@leisuresaas/react 0.1.0

package/src/hosted-ui.ts

@@ -0,0 +1,75 @@
+export const DEFAULT_HOSTED_UI_LOCALE = "en";
+
+const BCP47_RE = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
+
+export function isLocalePathSegment(raw?: string | null): boolean {
+  const v = (raw ?? "").trim();
+  return Boolean(v) && BCP47_RE.test(v) && v.length <= 32;
+}
+
+function canonicalizeBcp47(raw: string): string {
+  const parts = raw.trim().split("-").filter(Boolean);
+  if (parts.length === 0) {
+    return DEFAULT_HOSTED_UI_LOCALE;
+  }
+  const out = [parts[0]!.toLowerCase()];
+  for (const part of parts.slice(1)) {
+    if (part.length === 2 && /^[A-Za-z]{2}$/.test(part)) {
+      out.push(part.toUpperCase());
+    } else if (part.length === 4 && /^[A-Za-z]{4}$/.test(part)) {
+      out.push(part[0]!.toUpperCase() + part.slice(1).toLowerCase());
+    } else {
+      out.push(part.toLowerCase());
+    }
+  }
+  return out.join("-");
+}
+
+export function normalizeHostedUILocale(raw?: string | null): string {
+  const v = (raw ?? "").trim().replace(/_/g, "-");
+  if (!v || !isLocalePathSegment(v)) {
+    return DEFAULT_HOSTED_UI_LOCALE;
+  }
+  const lower = v.toLowerCase();
+  if (lower === "en" || lower.startsWith("en-")) {
+    return "en";
+  }
+  if (lower === "zh" || lower.startsWith("zh-")) {
+    return "zh-CN";
+  }
+  if (lower === "de" || lower.startsWith("de-")) {
+    return "de";
+  }
+  return canonicalizeBcp47(v);
+}
+
+export function isHostedUIPasswordResetURL(url: string): boolean {
+  try {
+    const path = new URL(url).pathname.replace(/^\//, "");
+    return /(^|\/)reset-password\/?$/.test(path);
+  } catch {
+    return false;
+  }
+}
+
+/** Rewrite the Hosted UI path locale segment. */
+export function withHostedUILocale(url: string, locale?: string | null): string {
+  const trimmed = url.trim();
+  if (locale == null || !String(locale).trim() || !trimmed || !/^https?:\/\//i.test(trimmed)) {
+    return trimmed;
+  }
+  const normalized = normalizeHostedUILocale(locale);
+  try {
+    const u = new URL(trimmed);
+    const segs = u.pathname.split("/").filter(Boolean);
+    if (segs.length > 0 && isLocalePathSegment(segs[0])) {
+      segs[0] = normalized;
+    } else {
+      segs.unshift(normalized);
+    }
+    u.pathname = `/${segs.join("/")}`;
+    return u.toString();
+  } catch {
+    return trimmed;
+  }
+}

package/src/index.ts

@@ -0,0 +1,117 @@
+export { LeisureSaasHttpError } from "./errors";
+export { applyPublishableKeyHeaders, resolvePublishableKeyFromEnv } from "./publishable-key";
+export { resolveGatewayUrlFromEnv } from "./gateway-url";
+export { fetchPlatformApiBase, resolvePlatformApiBase } from "./platform-api-base";
+export type { ResolvePlatformApiBaseOptions } from "./platform-api-base";
+
+export {
+  bindPlatformAccount,
+  changeProductPassword,
+  deleteProductAccount,
+  loginProductAccount,
+  logoutProductAccount,
+  refreshProductSession,
+  registerProductAccount,
+  requestProductEmailVerification,
+  requestProductPasswordReset,
+  startPlatformAuthorize,
+  unbindPlatformAccount,
+} from "./auth";
+export type { ProductAuthTokens, PublicAuthContext } from "./auth";
+export { ProductAuthProvider, useProductAuth } from "./auth-provider";
+
+export {
+  accessNeedsRefresh,
+  beginPlatformLogin,
+  buildOAuthAuthorizeUrl,
+  completePlatformLogin,
+  createPkcePair,
+  exchangeAuthorizationCode,
+  exchangeMagicToken,
+  generateOAuthState,
+  magicTokenFromURL,
+  productTokensFromOAuth,
+  refreshOAuthTokens,
+  revokeOAuthToken,
+} from "./oauth";
+export type { OAuthTokenResponse, PkcePair } from "./oauth";
+export { fetchUserInfo } from "./userinfo";
+export type { UserInfo } from "./userinfo";
+export {
+  DEFAULT_HOSTED_UI_LOCALE,
+  isHostedUIPasswordResetURL,
+  isLocalePathSegment,
+  normalizeHostedUILocale,
+  withHostedUILocale,
+} from "./hosted-ui";
+
+export {
+  Ad,
+  AdBanner,
+  AdFooter,
+  AdInline,
+  AdPreview,
+  AdSidebar,
+  AdsProvider,
+  useAdsContext,
+  useAdsFeed,
+  useAdRotation,
+  getPublicAdsFeed,
+  lineupIdFromSource,
+  recordPublicAdEvents,
+  AD_TYPES,
+  IMAGE_LAYOUTS,
+  TEXT_LAYOUTS,
+  defaultLayoutForType,
+  effectiveRotationMode,
+  layoutsForType,
+  normalizeAdType,
+  normalizeLayout,
+  normalizeRotationMode,
+} from "./ads-ui";
+export type {
+  AdEventInput,
+  AdFeedItem,
+  AdFeedRotation,
+  AdFeedSource,
+  AdLayout,
+  AdProps,
+  AdPreviewProps,
+  AdRotationMode,
+  AdType,
+  AdsFeedResponse,
+  AdsProviderProps,
+  ImageLayout,
+  InAppNavigate,
+  PublicAdsRequestContext,
+  TextLayout,
+} from "./ads-ui";
+
+export {
+  DRIVE_UPLOAD_MAX_AUTO_PUT_BYTES,
+  createFsContentURL,
+  createFsFolder,
+  createFsUploadSession,
+  deleteFsNode,
+  finishFsUploadSession,
+  getFsNode,
+  getFsStorageUsage,
+  listFsNodes,
+  moveFsNode,
+  putFsUploadURL,
+  renameFsNode,
+  uploadFsFile,
+} from "./drive";
+export type {
+  DriveRequestContext,
+  FsContentURLIntent,
+  FsContentURLResult,
+  FsNode,
+  FsStorageUsage,
+  FsUploadSessionResult,
+  UploadProgress,
+  UploadProgressHandler,
+} from "./drive";
+
+export { getPublicAppConfig } from "./app-config";
+export type { AppConfigResponse, PublicAppConfigRequestContext } from "./app-config";

package/src/oauth.ts

@@ -0,0 +1,257 @@
+import { startPlatformAuthorize, type PublicAuthContext, type ProductAuthTokens } from "./auth";
+
+const REFRESH_SKEW_SEC = 60;
+
+export function accessExpUnix(accessToken: string): number | undefined {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) {
+    return undefined;
+  }
+  try {
+    const json = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
+    const payload = JSON.parse(json) as { exp?: number };
+    return typeof payload.exp === "number" ? payload.exp : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function accessNeedsRefresh(accessToken: string): boolean {
+  const exp = accessExpUnix(accessToken);
+  if (!exp) {
+    return false;
+  }
+  return exp - Math.floor(Date.now() / 1000) <= REFRESH_SKEW_SEC;
+}
+
+export type OAuthTokenResponse = {
+  accessToken: string;
+  refreshToken?: string;
+  expiresIn?: number;
+  refreshExpiresIn?: number;
+};
+
+export type PkcePair = { verifier: string; challenge: string };
+
+function bytesToBase64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function generateOAuthState(): string {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return bytesToBase64Url(bytes);
+}
+
+export async function createPkcePair(): Promise<PkcePair> {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const verifier = bytesToBase64Url(bytes);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };
+}
+
+export function buildOAuthAuthorizeUrl(input: {
+  issuer: string;
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  state: string;
+  scopes?: string[];
+  locale?: string;
+}): string {
+  const params = new URLSearchParams({
+    client_id: input.clientId,
+    redirect_uri: input.redirectUri,
+    response_type: "code",
+    code_challenge: input.codeChallenge,
+    code_challenge_method: "S256",
+    state: input.state,
+  });
+  if (input.scopes && input.scopes.length > 0) {
+    params.set("scope", input.scopes.join(" "));
+  }
+  if (input.locale?.trim()) {
+    params.set("ui_locales", input.locale.trim());
+  }
+  return `${input.issuer.replace(/\/$/, "")}/oauth/authorize?${params}`;
+}
+
+async function postOAuthToken(issuer: string, body: URLSearchParams, label: string): Promise<OAuthTokenResponse> {
+  const res = await fetch(`${issuer.replace(/\/$/, "")}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`${label} failed (${res.status}): ${text}`);
+  }
+  const data = (await res.json()) as {
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    refresh_expires_in?: number;
+  };
+  const accessToken = data.access_token?.trim();
+  if (!accessToken) {
+    throw new Error(`${label}: missing access_token`);
+  }
+  return {
+    accessToken,
+    refreshToken: data.refresh_token?.trim() || undefined,
+    expiresIn: data.expires_in,
+    refreshExpiresIn: data.refresh_expires_in,
+  };
+}
+
+export async function refreshOAuthTokens(
+  issuer: string,
+  clientId: string,
+  refreshToken: string,
+): Promise<OAuthTokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId,
+  });
+  return postOAuthToken(issuer, body, "token refresh");
+}
+
+export async function exchangeAuthorizationCode(
+  issuer: string,
+  clientId: string,
+  code: string,
+  redirectUri: string,
+  codeVerifier: string,
+): Promise<OAuthTokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: code.trim(),
+    redirect_uri: redirectUri,
+    client_id: clientId,
+    code_verifier: codeVerifier,
+  });
+  return postOAuthToken(issuer, body, "authorization code exchange");
+}
+
+export async function revokeOAuthToken(input: {
+  issuer: string;
+  clientId: string;
+  token: string;
+  tokenTypeHint?: "refresh_token" | "access_token";
+}): Promise<void> {
+  const token = input.token.trim();
+  if (!token) {
+    return;
+  }
+  const body = new URLSearchParams({
+    token,
+    client_id: input.clientId,
+  });
+  if (input.tokenTypeHint) {
+    body.set("token_type_hint", input.tokenTypeHint);
+  }
+  const res = await fetch(`${input.issuer.replace(/\/$/, "")}/oauth/revoke`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`token revoke failed (${res.status}): ${text}`);
+  }
+}
+
+export async function exchangeMagicToken(
+  issuer: string,
+  clientId: string,
+  magicToken: string,
+  clientSecret?: string,
+): Promise<OAuthTokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: "urn:leisuresaas:oauth:magic-token",
+    magic_token: magicToken.trim(),
+    client_id: clientId,
+  });
+  if (clientSecret?.trim()) {
+    body.set("client_secret", clientSecret.trim());
+  }
+  return postOAuthToken(issuer, body, "magic token exchange");
+}
+
+export function magicTokenFromURL(url: string): string | undefined {
+  try {
+    const u = new URL(url);
+    const fromQuery = u.searchParams.get("magic_token")?.trim();
+    if (fromQuery) {
+      return fromQuery;
+    }
+    if (u.hash) {
+      const hash = new URLSearchParams(u.hash.replace(/^#/, ""));
+      return hash.get("magic_token")?.trim() || undefined;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}
+
+function jwtClaims(accessToken: string): Record<string, unknown> {
+  const parts = accessToken.split(".");
+  if (parts.length < 2) {
+    return {};
+  }
+  try {
+    const json = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
+    return JSON.parse(json) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+export function productTokensFromOAuth(tokens: OAuthTokenResponse): ProductAuthTokens {
+  const now = Math.floor(Date.now() / 1000);
+  const claims = jwtClaims(tokens.accessToken);
+  return {
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken ?? "",
+    accessExpiresAtUnix: tokens.expiresIn ? now + tokens.expiresIn : 0,
+    refreshExpiresAtUnix: tokens.refreshExpiresIn ? now + tokens.refreshExpiresIn : 0,
+    userId: typeof claims.sub === "string" ? claims.sub : "",
+    tenantId: typeof claims.tenant_id === "string" ? claims.tenant_id : "",
+  };
+}
+
+/** PKCE + publishable-key authorize URL. The product stores `verifier` and redirects the browser. */
+export async function beginPlatformLogin(
+  ctx: PublicAuthContext,
+  input: { redirectUri: string; state?: string },
+): Promise<{ authorizationUrl: string; verifier: string; state: string }> {
+  const state = input.state?.trim() || generateOAuthState();
+  const pkce = await createPkcePair();
+  const authorizationUrl = await startPlatformAuthorize(ctx, {
+    redirectUri: input.redirectUri,
+    codeChallenge: pkce.challenge,
+    state,
+  });
+  return { authorizationUrl, verifier: pkce.verifier, state };
+}
+
+/** Exchange the code from the platform authorize redirect. */
+export async function completePlatformLogin(input: {
+  authorizationUrl: string;
+  code: string;
+  redirectUri: string;
+  verifier: string;
+}): Promise<ProductAuthTokens> {
+  const authorize = new URL(input.authorizationUrl);
+  const clientId = authorize.searchParams.get("client_id")?.trim() ?? "";
+  const issuer = `${authorize.protocol}//${authorize.host}`;
+  const tokens = await exchangeAuthorizationCode(issuer, clientId, input.code, input.redirectUri, input.verifier);
+  return productTokensFromOAuth(tokens);
+}

package/src/platform-api-base.ts

@@ -0,0 +1,63 @@
+import { LeisureSaasHttpError } from "./errors";
+import { resolveGatewayUrlFromEnv } from "./gateway-url";
+
+const DISCOVERY_PLATFORM_API_KEY = "leisuresaas_platform_api_base";
+
+function trimSlash(url: string): string {
+  return url.replace(/\/$/, "");
+}
+
+/** Fetch platform API base from OIDC discovery (`leisuresaas_platform_api_base`). */
+export async function fetchPlatformApiBase(issuer: string): Promise<string> {
+  const base = trimSlash(issuer.trim());
+  if (!base) {
+    throw new Error("issuer is required");
+  }
+  const res = await fetch(`${base}/.well-known/openid-configuration`, {
+    method: "GET",
+    headers: { Accept: "application/json" },
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new LeisureSaasHttpError(res.status, text.trim());
+  }
+  let doc: Record<string, unknown>;
+  try {
+    doc = JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    throw new Error("openid-configuration: invalid JSON");
+  }
+  const raw = doc[DISCOVERY_PLATFORM_API_KEY];
+  const api = typeof raw === "string" ? trimSlash(raw.trim()) : "";
+  if (!api) {
+    throw new Error(`openid-configuration missing ${DISCOVERY_PLATFORM_API_KEY}`);
+  }
+  return api;
+}
+
+export type ResolvePlatformApiBaseOptions = {
+  gatewayUrl?: string;
+  issuer?: string;
+  env?: Record<string, string | undefined>;
+};
+
+/** Resolve platform API base: prop → NEXT_PUBLIC_GATEWAY_URL → discovery via issuer. */
+export async function resolvePlatformApiBase(opts: ResolvePlatformApiBaseOptions = {}): Promise<string> {
+  const fromProp = opts.gatewayUrl?.trim();
+  if (fromProp) {
+    return trimSlash(fromProp);
+  }
+  const fromEnv = resolveGatewayUrlFromEnv(opts.env);
+  if (fromEnv) {
+    return trimSlash(fromEnv);
+  }
+  const issuer =
+    opts.issuer?.trim() ||
+    opts.env?.NEXT_PUBLIC_OAUTH_ISSUER?.trim() ||
+    (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_OAUTH_ISSUER?.trim() : "") ||
+    "";
+  if (!issuer) {
+    return "";
+  }
+  return fetchPlatformApiBase(issuer);
+}

package/src/publishable-key.ts

@@ -0,0 +1,14 @@
+/** Sets X-Publishable-Key for Public API calls. */
+export function applyPublishableKeyHeaders(
+  headers: Record<string, string>,
+  publishableKey: string,
+): void {
+  const key = publishableKey.trim();
+  if (!key) return;
+  headers["X-Publishable-Key"] = key;
+}
+
+/** Prefer NEXT_PUBLIC_PUBLISHABLE_KEY. */
+export function resolvePublishableKeyFromEnv(env: Record<string, string | undefined> = process.env): string {
+  return env.NEXT_PUBLIC_PUBLISHABLE_KEY?.trim() || "";
+}

package/src/userinfo.ts

@@ -0,0 +1,30 @@
+export type UserInfo = {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+};
+
+/** Fetch OIDC UserInfo from the platform issuer. */
+export async function fetchUserInfo(issuer: string, accessToken: string): Promise<UserInfo> {
+  const base = issuer.replace(/\/$/, "");
+  const token = accessToken.trim();
+  if (!base) {
+    throw new Error("issuer is required");
+  }
+  if (!token) {
+    throw new Error("access token is required");
+  }
+  const res = await fetch(`${base}/oauth/userinfo`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`userinfo failed (${res.status}): ${body}`);
+  }
+  const data = (await res.json()) as UserInfo;
+  if (!data?.sub) {
+    throw new Error("userinfo missing sub");
+  }
+  return data;
+}