@redacto.io/consent-sdk-react 3.4.0 → 3.6.0

package/src/RedactoPrivacyCenter/lib/utils.ts

@@ -0,0 +1,625 @@
+import { refreshOtpTokenServer } from './api';
+import type { BaseUrlContextValue } from '../context/BaseUrlContext';
+
+// Token refresh lock to prevent concurrent refresh attempts
+let isRefreshing = false;
+let refreshPromise: Promise<string | null> | null = null;
+
+// Buffer time in seconds before token expiration to proactively refresh
+// Using 30 seconds to ensure tokens are refreshed before they expire
+const TOKEN_EXPIRY_BUFFER_SECONDS = 30;
+
+export const getCookieValue = (name: string) => {
+  const cookies = document.cookie.split('; ');
+  for (let cookie of cookies) {
+    const [key, value] = cookie.split('=');
+    if (key === name) {
+      return value;
+    }
+  }
+  return null;
+};
+
+/**
+ * Set refresh token cookie with proper attributes
+ * @param refreshToken - The refresh token value to set
+ */
+export const setRefreshTokenCookie = (refreshToken: string): void => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+
+  const cookieAttributes = [
+    `refresh_token=${refreshToken}`,
+    'path=/privacy-center',
+    `max-age=${60 * 60 * 24 * 7}`, // 7 days
+    `samesite=lax`,
+  ]
+    .filter(Boolean)
+    .join('; ');
+
+  document.cookie = cookieAttributes;
+};
+
+/**
+ * Decode JWT token and extract payload
+ * @param token - JWT token string
+ * @returns Decoded JWT payload or null if decoding fails
+ */
+export const decodeJwtToken = (token: string): { organisation_uuid?: string; organisation_name?: string; workspace_uuid?: string; [key: string]: any } | null => {
+  if (!token || typeof token !== 'string') {
+    return null;
+  }
+
+  try {
+    // JWT format: header.payload.signature
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+      // Malformed JWT
+      return null;
+    }
+
+    // Decode payload (second part)
+    const payload = parts[1];
+
+    // Base64URL decode
+    // Replace URL-safe characters and add padding if needed
+    let base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const padding = base64.length % 4;
+    if (padding) {
+      base64 += '='.repeat(4 - padding);
+    }
+
+    // Decode base64
+    const decodedPayload = atob(base64);
+    const payloadObj = JSON.parse(decodedPayload) as { organisation_uuid?: string; organisation_name?: string; workspace_uuid?: string; [key: string]: any };
+
+    return payloadObj;
+  } catch (error) {
+    // If decoding fails, return null
+    console.error('Error decoding JWT:', error);
+    return null;
+  }
+};
+
+/**
+ * Decode JWT payload and check if token is expired or will expire soon
+ * @param token - JWT token string
+ * @param bufferSeconds - Buffer time in seconds before expiration to consider token expired (default: 5 minutes)
+ * @returns true if token is expired, invalid, or will expire within buffer time; false if valid
+ */
+export const isJwtExpired = (token: string, bufferSeconds: number = 5 * 60): boolean => {
+  if (!token || typeof token !== 'string') {
+    return true;
+  }
+
+  try {
+    // JWT format: header.payload.signature
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+      // Malformed JWT
+      return true;
+    }
+
+    // Decode payload (second part)
+    const payload = parts[1];
+
+    // Base64URL decode
+    // Replace URL-safe characters and add padding if needed
+    let base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const padding = base64.length % 4;
+    if (padding) {
+      base64 += '='.repeat(4 - padding);
+    }
+
+    // Decode base64
+    const decodedPayload = atob(base64);
+    const payloadObj: { exp?: number } = JSON.parse(decodedPayload) as { exp?: number };
+
+    // Check if exp claim exists
+    if (typeof payloadObj.exp !== 'number') {
+      // Missing exp claim - treat as invalid
+      return true;
+    }
+
+    // Get current time in seconds
+    const now = Math.floor(Date.now() / 1000);
+
+    // Check if token is expired or will expire within buffer time
+    const isExpired = payloadObj.exp <= (now + bufferSeconds);
+
+    // exp is in seconds since epoch
+    return isExpired;
+  } catch (error) {
+    // If decoding fails, treat as expired/invalid
+    console.error('Error decoding JWT:', error);
+    return true;
+  }
+};
+
+/**
+ * Check if user is authenticated in privacy center
+ * User is considered authenticated if both access_token and email exist in sessionStorage
+ */
+export const isUserAuthenticated = (expectedSlug: string): boolean => {
+  if (typeof window === 'undefined') return false;
+  const accessToken = sessionStorage.getItem('access_token');
+  const email = sessionStorage.getItem('email');
+  const orgSlug = sessionStorage.getItem('pc_org_slug');
+
+  // Require that tokens exist and the stored organization slug matches
+  if (!accessToken || !email || !orgSlug) {
+    return false;
+  }
+
+  return orgSlug === expectedSlug;
+};
+
+/**
+ * Get initial state for sign-in form visibility
+ * Returns true if window is undefined (SSR) or user is not authenticated
+ * @param slug - The organization slug to check authentication against
+ * @returns true if sign-in form should be shown, false otherwise
+ */
+export const getInitialState = (slug: string): boolean => {
+  if (typeof window === 'undefined') return true;
+  return !isUserAuthenticated(slug);
+};
+
+/**
+ * Check authentication status and attempt token refresh if needed
+ * This function checks if the user is authenticated, validates JWT expiration,
+ * and attempts to refresh using the refresh token cookie if the token is expired or missing.
+ * @param expectedSlug - The organization slug to verify against
+ * @param organizationId - Optional organization ID (will be read from sessionStorage if not provided)
+ * @param workspaceId - Optional workspace ID (will be read from sessionStorage if not provided)
+ * @returns Promise<boolean> - true if authenticated with valid non-expired token, false otherwise
+ */
+export const checkAndRefreshAuth = async (
+  expectedSlug: string,
+  organizationId?: string,
+  workspaceId?: string,
+  consentClient?: BaseUrlContextValue['consentClient']
+): Promise<boolean> => {
+  if (typeof window === 'undefined') return false;
+
+  const accessToken = sessionStorage.getItem('access_token');
+  const email = sessionStorage.getItem('email');
+  const orgSlug = sessionStorage.getItem('pc_org_slug');
+
+  // If slug doesn't match, user is not authenticated for this organization
+  if (orgSlug && orgSlug !== expectedSlug) {
+    return false;
+  }
+
+  // Check if we need to refresh (token missing or expired)
+  const needsRefresh = !accessToken || (accessToken && isJwtExpired(accessToken, TOKEN_EXPIRY_BUFFER_SECONDS));
+
+  // If we have a valid token and all required data, user is authenticated
+  if (!needsRefresh && accessToken && email && orgSlug && orgSlug === expectedSlug) {
+    return true;
+  }
+
+  // If token is missing or expired, and we have email and orgSlug, try to refresh
+  if (needsRefresh && email && orgSlug === expectedSlug) {
+    // Get organizationId and workspaceId from sessionStorage if not provided
+    const orgId = organizationId || sessionStorage.getItem('pc_org_id') || '';
+    const wsId = workspaceId || sessionStorage.getItem('pc_workspace_id') || '';
+
+    if (!orgId || !wsId) {
+      return false;
+    }
+
+    try {
+      const refreshToken = getCookieValue('refresh_token');
+      if (!refreshToken) {
+        // No refresh token available - user needs to sign in again
+        signOutPrivacyCenter();
+        return false;
+      }
+
+      const result = await refreshOtpTokenServer(orgId, wsId, refreshToken, consentClient);
+      if (result && result.success !== false) {
+        const newAccessToken = (result as { access_token?: string })?.access_token;
+        const newRefreshToken = (result as { refresh_token?: string })?.refresh_token;
+
+        if (newAccessToken) {
+          // Validate the new token is not expired before storing
+          if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
+            console.error('Refreshed access token is already expired - clearing auth state');
+            signOutPrivacyCenter();
+            return false;
+          }
+          sessionStorage.setItem('access_token', newAccessToken);
+        } else {
+          // No access token in response - refresh failed
+          console.error('Refresh response missing access token - clearing auth state');
+          signOutPrivacyCenter();
+          return false;
+        }
+
+        if (newRefreshToken) {
+          setRefreshTokenCookie(newRefreshToken);
+        }
+
+        // Verify we now have a valid, non-expired access token
+        const isValid = !!newAccessToken && !isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS);
+        if (!isValid) {
+          console.error('Refreshed token validation failed - clearing auth state');
+          signOutPrivacyCenter();
+        }
+        return isValid;
+      } else {
+        // Refresh token expired/revoked or server returned failure
+        // This is an expected scenario - silently handle it
+        signOutPrivacyCenter();
+        return false;
+      }
+    } catch (error: any) {
+      // Check if error indicates refresh token is expired/revoked (expected scenario)
+      const errorMessage = error?.message || '';
+      const isRefreshTokenExpired =
+        errorMessage.includes('revoked') ||
+        errorMessage.includes('expired') ||
+        errorMessage.includes('Refresh token') ||
+        errorMessage.includes('Invalid refresh token') ||
+        errorMessage.includes('401') ||
+        errorMessage.includes('Unauthorized');
+
+      if (isRefreshTokenExpired) {
+        // Refresh token is expired/revoked - silently handle (expected scenario)
+        signOutPrivacyCenter();
+        return false;
+      }
+
+      // For other errors (network, etc.), log and don't clear auth state - might be temporary
+      console.error('[Token Refresh] Unexpected error refreshing token:', error);
+      return false;
+    }
+  }
+
+  return false;
+};
+
+/**
+ * Compare two email addresses (case-insensitive, handles URL encoding)
+ * @param email1 - First email (can be URL-encoded)
+ * @param email2 - Second email
+ * @returns true if emails match (case-insensitive), false otherwise
+ */
+export const compareEmails = (email1: string | null, email2: string | null): boolean => {
+  if (!email1 || !email2) {
+    return false;
+  }
+
+  // Decode URL-encoded email (handles %40 for @, %2B for +, etc.)
+  const decodedEmail1 = decodeURIComponent(email1.trim());
+  const normalizedEmail1 = decodedEmail1.toLowerCase();
+  const normalizedEmail2 = email2.trim().toLowerCase();
+
+  return normalizedEmail1 === normalizedEmail2;
+};
+
+/**
+ * Sign out from privacy center only
+ * Clears privacy-center specific storage and cookies without touching Supabase auth
+ */
+export const signOutPrivacyCenter = (): void => {
+  if (typeof window === 'undefined') return;
+
+  const privacyCenterKeys = [
+    'access_token',
+    'email',
+    'i18nextLng',
+    'lang',
+    'pc_org_slug',
+    'pc_org_id',
+    'pc_workspace_id',
+    'pc_current_page',
+    'pc_grievance_view',
+  ];
+  privacyCenterKeys.forEach((key) => {
+    sessionStorage.removeItem(key);
+  });
+
+  // Clear refresh token cookie set for privacy center
+  document.cookie =
+    'refresh_token=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+  // Fallback in case the cookie path differs
+  document.cookie =
+    'refresh_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+};
+
+/**
+ * Ensure a valid access token is available before making API calls.
+ * This function checks if the current token is valid (not expired).
+ * If expired or missing, it attempts to refresh using the refresh token.
+ * If refresh fails (refresh token expired), it signs out and redirects to sign-in.
+ * 
+ * @param organizationId - The organization UUID
+ * @param workspaceId - The workspace UUID
+ * @param slug - The organization slug for redirect
+ * @param authContext - Optional auth context values (accessToken, refreshToken, onError, updateTokens)
+ * @returns Promise<string | null> - Valid access token or null if auth failed
+ */
+export const ensureValidToken = async (
+  organizationId?: string,
+  workspaceId?: string,
+  slug?: string,
+  authContext?: {
+    accessToken?: string;
+    refreshToken?: string;
+    onError?: (error: Error) => boolean;
+    updateTokens?: (accessToken: string, refreshToken?: string) => void;
+  },
+  consentClient?: BaseUrlContextValue['consentClient']
+): Promise<string | null> => {
+  if (typeof window === 'undefined') return null;
+
+  // Use context accessToken if provided, otherwise fall back to sessionStorage
+  const accessToken = authContext?.accessToken || sessionStorage.getItem('access_token');
+
+  // Check if current token is valid (exists, is a string, and not expired)
+  // Use a buffer to proactively refresh before actual expiry
+  if (
+    accessToken &&
+    typeof accessToken === 'string' &&
+    accessToken.trim() !== '' &&
+    !isJwtExpired(accessToken, TOKEN_EXPIRY_BUFFER_SECONDS)
+  ) {
+    return accessToken;
+  }
+
+  // Token is missing or expired, need to refresh
+  // Use lock to prevent concurrent refresh attempts
+  if (isRefreshing && refreshPromise) {
+    // Wait for ongoing refresh to complete
+    const newToken = await refreshPromise;
+    // Return the new token directly (it's already stored in sessionStorage/context)
+    return newToken;
+  }
+
+  // Start refresh process
+  isRefreshing = true;
+  refreshPromise = performTokenRefresh(organizationId, workspaceId, slug, authContext, consentClient);
+
+  try {
+    const newToken = await refreshPromise;
+    // Return the new token directly (it's already stored in sessionStorage/context)
+    return newToken;
+  } finally {
+    isRefreshing = false;
+    refreshPromise = null;
+  }
+};
+
+/**
+ * Internal function to perform token refresh
+ * @returns Promise<string | null> - The new access token on success, null on failure
+ */
+const performTokenRefresh = async (
+  organizationId?: string,
+  workspaceId?: string,
+  slug?: string,
+  authContext?: {
+    accessToken?: string;
+    refreshToken?: string;
+    onError?: (error: Error) => boolean;
+    updateTokens?: (accessToken: string, refreshToken?: string) => void;
+  },
+  consentClient?: BaseUrlContextValue['consentClient']
+): Promise<string | null> => {
+  // Get organizationId and workspaceId from sessionStorage if not provided
+  const orgId = organizationId || sessionStorage.getItem('pc_org_id') || '';
+  const wsId = workspaceId || sessionStorage.getItem('pc_workspace_id') || '';
+  const orgSlug = slug || sessionStorage.getItem('pc_org_slug') || '';
+
+  if (!orgId || !wsId) {
+    console.error('[Token Refresh] Missing organizationId or workspaceId');
+    const error = new Error('Missing organizationId or workspaceId');
+    // Call onError if provided, check return value before proceeding
+    if (authContext?.onError) {
+      const shouldProceed = authContext.onError(error);
+      if (!shouldProceed) {
+        return null;
+      }
+    }
+    signOutPrivacyCenter();
+    redirectToSignIn(orgSlug, authContext?.onError);
+    return null;
+  }
+
+  // Use context refreshToken if provided, otherwise fall back to cookie
+  // If authContext is provided, prioritize its refreshToken (props mode)
+  // Otherwise, fall back to cookie (legacy mode)
+  let refreshTokenValue: string | null = null;
+
+  if (authContext) {
+    // Props mode: use refreshToken from context
+    refreshTokenValue = authContext.refreshToken || null;
+  } else {
+    // Legacy mode: use refreshToken from cookie
+    refreshTokenValue = getCookieValue('refresh_token');
+  }
+
+  // Validate refreshToken is a non-empty string
+  if (!refreshTokenValue || typeof refreshTokenValue !== 'string' || refreshTokenValue.trim() === '') {
+    // No refresh token available - user needs to sign in again
+    console.warn('[Token Refresh] No valid refresh token available', {
+      hasAuthContext: !!authContext,
+      refreshTokenFromContext: authContext?.refreshToken,
+      refreshTokenFromCookie: getCookieValue('refresh_token'),
+    });
+    const error = new Error('No refresh token available');
+    // Call onError if provided, check return value before proceeding
+    if (authContext?.onError) {
+      const shouldProceed = authContext.onError(error);
+      if (!shouldProceed) {
+        return null;
+      }
+    }
+    signOutPrivacyCenter();
+    redirectToSignIn(orgSlug, authContext?.onError);
+    return null;
+  }
+
+  // At this point, refreshTokenValue is guaranteed to be a non-empty string
+  const refreshToken: string = refreshTokenValue;
+
+  try {
+    const result = await refreshOtpTokenServer(orgId, wsId, refreshToken, consentClient);
+
+    if (result && result.success !== false) {
+      const newAccessToken = (result as { access_token?: string })?.access_token;
+      const newRefreshToken = (result as { refresh_token?: string })?.refresh_token;
+
+      if (newAccessToken) {
+        // Validate the new token is not expired before storing
+        if (isJwtExpired(newAccessToken, TOKEN_EXPIRY_BUFFER_SECONDS)) {
+          console.error('[Token Refresh] New access token is already expired');
+          const error = new Error('New access token is already expired');
+          // Call onError if provided, check return value before proceeding
+          if (authContext?.onError) {
+            const shouldProceed = authContext.onError(error);
+            if (!shouldProceed) {
+              return null;
+            }
+          }
+          signOutPrivacyCenter();
+          redirectToSignIn(orgSlug, authContext?.onError);
+          return null;
+        }
+
+        // Update tokens via context if available, otherwise use storage
+        if (authContext?.updateTokens) {
+          authContext.updateTokens(newAccessToken, newRefreshToken);
+        } else {
+          sessionStorage.setItem('access_token', newAccessToken);
+          if (newRefreshToken) {
+            setRefreshTokenCookie(newRefreshToken);
+          }
+        }
+
+        // Return the new access token directly (already stored in sessionStorage/context)
+        return newAccessToken;
+      } else {
+        // No access token in response - refresh failed
+        console.error('[Token Refresh] Response missing access token');
+        const error = new Error('Response missing access token');
+        // Call onError if provided, check return value before proceeding
+        if (authContext?.onError) {
+          const shouldProceed = authContext.onError(error);
+          if (!shouldProceed) {
+            return null;
+          }
+        }
+        signOutPrivacyCenter();
+        redirectToSignIn(orgSlug, authContext?.onError);
+        return null;
+      }
+    } else {
+      // Refresh token expired/revoked or server returned failure
+      const error = new Error('Refresh token expired or revoked');
+      // Call onError if provided, check return value before proceeding
+      if (authContext?.onError) {
+        const shouldProceed = authContext.onError(error);
+        if (!shouldProceed) {
+          return null;
+        }
+      }
+      signOutPrivacyCenter();
+      redirectToSignIn(orgSlug, authContext?.onError);
+      return null;
+    }
+  } catch (error: any) {
+    const errorMessage = error?.message || '';
+    const isRefreshTokenExpired =
+      errorMessage.includes('revoked') ||
+      errorMessage.includes('expired') ||
+      errorMessage.includes('Refresh token') ||
+      errorMessage.includes('Invalid refresh token') ||
+      errorMessage.includes('401') ||
+      errorMessage.includes('Unauthorized');
+
+    if (isRefreshTokenExpired) {
+      // Refresh token is expired/revoked - expected scenario
+      const err = new Error('Refresh token expired or revoked');
+      // Call onError if provided, check return value before proceeding
+      if (authContext?.onError) {
+        const shouldProceed = authContext.onError(err);
+        if (!shouldProceed) {
+          return null;
+        }
+      }
+      signOutPrivacyCenter();
+      redirectToSignIn(orgSlug, authContext?.onError);
+      return null;
+    }
+
+    // For other errors (network, etc.), log but don't clear auth state
+    console.error('[Token Refresh] Unexpected error:', error);
+    // Still call onError for unexpected errors
+    if (authContext?.onError) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      authContext.onError(err);
+    }
+    return null;
+  }
+};
+
+/**
+ * Helper to redirect to sign-in page
+ */
+const redirectToSignIn = (slug?: string, onError?: (error: Error) => boolean): void => {
+  if (typeof window === 'undefined') return;
+
+  // If onError is provided, call it and check return value
+  if (onError) {
+    const error = new Error('Authentication failed - redirecting to sign-in');
+    const shouldProceed = onError(error);
+    if (!shouldProceed) {
+      // User wants to handle navigation themselves
+      return;
+    }
+  }
+
+  const orgSlug = slug || sessionStorage.getItem('pc_org_slug') || '';
+  if (orgSlug) {
+    window.location.href = `/privacy-center/${orgSlug}/sign-in`;
+  } else {
+    window.location.href = '/privacy-center';
+  }
+};
+
+// Activity helper functions
+
+export type ActivityBadgeStatus =
+  | 'success'
+  | 'warning'
+  | 'error'
+  | 'info'
+  | 'pending';
+
+/**
+ * Get badge status based on activity type
+ */
+export const getActivityTypeStatus = (
+  activityType: string
+): ActivityBadgeStatus => {
+  const type = activityType.toLowerCase();
+  if (type.includes('consent') || type.includes('grant')) return 'success';
+  if (type.includes('revoke') || type.includes('withdraw')) return 'error';
+  if (type.includes('update') || type.includes('modify')) return 'warning';
+  if (type.includes('view') || type.includes('access')) return 'info';
+  return 'pending';
+};
+
+/**
+ * Format activity type for display
+ */
+export const formatActivityType = (activityType: string): string => {
+  return activityType
+    .split('_')
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+    .join(' ');
+};