@leisuresaas/react-native 0.6.2

package/src/public-app-config.ts

@@ -0,0 +1,106 @@
+import { LeisureSaasHttpError } from "./errors";
+import { mobilePlatform } from "./platform";
+import { applyPublishableKeyHeaders } from "./publishable-key";
+import type { MobilePlatform } from "./types";
+
+export type PublicAppConfigRequestContext = {
+  gatewayUrl: string;
+  publishableKey: string;
+  platform?: MobilePlatform | "web";
+  bundleId?: string;
+  origin?: string;
+  locale?: string;
+};
+
+export type AppConfigResponse = {
+  platform: string;
+  policy: {
+    min_supported_version: string;
+    latest_version: string;
+    store_url: string;
+    release_notes?: string;
+    update_message?: string;
+  };
+  /** Product support / legal URLs (Admin → Branding → Links). Empty string when unset. */
+  links: {
+    support_url: string;
+    terms_url: string;
+    privacy_url: string;
+  };
+  /** Product authoring locales (BCP 47) from Admin product Settings. */
+  supported_locales: string[];
+  /** Product default locale; always a member of supported_locales. */
+  default_locale: string;
+  client?: {
+    app_version?: string;
+    app_build?: string;
+  };
+  update: {
+    required: boolean;
+    recommended: boolean;
+    reason: string;
+  };
+};
+
+function trimSlash(url: string): string {
+  return url.replace(/\/$/, "");
+}
+
+function resolvePlatform(ctx: PublicAppConfigRequestContext): MobilePlatform | "web" {
+  return ctx.platform ?? mobilePlatform();
+}
+
+export async function getPublicAppConfig(
+  ctx: PublicAppConfigRequestContext,
+  input: { appVersion: string; appBuild?: string; fresh?: boolean },
+): Promise<AppConfigResponse> {
+  const platform = resolvePlatform(ctx);
+  const headers: Record<string, string> = {
+    Accept: "application/json",
+    "X-Client-Platform": platform,
+    "X-App-Version": input.appVersion.trim(),
+  };
+  applyPublishableKeyHeaders(headers, ctx.publishableKey);
+  if (input.appBuild?.trim()) {
+    headers["X-App-Build"] = input.appBuild.trim();
+  }
+  if (ctx.locale?.trim()) {
+    headers["Accept-Language"] = ctx.locale.trim();
+  }
+  if (platform === "web") {
+    if (ctx.origin?.trim()) headers.Origin = ctx.origin.trim();
+  } else if (ctx.bundleId?.trim()) {
+    headers["X-Ads-Bundle-Id"] = ctx.bundleId.trim();
+  }
+  if (input.fresh) {
+    headers["Cache-Control"] = "no-cache";
+  }
+
+  // Trailing slash: some gateways 301 …/app-config → …/app-config/ with a root-relative
+  // Location that drops the /gateway prefix and breaks fetch redirect (404).
+  let url = `${trimSlash(ctx.gatewayUrl)}/v1/public/app-config/`;
+  if (input.fresh) {
+    url += "?fresh=1";
+  }
+  const res = await fetch(url, { method: "GET", headers });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new LeisureSaasHttpError(res.status, text.trim());
+  }
+  const body = JSON.parse(text) as AppConfigResponse;
+  const links = body.links ?? { support_url: "", terms_url: "", privacy_url: "" };
+  const supported = Array.isArray(body.supported_locales)
+    ? body.supported_locales.map((x) => String(x ?? "").trim()).filter(Boolean)
+    : [];
+  const defaultLocale = String(body.default_locale ?? "").trim() || "en";
+  return {
+    ...body,
+    links: {
+      support_url: String(links.support_url ?? "").trim(),
+      terms_url: String(links.terms_url ?? "").trim(),
+      privacy_url: String(links.privacy_url ?? "").trim(),
+    },
+    supported_locales: supported.length > 0 ? supported : ["en"],
+    default_locale: defaultLocale,
+  };
+}

package/src/public-auth.ts

@@ -0,0 +1,252 @@
+import * as AuthSession from "expo-auth-session";
+import * as WebBrowser from "expo-web-browser";
+
+import { exchangeAuthorizationCode } from "./auth-session";
+import { LeisureSaasHttpError } from "./errors";
+import { mobilePlatform } from "./platform";
+import { applyPublishableKeyHeaders } from "./publishable-key";
+import type { MobilePlatform } from "./types";
+
+WebBrowser.maybeCompleteAuthSession();
+
+export type PublicAuthContext = {
+  gatewayUrl: string;
+  publishableKey: string;
+  platform?: MobilePlatform | "web";
+  bundleId?: string;
+  origin?: string;
+};
+
+export type ProductAuthTokens = {
+  accessToken: string;
+  refreshToken: string;
+  accessExpiresAtUnix: number;
+  refreshExpiresAtUnix: number;
+  userId: string;
+  tenantId: string;
+};
+
+type TokenJSON = {
+  access_token?: string;
+  refresh_token?: string;
+  access_expires_at_unix?: number;
+  refresh_expires_at_unix?: number;
+  user_id?: string;
+  tenant_id?: string;
+};
+
+function trimSlash(url: string): string {
+  return url.replace(/\/$/, "");
+}
+
+function resolvePlatform(ctx: PublicAuthContext): MobilePlatform | "web" {
+  return ctx.platform ?? mobilePlatform();
+}
+
+function authHeaders(ctx: PublicAuthContext, accessToken?: string): Record<string, string> {
+  const platform = resolvePlatform(ctx);
+  const headers: Record<string, string> = {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+    "X-Client-Platform": platform,
+  };
+  applyPublishableKeyHeaders(headers, ctx.publishableKey);
+  if (platform === "web") {
+    if (ctx.origin?.trim()) headers.Origin = ctx.origin.trim();
+  } else if (ctx.bundleId?.trim()) {
+    headers["X-Ads-Bundle-Id"] = ctx.bundleId.trim();
+  }
+  if (accessToken?.trim()) {
+    headers.Authorization = `Bearer ${accessToken.trim()}`;
+  }
+  return headers;
+}
+
+async function publicAuthRequest<T>(
+  ctx: PublicAuthContext,
+  path: string,
+  body?: unknown,
+  accessToken?: string,
+): Promise<T> {
+  const url = `${trimSlash(ctx.gatewayUrl)}/v1/public/auth${path}`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: authHeaders(ctx, accessToken),
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new LeisureSaasHttpError(res.status, text.trim());
+  }
+  if (!text) {
+    return {} as T;
+  }
+  return JSON.parse(text) as T;
+}
+
+function tokensFromJSON(data: TokenJSON): ProductAuthTokens {
+  const accessToken = data.access_token?.trim() ?? "";
+  if (!accessToken) {
+    throw new LeisureSaasHttpError(502, "missing access_token");
+  }
+  return {
+    accessToken,
+    refreshToken: data.refresh_token?.trim() ?? "",
+    accessExpiresAtUnix: data.access_expires_at_unix ?? 0,
+    refreshExpiresAtUnix: data.refresh_expires_at_unix ?? 0,
+    userId: data.user_id?.trim() ?? "",
+    tenantId: data.tenant_id?.trim() ?? "",
+  };
+}
+
+export async function registerProductAccount(
+  ctx: PublicAuthContext,
+  input: { email: string; password: string; name?: string; locale?: string },
+): Promise<{ verificationRequired: boolean }> {
+  const resp = await publicAuthRequest<{ verification_required?: boolean }>(ctx, "/register", {
+    email: input.email, password: input.password, name: input.name ?? "", locale: input.locale ?? "",
+  });
+  return { verificationRequired: resp.verification_required !== false };
+}
+
+export async function loginProductAccount(
+  ctx: PublicAuthContext,
+  input: { email: string; password: string; locale?: string },
+): Promise<ProductAuthTokens> {
+  const resp = await publicAuthRequest<TokenJSON>(ctx, "/login", {
+    email: input.email, password: input.password, locale: input.locale ?? "",
+  });
+  return tokensFromJSON(resp);
+}
+
+export async function refreshProductSession(ctx: PublicAuthContext, refreshToken: string): Promise<ProductAuthTokens> {
+  const resp = await publicAuthRequest<TokenJSON>(ctx, "/refresh", { refresh_token: refreshToken });
+  return tokensFromJSON(resp);
+}
+
+export async function requestProductPasswordReset(
+  ctx: PublicAuthContext,
+  input: { email: string; locale?: string },
+): Promise<void> {
+  await publicAuthRequest(ctx, "/password-reset", { email: input.email, locale: input.locale ?? "" });
+}
+
+export async function requestProductEmailVerification(
+  ctx: PublicAuthContext,
+  input: { email: string; locale?: string },
+): Promise<void> {
+  await publicAuthRequest(ctx, "/email-verification", { email: input.email, locale: input.locale ?? "" });
+}
+
+export async function changeProductPassword(
+  ctx: PublicAuthContext,
+  accessToken: string,
+  input: { currentPassword: string; newPassword: string },
+): Promise<void> {
+  await publicAuthRequest(ctx, "/password", {
+    current_password: input.currentPassword, new_password: input.newPassword,
+  }, accessToken);
+}
+
+export async function logoutProductAccount(
+  ctx: PublicAuthContext,
+  accessToken: string,
+  refreshToken?: string,
+): Promise<void> {
+  await publicAuthRequest(ctx, "/logout", { refresh_token: refreshToken ?? "" }, accessToken);
+}
+
+export async function deleteProductAccount(ctx: PublicAuthContext, accessToken: string): Promise<void> {
+  await publicAuthRequest(ctx, "/account/delete", {}, accessToken);
+}
+
+export async function startPlatformAuthorize(
+  ctx: PublicAuthContext,
+  input: { redirectUri: string; codeChallenge: string; state?: string },
+): Promise<string> {
+  const resp = await publicAuthRequest<{ authorization_url?: string }>(ctx, "/authorize", {
+    redirect_uri: input.redirectUri,
+    code_challenge: input.codeChallenge,
+    state: input.state ?? "",
+  });
+  const url = resp.authorization_url?.trim() ?? "";
+  if (!url) {
+    throw new LeisureSaasHttpError(502, "missing authorization_url");
+  }
+  return url;
+}
+
+export async function bindPlatformAccount(
+  ctx: PublicAuthContext,
+  accessToken: string,
+  input: { code: string; codeVerifier: string; redirectUri: string },
+): Promise<void> {
+  await publicAuthRequest(ctx, "/bind", {
+    code: input.code, code_verifier: input.codeVerifier, redirect_uri: input.redirectUri,
+  }, accessToken);
+}
+
+export async function unbindPlatformAccount(ctx: PublicAuthContext, accessToken: string): Promise<void> {
+  await publicAuthRequest(ctx, "/unbind", {}, accessToken);
+}
+
+/** Opens the platform hosted login and returns a product-pool token. */
+export async function loginWithPlatformAccount(
+  ctx: PublicAuthContext,
+  input: { redirectUri: string; state?: string },
+): Promise<ProductAuthTokens> {
+  const request = new AuthSession.AuthRequest({
+    clientId: "publishable",
+    redirectUri: input.redirectUri,
+    responseType: AuthSession.ResponseType.Code,
+    scopes: ["openid"],
+    usePKCE: true,
+  });
+  await request.makeAuthUrlAsync({ authorizationEndpoint: "https://leisuresaas.invalid/oauth/authorize" });
+  const challenge = request.codeChallenge?.trim() ?? "";
+  const verifier = request.codeVerifier?.trim() ?? "";
+  if (!challenge || !verifier) {
+    throw new LeisureSaasHttpError(500, "pkce challenge was not created");
+  }
+
+  const authorizationURL = await startPlatformAuthorize(ctx, {
+    redirectUri: input.redirectUri, codeChallenge: challenge, state: input.state,
+  });
+  const result = await WebBrowser.openAuthSessionAsync(authorizationURL, input.redirectUri);
+  if (result.type !== "success") {
+    throw new LeisureSaasHttpError(401, "platform login cancelled");
+  }
+  const redirected = new URL(result.url);
+  const code = redirected.searchParams.get("code")?.trim() ?? "";
+  if (!code) {
+    throw new LeisureSaasHttpError(401, "platform login returned no code");
+  }
+  const authorize = new URL(authorizationURL);
+  const clientId = authorize.searchParams.get("client_id")?.trim() ?? "";
+  const issuer = `${authorize.protocol}//${authorize.host}`;
+  const tokens = await exchangeAuthorizationCode(issuer, clientId, code, input.redirectUri, verifier);
+  const now = Math.floor(Date.now() / 1000);
+  const claims = jwtClaims(tokens.accessToken);
+  return {
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken ?? "",
+    accessExpiresAtUnix: tokens.expiresIn ? now + tokens.expiresIn : 0,
+    refreshExpiresAtUnix: tokens.refreshExpiresIn ? now + tokens.refreshExpiresIn : 0,
+    userId: typeof claims.sub === "string" ? claims.sub : "",
+    tenantId: typeof claims.tenant_id === "string" ? claims.tenant_id : "",
+  };
+}
+
+function jwtClaims(accessToken: string): Record<string, unknown> {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) {
+    return {};
+  }
+  try {
+    const json = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
+    const payload = JSON.parse(json) as Record<string, unknown>;
+    return payload;
+  } catch {
+    return {};
+  }
+}

package/src/publishable-key.ts

@@ -0,0 +1,19 @@
+/** Sets X-Publishable-Key for Public API calls. */
+export function applyPublishableKeyHeaders(
+  headers: Record<string, string>,
+  publishableKey: string,
+): void {
+  const key = publishableKey.trim();
+  if (!key) return;
+  headers["X-Publishable-Key"] = key;
+}
+
+/** Prefer EXPO_PUBLIC_PUBLISHABLE_KEY; legacy env names still accepted if they hold pk_live_. */
+export function resolvePublishableKeyFromEnv(env: Record<string, string | undefined> = process.env): string {
+  return (
+    env.EXPO_PUBLIC_PUBLISHABLE_KEY?.trim() ||
+    env.EXPO_PUBLIC_ADS_PK?.trim() ||
+    env.EXPO_PUBLIC_APP_CFG_PK?.trim() ||
+    ""
+  );
+}

package/src/push.ts

@@ -0,0 +1,89 @@
+import { appBundleId } from "./ads/bundle-id";
+import { mobilePlatform } from "./platform";
+import type { EnablePushOptions, MobilePlatform, RegisterDeviceTokenInput } from "./types";
+
+type ExpoNotificationsModule = {
+  requestPermissionsAsync: () => Promise<{ status: string }>;
+  getDevicePushTokenAsync: () => Promise<{ data: string; type?: string }>;
+};
+
+function loadNotifications(): ExpoNotificationsModule {
+  try {
+    // Optional peer: apps must install expo-notifications.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require("expo-notifications") as ExpoNotificationsModule;
+  } catch {
+    throw new Error(
+      "buildEnablePushRegistration requires peer dependency expo-notifications. Install it in your Expo app.",
+    );
+  }
+}
+
+function resolveAndroidPackage(opts?: EnablePushOptions): string | undefined {
+  if (opts?.androidPackage?.trim()) return opts.androidPackage.trim();
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const Application = require("expo-application") as { applicationId?: string | null };
+    if (Application.applicationId?.trim()) return Application.applicationId.trim();
+  } catch {
+    // fall through to appBundleId
+  }
+  return appBundleId() || undefined;
+}
+
+function resolveBundleId(opts?: EnablePushOptions): string | undefined {
+  if (opts?.bundleId?.trim()) return opts.bundleId.trim();
+  return appBundleId() || undefined;
+}
+
+function resolveEnvironment(opts?: EnablePushOptions): "development" | "production" {
+  if (opts?.environment === "development" || opts?.environment === "production") {
+    return opts.environment;
+  }
+  return typeof __DEV__ !== "undefined" && __DEV__ ? "development" : "production";
+}
+
+/** Read native FCM/APNs device token (not Expo Push Token). */
+export async function fetchNativeDevicePushToken(): Promise<string> {
+  const Notifications = loadNotifications();
+  const device = await Notifications.getDevicePushTokenAsync();
+  const token = String(device.data ?? "").trim();
+  if (!token) {
+    throw new Error("empty device push token");
+  }
+  if (token.startsWith("ExponentPushToken[") || token.startsWith("ExpoPushToken[")) {
+    throw new Error(
+      "ExponentPushToken is not supported; use a Dev Client / Store build with native FCM/APNs",
+    );
+  }
+  return token;
+}
+
+/**
+ * Request permission and build the body for product BFF
+ * `POST /v1/notifications/device-tokens` (path is product-defined).
+ * Does not call the network — App must POST via its own apiFetch.
+ */
+export async function buildEnablePushRegistration(
+  opts?: EnablePushOptions,
+): Promise<RegisterDeviceTokenInput> {
+  const Notifications = loadNotifications();
+  const permission = await Notifications.requestPermissionsAsync();
+  if (permission.status !== "granted") {
+    throw new Error(`notification permission ${permission.status}`);
+  }
+
+  const token = await fetchNativeDevicePushToken();
+  const platform: MobilePlatform = opts?.platform ?? mobilePlatform();
+  const input: RegisterDeviceTokenInput = {
+    platform,
+    token,
+    environment: resolveEnvironment(opts),
+  };
+  if (platform === "android") {
+    input.androidPackage = resolveAndroidPackage(opts);
+  } else {
+    input.bundleId = resolveBundleId(opts);
+  }
+  return input;
+}

package/src/types.ts

@@ -0,0 +1,123 @@
+export type MobilePlatform = "ios" | "android";
+
+/** Shared shape for product BFF plan list responses (optional typing aid). */
+export type Plan = {
+  plan_id: string;
+  name: string;
+  code?: string;
+  description?: string;
+  includes?: { text: string; href?: string; accent?: boolean }[];
+  plan_version_id?: string;
+  payment_channel?: string;
+  payment_mode?: string;
+  is_current?: boolean;
+  seat_limit?: number;
+  sort_order?: number;
+  recommended?: boolean;
+};
+
+export type SubscriptionStatus = {
+  id?: string;
+  status: string;
+  plan_id?: string;
+  plan_version_id?: string;
+  billing_source?: string;
+  current_period_end_unix?: number;
+};
+
+export type Entitlement = {
+  id?: string;
+  tenant_id?: string;
+  product_id?: string;
+  plan_id?: string;
+  plan_version_id?: string;
+  status?: string;
+  permission_keys?: string[];
+  quotas?: { metric_key: string; limit: number; period: string }[];
+};
+
+/** Body for product BFF `POST …/notifications/device-tokens` (from buildEnablePushRegistration). */
+export type RegisterDeviceTokenInput = {
+  platform: MobilePlatform;
+  token: string;
+  androidPackage?: string;
+  bundleId?: string;
+  environment?: "development" | "production";
+};
+
+export type EnablePushOptions = {
+  platform?: MobilePlatform;
+  androidPackage?: string;
+  bundleId?: string;
+  environment?: "development" | "production";
+};
+
+export type AuthConfig = {
+  issuer: string;
+  clientId: string;
+  redirectScheme: string;
+  redirectPath?: string;
+  scopes?: string[];
+  storageKey?: string;
+  refreshStorageKey?: string;
+  /**
+   * OAuth authorize `terminal` for Hosted UI layout (`mobile` = compact In-App Browser).
+   * Default: `mobile`.
+   */
+  terminal?: "mobile" | "web";
+  /**
+   * Hosted UI UI language (BCP 47). Sent as OIDC `ui_locales` on authorize and used to
+   * rewrite Hosted UI HTTPS paths opened via deep link (e.g. `de` → `/de/…`).
+   */
+  locale?: string;
+  /** When true (default), Universal Links to Hosted UI reset-password open In-App Browser. */
+  handlePasswordResetLinks?: boolean;
+};
+
+/** @deprecated Use AuthConfig */
+export type LeisureSaasAuthConfig = AuthConfig;
+
+export type AdFeedItem = {
+  id: string;
+  scope?: string;
+  type: string;
+  placement?: string;
+  priority?: number;
+  title?: string;
+  body_text?: string;
+  image_url?: string;
+  click_url?: string;
+};
+
+export type AdFeedRotation = {
+  enabled: boolean;
+  mode: string;
+  interval_sec: number;
+  loop: boolean;
+  autoplay: boolean;
+  show_indicators: boolean;
+};
+
+export type AdFeedSource = {
+  kind: string;
+  lineup_id?: string;
+  scope: string;
+  overridden?: boolean;
+};
+
+export type AdsFeedResponse = {
+  placement: string;
+  surface_key?: string;
+  type?: string;
+  layout?: string;
+  source?: AdFeedSource;
+  rotation?: AdFeedRotation;
+  ads: AdFeedItem[];
+};
+
+export type AdEventInput = {
+  adId: string;
+  eventType: "impression";
+  placementKey?: string;
+  lineupId?: string;
+};

package/src/userinfo.ts

@@ -0,0 +1,34 @@
+/**
+ * OIDC UserInfo (GET {issuer}/oauth/userinfo).
+ * Requires a user access token from the authorization_code flow — not client_credentials.
+ */
+export type UserInfo = {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+};
+
+/** Fetch OIDC UserInfo from the platform issuer. */
+export async function fetchUserInfo(issuer: string, accessToken: string): Promise<UserInfo> {
+  const base = issuer.replace(/\/$/, "");
+  const token = accessToken.trim();
+  if (!base) {
+    throw new Error("issuer is required");
+  }
+  if (!token) {
+    throw new Error("access token is required");
+  }
+  const res = await fetch(`${base}/oauth/userinfo`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`userinfo failed (${res.status}): ${body}`);
+  }
+  const data = (await res.json()) as UserInfo;
+  if (!data?.sub) {
+    throw new Error("userinfo missing sub");
+  }
+  return data;
+}