@mindfulauth/core 2.0.0-beta.7 → 2.0.0-beta.9

package/dist/astro/SecurityScript.astro

@@ -6,56 +6,17 @@
 // Security Settings Script - Astro Optimized
 // Combines: Change Password + 2FA Management + Add Authentication Method
 
-// ============================================================================
-// QRCODE DYNAMIC LOADING (bundled via qrcode npm package)
-// ============================================================================
-
-// Capture CDN origin at load time for loading co-hosted libraries
-const __cdnOrigin = (() => {
-  try {
-    if (document.currentScript && document.currentScript.src) {
-      return new URL(document.currentScript.src).origin;
-    }
-  } catch (_) {}
-  return '';
-})();
-
-/**
- * Dynamically loads the bundled QRCode library from the same CDN origin.
- * Uses the qrcode npm package (bundled as IIFE via esbuild).
- * Exposes QRCode.toCanvas(), QRCode.toDataURL(), QRCode.toString()
- * @returns {Promise<void>}
- */
-async function loadQRCodeLibrary() {
-  return new Promise((resolve, reject) => {
-    if (typeof QRCode !== 'undefined' && QRCode.toCanvas) {
-      resolve();
-      return;
-    }
-
-    const script = document.createElement('script');
-    script.src = `${__cdnOrigin}/lib/qrcode.js`;
-    script.onload = () => resolve();
-    script.onerror = () => reject(new Error('Failed to load QR code library'));
-    document.head.appendChild(script);
-  });
-}
-
 // ============================================================================
 // RECORDID EXTRACTION HELPER
 // ============================================================================
 
 /**
- * Extracts recordid from window variable (injected server-side by backend)
- * Backend MUST inject this variable for all implementations
- * Architecture
- * - All protected routes require /{memberid}/page URL structure
- * - Backend extracts memberid from URL path and validates against session
- * - Frontend receives memberid via window.MEMBERID injection
- * @returns {string|null} The recordid if found, null otherwise
+ * Extracts the recordId from the URL path (/{memberid}/...).
+ * The memberid is the first path segment, already validated server-side by middleware.
+ * @returns {string|undefined} The recordId if found, undefined otherwise
  */
 function getRecordId() {
-    return window.MEMBERID || null;
+    return window.location.pathname.split('/').filter(Boolean)[0] || undefined;
 }
 
 // ============================================================================
@@ -214,22 +175,20 @@ function init2FA() {
     setupDiv.removeAttribute('hidden');
     setupDiv.classList && setupDiv.classList.remove('hidden');
     setupDiv.style.display = 'flex';
-    qrCodeContainer.innerHTML = '';
+    qrCodeContainer.replaceChildren();
 
-    messageEl.textContent = 'Loading QR code generator...';
+    messageEl.textContent = 'Generating QR code...';
     try {
-      // Load QRCode library dynamically
-      await loadQRCodeLibrary();
-
-      messageEl.textContent = 'Generating secret key...';
       const response = await window.apiFetch('/auth/setup-2fa', { body: JSON.stringify({ recordid }) });
       const result = await response.json();
       if (result.success) {
-        qrCodeContainer.innerHTML = '';
+        qrCodeContainer.replaceChildren();
 
-        const canvas = document.createElement('canvas');
-        await QRCode.toCanvas(canvas, result.otpauthUri, { width: 256, margin: 2 });
-        qrCodeContainer.appendChild(canvas);
+        const img = document.createElement('img');
+        img.src = result.qrCodeDataUrl;
+        img.width = 256;
+        img.alt = 'QR code for authenticator app';
+        qrCodeContainer.appendChild(img);
 
         messageEl.textContent = 'Scan the QR code with your authenticator app and enter the code below.';
       } else {
@@ -269,7 +228,7 @@ function init2FA() {
           messageEl.textContent = result.message;
 
           if (result.recoveryCodes && result.recoveryCodes.length > 0) {
-            recoveryList.innerHTML = '';
+            recoveryList.replaceChildren();
             result.recoveryCodes.forEach(code => {
               const li = document.createElement('li');
               li.textContent = code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindfulauth/core",
-  "version": "2.0.0-beta.7",
+  "version": "2.0.0-beta.9",
   "description": "Mindful Auth core authentication library for Astro 6",
   "type": "module",
   "main": "./dist/core/index.js",