@robosophy/auth 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,141 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @robosophy/auth
+
+Sesión de los fronts de Mi Cuenta contra el Landing: access token RS256 de 15 minutos en `localStorage["token"]`, refresh opaco en cookie HttpOnly y datos del usuario desde `GET /api/usuario/self`.
+
+No depende de ningún framework. Necesita `axios` (peer dependency) y `fetch`.
+
+## Instalación
+
+```sh
+npm install @robosophy/auth
+```
+
+## Configuración
+
+Se llama una sola vez, al arrancar la app:
+
+```js
+import { configureAuth } from "@robosophy/auth";
+
+configureAuth({
+  landingUrl: import.meta.env.VITE_LANDING_URL, // origin del Landing (front y back comparten origin)
+  devEmail: import.meta.env.VITE_DEV_EMAIL,     // solo DEV
+  isDev: import.meta.env.DEV,
+});
+```
+
+## API
+
+| Función | Qué hace |
+|---|---|
+| `configureAuth(opts)` | Guarda `landingUrl`, `devEmail` e `isDev`. |
+| `getToken()` | Devuelve `localStorage["token"]` o `null`. |
+| `attachAuthRefresh(api)` | Agrega el Bearer a cada request y ante un 401 renueva el token y reintenta una vez. |
+| `getCurrentUser()` | `GET {landingUrl}/api/usuario/self`, cacheado en memoria. Si falla, el cache se descarta. |
+| `setSession(token)` | Guarda el token nuevo e invalida el cache del usuario. |
+| `logout()` | `POST {landingUrl}/api/auth/logout`, limpia la sesión y va a `{landingUrl}/login`. |
+| `clearSession()` | Borra `token`, `user-id`, `originalToken` y `token-landing` de `localStorage`. |
+
+## Cómo se renueva el token
+
+Ante un 401 de un request que todavía no se reintentó:
+
+1. Se toma el lock `basf-auth-refresh` con `navigator.locks`, compartido entre pestañas. Si el navegador no lo soporta, se deduplica solo dentro de la pestaña.
+2. Si `localStorage["token"]` ya cambió, otra pestaña renovó primero y se usa ese token.
+3. Si no, se pide uno nuevo:
+   - En DEV con `devEmail`: `POST {landingUrl}/dev/token` con `{ email }`. El Landing back local lo expone solo en el perfil `local`.
+   - Si no: `POST {landingUrl}/api/auth/refresh` con `credentials: "include"`, que rota la cookie de refresh.
+4. Con token nuevo se reintenta el request original. Si no hay token:
+   - En DEV: `console.warn("[auth] sin sesión: definí VITE_DEV_EMAIL en .env.local")` y el error sigue. No redirige.
+   - En prod: `clearSession()` y redirect a `{landingUrl}/login`, salvo que ya esté en esa página.
+
+Los 401 de `/api/auth/login`, `/api/auth/verify-2fa`, `/api/auth/resend-2fa`, `/api/auth/refresh`, `/api/auth/logout` y `/dev/token` no disparan el refresh: ahí el 401 es la respuesta (credenciales, código 2FA, refresh vencido). El resto de `/api/auth/*`, como `request-2fa-challenge`, sí renueva y reintenta.
+
+## Uso en Vue
+
+```js
+// main.js
+import { configureAuth } from "@robosophy/auth";
+
+configureAuth({
+  landingUrl: import.meta.env.VITE_LANDING_URL,
+  devEmail: import.meta.env.VITE_DEV_EMAIL,
+  isDev: import.meta.env.DEV,
+});
+```
+
+```js
+// axiosClient.js
+import axios from "axios";
+import { attachAuthRefresh } from "@robosophy/auth";
+
+const api = axios.create({ baseURL: import.meta.env.VITE_URL });
+attachAuthRefresh(api);
+export default api;
+```
+
+```js
+// router/index.js
+import { getCurrentUser } from "@robosophy/auth";
+
+router.beforeEach(async (to) => {
+  if (!to.meta.requiresAuth) return true;
+  try {
+    const user = await getCurrentUser();
+    return Boolean(user?.rolCYO?.rol);
+  } catch {
+    return false; // attachAuthRefresh ya redirigió al login (prod) o avisó por consola (DEV)
+  }
+});
+```
+
+```vue
+<!-- Botón de salir -->
+<script setup>
+import { logout } from "@robosophy/auth";
+</script>
+
+<template>
+  <button @click="logout">Salir</button>
+</template>
+```
+
+## Uso en React
+
+```tsx
+// main.tsx
+import { configureAuth } from "@robosophy/auth";
+
+configureAuth({
+  landingUrl: import.meta.env.VITE_LANDING_URL,
+  devEmail: import.meta.env.VITE_DEV_EMAIL,
+  isDev: import.meta.env.DEV,
+});
+```
+
+```tsx
+// useCurrentUser.ts
+import { useEffect, useState } from "react";
+import { getCurrentUser } from "@robosophy/auth";
+
+export function useCurrentUser<T>() {
+  const [user, setUser] = useState<T | null>(null);
+  useEffect(() => {
+    getCurrentUser<T>().then(setUser).catch(() => setUser(null));
+  }, []);
+  return user;
+}
+```
+
+```tsx
+import { logout } from "@robosophy/auth";
+
+<button onClick={() => logout()}>Salir</button>;
+```
+
+## Desarrollo local
+
+- La variable con la URL del Landing (`landingUrl`) apunta al **Landing back** en `http://localhost:8184`, no al Vite del front de Landing: ahí están `/api/usuario/self` y `/dev/token`.
+- `VITE_DEV_EMAIL=usuario@basf.com` va en `.env.local`, que no se commitea.
+- Con el Landing back en perfil `local`, el front pide el token solo en el primer 401: no hace falta loguearse ni copiar tokens.
+- Para entrar con otro usuario se cambia el email y se recarga. `configureAuth` detecta el cambio (lo guarda en `localStorage["auth-dev-email"]`) y borra la sesión del usuario anterior.

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+interface AuthOptions {
+    /** Origin del Landing (front y back comparten origin): ej. import.meta.env.VITE_LANDING_URL */
+    landingUrl: string;
+    /** Solo DEV: email para pedir el token a POST /dev/token del Landing back local. */
+    devEmail?: string;
+    /** import.meta.env.DEV */
+    isDev?: boolean;
+}
+/**
+ * Lo único que se usa de la instancia. Estructural para no atar los tipos a la versión de axios
+ * del paquete: cada front pasa la instancia de su propio axios.
+ */
+interface AxiosLike {
+    interceptors: {
+        request: {
+            use(onFulfilled: (config: any) => any): unknown;
+        };
+        response: {
+            use(onFulfilled: undefined, onRejected: (error: any) => any): unknown;
+        };
+    };
+    request(config: any): Promise<any>;
+}
+declare function configureAuth(opts: AuthOptions): void;
+declare function getToken(): string | null;
+declare function setSession(token: string): void;
+declare function clearSession(): void;
+declare function attachAuthRefresh(api: AxiosLike): void;
+declare function getCurrentUser<T = any>(): Promise<T>;
+declare function logout(): Promise<void>;
+
+export { type AuthOptions, type AxiosLike, attachAuthRefresh, clearSession, configureAuth, getCurrentUser, getToken, logout, setSession };

package/dist/index.js

@@ -0,0 +1,182 @@
+// src/index.ts
+import axios from "axios";
+var TOKEN_KEY = "token";
+var SESSION_KEYS = [TOKEN_KEY, "user-id", "originalToken", "token-landing"];
+var LOCK_NAME = "basf-auth-refresh";
+var REFRESH_PATH = "/api/auth/refresh";
+var DEV_TOKEN_PATH = "/dev/token";
+var LOGOUT_PATH = "/api/auth/logout";
+var SELF_PATH = "/api/usuario/self";
+var DEV_EMAIL_KEY = "auth-dev-email";
+var NO_RETRY_PATHS = [
+  "/api/auth/login",
+  "/api/auth/verify-2fa",
+  "/api/auth/resend-2fa",
+  REFRESH_PATH,
+  LOGOUT_PATH,
+  DEV_TOKEN_PATH
+];
+var options = null;
+var landingApi = null;
+var currentUser = null;
+var inFlightRefresh = null;
+function configureAuth(opts) {
+  options = {
+    landingUrl: opts.landingUrl.replace(/\/+$/, ""),
+    devEmail: opts.devEmail ?? "",
+    isDev: opts.isDev ?? false
+  };
+  landingApi = null;
+  currentUser = null;
+  if (options.isDev && options.devEmail !== "" && localStorage.getItem(DEV_EMAIL_KEY) !== options.devEmail) {
+    clearSession();
+    localStorage.setItem(DEV_EMAIL_KEY, options.devEmail);
+  }
+}
+function getToken() {
+  return localStorage.getItem(TOKEN_KEY);
+}
+function setSession(token) {
+  localStorage.setItem(TOKEN_KEY, token);
+  currentUser = null;
+}
+function clearSession() {
+  SESSION_KEYS.forEach((key) => localStorage.removeItem(key));
+  currentUser = null;
+}
+function attachAuthRefresh(api) {
+  api.interceptors.request.use((config) => {
+    const token = getToken();
+    if (token) {
+      setBearer(config, token);
+    }
+    return config;
+  });
+  api.interceptors.response.use(void 0, async (error) => {
+    const config = error?.config;
+    if (error?.response?.status !== 401 || !config || config._retried || isAuthEndpoint(config)) {
+      throw error;
+    }
+    config._retried = true;
+    const token = await renewToken(bearerOf(config));
+    if (!token) {
+      onSessionLost();
+      throw error;
+    }
+    setBearer(config, token);
+    return api.request(config);
+  });
+}
+function getCurrentUser() {
+  if (!currentUser) {
+    const request = getLandingApi().get(SELF_PATH).then((response) => response.data);
+    currentUser = request;
+    request.catch(() => {
+      if (currentUser === request) {
+        currentUser = null;
+      }
+    });
+  }
+  return currentUser;
+}
+async function logout() {
+  const { landingUrl } = requireOptions();
+  const token = getToken();
+  try {
+    await fetch(landingUrl + LOGOUT_PATH, {
+      method: "POST",
+      credentials: "include",
+      headers: token ? { Authorization: `Bearer ${token}` } : void 0
+    });
+  } catch {
+  }
+  clearSession();
+  window.location.href = `${landingUrl}/login`;
+}
+function requireOptions() {
+  if (!options) {
+    throw new Error("[auth] falta llamar a configureAuth() en main");
+  }
+  return options;
+}
+function getLandingApi() {
+  if (!landingApi) {
+    landingApi = axios.create({ baseURL: requireOptions().landingUrl });
+    attachAuthRefresh(landingApi);
+  }
+  return landingApi;
+}
+function isAuthEndpoint(config) {
+  const url = config.url ?? "";
+  return NO_RETRY_PATHS.some((path) => url.includes(path));
+}
+function setBearer(config, token) {
+  config.headers = config.headers ?? {};
+  config.headers["Authorization"] = `Bearer ${token}`;
+}
+function bearerOf(config) {
+  const header = config.headers?.["Authorization"] ?? config.headers?.["authorization"];
+  return typeof header === "string" && header.startsWith("Bearer ") ? header.slice("Bearer ".length) : null;
+}
+function renewToken(stale) {
+  if (!inFlightRefresh) {
+    inFlightRefresh = withRefreshLock(async () => {
+      const current = getToken();
+      if (current && current !== stale) {
+        return current;
+      }
+      const token = await requestNewToken();
+      if (token) {
+        localStorage.setItem(TOKEN_KEY, token);
+      }
+      return token;
+    }).finally(() => {
+      inFlightRefresh = null;
+    });
+  }
+  return inFlightRefresh;
+}
+function withRefreshLock(task) {
+  const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+  return locks ? locks.request(LOCK_NAME, task) : task();
+}
+async function requestNewToken() {
+  const { landingUrl, devEmail, isDev } = requireOptions();
+  const useDevToken = isDev && devEmail !== "";
+  try {
+    const response = await fetch(landingUrl + (useDevToken ? DEV_TOKEN_PATH : REFRESH_PATH), {
+      method: "POST",
+      credentials: "include",
+      headers: useDevToken ? { "Content-Type": "application/json" } : void 0,
+      body: useDevToken ? JSON.stringify({ email: devEmail }) : void 0
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const body = await response.json();
+    return typeof body?.value === "string" ? body.value : null;
+  } catch {
+    return null;
+  }
+}
+function onSessionLost() {
+  const { landingUrl, isDev } = requireOptions();
+  if (isDev) {
+    console.warn("[auth] sin sesi\xF3n: defin\xED VITE_DEV_EMAIL en .env.local");
+    return;
+  }
+  clearSession();
+  const loginUrl = `${landingUrl}/login`;
+  if (!window.location.href.startsWith(loginUrl)) {
+    window.location.href = loginUrl;
+  }
+}
+export {
+  attachAuthRefresh,
+  clearSession,
+  configureAuth,
+  getCurrentUser,
+  getToken,
+  logout,
+  setSession
+};

package/package.json

@@ -1,6 +1,35 @@
-{
-  "name": "@robosophy/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@robosophy/auth",
+  "version": "1.0.0",
+  "private": false,
+  "license": "UNLICENSED",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "package.json"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "prepublishOnly": "npm run build",
+    "build": "tsup src/index.ts --format esm --dts --clean --external axios",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "axios": ">=0.19.0"
+  },
+  "devDependencies": {
+    "axios": "^1.7.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.0"
+  }
+}