@progalaxyelabs/ngx-stonescriptphp-client 1.9.0 → 1.11.1

package/fesm2022/progalaxyelabs-ngx-stonescriptphp-client.mjs

@@ -110,8 +110,8 @@ class TokenService {
         localStorage.removeItem(this.lsRefreshTokenKey);
     }
     /**
-     * Check if there is a valid (non-empty) access token
-     * @returns True if access token exists and is not empty
+     * Check if there is a non-empty access token.
+     * Token is treated as opaque — validity is determined by the auth server.
      */
     hasValidAccessToken() {
         const token = this.getAccessToken();
@@ -200,6 +200,12 @@ class MyEnvironmentModel {
         messagingSenderId: '',
         measurementId: ''
     };
+    /**
+     * Platform's own API base URL (e.g., '//api.medstoreapp.in')
+     * Used to route registration through the platform API proxy instead of auth directly
+     * @example '//api.medstoreapp.in'
+     */
+    apiUrl;
     apiServer = { host: '' };
     chatServer = { host: '' };
     /**
@@ -240,6 +246,22 @@ class MyEnvironmentModel {
      * ```
      */
     customProviders;
+    /**
+     * Auth response field mapping.
+     * Defaults to StoneScriptPHP format: { status: 'ok', data: { access_token, user, ... } }
+     *
+     * For external auth servers that return flat responses like
+     * { access_token, identity, ... }, override with:
+     * ```typescript
+     * authResponseMap: {
+     *   accessTokenPath: 'access_token',
+     *   refreshTokenPath: 'refresh_token',
+     *   userPath: 'identity',
+     *   errorMessagePath: 'message'
+     * }
+     * ```
+     */
+    authResponseMap;
     /**
      * Branding configuration for auth components
      * Allows platforms to customize login/register pages without creating wrappers
@@ -775,6 +797,73 @@ class AuthService {
     isMultiServerMode() {
         return !!(this.environment.authServers && Object.keys(this.environment.authServers).length > 0);
     }
+    /**
+     * Get the platform's own API base URL
+     * Used for routes that go through the platform API proxy (e.g. register-tenant)
+     * @throws Error if no API URL is configured
+     */
+    getPlatformApiUrl() {
+        if (this.environment.apiUrl) {
+            return this.environment.apiUrl;
+        }
+        if (this.environment.apiServer?.host) {
+            return this.environment.apiServer.host;
+        }
+        throw new Error('No platform API URL configured. Set apiUrl in environment config.');
+    }
+    // ===== Auth Response Mapping Helpers =====
+    /** Default response map: StoneScriptPHP format */
+    get responseMap() {
+        return this.environment.authResponseMap ?? {
+            successPath: 'status',
+            successValue: 'ok',
+            accessTokenPath: 'data.access_token',
+            refreshTokenPath: 'data.refresh_token',
+            userPath: 'data.user',
+            errorMessagePath: 'message'
+        };
+    }
+    /** Resolve a dot-notation path on an object (e.g., 'data.access_token') */
+    resolvePath(obj, path) {
+        return path.split('.').reduce((o, key) => o?.[key], obj);
+    }
+    /** Check if an auth response indicates success */
+    isAuthSuccess(data) {
+        const map = this.responseMap;
+        if (map.successPath) {
+            return this.resolvePath(data, map.successPath) === (map.successValue ?? 'ok');
+        }
+        // No successPath configured — success = access token present
+        return !!this.resolvePath(data, map.accessTokenPath);
+    }
+    /** Extract access token from auth response */
+    getAccessToken(data) {
+        return this.resolvePath(data, this.responseMap.accessTokenPath);
+    }
+    /** Extract refresh token from auth response */
+    getRefreshToken(data) {
+        return this.resolvePath(data, this.responseMap.refreshTokenPath);
+    }
+    /** Extract user/identity object from auth response */
+    getUserFromResponse(data) {
+        return this.resolvePath(data, this.responseMap.userPath);
+    }
+    /** Extract error message from auth response */
+    getErrorMessage(data, fallback) {
+        const path = this.responseMap.errorMessagePath ?? 'message';
+        return this.resolvePath(data, path) || fallback;
+    }
+    /** Normalize a user/identity object into the standard User shape */
+    normalizeUser(raw) {
+        return {
+            user_id: raw.user_id ?? (raw.id ? this.hashUUID(raw.id) : 0),
+            id: raw.id ?? String(raw.user_id),
+            email: raw.email,
+            display_name: raw.display_name ?? raw.email?.split('@')[0] ?? '',
+            photo_url: raw.photo_url,
+            is_email_verified: raw.is_email_verified ?? false
+        };
+    }
     /**
      * Hash UUID to numeric ID for backward compatibility
      * Converts UUID string to a consistent numeric ID for legacy code
@@ -838,7 +927,7 @@ class AuthService {
             const response = await fetch(`${accountsUrl}/api/auth/login`, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                credentials: 'include', // Include cookies for refresh token
+                credentials: 'include',
                 body: JSON.stringify({
                     email,
                     password,
@@ -846,24 +935,21 @@ class AuthService {
                 })
             });
             const data = await response.json();
-            if (data.success && data.access_token) {
-                this.tokens.setAccessToken(data.access_token);
+            if (this.isAuthSuccess(data)) {
+                const accessToken = this.getAccessToken(data);
+                this.tokens.setAccessToken(accessToken);
                 this.signinStatus.setSigninStatus(true);
-                // Normalize user object to handle both response formats
-                const normalizedUser = {
-                    user_id: data.user.user_id ?? (data.user.id ? this.hashUUID(data.user.id) : 0),
-                    id: data.user.id ?? String(data.user.user_id),
-                    email: data.user.email,
-                    display_name: data.user.display_name ?? data.user.email.split('@')[0],
-                    photo_url: data.user.photo_url,
-                    is_email_verified: data.user.is_email_verified ?? false
-                };
-                this.updateUser(normalizedUser);
-                return { success: true, user: normalizedUser };
+                const rawUser = this.getUserFromResponse(data);
+                if (rawUser) {
+                    const normalizedUser = this.normalizeUser(rawUser);
+                    this.updateUser(normalizedUser);
+                    return { success: true, user: normalizedUser };
+                }
+                return { success: true };
             }
             return {
                 success: false,
-                message: data.message || 'Invalid credentials'
+                message: this.getErrorMessage(data, 'Invalid credentials')
             };
         }
         catch (error) {
@@ -959,16 +1045,11 @@ class AuthService {
                 if (event.data.type === 'oauth_success') {
                     this.tokens.setAccessToken(event.data.access_token);
                     this.signinStatus.setSigninStatus(true);
-                    // Normalize user object to handle both response formats
-                    const normalizedUser = {
-                        user_id: event.data.user.user_id ?? (event.data.user.id ? this.hashUUID(event.data.user.id) : 0),
-                        id: event.data.user.id ?? String(event.data.user.user_id),
-                        email: event.data.user.email,
-                        display_name: event.data.user.display_name ?? event.data.user.email.split('@')[0],
-                        photo_url: event.data.user.photo_url,
-                        is_email_verified: event.data.user.is_email_verified ?? false
-                    };
-                    this.updateUser(normalizedUser);
+                    const rawUser = event.data.user || this.getUserFromResponse(event.data);
+                    const normalizedUser = rawUser ? this.normalizeUser(rawUser) : undefined;
+                    if (normalizedUser) {
+                        this.updateUser(normalizedUser);
+                    }
                     window.removeEventListener('message', messageHandler);
                     popup.close();
                     resolve({
@@ -1021,28 +1102,25 @@ class AuthService {
                 })
             });
             const data = await response.json();
-            if (data.success && data.access_token) {
-                this.tokens.setAccessToken(data.access_token);
+            if (this.isAuthSuccess(data)) {
+                const accessToken = this.getAccessToken(data);
+                this.tokens.setAccessToken(accessToken);
                 this.signinStatus.setSigninStatus(true);
-                // Normalize user object to handle both response formats
-                const normalizedUser = {
-                    user_id: data.user.user_id ?? (data.user.id ? this.hashUUID(data.user.id) : 0),
-                    id: data.user.id ?? String(data.user.user_id),
-                    email: data.user.email,
-                    display_name: data.user.display_name ?? data.user.email.split('@')[0],
-                    photo_url: data.user.photo_url,
-                    is_email_verified: data.user.is_email_verified ?? false
-                };
-                this.updateUser(normalizedUser);
-                return {
-                    success: true,
-                    user: normalizedUser,
-                    message: data.needs_verification ? 'Please verify your email' : undefined
-                };
+                const rawUser = this.getUserFromResponse(data);
+                if (rawUser) {
+                    const normalizedUser = this.normalizeUser(rawUser);
+                    this.updateUser(normalizedUser);
+                    return {
+                        success: true,
+                        user: normalizedUser,
+                        message: data.needs_verification ? 'Please verify your email' : undefined
+                    };
+                }
+                return { success: true };
             }
             return {
                 success: false,
-                message: data.message || 'Registration failed'
+                message: this.getErrorMessage(data, 'Registration failed')
             };
         }
         catch (error) {
@@ -1099,30 +1177,33 @@ class AuthService {
                 credentials: 'include'
             });
             if (!response.ok) {
+                // Refresh failed (expired, revoked, wrong keypair) — clear stale tokens
+                // so the user gets a clean login page, not a broken retry loop
+                this.tokens.clear();
+                this.updateUser(null);
                 this.signinStatus.setSigninStatus(false);
                 return false;
             }
             const data = await response.json();
-            if (data.access_token) {
-                this.tokens.setAccessToken(data.access_token);
-                // Normalize user object to handle both response formats
-                if (data.user) {
-                    const normalizedUser = {
-                        user_id: data.user.user_id ?? (data.user.id ? this.hashUUID(data.user.id) : 0),
-                        id: data.user.id ?? String(data.user.user_id),
-                        email: data.user.email,
-                        display_name: data.user.display_name ?? data.user.email.split('@')[0],
-                        photo_url: data.user.photo_url,
-                        is_email_verified: data.user.is_email_verified ?? false
-                    };
-                    this.updateUser(normalizedUser);
+            const accessToken = this.getAccessToken(data) ?? data.access_token;
+            if (accessToken) {
+                this.tokens.setAccessToken(accessToken);
+                const rawUser = this.getUserFromResponse(data) ?? data.user;
+                if (rawUser) {
+                    this.updateUser(this.normalizeUser(rawUser));
                 }
                 this.signinStatus.setSigninStatus(true);
                 return true;
             }
+            // Response OK but no token — clear stale state
+            this.tokens.clear();
+            this.updateUser(null);
             return false;
         }
         catch (error) {
+            // Network error — clear stale state to avoid retry loops
+            this.tokens.clear();
+            this.updateUser(null);
             this.signinStatus.setSigninStatus(false);
             return false;
         }
@@ -1150,9 +1231,9 @@ class AuthService {
             if (data.provider !== 'emailPassword') {
                 return await this.registerTenantWithOAuth(data.tenantName, data.tenantSlug, data.provider);
             }
-            // Email/password registration
-            const accountsUrl = this.getAccountsUrl();
-            const response = await fetch(`${accountsUrl}/api/auth/register-tenant`, {
+            // Email/password registration — route through platform API proxy
+            const apiUrl = this.getPlatformApiUrl();
+            const response = await fetch(`${apiUrl}/auth/register-tenant`, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 credentials: 'include',
@@ -1167,20 +1248,15 @@ class AuthService {
                 })
             });
             const result = await response.json();
-            if (result.success && result.access_token) {
-                this.tokens.setAccessToken(result.access_token);
-                this.signinStatus.setSigninStatus(true);
-                if (result.user) {
-                    // Normalize user object to handle both response formats
-                    const normalizedUser = {
-                        user_id: result.user.user_id ?? (result.user.id ? this.hashUUID(result.user.id) : 0),
-                        id: result.user.id ?? String(result.user.user_id),
-                        email: result.user.email,
-                        display_name: result.user.display_name ?? result.user.email.split('@')[0],
-                        photo_url: result.user.photo_url,
-                        is_email_verified: result.user.is_email_verified ?? false
-                    };
-                    this.updateUser(normalizedUser);
+            if (this.isAuthSuccess(result)) {
+                const accessToken = this.getAccessToken(result);
+                if (accessToken) {
+                    this.tokens.setAccessToken(accessToken);
+                    this.signinStatus.setSigninStatus(true);
+                }
+                const rawUser = this.getUserFromResponse(result);
+                if (rawUser) {
+                    this.updateUser(this.normalizeUser(rawUser));
                 }
             }
             return result;
@@ -1225,22 +1301,13 @@ class AuthService {
                     return;
                 }
                 if (event.data.type === 'tenant_register_success') {
-                    // Set tokens and user
                     if (event.data.access_token) {
                         this.tokens.setAccessToken(event.data.access_token);
                         this.signinStatus.setSigninStatus(true);
                     }
-                    if (event.data.user) {
-                        // Normalize user object to handle both response formats
-                        const normalizedUser = {
-                            user_id: event.data.user.user_id ?? (event.data.user.id ? this.hashUUID(event.data.user.id) : 0),
-                            id: event.data.user.id ?? String(event.data.user.user_id),
-                            email: event.data.user.email,
-                            display_name: event.data.user.display_name ?? event.data.user.email.split('@')[0],
-                            photo_url: event.data.user.photo_url,
-                            is_email_verified: event.data.user.is_email_verified ?? false
-                        };
-                        this.updateUser(normalizedUser);
+                    const rawUser = event.data.user || this.getUserFromResponse(event.data);
+                    if (rawUser) {
+                        this.updateUser(this.normalizeUser(rawUser));
                     }
                     window.removeEventListener('message', messageHandler);
                     popup.close();
@@ -1316,16 +1383,17 @@ class AuthService {
                 body: JSON.stringify({ tenant_id: tenantId })
             });
             const data = await response.json();
-            if (data.success && data.access_token) {
-                this.tokens.setAccessToken(data.access_token);
+            if (this.isAuthSuccess(data)) {
+                const accessToken = this.getAccessToken(data);
+                this.tokens.setAccessToken(accessToken);
                 return {
                     success: true,
-                    access_token: data.access_token
+                    access_token: accessToken
                 };
             }
             return {
                 success: false,
-                message: data.message || 'Failed to select tenant'
+                message: this.getErrorMessage(data, 'Failed to select tenant')
             };
         }
         catch (error) {
@@ -1475,8 +1543,9 @@ class AuthService {
             if (!accessToken) {
                 throw new Error('Not authenticated');
             }
-            const accountsUrl = this.getAccountsUrl(serverName);
-            const response = await fetch(`${accountsUrl}/api/auth/register-tenant`, {
+            // Route through platform API proxy — PHP API adds platform_secret header
+            const apiUrl = this.getPlatformApiUrl();
+            const response = await fetch(`${apiUrl}/auth/register-tenant`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',