@robosystems/core 0.3.0

package/auth-core/config.d.ts

@@ -0,0 +1,19 @@
+import type { AppConfig, AppName } from './types';
+export declare const CURRENT_APP: AppName;
+/**
+ * Each app's fixed brand hex. Cross-app safe: unlike the Tailwind `primary`
+ * tokens (which only ever resolve to the *currently-running* app's palette),
+ * these literals correctly represent any app from inside any other app — used
+ * by the colored AnimatedLogo and the AppSwitcher so each product's mark shows
+ * in its own brand color.
+ */
+export declare const BRAND_COLORS: Record<AppName, string>;
+/**
+ * Per-app brand gradient (CSS) for the LogoBadge chip — a white mark on a
+ * brand-gradient rounded square. Cross-app safe literals (NOT tokens), so each
+ * product's chip renders its own gradient from inside any app (e.g. the
+ * AppSwitcher). Mirrors each app's landing hero gradient.
+ */
+export declare const BRAND_GRADIENTS: Record<AppName, string>;
+export declare const APP_CONFIGS: Record<string, AppConfig>;
+export declare const getAppConfig: (appName: string) => AppConfig;

package/auth-core/config.js

@@ -0,0 +1,56 @@
+export const CURRENT_APP = process.env.NEXT_PUBLIC_APP_NAME || 'robosystems';
+/**
+ * Each app's fixed brand hex. Cross-app safe: unlike the Tailwind `primary`
+ * tokens (which only ever resolve to the *currently-running* app's palette),
+ * these literals correctly represent any app from inside any other app — used
+ * by the colored AnimatedLogo and the AppSwitcher so each product's mark shows
+ * in its own brand color.
+ */
+export const BRAND_COLORS = {
+    robosystems: '#3B7AF5', // blue
+    roboledger: '#8B5CF6', // violet
+    roboinvestor: '#10B981', // emerald
+};
+/**
+ * Per-app brand gradient (CSS) for the LogoBadge chip — a white mark on a
+ * brand-gradient rounded square. Cross-app safe literals (NOT tokens), so each
+ * product's chip renders its own gradient from inside any app (e.g. the
+ * AppSwitcher). Mirrors each app's landing hero gradient.
+ */
+export const BRAND_GRADIENTS = {
+    robosystems: 'linear-gradient(135deg, #06B6D4, #3B7AF5 55%, #6366F1)', // cyan → blue → indigo
+    roboledger: 'linear-gradient(135deg, #8B5CF6, #A855F7 55%, #D946EF)', // violet → purple → fuchsia
+    roboinvestor: 'linear-gradient(135deg, #10B981, #14B8A6 55%, #06B6D4)', // emerald → teal → cyan
+};
+export const APP_CONFIGS = {
+    roboinvestor: {
+        name: 'roboinvestor',
+        displayName: 'RoboInvestor',
+        url: process.env.NEXT_PUBLIC_ROBOINVESTOR_APP_URL || 'https://roboinvestor.ai',
+        description: 'Portfolio Management Agent',
+        initials: 'RI',
+        colorClass: 'bg-emerald-600 dark:bg-emerald-500',
+        brandColor: BRAND_COLORS.roboinvestor,
+    },
+    roboledger: {
+        name: 'roboledger',
+        displayName: 'RoboLedger',
+        url: process.env.NEXT_PUBLIC_ROBOLEDGER_APP_URL || 'https://roboledger.ai',
+        description: 'Accounting & Reporting Agent',
+        initials: 'RL',
+        colorClass: 'bg-violet-600 dark:bg-violet-500',
+        brandColor: BRAND_COLORS.roboledger,
+    },
+    robosystems: {
+        name: 'robosystems',
+        displayName: 'RoboSystems',
+        url: process.env.NEXT_PUBLIC_ROBOSYSTEMS_APP_URL || 'https://robosystems.ai',
+        description: 'Financial Intelligence Platform',
+        initials: 'RS',
+        colorClass: 'bg-blue-600 dark:bg-blue-500',
+        brandColor: BRAND_COLORS.robosystems,
+    },
+};
+export const getAppConfig = (appName) => {
+    return APP_CONFIGS[appName] || APP_CONFIGS.robosystems;
+};

package/auth-core/hooks.d.ts

@@ -0,0 +1,19 @@
+import type { AuthUser } from './types';
+/**
+ * Creates user-specific operations that can be used with auth context.
+ * This is a factory function that takes the auth client instance.
+ */
+export declare function useUserHook(authClient: any, setUser: (user: AuthUser | null) => void): {
+    refreshUser: () => Promise<AuthUser | null>;
+    updateProfile: (data: {
+        name?: string;
+        email?: string;
+    }) => Promise<AuthUser>;
+};
+/**
+ * Hook to handle token expiry errors globally
+ * Automatically redirects to login on token expiry
+ */
+export declare function useTokenExpiryHandler(logout: (reason?: string) => Promise<void>): {
+    handleTokenExpiry: (error: unknown) => Promise<boolean>;
+};

package/auth-core/hooks.js

@@ -0,0 +1,63 @@
+'use client';
+import { useCallback, useEffect } from 'react';
+import { TokenExpiredError } from './client';
+/**
+ * Creates user-specific operations that can be used with auth context.
+ * This is a factory function that takes the auth client instance.
+ */
+export function useUserHook(authClient, setUser) {
+    const refreshUser = useCallback(async () => {
+        try {
+            const user = await authClient.getCurrentUser();
+            setUser(user);
+            return user;
+        }
+        catch (error) {
+            setUser(null);
+            return null;
+        }
+    }, [authClient, setUser]);
+    const updateProfile = useCallback(async (data) => {
+        // This would use SDK updateUser method
+        // For now, refresh user data after update
+        const user = await refreshUser();
+        if (!user) {
+            throw new Error('User not found after update');
+        }
+        return user;
+    }, [refreshUser]);
+    return {
+        refreshUser,
+        updateProfile,
+    };
+}
+/**
+ * Hook to handle token expiry errors globally
+ * Automatically redirects to login on token expiry
+ */
+export function useTokenExpiryHandler(logout) {
+    const handleTokenExpiry = useCallback(async (error) => {
+        if (error instanceof TokenExpiredError) {
+            // Token expired, redirect to login
+            await logout('session_expired');
+            return true; // Error was handled
+        }
+        return false; // Error was not handled
+    }, [logout]);
+    // Set up global error handler for unhandled promise rejections
+    useEffect(() => {
+        const handleUnhandledRejection = (event) => {
+            if (event.reason instanceof TokenExpiredError) {
+                event.preventDefault(); // Prevent default error logging
+                handleTokenExpiry(event.reason);
+            }
+        };
+        if (typeof window !== 'undefined') {
+            window.addEventListener('unhandledrejection', handleUnhandledRejection);
+            return () => {
+                window.removeEventListener('unhandledrejection', handleUnhandledRejection);
+            };
+        }
+    }, [handleTokenExpiry]);
+    return { handleTokenExpiry };
+}

package/auth-core/index.d.ts

@@ -0,0 +1,6 @@
+export * from './cleanup';
+export * from './client';
+export * from './config';
+export * from './hooks';
+export * from './sso';
+export * from './types';

package/auth-core/index.js

@@ -0,0 +1,6 @@
+export * from './cleanup';
+export * from './client';
+export * from './config';
+export * from './hooks';
+export * from './sso';
+export * from './types';

package/auth-core/sso.d.ts

@@ -0,0 +1,42 @@
+import type { AppConfig, AuthUser } from './types';
+export declare class SSOManager {
+    private authClient;
+    constructor(apiUrl: string);
+    /**
+     * Check if user is already authenticated via SSO
+     */
+    checkSSOAuthentication(): Promise<AuthUser | null>;
+    /**
+     * Generate SSO token for cross-app authentication
+     */
+    generateSSOToken(): Promise<import("./types").SSOTokenResponse>;
+    /**
+     * Get SSO redirect URL using secure POST-based flow
+     */
+    getSSORedirectUrl(targetApp: string, returnUrl?: string): Promise<string>;
+    /**
+     * Handle SSO login using secure POST-based flow
+     */
+    handleSSOLogin(): Promise<AuthUser | null>;
+    /**
+     * Get available apps for the authenticated user
+     */
+    getAvailableApps(): AppConfig[];
+    /**
+     * Sanitize error objects for safe logging in development
+     */
+    private sanitizeErrorForLogging;
+    /**
+     * Navigate to another app with secure SSO
+     */
+    navigateToApp(targetApp: string, returnUrl?: string): Promise<void>;
+}
+/**
+ * Hook for SSO functionality
+ */
+export declare function useSSO(apiUrl: string): {
+    checkSSOAuthentication: () => Promise<AuthUser>;
+    handleSSOLogin: () => Promise<AuthUser>;
+    navigateToApp: (targetApp: string, returnUrl?: string) => Promise<void>;
+    getAvailableApps: () => AppConfig[];
+};

package/auth-core/sso.js

@@ -0,0 +1,281 @@
+import { useMemo } from 'react';
+import { RoboSystemsAuthClient } from './client';
+import { APP_CONFIGS } from './config';
+// Configuration constants
+const AUTH_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const NAVIGATION_DELAY_MS = 100; // 100ms delay for navigation
+// Debug logging helper
+const debugLog = (message, error) => {
+    if (process.env.NODE_ENV === 'development') {
+        console.debug(`[SSO] ${message}`, error);
+    }
+};
+export class SSOManager {
+    constructor(apiUrl) {
+        this.authClient = new RoboSystemsAuthClient(apiUrl);
+    }
+    /**
+     * Check if user is already authenticated via SSO
+     */
+    async checkSSOAuthentication() {
+        try {
+            return await this.authClient.checkAuthentication();
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    /**
+     * Generate SSO token for cross-app authentication
+     */
+    async generateSSOToken() {
+        return await this.authClient.generateSSOToken();
+    }
+    /**
+     * Get SSO redirect URL using secure POST-based flow
+     */
+    async getSSORedirectUrl(targetApp, returnUrl) {
+        const ssoData = await this.generateSSOToken();
+        const appConfig = APP_CONFIGS[targetApp];
+        if (!appConfig) {
+            throw new Error(`Unknown app: ${targetApp}`);
+        }
+        // Step 1: Exchange SSO token for secure session ID
+        const exchangeResult = await this.authClient.ssoExchange(ssoData.token, targetApp);
+        // Step 2: Create URL that will trigger the POST-based flow
+        const url = new URL('/login', appConfig.url);
+        // Pass session ID via URL parameters for cross-domain compatibility
+        url.searchParams.set('session_id', exchangeResult.session_id);
+        if (returnUrl) {
+            url.searchParams.set('returnUrl', returnUrl);
+        }
+        // Store only non-sensitive metadata in sessionStorage as backup for same-domain cases
+        // Note: We avoid storing the session_id in sessionStorage for security
+        try {
+            sessionStorage.setItem('sso_target_app', targetApp);
+            if (returnUrl) {
+                sessionStorage.setItem('sso_return_url', returnUrl);
+            }
+        }
+        catch (error) {
+            // Storage error - continue without backup storage
+            debugLog('sessionStorage write failed during SSO URL generation', error);
+        }
+        return url.toString();
+    }
+    /**
+     * Handle SSO login using secure POST-based flow
+     */
+    async handleSSOLogin() {
+        // Check for session ID from URL parameters (cross-domain compatible)
+        const urlParams = new URLSearchParams(window.location.search);
+        const sessionId = urlParams.get('session_id');
+        const returnUrl = urlParams.get('returnUrl');
+        // Check sessionStorage for return URL fallback (same-domain case)
+        // Note: We don't store session_id in sessionStorage for security
+        let sessionStorageReturn = null;
+        try {
+            sessionStorageReturn = sessionStorage.getItem('sso_return_url');
+        }
+        catch (error) {
+            // Storage access error - continue without fallback
+            debugLog('sessionStorage read failed during SSO login', error);
+        }
+        const finalSessionId = sessionId; // Only use URL parameter for session ID
+        const finalReturnUrl = returnUrl || sessionStorageReturn;
+        if (!finalSessionId) {
+            return null;
+        }
+        try {
+            // Complete SSO authentication using session ID
+            const authResponse = await this.authClient.ssoComplete(finalSessionId);
+            // Clean up both URL parameters and session storage
+            if (sessionId) {
+                // Clean up URL parameters
+                const newUrl = new URL(window.location.href);
+                newUrl.searchParams.delete('session_id');
+                newUrl.searchParams.delete('returnUrl');
+                window.history.replaceState({}, '', newUrl.toString());
+            }
+            // Clean up session storage
+            try {
+                sessionStorage.removeItem('sso_target_app');
+                sessionStorage.removeItem('sso_return_url');
+            }
+            catch (error) {
+                // Storage access error - continue silently
+                debugLog('sessionStorage cleanup failed during SSO success', error);
+            }
+            // Handle return URL if provided
+            if (finalReturnUrl && finalReturnUrl !== window.location.pathname) {
+                // Delay navigation to allow authentication to complete
+                setTimeout(() => {
+                    window.location.href = finalReturnUrl;
+                }, NAVIGATION_DELAY_MS);
+            }
+            return authResponse.user;
+        }
+        catch (error) {
+            // Clean up both URL parameters and session storage on error
+            if (sessionId) {
+                const newUrl = new URL(window.location.href);
+                newUrl.searchParams.delete('session_id');
+                newUrl.searchParams.delete('returnUrl');
+                window.history.replaceState({}, '', newUrl.toString());
+            }
+            try {
+                sessionStorage.removeItem('sso_target_app');
+                sessionStorage.removeItem('sso_return_url');
+            }
+            catch (error) {
+                // Storage access error - continue silently
+                debugLog('sessionStorage cleanup failed during SSO error', error);
+            }
+            // Log errors for monitoring in production (sanitized)
+            if (process.env.NODE_ENV === 'development') {
+                console.error('SSO login failed:', this.sanitizeErrorForLogging(error));
+            }
+            else {
+                // Production error monitoring - log sanitized errors for observability
+                console.error('SSO authentication failed:', {
+                    timestamp: new Date().toISOString(),
+                    error: this.sanitizeErrorForLogging(error),
+                    user_agent: (navigator === null || navigator === void 0 ? void 0 : navigator.userAgent) || 'unknown',
+                });
+            }
+            return null;
+        }
+    }
+    /**
+     * Get available apps for the authenticated user
+     */
+    getAvailableApps() {
+        return Object.values(APP_CONFIGS);
+    }
+    /**
+     * Sanitize error objects for safe logging in development
+     */
+    sanitizeErrorForLogging(error) {
+        var _a;
+        if (error instanceof Error) {
+            return {
+                name: error.name,
+                message: error.message,
+                // Exclude potentially sensitive stack traces in some cases
+                stack: ((_a = error.stack) === null || _a === void 0 ? void 0 : _a.split('\n').slice(0, 3).join('\n')) + '...',
+            };
+        }
+        if (typeof error === 'object' && error !== null) {
+            // Remove any fields that might contain sensitive data
+            const sanitized = Object.assign({}, error);
+            delete sanitized.token;
+            delete sanitized.session_id;
+            delete sanitized.password;
+            delete sanitized.key;
+            return sanitized;
+        }
+        return String(error);
+    }
+    /**
+     * Navigate to another app with secure SSO
+     */
+    async navigateToApp(targetApp, returnUrl) {
+        const appConfig = APP_CONFIGS[targetApp];
+        if (!appConfig) {
+            throw new Error(`Unknown app: ${targetApp}`);
+        }
+        // Check local auth cache first to avoid unnecessary SSO token generation
+        if (typeof window !== 'undefined') {
+            let cachedUser = null;
+            try {
+                cachedUser = sessionStorage.getItem('auth_user_cache');
+            }
+            catch (error) {
+                // Storage access error - proceed with SSO flow
+                debugLog('sessionStorage read failed during navigation cache check', error);
+            }
+            if (cachedUser) {
+                try {
+                    const userData = JSON.parse(cachedUser);
+                    const cacheAge = Date.now() - (userData.cached_at || 0);
+                    // REMOVED: Cache bypass logic that was skipping SSO flow
+                    // Always use proper SSO flow for cross-app authentication
+                    debugLog('Proceeding with full SSO flow for secure cross-app auth');
+                }
+                catch (error) {
+                    // Invalid cache, proceed with SSO flow
+                    debugLog('Invalid cache found, proceeding with SSO flow', error);
+                    try {
+                        sessionStorage.removeItem('auth_user_cache');
+                    }
+                    catch (removeError) {
+                        // Storage error - continue silently
+                    }
+                }
+            }
+        }
+        try {
+            // Fallback to full SSO flow for stale/missing cache
+            const ssoData = await this.generateSSOToken();
+            // Step 2: Exchange token for secure session ID
+            const exchangeResult = await this.authClient.ssoExchange(ssoData.token, targetApp);
+            // Step 3: Navigate to target app with secure session handoff
+            const targetUrl = new URL('/login', appConfig.url);
+            // Pass session ID via URL parameters for cross-domain compatibility
+            targetUrl.searchParams.set('session_id', exchangeResult.session_id);
+            if (returnUrl) {
+                targetUrl.searchParams.set('returnUrl', returnUrl);
+            }
+            // Store only non-sensitive metadata in sessionStorage as backup for same-domain cases
+            // Note: We avoid storing the session_id in sessionStorage for security
+            if (typeof window !== 'undefined') {
+                try {
+                    sessionStorage.setItem('sso_target_app', targetApp);
+                    if (returnUrl) {
+                        sessionStorage.setItem('sso_return_url', returnUrl);
+                    }
+                }
+                catch (error) {
+                    // Storage error - continue without backup storage
+                    debugLog('sessionStorage write failed during SSO navigation', error);
+                }
+            }
+            // Navigate to target app
+            window.location.href = targetUrl.toString();
+        }
+        catch (error) {
+            if (process.env.NODE_ENV === 'development') {
+                console.error('Failed to navigate to app:', error);
+            }
+            debugLog('SSO navigation failed, attempting fallback', error);
+            // Fallback to direct navigation
+            try {
+                const targetUrl = new URL(appConfig.url);
+                if (returnUrl) {
+                    targetUrl.searchParams.set('returnUrl', returnUrl);
+                }
+                window.location.href = targetUrl.toString();
+            }
+            catch (locationError) {
+                if (process.env.NODE_ENV === 'development') {
+                    console.error('Fallback navigation failed:', locationError);
+                }
+                debugLog('All navigation methods failed', locationError);
+                // Final fallback using window.open
+                window.open(appConfig.url, '_self');
+            }
+        }
+    }
+}
+/**
+ * Hook for SSO functionality
+ */
+export function useSSO(apiUrl) {
+    const ssoManager = useMemo(() => new SSOManager(apiUrl), [apiUrl]);
+    return useMemo(() => ({
+        checkSSOAuthentication: () => ssoManager.checkSSOAuthentication(),
+        handleSSOLogin: () => ssoManager.handleSSOLogin(),
+        navigateToApp: (targetApp, returnUrl) => ssoManager.navigateToApp(targetApp, returnUrl),
+        getAvailableApps: () => ssoManager.getAvailableApps(),
+    }), [ssoManager]);
+}

package/auth-core/token-storage.d.ts

@@ -0,0 +1,58 @@
+/**
+ * JWT Token Storage Management
+ *
+ * Provides secure storage for JWT tokens using localStorage
+ * for cross-domain authentication support and persistent sessions.
+ */
+export interface TokenData {
+    token: string;
+    expiresAt: number;
+    refreshThreshold?: number;
+}
+export type TokenStatus = 'valid' | 'warning' | 'expired';
+/**
+ * Store JWT token in localStorage
+ * @param token - The JWT token from login response
+ * @param expiresIn - Optional expiry time in seconds (default 30 minutes)
+ * @param refreshThreshold - Optional refresh threshold in seconds (default 5 minutes)
+ */
+export declare function storeToken(token: string, expiresIn?: number, refreshThreshold?: number): void;
+/**
+ * Retrieve JWT token from localStorage
+ * @returns The stored token or null if not found/expired
+ */
+export declare function getToken(): string | null;
+/**
+ * Clear JWT token from storage
+ */
+export declare function clearToken(): void;
+/**
+ * Get current token status
+ * @returns 'valid' if token is fresh, 'warning' if approaching expiry, 'expired' if expired
+ */
+export declare function getTokenStatus(): TokenStatus;
+/**
+ * Get time until token expiry in milliseconds
+ * @returns Time until expiry in ms, or 0 if expired
+ */
+export declare function getTimeUntilExpiry(): number;
+/**
+ * Check if a valid token exists
+ * @returns True if a non-expired token exists
+ */
+export declare function hasValidToken(): boolean;
+/**
+ * Get the Authorization header value for API requests
+ * @returns Bearer token header or null
+ */
+export declare function getAuthHeader(): string | null;
+/**
+ * Extract token from login response and store it
+ * @param response - The auth response from login/refresh
+ */
+export declare function handleAuthResponse(response: any): void;
+/**
+ * Get valid token (backend handles refresh via grace period)
+ * @returns Valid token or null if expired
+ */
+export declare function getValidToken(): Promise<string | null>;