@robosystems/core 0.3.0

package/auth-core/client.js

@@ -0,0 +1,767 @@
+var _a;
+import { checkPasswordStrength, client, completeSsoAuth, createUserApiKey, forgotPassword, generateSsoToken, getCurrentAuthUser, getPasswordPolicy, listUserApiKeys, loginUser, logoutUser, refreshAuthSession, registerUser, resendVerificationEmail, resetPassword, revokeUserApiKey, ssoTokenExchange, validateResetToken, verifyEmail, } from '@robosystems/client';
+import * as sdkClientsModule from '@robosystems/client/clients';
+import { getToken, getValidToken } from './token-storage';
+// Global config hook for the clients package's lazy default singleton
+// (`import { clients } from '@robosystems/client/clients'`). We must
+// set this BEFORE the singleton is first accessed — the singleton reads the
+// token at construction time and never re-reads it. Without this, the
+// GraphQL client inside LedgerClient/InvestorClient has no credentials and
+// every resolver call returns UNAUTHENTICATED.
+//
+// Statically imported: the `@robosystems/client >=0.3.2` peer range
+// guarantees the clients surface (the root barrel imports it statically
+// too), and `require()` does not exist in this package's compiled ESM.
+// A missing *export* still falls through to a no-op, which just means the
+// extensions singleton is unconfigured but the core REST auth path works.
+const setSDKClientConfig = (_a = sdkClientsModule.setSDKClientConfig) !== null && _a !== void 0 ? _a : null;
+// Configuration constants
+const CACHE_TTL_MS = 30 * 1000; // 30 seconds - optimized for performance
+const ERROR_CACHE_TTL_MS = 5 * 1000; // 5 seconds - allow reasonable retry delay
+// Custom error class for token expiry
+export class TokenExpiredError extends Error {
+    constructor(message = 'Token expired') {
+        super(message);
+        this.name = 'TokenExpiredError';
+    }
+}
+export class RoboSystemsAuthClient {
+    constructor(baseUrl) {
+        this.authCheckPromise = null;
+        this.lastAuthCheck = null;
+        this.lastError = null;
+        this.refreshRetryCount = 0;
+        this.MAX_REFRESH_RETRIES = 3;
+        this.INITIAL_RETRY_DELAY = 1000; // 1 second
+        // Configure the SDK client with the provided base URL and credentials
+        this.client = client;
+        // Configure client with JWT authentication
+        this.configureClientWithAuth(baseUrl);
+    }
+    /**
+     * Configure the client with JWT authentication for all requests
+     */
+    configureClientWithAuth(baseUrl) {
+        var _a, _b, _c, _d, _e, _f;
+        // Get JWT token for authorization with auto-refresh
+        const getAuthToken = async () => {
+            const { getValidToken } = await import('./token-storage');
+            return await getValidToken(); // This will auto-refresh if needed
+        };
+        // Set base configuration
+        this.client.setConfig({
+            baseUrl: baseUrl.replace(/\/$/, ''), // Remove trailing slash
+            credentials: 'include', // Essential for cookie-based authentication
+            headers: {},
+        });
+        // Wire the SDK extensions singleton to pull a fresh JWT on every
+        // GraphQL request. The `extensions` singleton at
+        // `@robosystems/client/clients` lazy-builds on first access; if we
+        // seeded a static `token` it would get captured there and go stale the
+        // moment the JWT rotates (~every 30 min). Instead we register a
+        // `tokenProvider` callback that reads the latest token from storage on
+        // each request, so refresh flows through without any cache clearing.
+        //
+        // On the REST side this isn't necessary because the main SDK client's
+        // methods are wrapped below to inject `Authorization: Bearer` per-call
+        // — this block is only about the GraphQL read path that runs inside
+        // LedgerClient / InvestorClient / ReportClient via graphql-request.
+        if (setSDKClientConfig && typeof window !== 'undefined') {
+            try {
+                // token-storage is imported statically (its functions are all
+                // window-guarded, so it is server-safe); `require()` is not
+                // available in this package's compiled ESM output.
+                setSDKClientConfig({
+                    baseUrl: baseUrl.replace(/\/$/, ''),
+                    // Priming `token` with the current storage value isn't required
+                    // since the provider always wins, but it gives the singleton a
+                    // sensible initial value before the first async refresh.
+                    token: (_a = getToken()) !== null && _a !== void 0 ? _a : undefined,
+                    // Async provider — `getValidToken` auto-refreshes expired tokens
+                    // against the backend before returning. Every GraphQL request
+                    // consults this callback, so a token rotation between requests
+                    // is picked up automatically.
+                    tokenProvider: async () => {
+                        try {
+                            return await getValidToken();
+                        }
+                        catch (_a) {
+                            // If refresh fails (offline, backend down, token-storage
+                            // corrupted) let the request go out unauthenticated; the
+                            // backend's 401 will trigger the normal session-expired
+                            // handling instead of crashing the request at middleware.
+                            return null;
+                        }
+                    },
+                });
+            }
+            catch (err) {
+                console.warn('[AuthClient] Failed to seed SDK extensions config:', err);
+            }
+        }
+        // Wrap the client methods to add JWT token to requests
+        const originalPost = (_b = this.client.post) === null || _b === void 0 ? void 0 : _b.bind(this.client);
+        const originalPut = (_c = this.client.put) === null || _c === void 0 ? void 0 : _c.bind(this.client);
+        const originalPatch = (_d = this.client.patch) === null || _d === void 0 ? void 0 : _d.bind(this.client);
+        const originalDelete = (_e = this.client.delete) === null || _e === void 0 ? void 0 : _e.bind(this.client);
+        // Helper to add JWT token to headers and handle 401 responses
+        const wrapWithAuthAndErrorHandling = (originalMethod, methodName) => {
+            if (!originalMethod)
+                return undefined;
+            return async (options) => {
+                var _a, _b, _c;
+                try {
+                    const authToken = await getAuthToken();
+                    const headers = Object.assign({}, options.headers);
+                    if (authToken) {
+                        headers['Authorization'] = `Bearer ${authToken}`;
+                    }
+                    const enhancedOptions = Object.assign(Object.assign({}, options), { headers });
+                    const result = await originalMethod(enhancedOptions);
+                    return result;
+                }
+                catch (error) {
+                    // Check for 401 Unauthorized errors
+                    if ((error === null || error === void 0 ? void 0 : error.status) === 401 ||
+                        ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 401 ||
+                        ((_b = error === null || error === void 0 ? void 0 : error.message) === null || _b === void 0 ? void 0 : _b.toLowerCase().includes('unauthorized')) ||
+                        ((_c = error === null || error === void 0 ? void 0 : error.message) === null || _c === void 0 ? void 0 : _c.toLowerCase().includes('401'))) {
+                        // Clear cached auth data
+                        this.clearAuthCache();
+                        // Clear token from storage
+                        const { clearToken } = await import('./token-storage');
+                        clearToken();
+                        // Throw custom error that can be caught by UI
+                        throw new TokenExpiredError('Your session has expired. Please log in again.');
+                    }
+                    // Re-throw other errors
+                    throw error;
+                }
+            };
+        };
+        // Also wrap GET requests to add JWT token
+        const originalGet = (_f = this.client.get) === null || _f === void 0 ? void 0 : _f.bind(this.client);
+        // Override all methods with auth headers and error handling
+        this.client.get = wrapWithAuthAndErrorHandling(originalGet, 'GET');
+        this.client.post = wrapWithAuthAndErrorHandling(originalPost, 'POST');
+        this.client.put = wrapWithAuthAndErrorHandling(originalPut, 'PUT');
+        this.client.patch = wrapWithAuthAndErrorHandling(originalPatch, 'PATCH');
+        this.client.delete = wrapWithAuthAndErrorHandling(originalDelete, 'DELETE');
+    }
+    /**
+     * Push the latest auth token into the SDK extensions global config.
+     *
+     * Called from every auth success path (`login` / `register` / SSO
+     * token exchange / verify-email) so the SDK extensions singleton
+     * stays in sync with the current credential.
+     *
+     * The GraphQL read path already has refresh via `tokenProvider`
+     * (wired in `configureClientWithAuth`) and does not depend on this
+     * static field. But the SDK's React hooks (`useQuery`, `useOperation`,
+     * `useStreamingQuery`, …) still read `getSDKClientConfig().token`
+     * via `extractTokenFromSDKClient` to seed their inner `QueryClient`
+     * / `OperationClient` instances. Keeping the static field updated
+     * after every auth success keeps those hook-owned clients
+     * authenticated across login/register/SSO transitions.
+     *
+     * No-op when the SDK extensions module isn't installed.
+     */
+    syncClientConfigToken(token) {
+        if (!setSDKClientConfig)
+            return;
+        setSDKClientConfig({
+            baseUrl: this.client.getConfig().baseUrl,
+            token,
+        });
+    }
+    async login(email, password) {
+        const response = await loginUser({
+            client: this.client,
+            body: { email, password },
+        });
+        const sdkResponse = this.validateSDKAuthResponse(response.data);
+        // Store JWT token with expiry information if present in response
+        if (sdkResponse.token) {
+            const { storeToken } = await import('./token-storage');
+            storeToken(sdkResponse.token, sdkResponse.expires_in || 1800, sdkResponse.refresh_threshold || 300);
+            // Keep the SDK extensions singleton's static `token` field in
+            // sync. The GraphQL read path refreshes via `tokenProvider`
+            // independently, but the React hooks surface still reads the
+            // static field at hook-init time — see `syncClientConfigToken`
+            // for the full rationale.
+            this.syncClientConfigToken(sdkResponse.token);
+        }
+        return {
+            user: sdkResponse.user,
+            success: true,
+            message: sdkResponse.message,
+            token: sdkResponse.token,
+            expires_in: sdkResponse.expires_in,
+            refresh_threshold: sdkResponse.refresh_threshold,
+        };
+    }
+    async register(email, password, name, captchaToken) {
+        const response = await registerUser({
+            client: this.client,
+            body: {
+                email,
+                password,
+                name: name || '',
+                captcha_token: captchaToken || undefined,
+            },
+        });
+        // Check for error responses (4xx/5xx)
+        if (response.error) {
+            const errorData = response.error;
+            throw new Error((errorData === null || errorData === void 0 ? void 0 : errorData.detail) || 'Registration failed');
+        }
+        const sdkResponse = this.validateSDKAuthResponse(response.data);
+        // Store JWT token with expiry information if present in response
+        if (sdkResponse.token) {
+            const { storeToken } = await import('./token-storage');
+            storeToken(sdkResponse.token, sdkResponse.expires_in || 1800, sdkResponse.refresh_threshold || 300);
+            // Keep the SDK extensions singleton's static `token` field in
+            // sync. The GraphQL read path refreshes via `tokenProvider`
+            // independently, but the React hooks surface still reads the
+            // static field at hook-init time — see `syncClientConfigToken`
+            // for the full rationale.
+            this.syncClientConfigToken(sdkResponse.token);
+        }
+        return {
+            user: sdkResponse.user,
+            success: true,
+            message: sdkResponse.message,
+            token: sdkResponse.token,
+            expires_in: sdkResponse.expires_in,
+            refresh_threshold: sdkResponse.refresh_threshold,
+        };
+    }
+    async logout() {
+        try {
+            // Add timeout to prevent hanging
+            const logoutPromise = logoutUser({
+                client: this.client,
+            });
+            const timeoutPromise = new Promise((_, reject) => {
+                setTimeout(() => reject(new Error('Logout timeout after 10 seconds')), 10000);
+            });
+            await Promise.race([logoutPromise, timeoutPromise]);
+        }
+        catch (error) {
+            // Don't throw - continue with local cleanup even if backend fails
+        }
+        // Clear stored JWT token
+        const { clearToken } = await import('./token-storage');
+        clearToken();
+        // Verify logout by checking current user session
+        try {
+            // Clear any cached auth state to force fresh API call
+            this.clearAuthCache();
+            // Try to get current user - this should fail if logout worked
+            await this.getCurrentUser();
+        }
+        catch (verifyError) {
+            // This is expected - getCurrentUser should throw an error after logout
+        }
+    }
+    async getCurrentUser() {
+        var _a;
+        // Return cached result if fresh
+        if (this.lastAuthCheck &&
+            Date.now() - this.lastAuthCheck.timestamp < CACHE_TTL_MS) {
+            if (this.lastAuthCheck.result) {
+                return this.lastAuthCheck.result;
+            }
+        }
+        // Return cached error if fresh
+        if (this.lastError &&
+            Date.now() - this.lastError.timestamp < ERROR_CACHE_TTL_MS) {
+            throw this.lastError.error;
+        }
+        // If request already in progress, wait for it
+        if (this.authCheckPromise) {
+            return await this.authCheckPromise;
+        }
+        // Create new auth check promise
+        this.authCheckPromise = this.performAuthCheck();
+        try {
+            const result = await this.authCheckPromise;
+            // Clear any previous error on success
+            this.lastError = null;
+            return result;
+        }
+        catch (error) {
+            // Don't cache 403 errors - they indicate a permanent state change
+            const is403 = (error === null || error === void 0 ? void 0 : error.status) === 403 ||
+                ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status) === 403;
+            if (!is403) {
+                // Cache non-403 errors for consistent responses
+                this.lastError = {
+                    timestamp: Date.now(),
+                    error: error instanceof Error ? error : new Error(String(error)),
+                };
+            }
+            else {
+                // Clear cached error for 403s to force fresh checks
+                this.lastError = null;
+            }
+            throw error;
+        }
+        finally {
+            this.authCheckPromise = null;
+        }
+    }
+    async performAuthCheck() {
+        try {
+            const response = await getCurrentAuthUser({
+                client: this.client,
+            });
+            const data = this.validateSDKCurrentUserResponse(response.data);
+            const user = data.user;
+            this.lastAuthCheck = { timestamp: Date.now(), result: user };
+            return user;
+        }
+        catch (error) {
+            this.lastAuthCheck = { timestamp: Date.now(), result: null };
+            // Error caching is handled in getCurrentUser()
+            throw error;
+        }
+    }
+    async refreshSession() {
+        const response = await this.refreshSessionWithRetry();
+        // Check if response has data property or if it IS the data
+        const responseData = (response === null || response === void 0 ? void 0 : response.data) !== undefined ? response.data : response;
+        const sdkResponse = this.validateSDKAuthResponse(responseData);
+        // Store new JWT token with expiry information if present in response
+        if (sdkResponse.token) {
+            const { storeToken } = await import('./token-storage');
+            storeToken(sdkResponse.token, sdkResponse.expires_in || 1800, sdkResponse.refresh_threshold || 300);
+            // Keep the SDK extensions singleton's static `token` field in
+            // sync. The GraphQL read path refreshes via `tokenProvider`
+            // independently, but the React hooks surface still reads the
+            // static field at hook-init time — see `syncClientConfigToken`
+            // for the full rationale.
+            this.syncClientConfigToken(sdkResponse.token);
+        }
+        // Reset retry count on success
+        this.refreshRetryCount = 0;
+        return {
+            user: sdkResponse.user,
+            success: true,
+            message: sdkResponse.message,
+            token: sdkResponse.token,
+            expires_in: sdkResponse.expires_in,
+            refresh_threshold: sdkResponse.refresh_threshold,
+        };
+    }
+    /**
+     * Refresh session with exponential backoff retry logic
+     */
+    async refreshSessionWithRetry() {
+        let lastError = null;
+        for (let attempt = 0; attempt <= this.MAX_REFRESH_RETRIES; attempt++) {
+            try {
+                // Attempt to refresh the session
+                const response = await refreshAuthSession({
+                    client: this.client,
+                });
+                // Success - return the response
+                return response;
+            }
+            catch (error) {
+                lastError = error;
+                // If this is the last attempt, throw the error
+                if (attempt === this.MAX_REFRESH_RETRIES) {
+                    break;
+                }
+                // Calculate delay with exponential backoff
+                const delay = this.INITIAL_RETRY_DELAY * Math.pow(2, attempt);
+                // Add jitter to prevent thundering herd
+                const jitter = Math.random() * 0.3 * delay;
+                const totalDelay = delay + jitter;
+                console.warn(`Session refresh attempt ${attempt + 1} failed, retrying in ${Math.round(totalDelay)}ms...`);
+                // Wait before retrying
+                await new Promise((resolve) => setTimeout(resolve, totalDelay));
+            }
+        }
+        // All attempts failed - throw the last error
+        throw lastError || new Error('Failed to refresh session after all retries');
+    }
+    async createAPIKey(request) {
+        const response = await createUserApiKey({
+            client: this.client,
+            body: {
+                name: request.name,
+                description: request.permissions.join(', '), // Map permissions to description for now
+            },
+        });
+        const sdkResponse = response.data;
+        return {
+            id: sdkResponse.api_key.id,
+            name: sdkResponse.api_key.name,
+            key: sdkResponse.key,
+            permissions: request.permissions,
+            graphId: request.graphId,
+            createdAt: sdkResponse.api_key.created_at,
+            isActive: sdkResponse.api_key.is_active,
+            lastUsedAt: sdkResponse.api_key.last_used_at,
+            expiresAt: request.expiresAt,
+        };
+    }
+    async getAPIKeys() {
+        const response = await listUserApiKeys({
+            client: this.client,
+        });
+        const sdkResponse = response.data;
+        return sdkResponse.api_keys.map((apiKey) => ({
+            id: apiKey.id,
+            name: apiKey.name,
+            key: apiKey.prefix + '...', // Only prefix is available in list
+            permissions: [], // Not available in the SDK response
+            createdAt: apiKey.created_at,
+            isActive: apiKey.is_active,
+            lastUsedAt: apiKey.last_used_at,
+        }));
+    }
+    async revokeAPIKey(keyId) {
+        await revokeUserApiKey({
+            client: this.client,
+            path: { api_key_id: keyId },
+        });
+    }
+    async generateSSOToken() {
+        const response = await generateSsoToken({
+            client: this.client,
+        });
+        const data = response.data;
+        return data;
+    }
+    async ssoExchange(token, targetApp) {
+        const response = await ssoTokenExchange({
+            client: this.client,
+            body: { token, target_app: targetApp },
+        });
+        const data = response.data;
+        return {
+            session_id: data.session_id,
+        };
+    }
+    async ssoComplete(sessionId) {
+        const response = await completeSsoAuth({
+            client: this.client,
+            body: { session_id: sessionId },
+        });
+        const sdkResponse = this.validateSDKAuthResponse(response.data);
+        // Store JWT token with expiry information if present in response
+        if (sdkResponse.token) {
+            const { storeToken } = await import('./token-storage');
+            storeToken(sdkResponse.token, sdkResponse.expires_in || 1800, sdkResponse.refresh_threshold || 300);
+            // Keep the SDK extensions singleton's static `token` field in
+            // sync. The GraphQL read path refreshes via `tokenProvider`
+            // independently, but the React hooks surface still reads the
+            // static field at hook-init time — see `syncClientConfigToken`
+            // for the full rationale.
+            this.syncClientConfigToken(sdkResponse.token);
+        }
+        return {
+            user: sdkResponse.user,
+            success: true,
+            message: sdkResponse.message,
+            token: sdkResponse.token,
+            expires_in: sdkResponse.expires_in,
+            refresh_threshold: sdkResponse.refresh_threshold,
+        };
+    }
+    async checkAuthentication() {
+        try {
+            return await this.getCurrentUser();
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    // Clear request deduplication cache (useful after login/logout)
+    clearAuthCache() {
+        this.lastAuthCheck = null;
+        this.lastError = null;
+        this.authCheckPromise = null;
+    }
+    /**
+     * Send password reset email
+     */
+    async forgotPassword(email) {
+        try {
+            await forgotPassword({
+                client: this.client,
+                body: { email },
+            });
+            return {
+                success: true,
+                message: 'Password reset email sent if the account exists',
+            };
+        }
+        catch (error) {
+            console.error('Forgot password error:', error);
+            return {
+                success: false,
+                message: 'Failed to send password reset email',
+            };
+        }
+    }
+    /**
+     * Reset password using token
+     */
+    async resetPassword(token, newPassword) {
+        try {
+            const response = await resetPassword({
+                client: this.client,
+                body: {
+                    token,
+                    new_password: newPassword,
+                },
+            });
+            // Check for error responses (4xx/5xx)
+            if (response.error) {
+                const errorData = response.error;
+                return {
+                    success: false,
+                    message: (errorData === null || errorData === void 0 ? void 0 : errorData.detail) || 'Failed to reset password',
+                };
+            }
+            // Handle the auth response if login is automatic after reset
+            const data = response.data;
+            if ((data === null || data === void 0 ? void 0 : data.token) &&
+                typeof data.token === 'string' &&
+                data.token.length > 0) {
+                const { storeToken } = await import('./token-storage');
+                storeToken(data.token);
+            }
+            return {
+                success: true,
+                message: 'Password reset successfully',
+            };
+        }
+        catch (error) {
+            console.error('Reset password error:', error);
+            return {
+                success: false,
+                message: 'Failed to reset password',
+            };
+        }
+    }
+    /**
+     * Validate password reset token
+     */
+    async validateResetToken(token) {
+        try {
+            const response = await validateResetToken({
+                client: this.client,
+                query: { token },
+            });
+            const data = response.data;
+            return {
+                valid: (data === null || data === void 0 ? void 0 : data.valid) === true,
+                email: data === null || data === void 0 ? void 0 : data.email,
+                message: data === null || data === void 0 ? void 0 : data.message,
+            };
+        }
+        catch (error) {
+            console.error('Validate reset token error:', error);
+            return {
+                valid: false,
+                message: 'Invalid or expired reset token',
+            };
+        }
+    }
+    /**
+     * Verify email with token
+     */
+    async verifyEmail(token) {
+        try {
+            const response = await verifyEmail({
+                client: this.client,
+                body: { token },
+            });
+            // Check for error responses (4xx/5xx)
+            if (response.error) {
+                const errorData = response.error;
+                return {
+                    success: false,
+                    message: (errorData === null || errorData === void 0 ? void 0 : errorData.detail) || 'Failed to verify email',
+                };
+            }
+            const data = response.data;
+            // Handle the auth response if login is automatic after verification
+            if ((data === null || data === void 0 ? void 0 : data.token) &&
+                typeof data.token === 'string' &&
+                data.token.length > 0) {
+                const { storeToken } = await import('./token-storage');
+                storeToken(data.token);
+            }
+            return {
+                success: true,
+                message: 'Email verified successfully',
+                user: data === null || data === void 0 ? void 0 : data.user,
+            };
+        }
+        catch (error) {
+            console.error('Verify email error:', error);
+            return {
+                success: false,
+                message: 'Failed to verify email',
+            };
+        }
+    }
+    /**
+     * Resend verification email
+     */
+    async resendVerificationEmail(email) {
+        try {
+            await resendVerificationEmail({
+                client: this.client,
+                body: { email },
+            });
+            return {
+                success: true,
+                message: 'Verification email sent if the account exists',
+            };
+        }
+        catch (error) {
+            console.error('Resend verification email error:', error);
+            return {
+                success: false,
+                message: 'Failed to send verification email',
+            };
+        }
+    }
+    /**
+     * Get password policy requirements
+     */
+    async getPasswordPolicy() {
+        try {
+            const response = await getPasswordPolicy({
+                client: this.client,
+            });
+            const data = response.data;
+            return {
+                minLength: (data === null || data === void 0 ? void 0 : data.min_length) || 8,
+                requireUppercase: (data === null || data === void 0 ? void 0 : data.require_uppercase) || false,
+                requireLowercase: (data === null || data === void 0 ? void 0 : data.require_lowercase) || false,
+                requireNumbers: (data === null || data === void 0 ? void 0 : data.require_numbers) || false,
+                requireSpecial: (data === null || data === void 0 ? void 0 : data.require_special) || false,
+                specialCharacters: (data === null || data === void 0 ? void 0 : data.special_characters) || '!@#$%^&*()_+-=[]{}|;:,.<>?',
+            };
+        }
+        catch (error) {
+            console.error('Get password policy error:', error);
+            // Return default policy
+            return {
+                minLength: 8,
+                requireUppercase: true,
+                requireLowercase: true,
+                requireNumbers: true,
+                requireSpecial: true,
+                specialCharacters: '!@#$%^&*()_+-=[]{}|;:,.<>?',
+            };
+        }
+    }
+    /**
+     * Check password strength
+     */
+    async checkPasswordStrength(password, email) {
+        try {
+            const response = await checkPasswordStrength({
+                client: this.client,
+                body: { password, email },
+            });
+            const data = response.data;
+            return {
+                score: (data === null || data === void 0 ? void 0 : data.score) || 0,
+                strength: (data === null || data === void 0 ? void 0 : data.strength) || 'very-weak',
+                errors: (data === null || data === void 0 ? void 0 : data.errors) || [],
+                suggestions: (data === null || data === void 0 ? void 0 : data.suggestions) || [],
+                is_valid: (data === null || data === void 0 ? void 0 : data.is_valid) || false,
+            };
+        }
+        catch (error) {
+            console.error('Check password strength error:', error);
+            // Return basic strength calculation
+            let score = 0;
+            if (password.length >= 8)
+                score += 20;
+            if (password.length >= 12)
+                score += 20;
+            if (/[a-z]/.test(password))
+                score += 20;
+            if (/[A-Z]/.test(password))
+                score += 20;
+            if (/[0-9]/.test(password))
+                score += 10;
+            if (/[^a-zA-Z0-9]/.test(password))
+                score += 10;
+            return {
+                score,
+                strength: score < 20
+                    ? 'very-weak'
+                    : score < 40
+                        ? 'weak'
+                        : score < 60
+                            ? 'fair'
+                            : score < 80
+                                ? 'good'
+                                : 'strong',
+                errors: [],
+                suggestions: [],
+                is_valid: score >= 60,
+            };
+        }
+    }
+    /**
+     * Validate and safely cast SDK response data
+     */
+    normalizeUser(raw) {
+        var _a, _b, _c, _d, _e;
+        return {
+            id: raw.id,
+            email: raw.email,
+            name: raw.name,
+            emailVerified: (_a = raw.email_verified) !== null && _a !== void 0 ? _a : raw.emailVerified,
+            createdAt: (_c = (_b = raw.createdAt) !== null && _b !== void 0 ? _b : raw.created_at) !== null && _c !== void 0 ? _c : '',
+            updatedAt: (_e = (_d = raw.updatedAt) !== null && _d !== void 0 ? _d : raw.updated_at) !== null && _e !== void 0 ? _e : '',
+        };
+    }
+    validateSDKAuthResponse(data) {
+        if (!data || typeof data !== 'object') {
+            throw new Error('Invalid SDK response: expected object');
+        }
+        const response = data;
+        if (!response.user || typeof response.user !== 'object') {
+            throw new Error('Invalid SDK response: missing or invalid user');
+        }
+        const user = response.user;
+        if (!user.id || typeof user.id !== 'string') {
+            throw new Error('Invalid SDK response: user missing required id');
+        }
+        if (!user.email || typeof user.email !== 'string') {
+            throw new Error('Invalid SDK response: user missing required email');
+        }
+        response.user = this.normalizeUser(response.user);
+        return response;
+    }
+    validateSDKCurrentUserResponse(data) {
+        if (!data || typeof data !== 'object') {
+            throw new Error('Invalid SDK response: expected object');
+        }
+        const response = data;
+        // Check if the response is the user object directly (not nested under 'user' property)
+        if (response.id && response.email) {
+            return { user: this.normalizeUser(response) };
+        }
+        // Check if it's nested under 'user' property
+        if (!response.user || typeof response.user !== 'object') {
+            throw new Error('Invalid SDK response: missing or invalid user');
+        }
+        response.user = this.normalizeUser(response.user);
+        return response;
+    }
+}