && data?.session) {
+        this.user = data.user;
+        this.session = data.session;
       } else {
-        this.authError = null;
-        // Only update user and session if both are present (valid session)
-        if (data?.user && data?.session) {
-          this.user = data.user;
-          this.session = data.session;
-        } else {
-          // If no valid session, clear everything
-          this.user = null;
-          this.session = null;
-        }
+        this.user = null;
+        this.session = null;
       }
-      
       this.notify();
-      // Only return user if we have a valid session
-      return { 
-        user: (data?.user && data?.session) ? data.user : null, 
-        session: data?.session ?? null, 
-        error 
-      };
+      return ok({
+        user: (data?.user && data?.session) ? data.user : null,
+        session: data?.session ?? null,
+      });
     } catch (error) {
-      // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError 
         ? error 
         : new AuthError(error instanceof Error ? error.message : 'Authentication failed');
@@ -337,7 +326,7 @@ export class AuthService extends BaseService implements IAuthService {
       this.user = null;
       this.session = null;
       this.notify();
-      return { user: null, session: null, error: authError };
+      return err(toApiError(authError));
     }
   }
 
@@ -407,8 +396,9 @@ export class AuthService extends BaseService implements IAuthService {
     }
 
     this.clearRestorationTimeout();
-    const completedAt = Date.now();
-    const duration = this.restorationStartTime ? completedAt - this.restorationStartTime : null;
+    const _completedAt = Date.now();
+    // Duration calculated but not used - kept for potential future logging/debugging
+    // const duration = this.restorationStartTime ? _completedAt - this.restorationStartTime : null;
     this.restorationStartTime = null;
     const restorationComplete = !error;
     this.sessionRestorationState = {
@@ -482,6 +472,81 @@ export class AuthService extends BaseService implements IAuthService {
     }
   }
 
+  private handleSignedOut(session: SupabaseSession | null): void {
+    this.session = null;
+    this.user = null;
+    this.authError = null;
+    this.wasAuthenticatedRef = false;
+    if (session?.user) {
+      this.trackSession('logout', session).catch((err) => {
+        logger.warn('AuthService', `Failed to track logout session [ID:${this.instanceId}]:`, err);
+      });
+    }
+  }
+
+  private handleSignedInOrTokenRefreshed(
+    event: AuthChangeEvent,
+    session: SupabaseSession | null,
+    wasAuthenticated: boolean,
+    isNowAuthenticated: boolean,
+    userChanged: boolean,
+    previousUserId: string | null
+  ): void {
+    this.session = session;
+    this.user = session?.user ?? null;
+    if (session?.user) {
+      this.authError = null;
+    }
+    if (!wasAuthenticated && isNowAuthenticated && event === 'SIGNED_IN') {
+      this.clearPersistenceOnLogin(null, true);
+    } else if (userChanged && previousUserId) {
+      this.clearPersistenceOnLogin(previousUserId, true);
+    }
+    this.wasAuthenticatedRef = isNowAuthenticated;
+    if (event === 'SIGNED_IN' && session?.user) {
+      this.trackSession('login', session).catch((err) => {
+        logger.warn('AuthService', `Failed to track login session [ID:${this.instanceId}]:`, err);
+      });
+    }
+  }
+
+  private handleInitialSession(session: SupabaseSession | null, wasAuthenticated: boolean): void {
+    if (session) {
+      const previousUserId = this.user?.id ?? null;
+      const newUserId = session.user?.id ?? null;
+      const userChanged = previousUserId !== null && newUserId !== null && previousUserId !== newUserId;
+
+      this.session = session;
+      this.user = session.user ?? null;
+      this.authError = null;
+
+      if (userChanged && previousUserId) {
+        this.clearPersistenceOnLogin(previousUserId, true);
+      } else if (!wasAuthenticated && !!session.user) {
+        this.clearPersistenceOnLogin(null, true);
+      }
+
+      this.wasAuthenticatedRef = !!session.user;
+
+      const hasTimeoutError = this.sessionRestorationState.restorationError?.name === 'SessionRestorationTimeoutError';
+      if (
+        this.sessionRestorationState.isRestoring ||
+        this.sessionRestorationState.restorationError ||
+        (hasTimeoutError && session)
+      ) {
+        this.finishSessionRestoration();
+      }
+    } else {
+      this.wasAuthenticatedRef = false;
+      if (this.sessionRestorationState.isRestoring) {
+        this.finishSessionRestoration();
+      }
+    }
+
+    this.authLoading = false;
+    this.notify();
+  }
+
   private async setupAuthStateListener(): Promise<void> {
     if (!this.supabaseClient) {
       this.authLoading = false;
@@ -493,113 +558,29 @@ export class AuthService extends BaseService implements IAuthService {
       const subscription = this.supabaseClient.auth.onAuthStateChange(
         (event: AuthChangeEvent, session: SupabaseSession | null) => {
           try {
-            
-            // Track authentication state transition
             const wasAuthenticated = this.wasAuthenticatedRef;
             const isNowAuthenticated = !!session?.user;
-            const previousUserId = this.user?.id || null;
-            const newUserId = session?.user?.id || null;
+            const previousUserId = this.user?.id ?? null;
+            const newUserId = session?.user?.id ?? null;
             const userChanged = previousUserId !== null && newUserId !== null && previousUserId !== newUserId;
-            
-            // Handle different auth events
+
             if (event === 'SIGNED_OUT') {
-              this.session = null;
-              this.user = null;
-              this.authError = null;
-              this.wasAuthenticatedRef = false;
-              
-              // Automatic session tracking (non-blocking)
-              if (session?.user) {
-                this.trackSession('logout', session).catch(err => {
-                  logger.warn('AuthService', `Failed to track logout session [ID:${this.instanceId}]:`, err);
-                });
-              }
+              this.handleSignedOut(session);
             } else if (event === 'SIGNED_IN' || event === 'TOKEN_REFRESHED') {
-              this.session = session;
-              this.user = session?.user ?? null;
-
-              // Ensure state is set before non-blocking tracking calls
-              if (session?.user) {
-                this.authError = null;
-              }
-              
-              // Clear persistence when:
-              // 1. Transitioning from unauthenticated to authenticated (fresh login) - clear all + old unscoped keys
-              // 2. User changes (different user logs in) - clear previous user's persistence + old unscoped keys
-              if (!wasAuthenticated && isNowAuthenticated && event === 'SIGNED_IN') {
-                // Fresh login - clear all persistence including old unscoped keys
-                this.clearPersistenceOnLogin(null, true);
-              } else if (userChanged && previousUserId) {
-                // User changed - clear previous user's persistence + old unscoped keys
-                this.clearPersistenceOnLogin(previousUserId, true);
-              }
-              
-              this.wasAuthenticatedRef = isNowAuthenticated;
-              
-              // Automatic session tracking for login (non-blocking)
-              // Only track on SIGNED_IN, not TOKEN_REFRESHED (to avoid duplicate login records)
-              if (event === 'SIGNED_IN' && session?.user) {
-                this.trackSession('login', session).catch(err => {
-                  logger.warn('AuthService', `Failed to track login session [ID:${this.instanceId}]:`, err);
-                });
-              }
+              this.handleSignedInOrTokenRefreshed(
+                event,
+                session,
+                wasAuthenticated,
+                isNowAuthenticated,
+                userChanged,
+                previousUserId
+              );
             } else if (event === 'INITIAL_SESSION') {
-              if (session) {
-                const previousUserId = this.user?.id || null;
-                const newUserId = session.user?.id || null;
-                const userChanged = previousUserId !== null && newUserId !== null && previousUserId !== newUserId;
-                
-                this.session = session;
-                this.user = session.user ?? null;
-                this.authError = null;
-                
-                // Clear persistence if user changed (e.g., different user's session restored)
-                // This prevents data leakage when a different user's session is restored
-                if (userChanged && previousUserId) {
-                  // Clear previous user's persistence + old unscoped keys
-                  this.clearPersistenceOnLogin(previousUserId, true);
-                } else if (!wasAuthenticated && !!session.user) {
-                  // Fresh login on INITIAL_SESSION - clear all persistence including old unscoped keys
-                  this.clearPersistenceOnLogin(null, true);
-                }
-                // Don't clear persistence on INITIAL_SESSION for same user - this is just session restoration
-                // Persistence should only be cleared on actual SIGNED_IN events or user changes
-                // INITIAL_SESSION happens on page load/refresh, and we want to preserve
-                // dialog/form/datatable state across page refreshes for the same user
-                
-                this.wasAuthenticatedRef = !!session.user;
-                
-                // Reset restoration state if valid session arrives after earlier failure
-                // This clears stale errors when session eventually succeeds
-                const hasTimeoutError = this.sessionRestorationState.restorationError?.name === 'SessionRestorationTimeoutError';
-                if (this.sessionRestorationState.isRestoring || 
-                    this.sessionRestorationState.restorationError ||
-                    (hasTimeoutError && session)) {
-                  this.finishSessionRestoration();
-                }
-              } else {
-                // No session in INITIAL_SESSION event - user is not authenticated
-                this.wasAuthenticatedRef = false;
-                // Finish restoration to clear loading state
-                if (this.sessionRestorationState.isRestoring) {
-                  this.finishSessionRestoration();
-                }
-              }
-
-              // CRITICAL: Set loading to false AFTER handling INITIAL_SESSION
-              // This ensures ProtectedRoute waits for session restoration to complete
-              // before checking authentication state
-              this.authLoading = false;
-              
-              
-              this.notify();
-              return; // Return early to avoid setting loading to false again below
+              this.handleInitialSession(session, wasAuthenticated);
+              return;
             }
 
-            // For other events (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED), set loading to false and notify
             this.authLoading = false;
-            
-            
             this.notify();
           } catch (error) {
             logger.warn('AuthService', `Error in auth state change handler [ID:${this.instanceId}]:`, error);
@@ -633,7 +614,7 @@ export class AuthService extends BaseService implements IAuthService {
         const { data, error } = await this.supabaseClient.auth.getSession();
         currentSession = data?.session ?? null;
         sessionError = error ?? null;
-      } catch (error) {
+      } catch (_error) {
         // Handle cases where getSession might not exist (mocked/test clients)
         currentSession = null;
         sessionError = null;
@@ -657,7 +638,7 @@ export class AuthService extends BaseService implements IAuthService {
           if (userError && !this.authError) {
             this.authError = userError;
           }
-        } catch (getUserError) {
+        } catch (_getUserError) {
           // If getUser also fails, we've already recorded the sessionError
         }
       }