@omega.js/web 0.1.0

package/core/js/libs/auth/oauth.js

@@ -0,0 +1,394 @@
+// OAuth provider flows: redirect-first sign-in (popup only for iframes and
+// the ?authPopup=true override), the
+// returning-redirect result provider, and the accidental-signup reversal
+// (Google auto-creates accounts during signin attempts).
+
+// Libraries
+import omega from '@omega.js/client';
+import { extractBlockingFunctionMessage, isUserError } from '__main_assets__/js/libs/auth/errors.js';
+import { markOrphanedAccount } from '__main_assets__/js/libs/auth/orphan.js';
+import { trackLogin, trackSignup } from '__main_assets__/js/libs/auth/tracking.js';
+import { createLogger } from '__main_assets__/js/libs/logger.js';
+
+const logger = createLogger('auth:oauth');
+
+// The one-shot marker that says "this tab left for an OAuth redirect". Written
+// before signInWithRedirect, read on the way back: a return with no redirect
+// result means the credential never made it home, which is loud, not silent.
+const REDIRECT_PENDING_KEY = 'omega:authRedirectPending';
+
+/**
+ * Popup or redirect? Redirect is the default (it survives strict popup
+ * blockers and mobile webviews), with two cases that MUST use the popup:
+ *
+ *   - `?authPopup=true` — the manual override
+ *   - inside an iframe — a top-level redirect is not ours to make
+ *
+ * Development is NOT one of them any more (#156). It used to be: the Firebase
+ * emulator's OAuth handler hands the credential back through sessionStorage on
+ * the origin it is served from, and on the emulator's own port that origin is a
+ * third party to the site, so browser storage partitioning gave the SDK's
+ * helper iframe an empty partition and getRedirectResult() resolved null
+ * forever. `omega dev` now proxies the emulator under the SITE origin — the
+ * same same-origin trick production gets from the self-hosted /__/auth/*
+ * helpers — so the redirect leg comes home in dev too, and dev runs the flow
+ * users actually run.
+ */
+export function shouldUseAuthPopup() {
+  return new URL(window.location.href).searchParams.get('authPopup') === 'true'
+    || window !== window.top;
+}
+
+// Storage denial (privacy modes, blocked third-party contexts) is an expected
+// external condition, not our bug: the marker degrades to "no redirect was
+// pending", which is exactly the pre-marker behavior.
+function markPendingRedirect() {
+  try {
+    window.sessionStorage.setItem(REDIRECT_PENDING_KEY, String(Date.now()));
+  } catch (e) {
+    logger.warn('Could not mark the pending redirect:', e.message);
+  }
+}
+
+function takePendingRedirect() {
+  try {
+    const pending = window.sessionStorage.getItem(REDIRECT_PENDING_KEY) !== null;
+    window.sessionStorage.removeItem(REDIRECT_PENDING_KEY);
+
+    return pending;
+  } catch (e) {
+    return false;
+  }
+}
+
+/**
+ * Google's signInWithPopup/Redirect auto-creates accounts. If a user lands on
+ * /signin with a Google account that doesn't exist yet, Firebase creates one
+ * before we can stop it. This reverses that: delete the auth user, sign out,
+ * surface an inline error.
+ */
+export async function reverseAccidentalSignup(ctx, newUser) {
+  logger.warn('Reversing accidental signup from /signin (new Google account created with no consent on record)');
+
+  // SYNCHRONOUSLY flag the reversal so the auth-state-change listener in
+  // core/auth.js short-circuits its policy-based redirect for this user.
+  // Without this, Firebase's redirect-result-success path triggers an auth
+  // state change with user=<the-about-to-be-deleted-account> BEFORE we
+  // finish .delete() + signOut(), and the listener redirects to /account
+  // (or authReturnUrl) before the user ever sees the inline error.
+  // Cleared in the finally block after signOut() has fired the followup
+  // auth-state-change with user=null.
+  window.__OMEGA_REVERSING_SIGNUP = true;
+
+  try {
+    await newUser.delete();
+  } catch (e) {
+    // Best-effort. A delete that fails (network/token issue) leaves a live account
+    // with no consent on record, and nothing about the account says so later — so
+    // the uid is marked HERE, in the only place that knows: libs/auth/orphan.js
+    // retries the delete at auth-ready on a later visit, and signs the user out if
+    // that fails too ([#703](https://github.com/Omega-JS-Stack/omega/issues/703)).
+    logger.error('Failed to delete accidental account:', e);
+    markOrphanedAccount(newUser.uid);
+    omega.sentry().captureException(new Error('Failed to reverse accidental signup', { cause: e }));
+  }
+
+  try {
+    const { getAuth, signOut } = await import('@firebase/auth');
+    await signOut(getAuth());
+  } catch (e) {
+    logger.error('Failed to sign out after accidental signup:', e);
+  }
+
+  // Strip authReturnUrl so the next attempt doesn't redirect them away from /signin
+  const url = new URL(window.location.href);
+  if (url.searchParams.has('authReturnUrl')) {
+    url.searchParams.delete('authReturnUrl');
+    window.history.replaceState({}, document.title, url.toString());
+  }
+
+  if (ctx.formManager) {
+    ctx.formManager.showError(`This account doesn't exist. Try signing up first or use a different account.`);
+    ctx.formManager.ready();
+  }
+
+  // Clear the flag now that signOut() has fired its auth-state-change
+  // with user=null. Future state changes (e.g. user re-clicks Continue
+  // with Google after seeing the error) get normal listener processing.
+  window.__OMEGA_REVERSING_SIGNUP = false;
+}
+
+/**
+ * Process a returning OAuth redirect (or, in development only, the palette's
+ * simulation of one). Returns true when a redirect result was handled — the
+ * caller leaves the form disabled because navigation is imminent.
+ */
+export async function handleRedirectResult(ctx) {
+  const url = new URL(window.location.href);
+
+  // Read the marker first: this page load either follows a redirect we started
+  // or it doesn't, and every path below consumes the answer exactly once.
+  const hadPendingRedirect = takePendingRedirect();
+
+  // Resolve the redirect result — either from Firebase or a dev simulation
+  let result, additionalUserInfo;
+  let simulateRedirect = null;
+
+  /* @dev-only:start */
+  // The dev palette's OAuth-redirect simulation (#342). The read AND the fake
+  // result live inside the block, so a production build carries neither — it
+  // used to carry both, which let a visitor drive the post-redirect path on the
+  // live site. Stays null in production, so every branch below is dead there.
+  if (omega.isDevelopment()) {
+    simulateRedirect = url.searchParams.get('_dev_simulateRedirect');
+  }
+
+  if (simulateRedirect) {
+    logger.log('Simulating OAuth redirect result:', simulateRedirect);
+    await new Promise(resolve => setTimeout(resolve, 2000));
+
+    if (simulateRedirect !== 'error') {
+      result = {
+        user: { uid: 'dev-sim-uid', email: 'dev@test.local', providerData: [{ providerId: 'google.com' }] },
+        providerId: 'google.com',
+      };
+      additionalUserInfo = { isNewUser: simulateRedirect === 'signup' };
+    }
+  }
+  /* @dev-only:end */
+
+  try {
+    // INSIDE the try: getRedirectResult is the call that rejects when the
+    // server refused the signup (a blocking-function rate limit comes back as
+    // a 503 / `auth/error-code:-47`). Resolved outside, that rejection escaped
+    // past the caller's un-caught await and the person was left with a form
+    // disabled behind spinners and no message at all (#701).
+    if (!simulateRedirect) {
+      const { getAuth, getRedirectResult, getAdditionalUserInfo } = await import('@firebase/auth');
+      const auth = getAuth();
+      result = await getRedirectResult(auth);
+      if (result?.user) {
+        additionalUserInfo = getAdditionalUserInfo(result);
+      }
+    }
+
+    /* @dev-only:start */
+    if (simulateRedirect === 'error') {
+      const fakeError = new Error('Simulated: An account already exists with different credentials');
+      fakeError.code = 'auth/account-exists-with-different-credential';
+      throw fakeError;
+    }
+    /* @dev-only:end */
+
+    // Log results for debugging
+    logger.log('Redirect result:', result);
+
+    // If no result, return false to indicate no redirect was processed.
+    // A tab that LEFT for an OAuth redirect must come back with a credential:
+    // nothing means the provider handler never handed the event back, and the
+    // page must say so instead of quietly presenting an empty form again.
+    if (!result || !result.user) {
+      if (hadPendingRedirect) {
+        logger.error('Returned from an OAuth redirect with no result');
+        omega.sentry().captureException(new Error('OAuth redirect returned no result'));
+        ctx.formManager.showError('Sign-in did not complete. Please try again.');
+      }
+
+      return false;
+    }
+
+    logger.log('Successfully authenticated via redirect:', result.user.email);
+
+    // Determine the provider from the result
+    const providerId = result.providerId || result.user.providerData?.[0]?.providerId || 'unknown';
+
+    const isNewUser = additionalUserInfo?.isNewUser;
+    const pagePath = document.documentElement.getAttribute('data-page-path');
+    const isSignupPage = pagePath === '/signup';
+    logger.warn('redirect additionalUserInfo:', additionalUserInfo, 'isNewUser:', isNewUser, 'pagePath:', pagePath, 'isSignupPage:', isSignupPage, 'operationType:', result.operationType);
+
+    // Google quirk: if a new account was auto-created during a signin attempt
+    // (user came back from OAuth via the redirect path on /signin, not /signup),
+    // reverse it — they have no consent on record.
+    if (isNewUser && !isSignupPage) {
+      await reverseAccidentalSignup(ctx, result.user);
+      return true;
+    }
+
+    if (isNewUser || isSignupPage) {
+      trackSignup(providerId, result.user);
+      ctx.formManager.showSuccess('Account created successfully!');
+    } else {
+      trackLogin(providerId, result.user);
+      ctx.formManager.showSuccess('Successfully signed in!');
+    }
+
+    /* @dev-only:start */
+    // In simulation mode, handle the redirect ourselves since the auth
+    // state listener won't fire (no real Firebase login happened).
+    if (simulateRedirect) {
+      const authReturnUrl = url.searchParams.get('authReturnUrl');
+      const redirectTo = authReturnUrl && omega.isValidRedirectUrl(authReturnUrl)
+        ? authReturnUrl
+        : '/dashboard/account';
+      logger.log('Simulated redirect to:', redirectTo);
+      await new Promise(resolve => setTimeout(resolve, 1500));
+      window.location.href = redirectTo;
+    }
+    /* @dev-only:end */
+
+    // Return true to indicate redirect was successfully processed
+    return true;
+  } catch (error) {
+    // Only capture unexpected errors to Sentry
+    if (!isUserError(error.code)) {
+      omega.sentry().captureException(new Error('Error handling redirect result', { cause: error }));
+    }
+
+    // Handle specific OAuth errors. Check blocking-function rejections FIRST —
+    // those carry a custom message from @omega.js/backend (rate limit, disposable
+    // email, etc.) that the user actually needs to see, hidden behind a generic
+    // Firebase code.
+    const blockingMessage = extractBlockingFunctionMessage(error);
+    if (blockingMessage) {
+      ctx.formManager.showError(blockingMessage);
+    } else if (error.code === 'auth/account-exists-with-different-credential') {
+      ctx.formManager.showError('An account already exists with the same email address but different sign-in credentials. Try signing in with a different provider.');
+    } else if (error.code === 'auth/popup-blocked') {
+      ctx.formManager.showError('Popup was blocked. Please allow popups for this site and try again.');
+    } else if (error.code === 'auth/operation-not-allowed') {
+      ctx.formManager.showError('This sign-in method is not enabled.');
+    } else if (error.code && error.code !== 'auth/cancelled-popup-request') {
+      ctx.formManager.showError(`Authentication error: ${error.message}`);
+    }
+
+    // Return false on error so form becomes interactive for user to try again
+    return false;
+  }
+}
+
+/**
+ * Sign in (or up) with an OAuth provider — popup when ctx.useAuthPopup,
+ * redirect otherwise, with popup→redirect fallback on blockers.
+ */
+export async function signInWithProvider(ctx, providerName, action = 'signin') {
+  try {
+    // Import Firebase auth functions and providers
+    const {
+      getAuth,
+      signInWithPopup,
+      signInWithRedirect,
+      getAdditionalUserInfo,
+      GoogleAuthProvider,
+      FacebookAuthProvider,
+      TwitterAuthProvider,
+      GithubAuthProvider,
+    } = await import('@firebase/auth');
+
+    const auth = getAuth();
+
+    let provider;
+
+    // Create provider based on provider name
+    switch (providerName) {
+      case 'google.com':
+        provider = new GoogleAuthProvider();
+        break;
+      case 'facebook.com':
+        provider = new FacebookAuthProvider();
+        break;
+      case 'twitter.com':
+        provider = new TwitterAuthProvider();
+        break;
+      case 'github.com':
+        provider = new GithubAuthProvider();
+        break;
+      default:
+        throw new Error(`Unsupported provider: ${providerName}`);
+    }
+
+    // Use popup if query parameter is set, otherwise use redirect
+    if (ctx.useAuthPopup) {
+      try {
+        // Try popup
+        const result = await signInWithPopup(auth, provider);
+        logger.log('Successfully authenticated via popup:', result.user.email);
+
+        // Track based on whether this is a new user. v9 modular SDK requires
+        // getAdditionalUserInfo(result) — the legacy `result.additionalUserInfo`
+        // direct property does NOT exist on UserCredential in v9+.
+        const additionalUserInfoPopup = getAdditionalUserInfo(result);
+        const isNewUser = additionalUserInfoPopup?.isNewUser;
+        logger.warn('popup additionalUserInfo:', additionalUserInfoPopup, 'isNewUser:', isNewUser, 'action:', action);
+
+        // Google quirk: signInWithPopup auto-creates accounts. If a brand-new visitor
+        // clicks "Sign in with Google" on the SIGNIN page (not signup), reverse the
+        // auto-creation — they have no consent on record and never asked to create one.
+        if (isNewUser && action === 'signin') {
+          await reverseAccidentalSignup(ctx, result.user);
+          return;
+        }
+
+        if (isNewUser || action === 'signup') {
+          trackSignup(providerName, result.user);
+          ctx.formManager.showSuccess('Account created successfully!');
+        } else {
+          trackLogin(providerName, result.user);
+          ctx.formManager.showSuccess('Successfully signed in!');
+        }
+      } catch (popupError) {
+        // Check if popup was blocked or failed
+        if (popupError.code === 'auth/popup-blocked' ||
+            popupError.code === 'auth/popup-closed-by-user' ||
+            popupError.code === 'auth/cancelled-popup-request') {
+
+          logger.log('Popup failed, falling back to redirect:', popupError.code);
+
+          // Fallback to redirect
+          markPendingRedirect();
+          await signInWithRedirect(auth, provider);
+          // Note: This will redirect the user away from the page
+          // The handleRedirectResult function will handle the result when they return
+        } else {
+          // Re-throw other errors
+          throw popupError;
+        }
+      }
+    } else {
+      // Use redirect by default
+      logger.log('Using redirect for authentication');
+      markPendingRedirect();
+      await signInWithRedirect(auth, provider);
+      // Note: This will redirect the user away from the page
+      // The handleRedirectResult function will handle the result when they return
+    }
+  } catch (error) {
+    // A rejected signInWithRedirect never left the page — clear the pending
+    // marker so the next plain load does not report a redirect that was
+    // never in flight
+    takePendingRedirect();
+
+    // Only capture unexpected errors to Sentry
+    if (!isUserError(error.code)) {
+      omega.sentry().captureException(new Error('OAuth provider sign-in error', { cause: error }));
+    }
+
+    // Handle specific errors. Blocking-function rejections from @omega.js/backend
+    // carry a custom message (rate limit, disposable email, etc.) that the user
+    // needs to see — check those FIRST before generic Firebase codes.
+    const blockingMessage = extractBlockingFunctionMessage(error);
+    if (blockingMessage) {
+      throw new Error(blockingMessage);
+    } else if (error.code === 'auth/account-exists-with-different-credential') {
+      throw new Error('An account already exists with the same email address but different sign-in credentials. Try signing in with a different provider.');
+    } else if (error.code === 'auth/invalid-credential') {
+      throw new Error('Invalid credentials. Please try again.');
+    } else if (error.code === 'auth/operation-not-allowed') {
+      throw new Error('This sign-in method is not enabled. Please contact support.');
+    } else if (error.code === 'auth/user-disabled') {
+      throw new Error('This account has been disabled. Please contact support.');
+    }
+
+    throw error;
+  }
+}

package/core/js/libs/auth/orphan.js

@@ -0,0 +1,110 @@
+// The failed-delete backstop for a reversed accidental signup
+// ([#703](https://github.com/Omega-JS-Stack/omega/issues/703)).
+//
+// reverseAccidentalSignup (oauth.js) deletes the account Google auto-created
+// during a signin attempt. When that .delete() FAILS (network/token), the
+// account survives with no consent record — live, and nobody asked for it.
+//
+// Nothing about the account itself says so afterwards: Firestore rules always
+// allow a user's self-read, so an orphan resolves as a normal empty account, and
+// EVERY account is consent-less for the seconds between signup and the
+// /user/signup post writing the consent record (the state the deleted consent
+// guard collapsed into a lockout, #700). The only thing that knows an orphan is
+// an orphan is the browser that failed to delete it — so that is what is
+// recorded here, per uid, and read back at auth-ready on a later visit.
+
+// Libraries
+import omega from '@omega.js/client';
+import { createLogger } from '__main_assets__/js/libs/logger.js';
+
+const logger = createLogger('auth:orphan');
+
+// Under `temporary.` like the signup-metadata marker in core/auth.js: transient
+// state, not a preference. No TTL — the orphan it names lives until a delete
+// lands, and a marker for a uid nobody signs into again is inert. Held through
+// the client's storage module, which wraps every browser access itself, so
+// private mode needs no guard here.
+const ORPHAN_MARKER = 'temporary.orphanedAccount';
+
+/**
+ * Record that this account outlived its reversal.
+ *
+ * @param {string} uid - the auth uid whose delete failed
+ */
+export function markOrphanedAccount(uid) {
+  if (!uid) {
+    return;
+  }
+
+  omega.storage().set(`${ORPHAN_MARKER}.${uid}`, Date.now());
+}
+
+/**
+ * Drop every orphan marker this browser holds.
+ *
+ * Called when a signup captures consent (libs/auth/forms.js), BEFORE the
+ * Firebase call: somebody agreeing to the terms for the account they are about
+ * to sign into is exactly the person the retry below must never delete, and at
+ * that moment there is no uid yet to be precise about. A marker cleared for the
+ * wrong account only costs a cleanup that Sentry already recorded.
+ */
+export function clearOrphanMarkers() {
+  omega.storage().remove(ORPHAN_MARKER);
+}
+
+/**
+ * Retry the reversal for a marked account, at auth-ready on a later visit.
+ *
+ * @param {object} state - the auth state (`user`, `account`) from omega.auth().listen
+ * @returns {Promise<boolean>} true when the user was handled — deleted, or signed
+ *   out because the delete failed again — and the caller is done with them
+ */
+export async function retryOrphanCleanup(state) {
+  const uid = state.user?.uid;
+  const key = uid ? `${ORPHAN_MARKER}.${uid}` : null;
+
+  if (!key || !omega.storage().get(key, null)) {
+    return false;
+  }
+
+  // The one hard invariant: an account with legal consent on record is somebody's
+  // real account, whatever this browser remembers — they signed up for real since
+  // (on another device, say). Drop the stale marker and never touch them again.
+  if (state.account?.consent?.legal?.status === 'granted') {
+    logger.log('Dropping the orphan marker — the account has legal consent on record');
+    omega.storage().remove(key);
+
+    return false;
+  }
+
+  // The listener's user is the client's own projection, which carries no
+  // delete(): only the SDK's currentUser can delete itself, and only while it
+  // still IS the marked account.
+  const { getAuth, signOut } = await import('@firebase/auth');
+  const auth = getAuth();
+
+  if (auth.currentUser?.uid !== uid) {
+    return false;
+  }
+
+  try {
+    await auth.currentUser.delete();
+    omega.storage().remove(key);
+    logger.warn('Deleted an orphaned account on return — the reversal at signin never landed');
+  } catch (e) {
+    // Failed twice. Fall back to what the deleted consent guard did: the orphan
+    // does not stay signed in. The marker HOLDS, so the next visit tries again.
+    logger.error('Failed to delete the orphaned account again — signing out:', e);
+    omega.sentry().captureException(new Error('Failed to delete an orphaned account on return', { cause: e }));
+    await signOut(auth);
+  }
+
+  // Both paths leave the person signed out mid-page with no explanation
+  // otherwise — the same message the old guard showed, for the same reason.
+  omega.utilities().showNotification(
+    `This account hasn't completed setup. Please sign up first.`,
+    { type: 'danger', timeout: 8000 }
+  );
+
+  return true;
+}

package/core/js/libs/auth/password-toggle.js

@@ -0,0 +1,44 @@
+// The password eye — web's own click trigger, registered on @omega.js/client's
+// shared trigger registry (#16) as `omega-password-toggle`.
+//
+// Registered ONCE, from the global module (core/js/main.js), so it is armed on
+// every page before any page module runs. The auth pages and the
+// /test/styleguide page each used to wire this themselves with their own
+// querySelectorAll loop, which meant two copies of the behavior and neither one
+// seeing input groups rendered after boot. Delegation covers both.
+
+// Libraries
+import { registerTrigger } from '@omega.js/client/modules/triggers.js';
+
+export function setupPasswordToggle() {
+  registerTrigger('password-toggle', (event, $button) => {
+    // Find the password input in the same input group
+    const $inputGroup = $button.closest('.input-group');
+    const $passwordInput = $inputGroup?.querySelector('input');
+
+    if (!$passwordInput) {
+      return;
+    }
+
+    // Toggle the input type
+    const currentType = $passwordInput.type;
+    const newType = currentType === 'password' ? 'text' : 'password';
+    $passwordInput.type = newType;
+
+    // Toggle icon visibility
+    const $showIcon = $button.querySelector('.omega-password-show');
+    const $hideIcon = $button.querySelector('.omega-password-hide');
+
+    if (!$showIcon || !$hideIcon) {
+      return;
+    }
+
+    if (newType === 'text') {
+      $showIcon.classList.add('d-none');
+      $hideIcon.classList.remove('d-none');
+    } else {
+      $showIcon.classList.remove('d-none');
+      $hideIcon.classList.add('d-none');
+    }
+  });
+}