@shaykec/app-agent 1.0.5 → 1.0.6

package/templates/shared/android/WixMemberBackend/WixApiClient.kt

@@ -0,0 +1,207 @@
+package com.appship.shared.wix.member
+
+import com.appship.shared.secrets.SecretsConfig
+import com.appship.shared.wix.siteselector.WixSiteManager
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import okhttp3.*
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.RequestBody.Companion.toRequestBody
+import java.io.IOException
+
+/**
+ * Base HTTP client for Wix Member API.
+ * Handles authentication headers, token refresh, and JSON serialization.
+ * Uses [WixSiteManager] to read siteId dynamically, enabling runtime site switching.
+ */
+class WixApiClient(
+    private val authManager: WixAuthManager,
+    private val siteManager: WixSiteManager? = null
+) {
+    private val baseURL = "https://www.wixapis.com"
+
+    /** Resolves siteId dynamically: WixSiteManager first, then SecretsConfig fallback. */
+    private val siteId: String
+        get() = siteManager?.currentSiteId?.value?.takeIf { it.isNotEmpty() }
+            ?: SecretsConfig.wixSiteId
+    
+    private val json = Json {
+        ignoreUnknownKeys = true
+        isLenient = true
+        encodeDefaults = false
+    }
+    
+    private val client: OkHttpClient = OkHttpClient.Builder()
+        .addInterceptor { chain ->
+            val request = chain.request().newBuilder()
+                .addHeader("Authorization", "Bearer ${authManager.getCurrentToken()}")
+                .addHeader("wix-site-id", siteId)
+                .addHeader("Content-Type", "application/json")
+                .build()
+            
+            val response = chain.proceed(request)
+            
+            // Auto-refresh token on 401
+            if (response.code == 401 && authManager.isLoggedIn) {
+                response.close()
+                authManager.refreshToken()
+                // Retry with new token
+                val retryRequest = chain.request().newBuilder()
+                    .addHeader("Authorization", "Bearer ${authManager.getCurrentToken()}")
+                    .addHeader("wix-site-id", siteId)
+                    .addHeader("Content-Type", "application/json")
+                    .build()
+                chain.proceed(retryRequest)
+            } else {
+                response
+            }
+        }
+        .build()
+    
+    /**
+     * GET request with query parameters
+     */
+    suspend fun <T> get(
+        path: String,
+        queryParams: Map<String, String> = emptyMap()
+    ): Result<T> where T : Any = withContext(Dispatchers.IO) {
+        try {
+            val urlBuilder = HttpUrl.parse("$baseURL$path")?.newBuilder()
+                ?: return@withContext Result.failure(WixApiError.NetworkError("Invalid URL: $path"))
+            
+            queryParams.forEach { (key, value) ->
+                urlBuilder.addQueryParameter(key, value)
+            }
+            
+            val request = Request.Builder()
+                .url(urlBuilder.build())
+                .get()
+                .build()
+            
+            val response = client.newCall(request).execute()
+            handleResponse<T>(response)
+        } catch (e: IOException) {
+            Result.failure(WixApiError.NetworkError(e.message ?: "Network error"))
+        } catch (e: Exception) {
+            Result.failure(WixApiError.UnknownError(e.message ?: "Unknown error"))
+        }
+    }
+    
+    /**
+     * POST request with body
+     */
+    suspend fun <T, U> post(
+        path: String,
+        body: T
+    ): Result<U> where T : Any, U : Any = withContext(Dispatchers.IO) {
+        try {
+            val jsonBody = json.encodeToString(body).toRequestBody("application/json".toMediaType())
+            
+            val request = Request.Builder()
+                .url("$baseURL$path")
+                .post(jsonBody)
+                .build()
+            
+            val response = client.newCall(request).execute()
+            handleResponse<U>(response)
+        } catch (e: IOException) {
+            Result.failure(WixApiError.NetworkError(e.message ?: "Network error"))
+        } catch (e: Exception) {
+            Result.failure(WixApiError.UnknownError(e.message ?: "Unknown error"))
+        }
+    }
+    
+    /**
+     * PUT request with body
+     */
+    suspend fun <T, U> put(
+        path: String,
+        body: T
+    ): Result<U> where T : Any, U : Any = withContext(Dispatchers.IO) {
+        try {
+            val jsonBody = json.encodeToString(body).toRequestBody("application/json".toMediaType())
+            
+            val request = Request.Builder()
+                .url("$baseURL$path")
+                .put(jsonBody)
+                .build()
+            
+            val response = client.newCall(request).execute()
+            handleResponse<U>(response)
+        } catch (e: IOException) {
+            Result.failure(WixApiError.NetworkError(e.message ?: "Network error"))
+        } catch (e: Exception) {
+            Result.failure(WixApiError.UnknownError(e.message ?: "Unknown error"))
+        }
+    }
+    
+    /**
+     * DELETE request
+     */
+    suspend fun <T> delete(
+        path: String
+    ): Result<T> where T : Any = withContext(Dispatchers.IO) {
+        try {
+            val request = Request.Builder()
+                .url("$baseURL$path")
+                .delete()
+                .build()
+            
+            val response = client.newCall(request).execute()
+            handleResponse<T>(response)
+        } catch (e: IOException) {
+            Result.failure(WixApiError.NetworkError(e.message ?: "Network error"))
+        } catch (e: Exception) {
+            Result.failure(WixApiError.UnknownError(e.message ?: "Unknown error"))
+        }
+    }
+    
+    private inline fun <reified T> handleResponse(response: Response): Result<T> {
+        return when {
+            response.isSuccessful -> {
+                val body = response.body?.string()
+                if (body.isNullOrBlank()) {
+                    Result.failure(WixApiError.EmptyResponse)
+                } else {
+                    try {
+                        val decoded = json.decodeFromString<T>(body)
+                        Result.success(decoded)
+                    } catch (e: Exception) {
+                        Result.failure(WixApiError.ParseError(e.message ?: "Failed to parse response"))
+                    }
+                }
+            }
+            response.code == 401 -> {
+                Result.failure(WixApiError.Unauthorized)
+            }
+            response.code == 404 -> {
+                Result.failure(WixApiError.NotFound)
+            }
+            response.code in 400..499 -> {
+                Result.failure(WixApiError.ClientError(response.code, response.message))
+            }
+            response.code in 500..599 -> {
+                Result.failure(WixApiError.ServerError(response.code, response.message))
+            }
+            else -> {
+                Result.failure(WixApiError.UnknownError("Unexpected status code: ${response.code}"))
+            }
+        }
+    }
+}
+
+/**
+ * Wix API error types
+ */
+sealed class WixApiError(message: String) : Exception(message) {
+    object Unauthorized : WixApiError("Unauthorized - authentication required")
+    object NotFound : WixApiError("Resource not found")
+    object EmptyResponse : WixApiError("Empty response from server")
+    data class NetworkError(override val message: String) : WixApiError(message)
+    data class ParseError(override val message: String) : WixApiError(message)
+    data class ClientError(val code: Int, override val message: String) : WixApiError("Client error $code: $message")
+    data class ServerError(val code: Int, override val message: String) : WixApiError("Server error $code: $message")
+    data class UnknownError(override val message: String) : WixApiError(message)
+}

package/templates/shared/android/WixMemberBackend/WixAuthManager.kt

@@ -0,0 +1,476 @@
+package com.appship.shared.wix.member
+
+import android.content.Context
+import android.content.SharedPreferences
+import android.net.Uri
+import androidx.browser.customtabs.CustomTabsIntent
+import androidx.lifecycle.ComponentActivity
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import com.appship.shared.secrets.SecretsConfig
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import okhttp3.*
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.RequestBody.Companion.toRequestBody
+import java.io.IOException
+import java.security.SecureRandom
+import java.util.Base64
+
+/**
+ * Wix authentication manager with visitor-first model.
+ * Auto-generates visitor tokens for read operations.
+ * Prompts login for transaction operations (buy, book, RSVP, comment).
+ */
+class WixAuthManager(private val context: Context) {
+    
+    private val prefs: SharedPreferences = getEncryptedPrefs()
+    private val siteId = SecretsConfig.wixSiteId
+    private val clientId = SecretsConfig.wixClientId
+    private val redirectUrl = SecretsConfig.wixRedirectUrl
+    
+    private val json = Json {
+        ignoreUnknownKeys = true
+        isLenient = true
+    }
+    
+    private val _authState = MutableStateFlow<AuthState>(AuthState.Visitor(""))
+    val authState: StateFlow<AuthState> = _authState.asStateFlow()
+    
+    private val _isLoading = MutableStateFlow(false)
+    val isLoading: StateFlow<Boolean> = _isLoading.asStateFlow()
+    
+    private val _error = MutableStateFlow<WixAuthError?>(null)
+    val error: StateFlow<WixAuthError?> = _error.asStateFlow()
+    
+    private val client = OkHttpClient()
+    
+    init {
+        initializeAuth()
+    }
+    
+    /**
+     * Get encrypted shared preferences for token storage
+     */
+    private fun getEncryptedPrefs(): SharedPreferences {
+        val masterKey = MasterKey.Builder(context)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            .build()
+        
+        return EncryptedSharedPreferences.create(
+            context,
+            "wix_auth_prefs",
+            masterKey,
+            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+    }
+    
+    /**
+     * Initialize auth state - load saved member token or fetch visitor token
+     */
+    private fun initializeAuth() {
+        val savedAccessToken = prefs.getString("access_token", null)
+        val savedRefreshToken = prefs.getString("refresh_token", null)
+        val savedMemberId = prefs.getString("member_id", null)
+        
+        if (savedAccessToken != null && savedRefreshToken != null) {
+            // Load saved member session
+            val member = WixMember(
+                id = savedMemberId ?: "",
+                email = prefs.getString("member_email", null),
+                displayName = prefs.getString("member_display_name", null),
+                profilePhoto = prefs.getString("member_photo", null)
+            )
+            _authState.value = AuthState.Member(savedAccessToken, savedRefreshToken, member)
+        } else {
+            // Fetch visitor token
+            fetchVisitorToken()
+        }
+    }
+    
+    /**
+     * Fetch visitor token for anonymous access
+     */
+    private fun fetchVisitorToken() {
+        _isLoading.value = true
+        _error.value = null
+        
+        // Generate visitor token via Wix API
+        val requestBody = """
+            {
+                "siteId": "$siteId"
+            }
+        """.trimIndent().toRequestBody("application/json".toMediaType())
+        
+        val request = Request.Builder()
+            .url("https://www.wixapis.com/visitor/v1/tokens")
+            .post(requestBody)
+            .addHeader("wix-site-id", siteId)
+            .build()
+        
+        client.newCall(request).enqueue(object : Callback {
+            override fun onFailure(call: Call, e: IOException) {
+                _isLoading.value = false
+                _error.value = WixAuthError.NetworkError(e.message ?: "Failed to fetch visitor token")
+                // Fallback to empty token - API calls will fail but app won't crash
+                _authState.value = AuthState.Visitor("")
+            }
+            
+            override fun onResponse(call: Call, response: Response) {
+                _isLoading.value = false
+                if (response.isSuccessful) {
+                    val body = response.body?.string() ?: ""
+                    try {
+                        val tokenResponse = json.decodeFromString<VisitorTokenResponse>(body)
+                        val token = tokenResponse.token ?: ""
+                        _authState.value = AuthState.Visitor(token)
+                        prefs.edit().putString("visitor_token", token).apply()
+                    } catch (e: Exception) {
+                        _error.value = WixAuthError.NetworkError("Failed to parse visitor token")
+                        _authState.value = AuthState.Visitor("")
+                    }
+                } else {
+                    _error.value = WixAuthError.NetworkError("Failed to fetch visitor token: ${response.code}")
+                    _authState.value = AuthState.Visitor("")
+                }
+            }
+        })
+    }
+    
+    /**
+     * Login with OAuth using Chrome Custom Tabs (PKCE flow)
+     */
+    suspend fun loginWithOAuth(activity: ComponentActivity) = withContext(Dispatchers.Main) {
+        _isLoading.value = true
+        _error.value = null
+        
+        // Generate PKCE code verifier and challenge
+        val codeVerifier = generateCodeVerifier()
+        val codeChallenge = generateCodeChallenge(codeVerifier)
+        val state = generateState()
+        
+        // Store PKCE values for callback
+        prefs.edit()
+            .putString("oauth_code_verifier", codeVerifier)
+            .putString("oauth_state", state)
+            .apply()
+        
+        // Build OAuth URL
+        val authUrl = Uri.parse("https://www.wix.com/oauth/authorize").buildUpon()
+            .appendQueryParameter("client_id", clientId)
+            .appendQueryParameter("redirect_uri", redirectUrl)
+            .appendQueryParameter("response_type", "code")
+            .appendQueryParameter("scope", "offline_access")
+            .appendQueryParameter("code_challenge", codeChallenge)
+            .appendQueryParameter("code_challenge_method", "S256")
+            .appendQueryParameter("state", state)
+            .build()
+        
+        // Launch Chrome Custom Tabs
+        val customTabsIntent = CustomTabsIntent.Builder()
+            .setShowTitle(true)
+            .build()
+        
+        customTabsIntent.launchUrl(activity, authUrl)
+        
+        // Note: OAuth callback handling should be done in the app's deep link handler
+        // This manager provides exchangeCodeForToken() to complete the flow
+    }
+    
+    /**
+     * Exchange authorization code for access token (called from deep link handler)
+     */
+    suspend fun exchangeCodeForToken(code: String, state: String): Result<WixMember> = withContext(Dispatchers.IO) {
+        try {
+            // Verify state
+            val savedState = prefs.getString("oauth_state", null)
+            if (savedState != state) {
+                return@withContext Result.failure(WixAuthError.InvalidState)
+            }
+            
+            val codeVerifier = prefs.getString("oauth_code_verifier", null)
+                ?: return@withContext Result.failure(WixAuthError.MissingCodeVerifier)
+            
+            // Exchange code for token
+            val requestBody = TokenExchangeRequest(
+                clientId = clientId,
+                code = code,
+                codeVerifier = codeVerifier,
+                redirectUri = redirectUrl,
+                grantType = "authorization_code"
+            )
+            
+            val jsonBody = json.encodeToString(requestBody).toRequestBody("application/json".toMediaType())
+            
+            val request = Request.Builder()
+                .url("https://www.wix.com/oauth/access")
+                .post(jsonBody)
+                .build()
+            
+            val response = client.newCall(request).execute()
+            
+            if (response.isSuccessful) {
+                val body = response.body?.string() ?: return@withContext Result.failure(WixAuthError.NetworkError("Empty response"))
+                
+                try {
+                    val tokenResponse = json.decodeFromString<TokenResponse>(body)
+                    val accessToken = tokenResponse.accessToken ?: return@withContext Result.failure(WixAuthError.NetworkError("Missing access token"))
+                    val refreshToken = tokenResponse.refreshToken ?: return@withContext Result.failure(WixAuthError.NetworkError("Missing refresh token"))
+                    val memberId = tokenResponse.memberId
+                    
+                    // Fetch member details
+                    val member = fetchMemberDetails(accessToken, memberId ?: "")
+                    
+                    // Save tokens
+                    prefs.edit()
+                        .putString("access_token", accessToken)
+                        .putString("refresh_token", refreshToken)
+                        .putString("member_id", memberId)
+                        .putString("member_email", member.email)
+                        .putString("member_display_name", member.displayName)
+                        .putString("member_photo", member.profilePhoto)
+                        .remove("oauth_code_verifier")
+                        .remove("oauth_state")
+                        .apply()
+                    
+                    _authState.value = AuthState.Member(accessToken, refreshToken, member)
+                    _isLoading.value = false
+                    Result.success(member)
+                } catch (e: Exception) {
+                    _isLoading.value = false
+                    Result.failure(WixAuthError.NetworkError("Failed to parse token response: ${e.message}"))
+                }
+            } else {
+                _isLoading.value = false
+                Result.failure(WixAuthError.NetworkError("Token exchange failed: ${response.code}"))
+            }
+        } catch (e: Exception) {
+            _isLoading.value = false
+            Result.failure(WixAuthError.NetworkError(e.message ?: "Token exchange failed"))
+        }
+    }
+    
+    /**
+     * Fetch member details from Wix API
+     */
+    private suspend fun fetchMemberDetails(accessToken: String, memberId: String): WixMember = withContext(Dispatchers.IO) {
+        val request = Request.Builder()
+            .url("https://www.wixapis.com/members/v1/members/$memberId")
+            .get()
+            .addHeader("Authorization", "Bearer $accessToken")
+            .addHeader("wix-site-id", siteId)
+            .build()
+        
+        val response = client.newCall(request).execute()
+        
+        if (response.isSuccessful) {
+            val body = response.body?.string() ?: ""
+            try {
+                json.decodeFromString<WixMember>(body)
+            } catch (e: Exception) {
+                WixMember(id = memberId)
+            }
+        } else {
+            WixMember(id = memberId)
+        }
+    }
+    
+    /**
+     * Refresh access token using refresh token
+     */
+    suspend fun refreshToken() = withContext(Dispatchers.IO) {
+        val currentState = _authState.value
+        if (currentState !is AuthState.Member) {
+            return@withContext
+        }
+        
+        val refreshToken = currentState.refreshToken
+        
+        val requestBody = RefreshTokenRequest(
+            clientId = clientId,
+            refreshToken = refreshToken,
+            grantType = "refresh_token"
+        )
+        
+        val jsonBody = json.encodeToString(requestBody).toRequestBody("application/json".toMediaType())
+        
+        val request = Request.Builder()
+            .url("https://www.wix.com/oauth/access")
+            .post(jsonBody)
+            .build()
+        
+        try {
+            val response = client.newCall(request).execute()
+            
+            if (response.isSuccessful) {
+                val body = response.body?.string() ?: return@withContext
+                try {
+                    val tokenResponse = json.decodeFromString<TokenResponse>(body)
+                    val accessToken = tokenResponse.accessToken
+                    val newRefreshToken = tokenResponse.refreshToken
+                    
+                    if (accessToken != null) {
+                        prefs.edit()
+                            .putString("access_token", accessToken)
+                            .apply()
+                        
+                        if (newRefreshToken != null) {
+                            prefs.edit().putString("refresh_token", newRefreshToken).apply()
+                            _authState.value = currentState.copy(
+                                accessToken = accessToken,
+                                refreshToken = newRefreshToken
+                            )
+                        } else {
+                            _authState.value = currentState.copy(accessToken = accessToken)
+                        }
+                    }
+                } catch (e: Exception) {
+                    // Refresh failed - logout
+                    logout()
+                }
+            } else {
+                // Refresh failed - logout
+                logout()
+            }
+        } catch (e: Exception) {
+            // Refresh failed - logout
+            logout()
+        }
+    }
+    
+    /**
+     * Logout - clear member token and revert to visitor
+     */
+    fun logout() {
+        prefs.edit()
+            .remove("access_token")
+            .remove("refresh_token")
+            .remove("member_id")
+            .remove("member_email")
+            .remove("member_display_name")
+            .remove("member_photo")
+            .apply()
+        
+        val visitorToken = prefs.getString("visitor_token", "") ?: ""
+        _authState.value = AuthState.Visitor(visitorToken)
+    }
+    
+    /**
+     * Require login - check if logged in, prompt if needed
+     */
+    suspend fun requireLogin(
+        activity: ComponentActivity,
+        action: suspend () -> Unit
+    ) {
+        if (isLoggedIn) {
+            action()
+        } else {
+            loginWithOAuth(activity)
+            // Note: After OAuth completes, the app should retry the action
+        }
+    }
+    
+    /**
+     * Get current token (visitor or member)
+     */
+    fun getCurrentToken(): String {
+        return when (val state = _authState.value) {
+            is AuthState.Visitor -> state.token
+            is AuthState.Member -> state.accessToken
+            else -> ""
+        }
+    }
+    
+    val isLoggedIn: Boolean
+        get() = _authState.value is AuthState.Member
+    
+    val currentMember: WixMember?
+        get() = when (val state = _authState.value) {
+            is AuthState.Member -> state.member
+            else -> null
+        }
+    
+    // MARK: - PKCE Helpers
+    
+    private fun generateCodeVerifier(): String {
+        val bytes = ByteArray(32)
+        SecureRandom().nextBytes(bytes)
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
+    }
+    
+    private fun generateCodeChallenge(verifier: String): String {
+        val digest = java.security.MessageDigest.getInstance("SHA-256")
+        val hash = digest.digest(verifier.toByteArray())
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(hash)
+    }
+    
+    private fun generateState(): String {
+        val bytes = ByteArray(16)
+        SecureRandom().nextBytes(bytes)
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
+    }
+}
+
+/**
+ * Authentication state sealed class
+ */
+sealed class AuthState {
+    data class Visitor(val token: String) : AuthState()
+    object Authenticating : AuthState()
+    data class Member(val accessToken: String, val refreshToken: String, val member: WixMember) : AuthState() {
+        fun copy(accessToken: String? = null, refreshToken: String? = null): Member {
+            return Member(
+                accessToken = accessToken ?: this.accessToken,
+                refreshToken = refreshToken ?: this.refreshToken,
+                member = this.member
+            )
+        }
+    }
+    data class Error(val error: WixAuthError) : AuthState()
+}
+
+/**
+ * Authentication error types
+ */
+sealed class WixAuthError(message: String) : Exception(message) {
+    object InvalidState : WixAuthError("Invalid OAuth state")
+    object MissingCodeVerifier : WixAuthError("Missing code verifier")
+    data class NetworkError(override val message: String) : WixAuthError(message)
+    data class UnknownError(override val message: String) : WixAuthError(message)
+}
+
+// MARK: - Serialization Models
+
+@Serializable
+private data class VisitorTokenResponse(
+    val token: String? = null
+)
+
+@Serializable
+private data class TokenExchangeRequest(
+    val client_id: String,
+    val code: String,
+    val code_verifier: String,
+    val redirect_uri: String,
+    val grant_type: String
+)
+
+@Serializable
+private data class RefreshTokenRequest(
+    val client_id: String,
+    val refresh_token: String,
+    val grant_type: String
+)
+
+@Serializable
+private data class TokenResponse(
+    val access_token: String? = null,
+    val refresh_token: String? = null,
+    val member_id: String? = null
+)