@pushwoosh/smart-components-kit 1.3.22 → 1.3.23

package/ProductUpdates/ProductUpdates.js

@@ -19,16 +19,20 @@ export function ProductUpdates({
     isLoading,
     hasUpdates,
     markAllRead,
-    clearNewBadges
+    clearNewBadges,
+    isImpersonation,
+    isImpersonationResolved
   } = useProductUpdates();
+  // Staff in impersonation must not auto-open: the modal would spend the client's read marks.
+  // Unresolved means the token is still being read, so hold rather than open and find out later.
   useEffect(() => {
-    if (!isAllowed || !autoOpenOnUnread || hasAutoOpened.current || unreadCount === 0) {
+    if (!isAllowed || !autoOpenOnUnread || hasAutoOpened.current || unreadCount === 0 || !isImpersonationResolved || isImpersonation) {
       return;
     }
     hasAutoOpened.current = true;
     setIsOpen(true);
     markAllRead();
-  }, [isAllowed, autoOpenOnUnread, unreadCount, markAllRead]);
+  }, [isAllowed, autoOpenOnUnread, unreadCount, markAllRead, isImpersonation, isImpersonationResolved]);
   const handleOpen = () => {
     setIsOpen(true);
     markAllRead();

package/ProductUpdates/hooks/useProductUpdates.d.ts

@@ -8,6 +8,10 @@ type UseProductUpdates = {
     readonly markAllRead: () => Promise<void>;
     /** Drops the NEW badges and the unread counter. Call on close, so they last while reading. */
     readonly clearNewBadges: () => void;
+    /** Staff viewing a client account from the super admin: no marks are written for them. */
+    readonly isImpersonation: boolean;
+    /** False until the access token is read, so an auto-open effect can hold instead of racing it. */
+    readonly isImpersonationResolved: boolean;
 };
 export declare function useProductUpdates(): UseProductUpdates;
 export {};

package/ProductUpdates/hooks/useProductUpdates.js

@@ -1,6 +1,7 @@
 import { useCallback, useRef, useState } from 'react';
 import { useAsync } from '@pushwoosh/kit-helpers';
 import { useSPAContext } from '@pushwoosh/spa-context';
+import { useIsStaffImpersonation } from '../../staffImpersonation';
 import { ALERT_STATUS_READ, ALERT_STATUS_UNREAD, ALERT_TYPE_PRODUCT_UPDATE, ORDER_BY_CREATED, ORDER_DIRECTION_DESC, MAX_VISIBLE_UPDATES } from '../constants';
 import { useIsAllowProductUpdates } from './useIsAllowProductUpdates';
 const EMPTY = [];
@@ -9,6 +10,10 @@ export function useProductUpdates() {
     rpcGateway
   } = useSPAContext();
   const isAllowed = useIsAllowProductUpdates();
+  const {
+    isImpersonation,
+    isResolved
+  } = useIsStaffImpersonation();
   const [areBadgesCleared, setAreBadgesCleared] = useState(false);
   const hasSentRef = useRef(false);
   const state = useAsync(async () => {
@@ -32,7 +37,9 @@ export function useProductUpdates() {
   // The mark goes out on open, not on close: a reload with the modal still open is not
   // a close, and the same updates used to pop again.
   const markAllRead = useCallback(async () => {
-    if (hasSentRef.current) {
+    // Read marks belong to the client's user, so staff writes none, and an unresolved check holds
+    // the mark rather than guessing. The flag is set before the first await: two calls send once.
+    if (hasSentRef.current || isImpersonation || !isResolved) {
       return;
     }
     const unread = fetched.filter(update => update.status === ALERT_STATUS_UNREAD);
@@ -51,7 +58,7 @@ export function useProductUpdates() {
       console.error('Failed to mark product updates as read:', error);
       hasSentRef.current = false;
     }
-  }, [rpcGateway, fetched]);
+  }, [rpcGateway, fetched, isImpersonation, isResolved]);
   const clearNewBadges = useCallback(() => setAreBadgesCleared(true), []);
   return {
     updates,
@@ -59,6 +66,8 @@ export function useProductUpdates() {
     isLoading: state.loading,
     hasUpdates: updates.length > 0,
     markAllRead,
-    clearNewBadges
+    clearNewBadges,
+    isImpersonation,
+    isImpersonationResolved: isResolved
   };
 }

package/index.d.ts

@@ -7,6 +7,7 @@ export * from './EmailTemplatePreview';
 export * from './ExportCSV';
 export * from './PlatformsConfigurationDrawer';
 export * from './ProductUpdates';
+export * from './staffImpersonation';
 export * from './LanguagesSelector';
 export * from './MediaStorage';
 export * from './mmsAttachments';

package/index.js

@@ -7,6 +7,7 @@ export * from './EmailTemplatePreview';
 export * from './ExportCSV';
 export * from './PlatformsConfigurationDrawer';
 export * from './ProductUpdates';
+export * from './staffImpersonation';
 export * from './LanguagesSelector';
 export * from './MediaStorage';
 export * from './mmsAttachments';

package/package.json

@@ -33,6 +33,7 @@
     "@pushwoosh/rpc-v2-http-api-data": "^0.2.151",
     "@pushwoosh/spa-context": "^1.7.1",
     "idb-keyval": "^6.2.2",
+    "jwt-decode": "^4.0.0",
     "react-hook-form": "^7.68.0",
     "react-router-dom": "^5.3.4"
   },
@@ -54,5 +55,5 @@
     "react": "^16.14.0 || ^18.0.0",
     "react-dom": "^16.14.0 || ^18.0.0"
   },
-  "version": "1.3.22"
+  "version": "1.3.23"
 }

package/staffImpersonation/index.d.ts

@@ -0,0 +1 @@
+export { useIsStaffImpersonation } from './useIsStaffImpersonation';

package/staffImpersonation/index.js

@@ -0,0 +1 @@
+export { useIsStaffImpersonation } from './useIsStaffImpersonation';

package/staffImpersonation/isStaffImpersonation.d.ts

@@ -0,0 +1,5 @@
+type AccessTokenSource = {
+    readonly getAccessToken: () => Promise<string>;
+};
+export declare function isStaffImpersonation(httpClient: AccessTokenSource): Promise<boolean>;
+export {};

package/staffImpersonation/isStaffImpersonation.js

@@ -0,0 +1,13 @@
+import { jwtDecode } from 'jwt-decode';
+// Staff coming from the super admin gets is_su with no parent user; a client switched into
+// their own child account gets is_su too, but with the parent user id filled in.
+export async function isStaffImpersonation(httpClient) {
+  try {
+    const claims = jwtDecode(await httpClient.getAccessToken());
+    const hasParentUser = claims.parent_user_id != null && claims.parent_user_id !== '0';
+    return claims.is_su === true && !hasParentUser;
+  } catch {
+    // Fail open: a client must not lose the feature because the token could not be read.
+    return false;
+  }
+}

package/staffImpersonation/isStaffImpersonation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/staffImpersonation/isStaffImpersonation.test.js

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+import { isStaffImpersonation } from './isStaffImpersonation';
+function tokenWith(claims) {
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  return `eyJhbGciOiJub25lIn0.${payload}.signature`;
+}
+function clientWith(token) {
+  return {
+    getAccessToken: async () => {
+      if (token instanceof Error) {
+        throw token;
+      }
+      return token;
+    }
+  };
+}
+describe('isStaffImpersonation', () => {
+  it('is false for a plain client login', async () => {
+    await expect(isStaffImpersonation(clientWith(tokenWith({
+      account_id: 42
+    })))).resolves.toBe(false);
+  });
+  it('is true for staff impersonation without parent_user_id', async () => {
+    await expect(isStaffImpersonation(clientWith(tokenWith({
+      is_su: true
+    })))).resolves.toBe(true);
+  });
+  it('is true for staff impersonation with parent_user_id "0"', async () => {
+    await expect(isStaffImpersonation(clientWith(tokenWith({
+      is_su: true,
+      parent_user_id: '0'
+    })))).resolves.toBe(true);
+  });
+  it('is false for a client switched into their own child account', async () => {
+    await expect(isStaffImpersonation(clientWith(tokenWith({
+      is_su: true,
+      parent_user_id: '77123'
+    })))).resolves.toBe(false);
+  });
+  it('is false when the token carries no claims at all', async () => {
+    await expect(isStaffImpersonation(clientWith(tokenWith({})))).resolves.toBe(false);
+  });
+  it('is false for a garbage token', async () => {
+    await expect(isStaffImpersonation(clientWith('not-a-jwt'))).resolves.toBe(false);
+  });
+  it('is false when there is no token to read', async () => {
+    await expect(isStaffImpersonation(clientWith(new Error('Unauthorized!')))).resolves.toBe(false);
+  });
+});

package/staffImpersonation/useIsStaffImpersonation.d.ts

@@ -0,0 +1,7 @@
+type UseIsStaffImpersonation = {
+    readonly isImpersonation: boolean;
+    /** False until the token is read, so a caller can hold an effect instead of racing it. */
+    readonly isResolved: boolean;
+};
+export declare function useIsStaffImpersonation(): UseIsStaffImpersonation;
+export {};

package/staffImpersonation/useIsStaffImpersonation.js

@@ -0,0 +1,13 @@
+import { useAsync } from '@pushwoosh/kit-helpers';
+import { useSPAContext } from '@pushwoosh/spa-context';
+import { isStaffImpersonation } from './isStaffImpersonation';
+export function useIsStaffImpersonation() {
+  const {
+    httpClient
+  } = useSPAContext();
+  const state = useAsync(() => isStaffImpersonation(httpClient), [httpClient]);
+  return {
+    isImpersonation: state.value ?? false,
+    isResolved: !state.loading
+  };
+}