@progalaxyelabs/ngx-stonescriptphp-client 1.23.5 → 1.24.1

package/fesm2022/progalaxyelabs-ngx-stonescriptphp-client.mjs

@@ -175,6 +175,10 @@ class StoneScriptPHPAuth {
         else if (raw.id) {
             user.user_id = this.hashUUID(raw.id);
         }
+        // Populate role from raw data if available
+        if (raw.role) {
+            user.role = raw.role;
+        }
         return user;
     }
     hashUUID(uuid) {
@@ -261,7 +265,7 @@ class StoneScriptPHPAuth {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 credentials: 'include',
-                body: JSON.stringify({ email, password, platform: this.config.platformCode })
+                body: JSON.stringify({ email, password, platform_code: this.config.platformCode })
             });
             const data = await response.json();
             if (this.isAuthSuccess(data)) {
@@ -290,7 +294,7 @@ class StoneScriptPHPAuth {
                     email,
                     password,
                     display_name: displayName,
-                    platform: this.config.platformCode
+                    platform_code: this.config.platformCode
                 })
             });
             const data = await response.json();
@@ -414,7 +418,7 @@ class StoneScriptPHPAuth {
             const left = (window.screen.width - width) / 2;
             const top = (window.screen.height - height) / 2;
             const accountsUrl = this.getAccountsUrl();
-            const oauthUrl = `${accountsUrl}/oauth/${provider}?platform=${this.config.platformCode}&mode=popup`;
+            const oauthUrl = `${accountsUrl}/oauth/${provider}?platform_code=${this.config.platformCode}&mode=popup`;
             const popup = window.open(oauthUrl, `${provider}_login`, `width=${width},height=${height},left=${left},top=${top}`);
             if (!popup) {
                 resolve({ success: false, message: 'Popup blocked. Please allow popups for this site.' });
@@ -633,7 +637,7 @@ class ProgalaxyElabsAuth {
             const response = await fetch(`${this.host}/api/auth/login`, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ email, password, platform: this.config.platformCode })
+                body: JSON.stringify({ email, password, platform_code: this.config.platformCode })
             });
             const data = await response.json();
             if (!response.ok) {
@@ -654,7 +658,7 @@ class ProgalaxyElabsAuth {
                     email,
                     password,
                     display_name: displayName,
-                    platform: this.config.platformCode
+                    platform_code: this.config.platformCode
                 })
             });
             const data = await response.json();
@@ -722,7 +726,7 @@ class ProgalaxyElabsAuth {
                 success: true,
                 accessToken: data.access_token,
                 refreshToken: data.refresh_token,
-                user: this.toUser(data.identity),
+                user: this.toUser(data.identity, data.membership?.role),
                 membership: this.toMembership(data.membership),
             };
         }
@@ -841,7 +845,7 @@ class ProgalaxyElabsAuth {
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
                     verified_token: verifiedToken,
-                    platform: this.config.platformCode
+                    platform_code: this.config.platformCode
                 })
             });
             // 404 means no identity found — caller should show registration form
@@ -866,7 +870,7 @@ class ProgalaxyElabsAuth {
                 body: JSON.stringify({
                     verified_token: verifiedToken,
                     display_name: displayName,
-                    platform: this.config.platformCode
+                    platform_code: this.config.platformCode
                 })
             });
             const data = await response.json();
@@ -885,7 +889,7 @@ class ProgalaxyElabsAuth {
             const width = 500, height = 600;
             const left = (window.screen.width - width) / 2;
             const top = (window.screen.height - height) / 2;
-            const oauthUrl = `${this.host}/oauth/${provider}?platform=${this.config.platformCode}&mode=popup`;
+            const oauthUrl = `${this.host}/oauth/${provider}?platform_code=${this.config.platformCode}&mode=popup`;
             const popup = window.open(oauthUrl, `${provider}_login`, `width=${width},height=${height},left=${left},top=${top}`);
             if (!popup) {
                 resolve({ success: false, message: 'Popup blocked. Please allow popups for this site.' });
@@ -971,20 +975,25 @@ class ProgalaxyElabsAuth {
             success: true,
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            user: this.toUser(data.identity),
+            user: this.toUser(data.identity, data.membership?.role),
             membership: this.toMembership(data.membership),
         };
     }
-    toUser(raw) {
+    toUser(raw, role) {
         if (!raw)
             return undefined;
-        return {
+        const user = {
             email: raw.email ?? '',
             phone: raw.phone,
             display_name: raw.display_name ?? raw.email?.split('@')[0] ?? '',
             photo_url: raw.photo_url ?? raw.picture,
             is_email_verified: raw.is_email_verified ?? false
         };
+        // Populate role: prefer explicit param, then raw.role, then raw.membership?.role
+        const resolvedRole = role ?? raw.role ?? raw.membership?.role;
+        if (resolvedRole)
+            user.role = resolvedRole;
+        return user;
     }
     toMembership(raw) {
         return {
@@ -1108,6 +1117,31 @@ class TokenService {
         const token = this.getAccessToken();
         return token !== null && token !== '';
     }
+    /**
+     * Decode the payload of a JWT without verifying the signature.
+     * Returns the parsed claims object, or null if the token is invalid/missing.
+     *
+     * Usage: const claims = tokenService.decodeJwtPayload(token);
+     *        const role = claims?.role;
+     */
+    decodeJwtPayload(token) {
+        const jwt = token ?? this.getAccessToken();
+        if (!jwt)
+            return null;
+        try {
+            const parts = jwt.split('.');
+            if (parts.length !== 3)
+                return null;
+            // Base64url → Base64 → JSON
+            const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+            const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+            const json = atob(padded);
+            return JSON.parse(json);
+        }
+        catch {
+            return null;
+        }
+    }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
     static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "20.3.17", ngImport: i0, type: TokenService, providedIn: 'root' });
 }
@@ -1213,10 +1247,28 @@ class AuthService {
             this.tokens.setAccessToken(result.accessToken);
         if (result.refreshToken)
             this.tokens.setRefreshToken(result.refreshToken);
-        if (result.user)
-            this.updateUser(result.user);
+        if (result.user) {
+            // Enrich user with role from JWT claims if not already set
+            const user = result.user.role
+                ? result.user
+                : this.enrichUserWithJwtRole(result.user, result.accessToken);
+            this.updateUser(user);
+        }
         this.signinStatus.setSigninStatus(true);
     }
+    /**
+     * Decode the access token and attach the `role` claim to the user object.
+     * Falls back to role from the membership field in the AuthResult if no JWT role found.
+     */
+    enrichUserWithJwtRole(user, accessToken) {
+        if (accessToken) {
+            const claims = this.tokens.decodeJwtPayload(accessToken);
+            if (claims?.role) {
+                return { ...user, role: claims.role };
+            }
+        }
+        return user;
+    }
     // ── Core auth operations ──────────────────────────────────────────────────
     async loginWithEmail(email, password) {
         const result = await this.plugin.login(email, password);
@@ -1269,14 +1321,22 @@ class AuthService {
     }
     async checkSession(serverName) {
         if (this.tokens.hasValidAccessToken()) {
+            // If we already have a stored user, update their role from the current JWT
+            const storedUser = this.getCurrentUser();
+            if (storedUser && !storedUser.role) {
+                const enriched = this.enrichUserWithJwtRole(storedUser);
+                if (enriched.role)
+                    this.updateUser(enriched);
+            }
             this.signinStatus.setSigninStatus(true);
             return true;
         }
         const result = await this.plugin.checkSession();
         if (result.success && result.accessToken) {
             this.tokens.setAccessToken(result.accessToken);
-            if (result.user)
-                this.updateUser(result.user);
+            if (result.user) {
+                this.updateUser(this.enrichUserWithJwtRole(result.user, result.accessToken));
+            }
             this.signinStatus.setSigninStatus(true);
             return true;
         }