@payez/next-mvp 4.8.1 → 4.8.3

package/src/hooks/useProfile.ts

@@ -1,82 +1,82 @@
-'use client';
-
-/**
- * ⚠️ WARNING: This hook cannot be used directly from the @payez/next-mvp package!
- *
- * @deprecated Import this hook from your local app instead
- *
- * **Why?** This hook depends on useAuth, which requires SessionProvider context that cannot cross package boundaries.
- *
- * **Solution:** Create a local version in your app (e.g., src/hooks/useProfile.ts):
- *
- * @example
- * ```typescript
- * // src/hooks/useProfile.ts (YOUR APP)
- * 'use client';
- * import { useQuery } from '@tanstack/react-query';
- * import { useAuth } from './useAuth'; // Your local useAuth
- * import { isApiSuccess } from '@payez/next-mvp/lib/standardized-client-api';
- *
- * export function useProfile() {
- *   const { isAuthenticated, apiCall } = useAuth();
- *   return useQuery({
- *     queryKey: ['account', 'profile'],
- *     enabled: isAuthenticated,
- *     queryFn: async () => {
- *       const result = await apiCall('/api/account/profile', 'GET');
- *       if (isApiSuccess(result)) return result.data;
- *       throw new Error(result.message);
- *     }
- *   });
- * }
- * ```
- *
- * @see {@link https://github.com/payez/next-mvp/blob/main/docs/centralized-auth-api-pattern.md#usage-patterns Complete documentation}
- */
-
-import { useQuery } from '@tanstack/react-query';
-import { useAuth } from './useAuth';
-import { isApiSuccess, isApiError } from '../lib/standardized-client-api';
-
-export type ProfileResponse = {
-  email: string;
-  user_id?: string;
-  first_name?: string;
-  last_name?: string;
-  full_name?: string;
-  phone_number?: string;
-  email_confirmed?: boolean;
-  phone_confirmed?: boolean;
-  two_factor_enabled?: boolean;
-  roles?: string[];
-  // REMOVED: `contact_information?: Record<string, any>` - the ADMIN DTO's field
-  // name (AdminUserProfileResponse), never emitted by /api/account/profile. This
-  // permissive declaration is WHY the wrong mapper type-checked for so long: the
-  // correct `contact_info` and `address` shapes were already declared right here,
-  // and this `Record<string, any>` sat beside them as an off switch, accepting
-  // `contact_information.addressLine1` on a path that could never carry data.
-  // Found by BAPert (41365) as the residual of my own half-sweep - I deleted the
-  // twin of this line from EnhancedProfilePage and left this one standing.
-  [key: string]: any;
-};
-
-export function useProfile() {
-  const { isAuthenticated, apiCall } = useAuth();
-
-  return useQuery<ProfileResponse, Error>({
-    queryKey: ['account', 'profile'],
-    enabled: isAuthenticated,
-    queryFn: async () => {
-      const result = await apiCall<ProfileResponse>('/api/account/profile', 'GET');
-      if (isApiSuccess(result)) {
-        return result.data;
-      }
-      // If API returned standardized error
-      if (isApiError(result)) {
-        throw new Error(result.message || 'Failed to load profile');
-      }
-      throw new Error('Failed to load profile');
-    },
-    staleTime: 5 * 60 * 1000,
-  });
-}
+'use client';
+
+/**
+ * ⚠️ WARNING: This hook cannot be used directly from the @payez/next-mvp package!
+ *
+ * @deprecated Import this hook from your local app instead
+ *
+ * **Why?** This hook depends on useAuth, which requires SessionProvider context that cannot cross package boundaries.
+ *
+ * **Solution:** Create a local version in your app (e.g., src/hooks/useProfile.ts):
+ *
+ * @example
+ * ```typescript
+ * // src/hooks/useProfile.ts (YOUR APP)
+ * 'use client';
+ * import { useQuery } from '@tanstack/react-query';
+ * import { useAuth } from './useAuth'; // Your local useAuth
+ * import { isApiSuccess } from '@payez/next-mvp/lib/standardized-client-api';
+ *
+ * export function useProfile() {
+ *   const { isAuthenticated, apiCall } = useAuth();
+ *   return useQuery({
+ *     queryKey: ['account', 'profile'],
+ *     enabled: isAuthenticated,
+ *     queryFn: async () => {
+ *       const result = await apiCall('/api/account/profile', 'GET');
+ *       if (isApiSuccess(result)) return result.data;
+ *       throw new Error(result.message);
+ *     }
+ *   });
+ * }
+ * ```
+ *
+ * @see {@link https://github.com/payez/next-mvp/blob/main/docs/centralized-auth-api-pattern.md#usage-patterns Complete documentation}
+ */
+
+import { useQuery } from '@tanstack/react-query';
+import { useAuth } from './useAuth';
+import { isApiSuccess, isApiError } from '../lib/standardized-client-api';
+
+export type ProfileResponse = {
+  email: string;
+  user_id?: string;
+  first_name?: string;
+  last_name?: string;
+  full_name?: string;
+  phone_number?: string;
+  email_confirmed?: boolean;
+  phone_confirmed?: boolean;
+  two_factor_enabled?: boolean;
+  roles?: string[];
+  // REMOVED: `contact_information?: Record<string, any>` - the ADMIN DTO's field
+  // name (AdminUserProfileResponse), never emitted by /api/account/profile. This
+  // permissive declaration is WHY the wrong mapper type-checked for so long: the
+  // correct `contact_info` and `address` shapes were already declared right here,
+  // and this `Record<string, any>` sat beside them as an off switch, accepting
+  // `contact_information.addressLine1` on a path that could never carry data.
+  // Found by BAPert (41365) as the residual of my own half-sweep - I deleted the
+  // twin of this line from EnhancedProfilePage and left this one standing.
+  [key: string]: any;
+};
+
+export function useProfile() {
+  const { isAuthenticated, apiCall } = useAuth();
+
+  return useQuery<ProfileResponse, Error>({
+    queryKey: ['account', 'profile'],
+    enabled: isAuthenticated,
+    queryFn: async () => {
+      const result = await apiCall<ProfileResponse>('/api/account/profile', 'GET');
+      if (isApiSuccess(result)) {
+        return result.data;
+      }
+      // If API returned standardized error
+      if (isApiError(result)) {
+        throw new Error(result.message || 'Failed to load profile');
+      }
+      throw new Error('Failed to load profile');
+    },
+    staleTime: 5 * 60 * 1000,
+  });
+}

package/src/hooks/usePublicAuthSettings.ts

@@ -1,171 +1,171 @@
-/**
- * usePublicAuthSettings Hook
- *
- * Fetches public auth settings for pre-login pages (signup, login).
- * Does NOT require authentication - settings are fetched via API.
- */
-
-'use client';
-
-import { useState, useEffect } from 'react';
-import type { FederatedProvider } from '../types/auth';
-
-export interface PublicAuthSettings {
-    enabledProviders: FederatedProvider[];
-    allowFederatedLogin: boolean;
-    require2FA: boolean;
-    allowed2FAMethods: string[];
-    // OPTIONAL: present only when the IDP states them, never invented.
-    // 257255 removed these on the basis that "the config document does not
-    // carry them"; the 240447 loader fix has since made the document carry
-    // them, so routes/auth/settings.ts reads and returns them again. They stay
-    // OPTIONAL because an older IDP build may omit them, and `?? true` would
-    // re-create the exact permission claim this card exists to kill.
-    // (The @example below already assumed this field - it referenced
-    // settings?.allowPublicRegistration while the type had removed it.)
-    allowPublicRegistration?: boolean;
-    enablePasswordReset?: boolean;
-}
-
-export interface UsePublicAuthSettingsResult {
-    settings: PublicAuthSettings | null;
-    isLoading: boolean;
-    error: Error | null;
-}
-
-// Map provider strings to FederatedProvider type
-const PROVIDER_MAP: Record<string, FederatedProvider> = {
-    'google': 'google',
-    'apple': 'apple',
-    'facebook': 'facebook',
-    'github': 'github',
-    'microsoft': 'microsoft',
-    'azure-ad': 'microsoft',
-};
-
-// 257255 / BAPert ruling v32(a): DEFAULT_SETTINGS DELETED.
-//
-// It was substituted on BOTH failure branches below, so a page kept rendering
-// require2FA=true with methods ['email','sms'] whenever the fetch failed - a
-// FABRICATED AUTHORIZATION POLICY, client-side. Hard-failing the endpoint alone
-// does not fix that: it just moves the lie from the server to the browser.
-//
-// QAPert's measurement makes this a proof rather than a preference: the SAME
-// client is require_2fa=TRUE on AKS and FALSE on dev-93, so any hardcoded
-// fallback is wrong in at least one environment BY CONSTRUCTION.
-//
-// On failure `settings` stays NULL and `error` is set. Callers must render an
-// honest "we could not load sign-in options" state and OFFER NOTHING.
-
-/**
- * Hook to fetch public auth settings for login/signup pages.
- *
- * @example
- * ```tsx
- * function SignupPage() {
- *   const { settings, isLoading } = usePublicAuthSettings();
- *
- *   if (isLoading) return <Spinner />;
- *
- *   return (
- *     <>
- *       {settings?.allowFederatedLogin && (
- *         <FederatedAuthSection providers={settings.enabledProviders} />
- *       )}
- *       {settings?.allowPublicRegistration && (
- *         <EmailSignupForm />
- *       )}
- *     </>
- *   );
- * }
- * ```
- */
-export function usePublicAuthSettings(): UsePublicAuthSettingsResult {
-    const [settings, setSettings] = useState<PublicAuthSettings | null>(null);
-    const [isLoading, setIsLoading] = useState(true);
-    const [error, setError] = useState<Error | null>(null);
-
-    useEffect(() => {
-        let mounted = true;
-
-        async function fetchSettings() {
-            try {
-                const response = await fetch('/api/auth/settings');
-
-                if (!mounted) return;
-
-                if (!response.ok) {
-                    throw new Error(`Failed to fetch auth settings: ${response.status}`);
-                }
-
-                const data = await response.json();
-
-                if (data.success && data.data) {
-                    // Map provider strings to FederatedProvider type
-                    const providers = (data.data.enabledProviders || [])
-                        .map((p: string) => PROVIDER_MAP[p.toLowerCase()])
-                        .filter((p: FederatedProvider | undefined): p is FederatedProvider => p !== undefined);
-
-                    setSettings({
-                        ...data.data,
-                        enabledProviders: providers,
-                    });
-                } else {
-                    // The endpoint told us it could not read a policy (503 +
-                    // success:false + code). Do NOT invent one - surface it.
-                    const code = data?.error?.code ?? 'POLICY_UNAVAILABLE';
-                    setSettings(null);
-                    setError(new Error(`[auth-settings] ${code}: sign-in options unavailable`));
-                    return;
-                }
-
-                setError(null);
-            } catch (err) {
-                if (!mounted) return;
-                console.warn('[usePublicAuthSettings] Failed to fetch settings:', err);
-                setError(err instanceof Error ? err : new Error(String(err)));
-                setSettings(null);   // 257255: never fabricate a policy
-            } finally {
-                if (mounted) {
-                    setIsLoading(false);
-                }
-            }
-        }
-
-        fetchSettings();
-
-        return () => {
-            mounted = false;
-        };
-    }, []);
-
-    return { settings, isLoading, error };
-}
-
-/**
- * Hook to check if federated (OAuth) login is enabled.
- */
-export function useFederatedLoginEnabled(): boolean {
-    const { settings } = usePublicAuthSettings();
-    return settings?.allowFederatedLogin ?? false;
-}
-
-/**
- * Hook to check if public registration is enabled.
- */
-export function usePublicRegistrationEnabled(): boolean {
-    // 257255: was `?? true`, which OFFERED a sign-up lane the IDP may forbid -
-    // card 240447 measured exactly that on portal. The field is no longer served
-    // (it was never read from config), so this is now always fail-closed until
-    // the config document carries it.
-    return false;
-}
-
-/**
- * Hook to check if password reset is enabled.
- */
-export function usePasswordResetEnabled(): boolean {
-    // 257255: was `?? true` and was never read from config. Fail-closed until
-    // the config document carries it.
-    return false;
-}
+/**
+ * usePublicAuthSettings Hook
+ *
+ * Fetches public auth settings for pre-login pages (signup, login).
+ * Does NOT require authentication - settings are fetched via API.
+ */
+
+'use client';
+
+import { useState, useEffect } from 'react';
+import type { FederatedProvider } from '../types/auth';
+
+export interface PublicAuthSettings {
+    enabledProviders: FederatedProvider[];
+    allowFederatedLogin: boolean;
+    require2FA: boolean;
+    allowed2FAMethods: string[];
+    // OPTIONAL: present only when the IDP states them, never invented.
+    // 257255 removed these on the basis that "the config document does not
+    // carry them"; the 240447 loader fix has since made the document carry
+    // them, so routes/auth/settings.ts reads and returns them again. They stay
+    // OPTIONAL because an older IDP build may omit them, and `?? true` would
+    // re-create the exact permission claim this card exists to kill.
+    // (The @example below already assumed this field - it referenced
+    // settings?.allowPublicRegistration while the type had removed it.)
+    allowPublicRegistration?: boolean;
+    enablePasswordReset?: boolean;
+}
+
+export interface UsePublicAuthSettingsResult {
+    settings: PublicAuthSettings | null;
+    isLoading: boolean;
+    error: Error | null;
+}
+
+// Map provider strings to FederatedProvider type
+const PROVIDER_MAP: Record<string, FederatedProvider> = {
+    'google': 'google',
+    'apple': 'apple',
+    'facebook': 'facebook',
+    'github': 'github',
+    'microsoft': 'microsoft',
+    'azure-ad': 'microsoft',
+};
+
+// 257255 / BAPert ruling v32(a): DEFAULT_SETTINGS DELETED.
+//
+// It was substituted on BOTH failure branches below, so a page kept rendering
+// require2FA=true with methods ['email','sms'] whenever the fetch failed - a
+// FABRICATED AUTHORIZATION POLICY, client-side. Hard-failing the endpoint alone
+// does not fix that: it just moves the lie from the server to the browser.
+//
+// QAPert's measurement makes this a proof rather than a preference: the SAME
+// client is require_2fa=TRUE on AKS and FALSE on dev-93, so any hardcoded
+// fallback is wrong in at least one environment BY CONSTRUCTION.
+//
+// On failure `settings` stays NULL and `error` is set. Callers must render an
+// honest "we could not load sign-in options" state and OFFER NOTHING.
+
+/**
+ * Hook to fetch public auth settings for login/signup pages.
+ *
+ * @example
+ * ```tsx
+ * function SignupPage() {
+ *   const { settings, isLoading } = usePublicAuthSettings();
+ *
+ *   if (isLoading) return <Spinner />;
+ *
+ *   return (
+ *     <>
+ *       {settings?.allowFederatedLogin && (
+ *         <FederatedAuthSection providers={settings.enabledProviders} />
+ *       )}
+ *       {settings?.allowPublicRegistration && (
+ *         <EmailSignupForm />
+ *       )}
+ *     </>
+ *   );
+ * }
+ * ```
+ */
+export function usePublicAuthSettings(): UsePublicAuthSettingsResult {
+    const [settings, setSettings] = useState<PublicAuthSettings | null>(null);
+    const [isLoading, setIsLoading] = useState(true);
+    const [error, setError] = useState<Error | null>(null);
+
+    useEffect(() => {
+        let mounted = true;
+
+        async function fetchSettings() {
+            try {
+                const response = await fetch('/api/auth/settings');
+
+                if (!mounted) return;
+
+                if (!response.ok) {
+                    throw new Error(`Failed to fetch auth settings: ${response.status}`);
+                }
+
+                const data = await response.json();
+
+                if (data.success && data.data) {
+                    // Map provider strings to FederatedProvider type
+                    const providers = (data.data.enabledProviders || [])
+                        .map((p: string) => PROVIDER_MAP[p.toLowerCase()])
+                        .filter((p: FederatedProvider | undefined): p is FederatedProvider => p !== undefined);
+
+                    setSettings({
+                        ...data.data,
+                        enabledProviders: providers,
+                    });
+                } else {
+                    // The endpoint told us it could not read a policy (503 +
+                    // success:false + code). Do NOT invent one - surface it.
+                    const code = data?.error?.code ?? 'POLICY_UNAVAILABLE';
+                    setSettings(null);
+                    setError(new Error(`[auth-settings] ${code}: sign-in options unavailable`));
+                    return;
+                }
+
+                setError(null);
+            } catch (err) {
+                if (!mounted) return;
+                console.warn('[usePublicAuthSettings] Failed to fetch settings:', err);
+                setError(err instanceof Error ? err : new Error(String(err)));
+                setSettings(null);   // 257255: never fabricate a policy
+            } finally {
+                if (mounted) {
+                    setIsLoading(false);
+                }
+            }
+        }
+
+        fetchSettings();
+
+        return () => {
+            mounted = false;
+        };
+    }, []);
+
+    return { settings, isLoading, error };
+}
+
+/**
+ * Hook to check if federated (OAuth) login is enabled.
+ */
+export function useFederatedLoginEnabled(): boolean {
+    const { settings } = usePublicAuthSettings();
+    return settings?.allowFederatedLogin ?? false;
+}
+
+/**
+ * Hook to check if public registration is enabled.
+ */
+export function usePublicRegistrationEnabled(): boolean {
+    // 257255: was `?? true`, which OFFERED a sign-up lane the IDP may forbid -
+    // card 240447 measured exactly that on portal. The field is no longer served
+    // (it was never read from config), so this is now always fail-closed until
+    // the config document carries it.
+    return false;
+}
+
+/**
+ * Hook to check if password reset is enabled.
+ */
+export function usePasswordResetEnabled(): boolean {
+    // 257255: was `?? true` and was never read from config. Fail-closed until
+    // the config document carries it.
+    return false;
+}