@progalaxyelabs/ngx-stonescriptphp-client 1.23.5 → 1.24.0

package/fesm2022/progalaxyelabs-ngx-stonescriptphp-client.mjs

@@ -175,6 +175,10 @@ class StoneScriptPHPAuth {
         else if (raw.id) {
             user.user_id = this.hashUUID(raw.id);
         }
+        // Populate role from raw data if available
+        if (raw.role) {
+            user.role = raw.role;
+        }
         return user;
     }
     hashUUID(uuid) {
@@ -722,7 +726,7 @@ class ProgalaxyElabsAuth {
                 success: true,
                 accessToken: data.access_token,
                 refreshToken: data.refresh_token,
-                user: this.toUser(data.identity),
+                user: this.toUser(data.identity, data.membership?.role),
                 membership: this.toMembership(data.membership),
             };
         }
@@ -971,20 +975,25 @@ class ProgalaxyElabsAuth {
             success: true,
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            user: this.toUser(data.identity),
+            user: this.toUser(data.identity, data.membership?.role),
             membership: this.toMembership(data.membership),
         };
     }
-    toUser(raw) {
+    toUser(raw, role) {
         if (!raw)
             return undefined;
-        return {
+        const user = {
             email: raw.email ?? '',
             phone: raw.phone,
             display_name: raw.display_name ?? raw.email?.split('@')[0] ?? '',
             photo_url: raw.photo_url ?? raw.picture,
             is_email_verified: raw.is_email_verified ?? false
         };
+        // Populate role: prefer explicit param, then raw.role, then raw.membership?.role
+        const resolvedRole = role ?? raw.role ?? raw.membership?.role;
+        if (resolvedRole)
+            user.role = resolvedRole;
+        return user;
     }
     toMembership(raw) {
         return {
@@ -1108,6 +1117,31 @@ class TokenService {
         const token = this.getAccessToken();
         return token !== null && token !== '';
     }
+    /**
+     * Decode the payload of a JWT without verifying the signature.
+     * Returns the parsed claims object, or null if the token is invalid/missing.
+     *
+     * Usage: const claims = tokenService.decodeJwtPayload(token);
+     *        const role = claims?.role;
+     */
+    decodeJwtPayload(token) {
+        const jwt = token ?? this.getAccessToken();
+        if (!jwt)
+            return null;
+        try {
+            const parts = jwt.split('.');
+            if (parts.length !== 3)
+                return null;
+            // Base64url → Base64 → JSON
+            const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+            const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+            const json = atob(padded);
+            return JSON.parse(json);
+        }
+        catch {
+            return null;
+        }
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, providedIn: 'root' });
 }
@@ -1213,10 +1247,28 @@ class AuthService {
             this.tokens.setAccessToken(result.accessToken);
         if (result.refreshToken)
             this.tokens.setRefreshToken(result.refreshToken);
-        if (result.user)
-            this.updateUser(result.user);
+        if (result.user) {
+            // Enrich user with role from JWT claims if not already set
+            const user = result.user.role
+                ? result.user
+                : this.enrichUserWithJwtRole(result.user, result.accessToken);
+            this.updateUser(user);
+        }
         this.signinStatus.setSigninStatus(true);
     }
+    /**
+     * Decode the access token and attach the `role` claim to the user object.
+     * Falls back to role from the membership field in the AuthResult if no JWT role found.
+     */
+    enrichUserWithJwtRole(user, accessToken) {
+        if (accessToken) {
+            const claims = this.tokens.decodeJwtPayload(accessToken);
+            if (claims?.role) {
+                return { ...user, role: claims.role };
+            }
+        }
+        return user;
+    }
     // ── Core auth operations ──────────────────────────────────────────────────
     async loginWithEmail(email, password) {
         const result = await this.plugin.login(email, password);
@@ -1269,14 +1321,22 @@ class AuthService {
     }
     async checkSession(serverName) {
         if (this.tokens.hasValidAccessToken()) {
+            // If we already have a stored user, update their role from the current JWT
+            const storedUser = this.getCurrentUser();
+            if (storedUser && !storedUser.role) {
+                const enriched = this.enrichUserWithJwtRole(storedUser);
+                if (enriched.role)
+                    this.updateUser(enriched);
+            }
             this.signinStatus.setSigninStatus(true);
             return true;
         }
         const result = await this.plugin.checkSession();
         if (result.success && result.accessToken) {
             this.tokens.setAccessToken(result.accessToken);
-            if (result.user)
-                this.updateUser(result.user);
+            if (result.user) {
+                this.updateUser(this.enrichUserWithJwtRole(result.user, result.accessToken));
+            }
             this.signinStatus.setSigninStatus(true);
             return true;
         }