@jskit-ai/auth-web 0.1.159 → 0.1.161

package/src/server/managedPreviewIdentity.js

@@ -0,0 +1,344 @@
+import { DEV_AUTH_SECRET_HEADER } from "@jskit-ai/auth-core/server/devAuth";
+import { AUTH_PATHS } from "@jskit-ai/auth-core/shared/authPaths";
+
+const MANAGED_PREVIEW_IDENTITY_PROTOCOL = "vibe64.preview-identity.command.v1";
+const MANAGED_PREVIEW_IDENTITY_ENABLED_ENV = "VIBE64_PREVIEW_IDENTITY_ENABLED";
+const MANAGED_PREVIEW_IDENTITY_SECRET_ENV = "VIBE64_PREVIEW_IDENTITY_SECRET";
+const MAX_MESSAGE_BYTES = 64 * 1024;
+
+function commandError(message, code = "jskit_managed_preview_identity_failed", details = {}) {
+  return Object.assign(new Error(message), { code, ...details });
+}
+
+function response(requestId, values) {
+  return {
+    protocol: MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+    requestId: String(requestId || ""),
+    ...values
+  };
+}
+
+function failure(requestId, error) {
+  return response(requestId, {
+    code: String(error?.code || "jskit_managed_preview_identity_failed"),
+    error: String(error?.message || error || "Managed preview identity failed."),
+    ok: false,
+    setCookie: Array.isArray(error?.setCookie) ? error.setCookie : [],
+    signedOut: error?.signedOut === true,
+    statusCode: Number.isInteger(Number(error?.statusCode)) ? Number(error.statusCode) : 400
+  });
+}
+
+async function readBoundedStream(stream, label) {
+  let bytes = 0;
+  const chunks = [];
+  for await (const chunk of stream) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > MAX_MESSAGE_BYTES) {
+      throw commandError(
+        `${label} is too large.`,
+        "jskit_managed_preview_identity_message_too_large",
+        { statusCode: 413 }
+      );
+    }
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+async function readCommandInput(stream) {
+  try {
+    return JSON.parse(await readBoundedStream(stream, "Managed preview identity request"));
+  } catch (error) {
+    if (error?.code) {
+      throw error;
+    }
+    throw commandError(
+      "Managed preview identity request is invalid JSON.",
+      "jskit_managed_preview_identity_request_invalid"
+    );
+  }
+}
+
+function localTargetOrigin(value) {
+  let target;
+  try {
+    target = new URL(String(value || ""));
+  } catch {
+    throw commandError(
+      "Managed preview identity target must be a local application.",
+      "jskit_managed_preview_identity_target_invalid"
+    );
+  }
+  const hostname = target.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+  const local = hostname === "localhost" ||
+    hostname.endsWith(".localhost") ||
+    /^127(?:\.\d{1,3}){3}$/u.test(hostname) ||
+    hostname === "::1" ||
+    /^vibe64-launch-[a-f0-9]{12}$/u.test(hostname);
+  if (target.protocol !== "http:" || !local) {
+    throw commandError(
+      "Managed preview identity target must be a local application.",
+      "jskit_managed_preview_identity_target_invalid"
+    );
+  }
+  return target.origin;
+}
+
+function normalizeRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw commandError(
+      "Managed preview identity request must be an object.",
+      "jskit_managed_preview_identity_request_invalid"
+    );
+  }
+  const requestId = String(value.requestId || "").trim();
+  const operation = String(value.operation || "").trim();
+  if (value.protocol !== MANAGED_PREVIEW_IDENTITY_PROTOCOL || !requestId) {
+    throw commandError(
+      "Managed preview identity request protocol is invalid.",
+      "jskit_managed_preview_identity_protocol_invalid"
+    );
+  }
+  if (!["login-as", "logout"].includes(operation)) {
+    throw commandError(
+      "Managed preview identity operation is invalid.",
+      "jskit_managed_preview_identity_operation_invalid"
+    );
+  }
+  return {
+    operation,
+    requestId,
+    subject: value.subject,
+    targetOrigin: localTargetOrigin(value.target?.origin || value.target?.href)
+  };
+}
+
+function identityFromSubject(subject) {
+  if (subject?.kind === "selector") {
+    const type = String(subject.selector?.type || "").trim();
+    const value = String(subject.selector?.value || "").trim();
+    if (type === "email" && value) {
+      return { email: value };
+    }
+    if (type === "user-id" && value) {
+      return { userId: value };
+    }
+  }
+  throw commandError(
+    "Managed preview identity requires an existing application email or user ID.",
+    "jskit_managed_preview_identity_selector_unsupported"
+  );
+}
+
+function responseCookies(fetchResponse) {
+  if (typeof fetchResponse?.headers?.getSetCookie === "function") {
+    return fetchResponse.headers.getSetCookie().map(String).filter(Boolean);
+  }
+  const value = String(fetchResponse?.headers?.get?.("set-cookie") || "").trim();
+  return value ? [value] : [];
+}
+
+function cookieHeader(setCookie) {
+  const cookies = new Map();
+  for (const entry of setCookie) {
+    const pair = String(entry || "").split(";", 1)[0].trim();
+    const separator = pair.indexOf("=");
+    if (separator > 0) {
+      cookies.set(pair.slice(0, separator).trim(), pair);
+    }
+  }
+  return [...cookies.values()].join("; ");
+}
+
+async function responsePayload(fetchResponse) {
+  const text = fetchResponse?.body
+    ? await readBoundedStream(fetchResponse.body, "Managed preview identity response")
+    : "";
+  if (!text) {
+    return null;
+  }
+  try {
+    const value = JSON.parse(text);
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function rejected(payload, fetchResponse, details = {}) {
+  const fieldErrors = payload?.details?.fieldErrors || payload?.fieldErrors || {};
+  const fieldMessage = Object.values(
+    fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors) ? fieldErrors : {}
+  ).find(Boolean);
+  const firstError = Array.isArray(payload?.errors) ? payload.errors.find(Boolean) : null;
+  return commandError(
+    String(
+      fieldMessage ||
+      firstError?.message ||
+      firstError ||
+      payload?.error ||
+      payload?.message ||
+      "Managed preview identity exchange failed."
+    ),
+    String(firstError?.code || payload?.code || "jskit_managed_preview_identity_rejected"),
+    { statusCode: Number(fetchResponse?.status || 502), ...details }
+  );
+}
+
+async function fetchRequest(fetchImpl, href, options) {
+  try {
+    return await fetchImpl(href, options);
+  } catch {
+    throw commandError(
+      "Managed preview identity could not reach the application.",
+      "jskit_managed_preview_identity_unreachable",
+      { statusCode: 502 }
+    );
+  }
+}
+
+function postJson(fetchImpl, href, body, headers = {}) {
+  return fetchRequest(fetchImpl, href, {
+    body: JSON.stringify(body),
+    headers: { "content-type": "application/json", ...headers },
+    method: "POST",
+    redirect: "manual"
+  });
+}
+
+async function bootstrapSession(fetchImpl, targetOrigin) {
+  const fetchResponse = await fetchRequest(fetchImpl, `${targetOrigin}${AUTH_PATHS.SESSION}`, {
+    method: "GET",
+    redirect: "manual"
+  });
+  const payload = await responsePayload(fetchResponse);
+  const setCookie = responseCookies(fetchResponse);
+  if (!fetchResponse.ok) {
+    throw rejected(payload, fetchResponse, { setCookie });
+  }
+  const csrfToken = String(payload?.csrfToken || "").trim();
+  if (!csrfToken) {
+    throw commandError(
+      "Session bootstrap did not return a CSRF token.",
+      "jskit_managed_preview_identity_csrf_missing",
+      { setCookie, statusCode: 502 }
+    );
+  }
+  return { csrfToken, setCookie };
+}
+
+async function logout(fetchImpl, targetOrigin, session) {
+  const fetchResponse = await postJson(fetchImpl, `${targetOrigin}${AUTH_PATHS.LOGOUT}`, {}, {
+    cookie: cookieHeader(session.setCookie),
+    "csrf-token": session.csrfToken
+  });
+  const payload = await responsePayload(fetchResponse);
+  const setCookie = [...session.setCookie, ...responseCookies(fetchResponse)];
+  if (!fetchResponse.ok || payload?.ok !== true) {
+    throw rejected(payload, fetchResponse, { setCookie, signedOut: false });
+  }
+  return { csrfToken: session.csrfToken, setCookie };
+}
+
+async function login(fetchImpl, targetOrigin, identity, secret, session) {
+  const fetchResponse = await postJson(fetchImpl, `${targetOrigin}${AUTH_PATHS.DEV_LOGIN_AS}`, identity, {
+    cookie: cookieHeader(session.setCookie),
+    "csrf-token": session.csrfToken,
+    [DEV_AUTH_SECRET_HEADER]: secret
+  });
+  const payload = await responsePayload(fetchResponse);
+  const setCookie = [...session.setCookie, ...responseCookies(fetchResponse)];
+  if (!fetchResponse.ok || payload?.ok !== true) {
+    throw rejected(payload, fetchResponse, { setCookie, signedOut: true });
+  }
+  return {
+    identity: {
+      displayName: String(payload.displayName || payload.username || "").trim(),
+      email: String(payload.email || identity.email || "").trim().toLowerCase(),
+      userId: String(payload.userId || identity.userId || "").trim(),
+      username: String(payload.username || "").trim()
+    },
+    setCookie
+  };
+}
+
+async function executeManagedPreviewIdentityRequest(value, {
+  env = process.env,
+  fetchImpl = globalThis.fetch
+} = {}) {
+  let requestId = String(value?.requestId || "").trim();
+  try {
+    const request = normalizeRequest(value);
+    requestId = request.requestId;
+    if (typeof fetchImpl !== "function") {
+      throw commandError(
+        "Managed preview identity requires fetch support.",
+        "jskit_managed_preview_identity_fetch_unavailable",
+        { statusCode: 500 }
+      );
+    }
+    if (String(env[MANAGED_PREVIEW_IDENTITY_ENABLED_ENV] || "").trim().toLowerCase() !== "true") {
+      throw commandError(
+        "Managed preview identity is not enabled.",
+        "jskit_managed_preview_identity_disabled",
+        { statusCode: 403 }
+      );
+    }
+    const secret = String(env[MANAGED_PREVIEW_IDENTITY_SECRET_ENV] || "").trim();
+    if (!/^[a-f0-9]{64}$/u.test(secret)) {
+      throw commandError(
+        "Managed preview identity secret is unavailable.",
+        "jskit_managed_preview_identity_secret_missing",
+        { statusCode: 500 }
+      );
+    }
+    const identity = request.operation === "login-as"
+      ? identityFromSubject(request.subject)
+      : null;
+    const session = await bootstrapSession(fetchImpl, request.targetOrigin);
+    const signedOutSession = await logout(fetchImpl, request.targetOrigin, session);
+    if (request.operation === "logout") {
+      return response(requestId, {
+        identity: null,
+        ok: true,
+        setCookie: signedOutSession.setCookie,
+        signedOut: true
+      });
+    }
+    const result = await login(fetchImpl, request.targetOrigin, identity, secret, signedOutSession);
+    return response(requestId, {
+      identity: result.identity,
+      ok: true,
+      setCookie: result.setCookie,
+      signedOut: false
+    });
+  } catch (error) {
+    return failure(requestId, error);
+  }
+}
+
+async function runManagedPreviewIdentityCommand({
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  stdin = process.stdin,
+  stdout = process.stdout
+} = {}) {
+  let request;
+  try {
+    request = await readCommandInput(stdin);
+  } catch (error) {
+    stdout.write(`${JSON.stringify(failure("", error))}\n`);
+    return 0;
+  }
+  const result = await executeManagedPreviewIdentityRequest(request, { env, fetchImpl });
+  stdout.write(`${JSON.stringify(result)}\n`);
+  return 0;
+}
+
+export {
+  MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+  executeManagedPreviewIdentityRequest,
+  runManagedPreviewIdentityCommand
+};

package/src/server/services/AuthWebService.js

@@ -2,12 +2,11 @@ import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabi
 import { AUTH_ACTION_IDS } from "../constants/authActionIds.js";
 
 class AuthWebService {
-  constructor({ authService, getAuthService, devAuthBootstrapEnabled } = {}) {
-    if (!authService && typeof getAuthService !== "function") {
-      throw new Error("authService or getAuthService is required.");
+  constructor({ authService, devAuthBootstrapEnabled } = {}) {
+    if (!authService || typeof authService !== "object") {
+      throw new Error("authService is required.");
     }
-    this.authService = authService || null;
-    this.getAuthService = typeof getAuthService === "function" ? getAuthService : null;
+    this.authService = authService;
     this.devAuthBootstrapEnabled =
       typeof devAuthBootstrapEnabled === "boolean" ? devAuthBootstrapEnabled : null;
   }
@@ -73,17 +72,6 @@ class AuthWebService {
   }
 
   resolveAuthService() {
-    if (this.authService) {
-      return this.authService;
-    }
-    if (typeof this.getAuthService !== "function") {
-      throw new Error("authService is required.");
-    }
-
-    this.authService = this.getAuthService();
-    if (!this.authService) {
-      throw new Error("authService is required.");
-    }
     return this.authService;
   }
 

package/test/clientBoot.test.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import test from "node:test";
 
-test("auth-web client index defines provider-based client routes surface", () => {
+test("auth-web client index exports its routes and declarative provider", () => {
   const source = readFileSync(fileURLToPath(new URL("../src/client/index.js", import.meta.url)), "utf8");
 
   assert.equal(source.includes('export { useAuthStore } from "./stores/useAuthStore.js";'), true);
@@ -14,7 +14,7 @@ test("auth-web client index defines provider-based client routes surface", () =>
   assert.equal(source.includes('"auth-login": DefaultLoginView'), true);
   assert.equal(source.includes('"auth-signout": DefaultSignOutView'), true);
   assert.equal(source.includes('"auth-default-login": DefaultLoginView'), true);
-  assert.equal(source.includes("const clientProviders = Object.freeze([AuthWebClientProvider]);"), true);
+  assert.equal(source.includes('export { AuthWebClientProvider } from "./providers/AuthWebClientProvider.js";'), true);
   assert.equal(source.includes("async function bootClient(context) {"), false);
-  assert.equal(source.includes("export { routeComponents, clientProviders };"), true);
+  assert.equal(source.includes("export { routeComponents };"), true);
 });

package/test/clientSurface.test.js

@@ -25,19 +25,6 @@ test("auth-web packageMetadata declares auth surface ui routes", () => {
   assert.equal(resetRoute?.autoRegister, false);
 });
 
-test("auth-web auth page templates declare public route guard", () => {
-  const loginTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/login.vue", import.meta.url));
-  const signOutTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/signout.vue", import.meta.url));
-  const resetTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/reset-password.vue", import.meta.url));
-  const loginTemplateSource = readFileSync(loginTemplatePath, "utf8");
-  const signOutTemplateSource = readFileSync(signOutTemplatePath, "utf8");
-  const resetTemplateSource = readFileSync(resetTemplatePath, "utf8");
-
-  assert.match(loginTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
-  assert.match(signOutTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
-  assert.match(resetTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
-});
-
 test("auth-web exports runtime signout helpers directly", () => {
   assert.equal(typeof fromRuntimeUseSignOut, "function");
   assert.equal(typeof fromRuntimeCreateSignOutAction, "function");
@@ -72,12 +59,15 @@ test("auth-web runtime/useLoginView composes login view state, validation, and a
   assert.match(runtimeUseLoginViewSource, /export\s+\{\s*useLoginView\s*\};/);
 });
 
-test("auth-web client provider registers a mobile auth callback completion token", () => {
+test("auth-web client capability includes mobile callback completion", () => {
   const providerPath = fileURLToPath(new URL("../src/client/providers/AuthWebClientProvider.js", import.meta.url));
+  const authClientPath = fileURLToPath(new URL("../src/client/runtime/authClient.js", import.meta.url));
   const providerSource = readFileSync(providerPath, "utf8");
+  const authClientSource = readFileSync(authClientPath, "utf8");
 
-  assert.match(providerSource, /auth\.mobile-callback\.client/);
-  assert.match(providerSource, /completeOAuthCallbackFromUrl/);
+  assert.match(providerSource, /auth: "client\.auth"/);
+  assert.match(authClientSource, /mobileCallback/);
+  assert.match(authClientSource, /completeOAuthCallbackFromUrl/);
 });
 
 test("auth profile activator preserves the generated tap-target contract", () => {

package/test/managedPreviewIdentity.test.js

@@ -0,0 +1,89 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+  executeManagedPreviewIdentityRequest
+} from "../src/server/managedPreviewIdentity.js";
+
+const SECRET = "a".repeat(64);
+
+function jsonResponse(payload, { cookie = "", status = 200 } = {}) {
+  return new Response(JSON.stringify(payload), {
+    headers: {
+      "content-type": "application/json",
+      ...(cookie ? { "set-cookie": cookie } : {})
+    },
+    status
+  });
+}
+
+test("managed preview identity signs out before selecting an existing application user", async () => {
+  const calls = [];
+  const responses = [
+    jsonResponse({ csrfToken: "csrf-token" }, { cookie: "session=initial; Path=/" }),
+    jsonResponse({ ok: true }, { cookie: "session=; Max-Age=0; Path=/" }),
+    jsonResponse({
+      displayName: "Ada Lovelace",
+      email: "ada@example.com",
+      ok: true,
+      userId: "user-1"
+    }, { cookie: "session=selected; Path=/" })
+  ];
+  const result = await executeManagedPreviewIdentityRequest({
+    operation: "login-as",
+    protocol: MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+    requestId: "request-1",
+    subject: {
+      kind: "selector",
+      selector: { type: "email", value: "ada@example.com" }
+    },
+    target: { origin: "http://vibe64-launch-deadbeefcafe" }
+  }, {
+    env: {
+      VIBE64_PREVIEW_IDENTITY_ENABLED: "true",
+      VIBE64_PREVIEW_IDENTITY_SECRET: SECRET
+    },
+    fetchImpl: async (href, options) => {
+      calls.push({ href, options });
+      return responses.shift();
+    }
+  });
+
+  assert.equal(result.ok, true);
+  assert.equal(result.identity.email, "ada@example.com");
+  assert.equal(result.signedOut, false);
+  assert.deepEqual(calls.map(({ href }) => new URL(href).pathname), [
+    "/api/session",
+    "/api/logout",
+    "/api/dev-auth/login-as"
+  ]);
+  assert.equal(calls[2].options.headers["x-jskit-dev-auth-secret"], SECRET);
+  assert.equal(JSON.parse(calls[2].options.body).email, "ada@example.com");
+});
+
+test("managed preview identity rejects a disabled or non-local exchange", async () => {
+  const disabled = await executeManagedPreviewIdentityRequest({
+    operation: "logout",
+    protocol: MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+    requestId: "request-2",
+    target: { origin: "http://localhost:3000" }
+  }, { env: {}, fetchImpl: async () => assert.fail("fetch must not run") });
+  assert.equal(disabled.ok, false);
+  assert.equal(disabled.code, "jskit_managed_preview_identity_disabled");
+
+  const remote = await executeManagedPreviewIdentityRequest({
+    operation: "logout",
+    protocol: MANAGED_PREVIEW_IDENTITY_PROTOCOL,
+    requestId: "request-3",
+    target: { origin: "https://example.com" }
+  }, {
+    env: {
+      VIBE64_PREVIEW_IDENTITY_ENABLED: "true",
+      VIBE64_PREVIEW_IDENTITY_SECRET: SECRET
+    },
+    fetchImpl: async () => assert.fail("fetch must not run")
+  });
+  assert.equal(remote.ok, false);
+  assert.equal(remote.code, "jskit_managed_preview_identity_target_invalid");
+});

package/test/packageMetadataOwnership.test.js

@@ -4,19 +4,7 @@ import packageJson from "../package.json" with { type: "json" };
 
 const packageMetadata = packageJson.jskit;
 
-test("auth-web leaves its editable view and route scaffolds app-owned", () => {
-  const expectedIds = [
-    "auth-view-login",
-    "auth-view-signout",
-    "auth-view-reset-password",
-    "auth-page-login",
-    "auth-page-signout",
-    "auth-page-reset-password"
-  ];
-
-  for (const id of expectedIds) {
-    const mutation = packageMetadata.mutations.files.find((entry) => entry.id === id);
-    assert.ok(mutation, `Missing auth-web scaffold mutation ${id}.`);
-    assert.equal(mutation.ownership, "app", `${id} must remain app-owned across package updates.`);
-  }
+test("auth-web ships reusable views without mutating application source", () => {
+  assert.equal(Object.hasOwn(packageMetadata, "mutations"), false);
+  assert.equal(Object.keys(packageJson.exports).some((subpath) => subpath.includes("templates")), false);
 });