@morscherlab/mint-sdk 1.3.0-beta.3 → 1.3.0-beta.5

package/src/composables/useAuth.ts

@@ -1,470 +0,0 @@
-import axios from 'axios'
-import { ref, onMounted, onUnmounted, watch, getCurrentInstance, type Ref } from 'vue'
-import { useAuthStore } from '../stores/auth'
-import { useSettingsStore } from '../stores/settings'
-import type { AuthConfig, UserInfo, LoginResponse, TokenVerifyResponse, UpdateProfileRequest } from '../types'
-import type { RoleInfo } from '../permissions'
-
-interface UserResponse {
-  id: number
-  username: string
-  shortname: string | null
-  email: string | null
-  role: string
-  role_obj?: RoleInfo | null
-  is_active: boolean
-  // Set by PUT /users/me after a password change, which revokes the old token.
-  access_token?: string | null
-  expires_in?: number | null
-}
-
-interface RefreshResponse {
-  access_token: string
-  expires_in: number
-  token_type: string
-}
-
-// Token refresh configuration
-const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000 // Refresh 5 minutes before expiry
-const TOKEN_REFRESH_CHECK_INTERVAL_MS = 60 * 1000 // Check every minute
-
-/**
- * Authentication composable with automatic token refresh.
- *
- * Features:
- * - Automatic token refresh before expiration
- * - Login/logout/register functionality
- * - Token verification on startup
- * - User profile management
- *
- * @example
- * ```typescript
- * const { login, logout, isAuthenticated, user } = useAuth()
- *
- * // Login
- * const success = await login('username', 'password')
- *
- * // Automatic refresh is enabled by default
- * // Tokens are refreshed 5 minutes before expiration
- * ```
- */
-export interface UseAuthReturn {
-  login: (username: string, password: string) => Promise<boolean>
-  logout: () => void
-  register: (username: string, password: string, email?: string) => Promise<boolean>
-  verifyToken: () => Promise<boolean>
-  fetchAuthConfig: () => Promise<AuthConfig>
-  initializeAuth: () => Promise<void>
-  getCurrentUser: () => Promise<UserInfo | null>
-  getAuthHeader: () => Record<string, string>
-  updateProfile: (data: { email?: string; shortname?: string; currentPassword?: string; newPassword?: string }) => Promise<{ success: boolean; error?: string }>
-  refreshToken: () => Promise<boolean>
-  isRefreshing: Ref<boolean>
-}
-
-// Module-level singletons to prevent duplicate refresh requests and timers
-// across multiple useAuth() instances
-let _refreshPromise: Promise<boolean> | null = null
-let _refreshTimerId: number | null = null
-let _mountedConsumerCount = 0
-
-/** @internal Reset module-level state — only for use in tests. */
-export function _resetAuthStateForTesting(): void {
-  _refreshPromise = null
-  if (_refreshTimerId !== null) {
-    clearTimeout(_refreshTimerId)
-    _refreshTimerId = null
-  }
-  _mountedConsumerCount = 0
-}
-
-/** Manages authentication state with login/logout/register and automatic JWT token refresh. */
-export function useAuth(): UseAuthReturn {
-  const authStore = useAuthStore()
-  const settingsStore = useSettingsStore()
-
-  const isRefreshing = ref(false)
-
-  function getApiBaseUrl(): string {
-    return settingsStore.getApiBaseUrl()
-  }
-
-  async function fetchAuthConfig(): Promise<AuthConfig> {
-    try {
-      const response = await axios.get<{
-        auth_required: boolean
-        passkey_enabled: boolean
-        passkey_registered?: boolean
-        registration_enabled?: boolean
-        database_mode?: string
-        access?: {
-          experiment_visibility_mode?: 'open' | 'restricted'
-          experimentVisibilityMode?: 'open' | 'restricted'
-        }
-      }>(`${getApiBaseUrl()}/setup/config/public`)
-
-      const config: AuthConfig = {
-        authRequired: response.data.auth_required,
-        passkeyEnabled: response.data.passkey_enabled,
-        passkeyRegistered: response.data.passkey_registered ?? false,
-        registrationEnabled: response.data.registration_enabled ?? false,
-        databaseMode: response.data.database_mode ?? 'none',
-        experimentVisibilityMode:
-          response.data.access?.experiment_visibility_mode
-          ?? response.data.access?.experimentVisibilityMode
-          ?? 'open',
-      }
-
-      authStore.setAuthConfig(config)
-      return config
-    } catch (error) {
-      console.error('Failed to fetch auth config:', error)
-      return {
-        authRequired: false,
-        passkeyEnabled: false,
-        passkeyRegistered: false,
-        registrationEnabled: false,
-        databaseMode: 'none',
-        experimentVisibilityMode: 'open',
-      }
-    }
-  }
-
-  async function login(username: string, password: string): Promise<boolean> {
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      const response = await axios.post<LoginResponse>(
-        `${getApiBaseUrl()}/auth/login`,
-        { username, password }
-      )
-
-      authStore.setToken(response.data.access_token, response.data.expires_in)
-      authStore.setUsername(username)
-
-      await getCurrentUser()
-
-      // Start auto-refresh after successful login
-      scheduleTokenRefresh()
-
-      return true
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        authStore.setError(error.response.data.detail || 'Login failed')
-      } else {
-        authStore.setError('Network error. Please try again.')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function register(username: string, password: string, email?: string): Promise<boolean> {
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      await axios.post<UserResponse>(
-        `${getApiBaseUrl()}/users/register`,
-        { username, password, email }
-      )
-
-      return await login(username, password)
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        authStore.setError(error.response.data.detail || 'Registration failed')
-      } else {
-        authStore.setError('Network error. Please try again.')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function getCurrentUser(): Promise<UserInfo | null> {
-    if (!authStore.token) {
-      return null
-    }
-
-    try {
-      const response = await axios.get<UserResponse>(
-        `${getApiBaseUrl()}/users/me`,
-        { headers: getAuthHeader() }
-      )
-
-      const userInfo: UserInfo = {
-        id: response.data.id,
-        username: response.data.username,
-        shortname: response.data.shortname,
-        email: response.data.email,
-        role: response.data.role,
-        roleObj: response.data.role_obj ?? null,
-        isActive: response.data.is_active,
-      }
-
-      authStore.setUserInfo(userInfo)
-      return userInfo
-    } catch {
-      return null
-    }
-  }
-
-  async function verifyToken(): Promise<boolean> {
-    if (!authStore.token) {
-      return false
-    }
-
-    try {
-      const response = await axios.get<TokenVerifyResponse>(
-        `${getApiBaseUrl()}/auth/verify`,
-        {
-          headers: {
-            Authorization: `Bearer ${authStore.token}`,
-          },
-        }
-      )
-
-      if (response.data.valid && response.data.username) {
-        authStore.setUsername(response.data.username)
-        return true
-      }
-
-      authStore.clearToken()
-      return false
-    } catch {
-      authStore.clearToken()
-      return false
-    }
-  }
-
-  /**
-   * Refresh the authentication token.
-   * Called automatically before token expiration.
-   * Uses promise caching to prevent concurrent refresh requests.
-   */
-  async function refreshToken(): Promise<boolean> {
-    if (!authStore.token) return false
-    if (_refreshPromise) return _refreshPromise
-
-    _refreshPromise = (async () => {
-      isRefreshing.value = true
-      // A password change can swap in a fresh token while this refresh is in
-      // flight; its late answer must not replace or clear that token.
-      const sentToken = authStore.token
-
-      try {
-        const response = await axios.post<RefreshResponse>(
-          `${getApiBaseUrl()}/auth/refresh`,
-          {},
-          { headers: getAuthHeader() }
-        )
-
-        if (authStore.token !== sentToken) return true // superseded by a newer token
-        authStore.setToken(response.data.access_token, response.data.expires_in)
-
-        // Reschedule next refresh
-        scheduleTokenRefresh()
-
-        return true
-      } catch (error) {
-        // If refresh fails, the token may have been revoked
-        // Clear auth state and let user re-login
-        if (axios.isAxiosError(error) && error.response?.status === 401 && authStore.token === sentToken) {
-          console.warn('[Auth] Token refresh failed - session expired')
-          authStore.clearToken()
-          stopTokenRefresh()
-        }
-        return false
-      } finally {
-        isRefreshing.value = false
-        _refreshPromise = null
-      }
-    })()
-
-    return _refreshPromise
-  }
-
-  /**
-   * Schedule automatic token refresh before expiration.
-   */
-  function scheduleTokenRefresh(): void {
-    // Clear any existing timer
-    stopTokenRefresh()
-
-    if (!authStore.tokenExpires) {
-      return
-    }
-
-    const expiresAt = authStore.tokenExpires.getTime()
-    const refreshAt = expiresAt - TOKEN_REFRESH_MARGIN_MS
-    const now = Date.now()
-
-    if (refreshAt <= now) {
-      // Token is already close to expiring or expired, refresh now
-      refreshToken()
-      return
-    }
-
-    // Schedule refresh
-    const delay = refreshAt - now
-    _refreshTimerId = window.setTimeout(() => {
-      refreshToken()
-    }, delay)
-  }
-
-  /**
-   * Stop automatic token refresh.
-   */
-  function stopTokenRefresh(): void {
-    if (_refreshTimerId !== null) {
-      window.clearTimeout(_refreshTimerId)
-      _refreshTimerId = null
-    }
-  }
-
-  /**
-   * Check if token needs refresh and refresh if necessary.
-   * Called periodically as a safety net.
-   */
-  function checkAndRefreshIfNeeded(): void {
-    if (!authStore.token || !authStore.tokenExpires) {
-      return
-    }
-
-    const expiresAt = authStore.tokenExpires.getTime()
-    const refreshAt = expiresAt - TOKEN_REFRESH_MARGIN_MS
-    const now = Date.now()
-
-    if (now >= refreshAt) {
-      refreshToken()
-    }
-  }
-
-  async function initializeAuth(): Promise<void> {
-    authStore.initialize()
-    await fetchAuthConfig()
-
-    if (authStore.token) {
-      const valid = await verifyToken()
-      if (valid) {
-        await getCurrentUser()
-        // Start auto-refresh for existing session
-        scheduleTokenRefresh()
-      }
-    }
-  }
-
-  function logout(): void {
-    stopTokenRefresh()
-    authStore.logout()
-  }
-
-  function getAuthHeader(): Record<string, string> {
-    if (authStore.token) {
-      return { Authorization: `Bearer ${authStore.token}` }
-    }
-    return {}
-  }
-
-  async function updateProfile(data: {
-    email?: string
-    shortname?: string
-    currentPassword?: string
-    newPassword?: string
-  }): Promise<{ success: boolean; error?: string }> {
-    if (!authStore.token) {
-      return { success: false, error: 'Not authenticated' }
-    }
-
-    try {
-      const requestData: UpdateProfileRequest = {}
-      if (data.email !== undefined) requestData.email = data.email
-      if (data.shortname !== undefined) requestData.shortname = data.shortname
-      if (data.currentPassword) requestData.current_password = data.currentPassword
-      if (data.newPassword) requestData.new_password = data.newPassword
-
-      const response = await axios.put<UserResponse>(
-        `${getApiBaseUrl()}/users/me`,
-        requestData,
-        { headers: getAuthHeader() }
-      )
-
-      if (response.data.access_token && response.data.expires_in) {
-        authStore.setToken(response.data.access_token, response.data.expires_in)
-        scheduleTokenRefresh()
-      }
-
-      const userInfo: UserInfo = {
-        id: response.data.id,
-        username: response.data.username,
-        shortname: response.data.shortname,
-        email: response.data.email,
-        role: response.data.role,
-        roleObj: response.data.role_obj ?? null,
-        isActive: response.data.is_active,
-      }
-      authStore.setUserInfo(userInfo)
-
-      return { success: true }
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        return { success: false, error: error.response.data.detail || 'Update failed' }
-      }
-      return { success: false, error: 'Network error. Please try again.' }
-    }
-  }
-
-  // Set up periodic check as safety net (only inside component setup)
-  let checkInterval: number | null = null
-
-  if (getCurrentInstance()) {
-    onMounted(() => {
-      _mountedConsumerCount += 1
-      checkInterval = window.setInterval(checkAndRefreshIfNeeded, TOKEN_REFRESH_CHECK_INTERVAL_MS)
-    })
-
-    onUnmounted(() => {
-      if (checkInterval !== null) {
-        window.clearInterval(checkInterval)
-        checkInterval = null
-      }
-
-      _mountedConsumerCount = Math.max(0, _mountedConsumerCount - 1)
-      if (_mountedConsumerCount === 0) {
-        stopTokenRefresh()
-      }
-    })
-
-    // Watch for token changes to reschedule refresh
-    watch(
-      () => authStore.tokenExpires,
-      (newExpires) => {
-        if (newExpires) {
-          scheduleTokenRefresh()
-        } else {
-          stopTokenRefresh()
-        }
-      }
-    )
-  }
-
-  return {
-    // Core auth methods
-    login,
-    logout,
-    register,
-    verifyToken,
-    fetchAuthConfig,
-    initializeAuth,
-    getCurrentUser,
-    getAuthHeader,
-    updateProfile,
-
-    // Token refresh
-    refreshToken,
-    isRefreshing,
-  }
-}

package/src/composables/usePasskey.ts

@@ -1,216 +0,0 @@
-import axios from 'axios'
-import { useAuthStore } from '../stores/auth'
-import { useSettingsStore } from '../stores/settings'
-import type { CredentialInfo } from '../types'
-
-// Lazy-load @simplewebauthn/browser so plugins that never call usePasskey
-// don't need the optional peer dep installed (avoids build failures).
-async function loadWebAuthn() {
-  try {
-    return await import('@simplewebauthn/browser')
-  } catch {
-    throw new Error(
-      '@simplewebauthn/browser is required for passkey support. Install it: bun add @simplewebauthn/browser',
-    )
-  }
-}
-
-interface PasskeyLoginResponse {
-  access_token: string
-  token_type: string
-  expires_in: number
-}
-
-/** Registers and authenticates passkeys using WebAuthn, lazily loading the browser dependency. */
-export function usePasskey() {
-  const authStore = useAuthStore()
-  const settingsStore = useSettingsStore()
-
-  function getApiBaseUrl(): string {
-    return settingsStore.getApiBaseUrl()
-  }
-
-  async function isSupported(): Promise<boolean> {
-    try {
-      const { browserSupportsWebAuthn } = await loadWebAuthn()
-      return browserSupportsWebAuthn()
-    } catch {
-      return false
-    }
-  }
-
-  async function registerPasskey(deviceName?: string): Promise<boolean> {
-    const webauthn = await loadWebAuthn()
-    if (!webauthn.browserSupportsWebAuthn()) {
-      authStore.setError('WebAuthn is not supported in this browser')
-      return false
-    }
-
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      const optionsResponse = await axios.get<{ options: string }>(
-        `${getApiBaseUrl()}/auth/passkey/register/options`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-          withCredentials: true,
-        }
-      )
-
-      const options = JSON.parse(optionsResponse.data.options)
-
-      const credential = await webauthn.startRegistration({ optionsJSON: options })
-
-      await axios.post(
-        `${getApiBaseUrl()}/auth/passkey/register/verify`,
-        {
-          credential: JSON.stringify(credential),
-          device_name: deviceName,
-        },
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-          withCredentials: true,
-        }
-      )
-
-      authStore.setAuthConfig({
-        ...authStore.authConfig,
-        passkeyRegistered: true,
-      })
-
-      return true
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        authStore.setError(error.response.data.detail || 'Passkey registration failed')
-      } else if (error instanceof Error) {
-        if (error.name === 'NotAllowedError') {
-          authStore.setError('Registration was cancelled or timed out')
-        } else if (error.name === 'InvalidStateError') {
-          authStore.setError('This authenticator is already registered')
-        } else {
-          authStore.setError(error.message)
-        }
-      } else {
-        authStore.setError('Passkey registration failed')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function loginWithPasskey(): Promise<boolean> {
-    const webauthn = await loadWebAuthn()
-    if (!webauthn.browserSupportsWebAuthn()) {
-      authStore.setError('WebAuthn is not supported in this browser')
-      return false
-    }
-
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      const optionsResponse = await axios.get<{ options: string }>(
-        `${getApiBaseUrl()}/auth/passkey/login/options`,
-        { withCredentials: true }
-      )
-
-      const options = JSON.parse(optionsResponse.data.options)
-
-      const credential = await webauthn.startAuthentication({ optionsJSON: options })
-
-      const response = await axios.post<PasskeyLoginResponse>(
-        `${getApiBaseUrl()}/auth/passkey/login/verify`,
-        { credential: JSON.stringify(credential) },
-        { withCredentials: true }
-      )
-
-      authStore.setToken(response.data.access_token, response.data.expires_in)
-
-      return true
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        if (error.response.status === 404) {
-          authStore.setError('No passkeys registered. Please login with password first.')
-        } else {
-          authStore.setError(error.response.data.detail || 'Passkey login failed')
-        }
-      } else if (error instanceof Error) {
-        if (error.name === 'NotAllowedError') {
-          authStore.setError('Authentication was cancelled or timed out')
-        } else {
-          authStore.setError(error.message)
-        }
-      } else {
-        authStore.setError('Passkey login failed')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function listCredentials(): Promise<CredentialInfo[]> {
-    try {
-      const response = await axios.get<{ credentials: CredentialInfo[] }>(
-        `${getApiBaseUrl()}/auth/passkey/credentials`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-        }
-      )
-      return response.data.credentials
-    } catch {
-      return []
-    }
-  }
-
-  async function deleteCredential(credentialId: string): Promise<boolean> {
-    try {
-      await axios.delete(
-        `${getApiBaseUrl()}/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-        }
-      )
-
-      const remaining = await listCredentials()
-      if (remaining.length === 0) {
-        authStore.setAuthConfig({
-          ...authStore.authConfig,
-          passkeyRegistered: false,
-        })
-      }
-
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  async function deleteAllCredentials(): Promise<boolean> {
-    try {
-      await axios.delete(`${getApiBaseUrl()}/auth/passkey/credentials`, {
-        headers: { Authorization: `Bearer ${authStore.token}` },
-      })
-
-      authStore.setAuthConfig({
-        ...authStore.authConfig,
-        passkeyRegistered: false,
-      })
-
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  return {
-    isSupported,
-    registerPasskey,
-    loginWithPasskey,
-    listCredentials,
-    deleteCredential,
-    deleteAllCredentials,
-  }
-}