@lukoweb/apitogo 0.1.24 → 0.1.37

package/src/lib/authentication/providers/dev-portal.tsx

@@ -0,0 +1,270 @@
+import type { DevPortalAuthenticationConfig } from "../../../config/config.js";
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+import type {
+  AuthActionContext,
+  AuthActionOptions,
+  AuthenticationPlugin,
+  AuthenticationProviderInitializer,
+} from "../authentication.js";
+import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import {
+  type UserProfile,
+  useAuthState,
+  waitForAuthStateHydration,
+} from "../state.js";
+import type {
+  DevPortalAuthMode,
+  EndUserMeResponse,
+} from "./dev-portal-constants.js";
+import {
+  buildDevPortalLoginUrl,
+  buildDevPortalLogoutUrl,
+  isPlaceholderDevPortalApiUrl,
+  mapEndUserMeToProfile,
+  probeDevPortalBackend,
+  resolveDevPortalApiBaseUrl,
+} from "./dev-portal-utils.js";
+
+export type DevPortalProviderData = {
+  type: "dev-portal";
+  apiBaseUrl: string;
+  authMode: DevPortalAuthMode;
+};
+
+declare module "../state.js" {
+  interface ProviderDataRegistry {
+    "dev-portal": DevPortalProviderData;
+  }
+}
+
+export class DevPortalAuthenticationProvider
+  extends CoreAuthenticationPlugin
+  implements AuthenticationPlugin
+{
+  private readonly apiBaseUrl: string | undefined;
+  private readonly redirectToAfterSignIn: string | undefined;
+  private readonly redirectToAfterSignUp: string | undefined;
+  private readonly redirectToAfterSignOut: string;
+  private authMode: DevPortalAuthMode = "preview";
+  private backendAvailable = false;
+  private refreshGeneration = 0;
+  private refreshInFlight: Promise<boolean> | null = null;
+
+  constructor({
+    apiBaseUrl,
+    redirectToAfterSignIn,
+    redirectToAfterSignUp,
+    redirectToAfterSignOut = "/",
+  }: DevPortalAuthenticationConfig) {
+    super();
+    this.apiBaseUrl = resolveDevPortalApiBaseUrl({ apiBaseUrl });
+    this.redirectToAfterSignIn = redirectToAfterSignIn;
+    this.redirectToAfterSignUp = redirectToAfterSignUp;
+    this.redirectToAfterSignOut = redirectToAfterSignOut;
+  }
+
+  async initialize(_context: ZudokuContext): Promise<void> {
+    // Node SSR cannot reach local HTTPS backends with self-signed certs.
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (!this.backendAvailable) {
+      this.setPreviewState();
+      return;
+    }
+
+    await this.refreshUserProfile();
+  }
+
+  onPageLoad = async () => {
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (!this.backendAvailable) {
+      this.setPreviewState();
+      return;
+    }
+
+    await this.refreshUserProfile();
+  };
+
+  private async syncBackendAvailability(): Promise<void> {
+    if (!this.apiBaseUrl || isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
+      this.backendAvailable = false;
+      this.authMode = "preview";
+      return;
+    }
+
+    this.backendAvailable = await probeDevPortalBackend(this.apiBaseUrl);
+    this.authMode = this.backendAvailable ? "live" : "preview";
+  }
+
+  private setPreviewState(): void {
+    useAuthState.setState({
+      isAuthenticated: false,
+      isPending: false,
+      profile: null,
+      providerData: this.apiBaseUrl
+        ? {
+            type: "dev-portal",
+            apiBaseUrl: this.apiBaseUrl,
+            authMode: "preview",
+          }
+        : null,
+      isBackendAvailable: false,
+      authMode: "preview",
+    });
+  }
+
+  private ensureLiveBackend(): string {
+    if (!this.apiBaseUrl || !this.backendAvailable) {
+      throw new Error("Dev portal authentication is not available in preview.");
+    }
+
+    return this.apiBaseUrl;
+  }
+
+  async refreshUserProfile(): Promise<boolean> {
+    if (this.refreshInFlight) {
+      return this.refreshInFlight;
+    }
+
+    this.refreshInFlight = this.refreshUserProfileInternal().finally(() => {
+      this.refreshInFlight = null;
+    });
+
+    return this.refreshInFlight;
+  }
+
+  private async refreshUserProfileInternal(): Promise<boolean> {
+    if (!this.apiBaseUrl) {
+      this.setPreviewState();
+      return false;
+    }
+
+    if (isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
+      this.setPreviewState();
+      return false;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (!this.backendAvailable) {
+      this.setPreviewState();
+      return false;
+    }
+
+    const generation = ++this.refreshGeneration;
+    useAuthState.setState({ isPending: true });
+
+    try {
+      const response = await fetch(`${this.apiBaseUrl}/api/v1/auth/me`, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        credentials: "include",
+        redirect: "manual",
+      });
+
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      // Backends may still respond with 302 to the IdP; treat as unauthenticated.
+      if (
+        response.type === "opaqueredirect" ||
+        response.status === 302 ||
+        response.status === 401
+      ) {
+        useAuthState.setState({
+          isAuthenticated: false,
+          isPending: false,
+          profile: null,
+          providerData: {
+            type: "dev-portal",
+            apiBaseUrl: this.apiBaseUrl,
+            authMode: "live",
+          },
+          isBackendAvailable: true,
+          authMode: "live",
+        });
+        return false;
+      }
+
+      if (!response.ok) {
+        this.setPreviewState();
+        return false;
+      }
+
+      const me = (await response.json()) as EndUserMeResponse;
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      const profile: UserProfile = mapEndUserMeToProfile(me);
+
+      useAuthState.setState({
+        isAuthenticated: true,
+        isPending: false,
+        profile,
+        providerData: {
+          type: "dev-portal",
+          apiBaseUrl: this.apiBaseUrl,
+          authMode: "live",
+        },
+        isBackendAvailable: true,
+        authMode: "live",
+      });
+      return true;
+    } catch {
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      this.setPreviewState();
+      return false;
+    }
+  }
+
+  async signIn(
+    _: AuthActionContext,
+    { redirectTo }: AuthActionOptions = {},
+  ): Promise<void> {
+    const apiBaseUrl = this.ensureLiveBackend();
+    const target =
+      redirectTo ?? this.redirectToAfterSignIn ?? window.location.href;
+    window.location.assign(buildDevPortalLoginUrl(apiBaseUrl, target));
+  }
+
+  async signUp(
+    _: AuthActionContext,
+    { redirectTo }: AuthActionOptions = {},
+  ): Promise<void> {
+    const apiBaseUrl = this.ensureLiveBackend();
+    const target =
+      redirectTo ?? this.redirectToAfterSignUp ?? window.location.href;
+    window.location.assign(buildDevPortalLoginUrl(apiBaseUrl, target));
+  }
+
+  async signOut(_: AuthActionContext): Promise<void> {
+    const apiBaseUrl = this.ensureLiveBackend();
+    window.location.assign(
+      buildDevPortalLogoutUrl(apiBaseUrl, this.redirectToAfterSignOut),
+    );
+  }
+
+  async signRequest(request: Request): Promise<Request> {
+    return request;
+  }
+}
+
+const devPortalAuth: AuthenticationProviderInitializer<
+  DevPortalAuthenticationConfig
+> = (options) => new DevPortalAuthenticationProvider(options);
+
+export default devPortalAuth;