@structured-id/ui-core 0.1.5

package/src/profile/composables/useIdentityApi.ts

@@ -0,0 +1,123 @@
+/**
+ * Profile identity API composable.
+ *
+ * Wraps IdentityServiceClient proto calls with Bearer auth.
+ * Shared between profile-ui-ce, profile-ui-ee, and frontend.
+ */
+import {
+  getTransport,
+  IdentityServiceClient,
+  type Profile,
+  type Session,
+  type Credential,
+  type Principal,
+  ProfileStatus,
+  PrincipalType,
+  CredentialType,
+  AuthenticatorAttachment,
+  Timestamp,
+} from "../../index";
+import { authMeta } from "../auth";
+
+function client(): IdentityServiceClient {
+  return new IdentityServiceClient(getTransport());
+}
+
+// ── Profile ──
+
+export type { Profile, Principal };
+
+export async function fetchCurrentProfile(): Promise<Profile> {
+  const { response } = await client().getCurrentProfile({}, { meta: authMeta() });
+  return response.profile!;
+}
+
+export async function updateProfile(
+  id: string,
+  update: {
+    givenName?: string;
+    familyName?: string;
+    middleName?: string;
+    avatarUrl?: string;
+  },
+): Promise<Profile> {
+  const { response } = await client().updateProfile(
+    {
+      id,
+      givenName: update.givenName,
+      familyName: update.familyName,
+      middleName: update.middleName,
+      avatarUrl: update.avatarUrl,
+    },
+    { meta: authMeta() },
+  );
+  return response.profile!;
+}
+
+// ── Sessions ──
+
+export type { Session };
+
+export async function fetchSessions(profileId: string): Promise<Session[]> {
+  const { response } = await client().listSessions(
+    { profileId },
+    { meta: authMeta() },
+  );
+  return response.sessions;
+}
+
+export async function revokeSession(sessionId: string): Promise<void> {
+  await client().revokeSession({ sessionId }, { meta: authMeta() });
+}
+
+// ── Credentials ──
+
+export type { Credential };
+
+export async function fetchCredentials(
+  profileId: string,
+): Promise<Credential[]> {
+  const { response } = await client().listCredentials(
+    { profileId },
+    { meta: authMeta() },
+  );
+  return response.credentials;
+}
+
+export async function revokeCredential(credentialId: string): Promise<void> {
+  await client().revokeCredential({ credentialId }, { meta: authMeta() });
+}
+
+export async function updateCredentialLabel(
+  credentialId: string,
+  label: string,
+): Promise<Credential> {
+  const { response } = await client().updateCredential(
+    { credentialId, label },
+    { meta: authMeta() },
+  );
+  return response.credential!;
+}
+
+// ── Principals ──
+
+export async function fetchPrincipals(profileId: string): Promise<Principal[]> {
+  const { response } = await client().listPrincipals(
+    { profileId },
+    { meta: authMeta() },
+  );
+  return response.principals;
+}
+
+export async function removePrincipal(principalId: string): Promise<void> {
+  await client().removePrincipal({ principalId }, { meta: authMeta() });
+}
+
+// Re-export enums and Timestamp for convenience
+export {
+  ProfileStatus,
+  PrincipalType,
+  CredentialType,
+  AuthenticatorAttachment,
+  Timestamp,
+};

package/src/profile/composables/useLoginSuccess.test.ts

@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { setActivePinia, createPinia } from "pinia";
+import { createApp, defineComponent } from "vue";
+import { createRouter, createMemoryHistory } from "vue-router";
+import { useLoginSuccess } from "./useLoginSuccess";
+import { useAuthStore } from "../../stores/auth";
+
+// Mock checkBffSession from BFF composable
+vi.mock("../../composables/useBffAuth", () => ({
+  checkBffSession: vi.fn(),
+}));
+
+import { checkBffSession } from "../../composables/useBffAuth";
+const mockCheckBffSession = vi.mocked(checkBffSession);
+
+// Helper: run composable inside a real Vue app with router + pinia
+async function withApp<T>(
+  fn: () => T,
+): Promise<{ result: T; router: ReturnType<typeof createRouter> }> {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: "/", component: { template: "<div />" } },
+      { path: "/account", component: { template: "<div />" } },
+      { path: "/admin", component: { template: "<div />" } },
+    ],
+  });
+  await router.push("/");
+  await router.isReady();
+
+  const pinia = createPinia();
+  setActivePinia(pinia);
+
+  let result: T;
+  const App = defineComponent({
+    setup() {
+      result = fn();
+      return () => null;
+    },
+  });
+
+  const app = createApp(App);
+  app.use(pinia);
+  app.use(router);
+  app.mount(document.createElement("div"));
+
+  return { result: result!, router };
+}
+
+describe("useLoginSuccess (BFF cookie mode)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("calls checkBffSession and populates auth store on success", async () => {
+    mockCheckBffSession.mockResolvedValue({
+      sub: "profile-uuid-1",
+      name: "Alice Smith",
+      email: "alice@example.com",
+      preferred_username: "alice",
+    });
+
+    const { result } = await withApp(() => useLoginSuccess("/account"));
+    const auth = useAuthStore();
+
+    await result.onLoginSuccess();
+
+    expect(mockCheckBffSession).toHaveBeenCalled();
+    expect(auth.isAuthenticated).toBe(true);
+    expect(auth.profileId).toBe("profile-uuid-1");
+    expect(auth.displayName).toBe("Alice Smith");
+    expect(auth.email).toBe("alice@example.com");
+  });
+
+  it("navigates to redirectTo after BFF session check", async () => {
+    mockCheckBffSession.mockResolvedValue({ sub: "p1" });
+
+    const { result, router } = await withApp(() => useLoginSuccess("/admin"));
+
+    await result.onLoginSuccess();
+
+    await router.isReady();
+    expect(router.currentRoute.value.path).toBe("/admin");
+  });
+
+  it("navigates even if BFF session check fails", async () => {
+    mockCheckBffSession.mockRejectedValue(new Error("Network error"));
+
+    const { result, router } = await withApp(() => useLoginSuccess("/account"));
+    const auth = useAuthStore();
+
+    await result.onLoginSuccess();
+
+    await router.isReady();
+    expect(router.currentRoute.value.path).toBe("/account");
+    // Auth state not set (session check failed)
+    expect(auth.isAuthenticated).toBe(false);
+  });
+
+  it("navigates when BFF session returns null (cookie not yet set)", async () => {
+    mockCheckBffSession.mockResolvedValue(null);
+
+    const { result, router } = await withApp(() => useLoginSuccess("/account"));
+    const auth = useAuthStore();
+
+    await result.onLoginSuccess();
+
+    await router.isReady();
+    expect(router.currentRoute.value.path).toBe("/account");
+    expect(auth.isAuthenticated).toBe(false);
+  });
+});

package/src/profile/composables/useLoginSuccess.ts

@@ -0,0 +1,65 @@
+/**
+ * Shared post-login success handler.
+ *
+ * After BFF migration (#536i-3): tokens are set server-side via BFF session cookie.
+ * The SPA no longer stores tokens — it only calls checkBffSession() to populate
+ * the auth store from the BFF /auth/userinfo endpoint.
+ *
+ * The BFF login flow:
+ *   1. App redirects to /auth/login (PKCE initiation)
+ *   2. User authenticates on the IdP
+ *   3. BFF callback sets httpOnly session cookie
+ *   4. BFF redirects back to SPA
+ *   5. SPA calls checkBffSession() → setBffSession() → navigates to dashboard
+ *
+ * For apps where the SPA IS the auth UI (personal-ui OPAQUE flow):
+ *   The OPAQUE login completes, sid-auth sets the server-side session,
+ *   and this handler fetches userinfo from BFF to restore session state.
+ *
+ * Used by all apps (personal-ui, admin-ui, frontend) for consistent behavior.
+ */
+import { useRouter } from "vue-router";
+import { useAuthStore } from "../../index";
+import { checkBffSession } from "../../index";
+
+export interface LoginSuccessResult {
+  sessionId?: string;
+}
+
+/**
+ * Create a login success handler that restores BFF session state and navigates.
+ *
+ * @param redirectTo - Route to navigate after successful login (e.g., "/account", "/admin")
+ *
+ * @example
+ * ```vue
+ * <script setup>
+ * import { useLoginSuccess } from "@structured-id/ui-core/profile";
+ * const { onLoginSuccess } = useLoginSuccess("/account");
+ * </script>
+ * <template>
+ *   <SidLoginForm :login-fn="login" @success="onLoginSuccess" />
+ * </template>
+ * ```
+ */
+export function useLoginSuccess(redirectTo: string) {
+  const auth = useAuthStore();
+  const router = useRouter();
+
+  async function onLoginSuccess(_result?: LoginSuccessResult) {
+    // Restore BFF session from /auth/userinfo — the BFF set the httpOnly cookie
+    // during the login flow. We fetch userinfo to populate the auth store.
+    try {
+      const userInfo = await checkBffSession();
+      if (userInfo) {
+        auth.setBffSession(userInfo);
+      }
+    } catch {
+      // Non-critical — navigation will succeed, route guard will re-check session
+    }
+
+    await router.push(redirectTo);
+  }
+
+  return { onLoginSuccess };
+}

package/src/profile/composables/useOpaqueAuth.test.ts

@@ -0,0 +1,290 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  createOpaqueAuth,
+  type OpaqueClientApi,
+  type OpaqueClientFactory,
+} from "./useOpaqueAuth";
+
+// Mock the gRPC wrappers
+vi.mock("./useAuthApi", () => ({
+  opaqueLoginStart: vi.fn(),
+  opaqueLoginFinish: vi.fn(),
+  opaqueRegistrationStart: vi.fn(),
+  opaqueRegistrationFinish: vi.fn(),
+}));
+
+import {
+  opaqueLoginStart,
+  opaqueLoginFinish,
+  opaqueRegistrationStart,
+  opaqueRegistrationFinish,
+  type OpaqueLoginStartResponse,
+  type OpaqueLoginFinishResponse,
+  type OpaqueRegistrationStartResponse,
+  type OpaqueRegistrationFinishResponse,
+} from "./useAuthApi";
+
+const mockLoginStart = vi.mocked(opaqueLoginStart);
+const mockLoginFinish = vi.mocked(opaqueLoginFinish);
+const mockRegStart = vi.mocked(opaqueRegistrationStart);
+const mockRegFinish = vi.mocked(opaqueRegistrationFinish);
+
+// ── Fake OpaqueClient ──
+
+function createFakeOpaqueClient(): OpaqueClientApi {
+  return {
+    loginStart: vi.fn().mockResolvedValue({
+      ke1: new Uint8Array([1, 2, 3]),
+      state: "login-state-opaque",
+    }),
+    loginFinish: vi.fn().mockResolvedValue({
+      ke3: new Uint8Array([7, 8, 9]),
+    }),
+    registrationStart: vi.fn().mockResolvedValue({
+      request: new Uint8Array([10, 11, 12]),
+      state: "reg-state-opaque",
+    }),
+    registrationFinish: vi.fn().mockResolvedValue({
+      record: new Uint8Array([20, 21, 22]),
+    }),
+  };
+}
+
+let fakeClient: OpaqueClientApi;
+let factory: OpaqueClientFactory;
+
+describe("createOpaqueAuth", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    fakeClient = createFakeOpaqueClient();
+    factory = vi.fn().mockReturnValue(fakeClient);
+  });
+
+  describe("login", () => {
+    beforeEach(() => {
+      mockLoginStart.mockResolvedValue({
+        credentialResponse: new Uint8Array([4, 5, 6]),
+        serverLoginState: "server-state-123",
+      } as unknown as OpaqueLoginStartResponse);
+      mockLoginFinish.mockResolvedValue({
+        sessionId: "sess-1",
+        accessToken: "jwt-token",
+        expiresIn: BigInt(3600),
+      } as unknown as OpaqueLoginFinishResponse);
+    });
+
+    it("performs full 4-step OPAQUE login flow", async () => {
+      const { login } = createOpaqueAuth(factory, "test.server");
+      const result = await login("alice@test.com", "password123");
+
+      // Factory creates client with correct serverId and clientId
+      expect(factory).toHaveBeenCalledWith("test.server", "alice@test.com");
+
+      // Step 1: client-side crypto
+      expect(fakeClient.loginStart).toHaveBeenCalledWith("password123");
+
+      // Step 2: gRPC call with ke1
+      expect(mockLoginStart).toHaveBeenCalledWith(
+        "alice@test.com",
+        new Uint8Array([1, 2, 3]),
+      );
+
+      // Step 3: client-side finalization
+      expect(fakeClient.loginFinish).toHaveBeenCalledWith(
+        "password123",
+        new Uint8Array([4, 5, 6]),
+        "login-state-opaque",
+      );
+
+      // Step 4: gRPC finish call
+      expect(mockLoginFinish).toHaveBeenCalledWith(
+        "alice@test.com",
+        new Uint8Array([7, 8, 9]),
+        "server-state-123",
+      );
+
+      // Result: bigint expiresIn converted to number
+      expect(result).toEqual({
+        sessionId: "sess-1",
+        accessToken: "jwt-token",
+        expiresIn: 3600,
+      });
+    });
+
+    it("calls onStep callback at each phase", async () => {
+      const { login } = createOpaqueAuth(factory);
+      const onStep = vi.fn();
+      await login("alice@test.com", "pass", onStep);
+
+      expect(onStep).toHaveBeenCalledWith(1);
+      expect(onStep).toHaveBeenCalledWith(2);
+      expect(onStep).toHaveBeenCalledWith(3);
+      expect(onStep).toHaveBeenCalledTimes(3);
+    });
+
+    it("propagates gRPC error from loginStart", async () => {
+      mockLoginStart.mockRejectedValue(new Error("UNAUTHENTICATED"));
+
+      const { login } = createOpaqueAuth(factory);
+      await expect(login("alice@test.com", "wrong")).rejects.toThrow(
+        "UNAUTHENTICATED",
+      );
+    });
+
+    it("propagates gRPC error from loginFinish", async () => {
+      mockLoginFinish.mockRejectedValue(new Error("INTERNAL"));
+
+      const { login } = createOpaqueAuth(factory);
+      await expect(login("alice@test.com", "pass")).rejects.toThrow("INTERNAL");
+    });
+
+    it("propagates client-side crypto error", async () => {
+      (fakeClient.loginStart as ReturnType<typeof vi.fn>).mockRejectedValue(
+        new Error("WASM init failed"),
+      );
+
+      const { login } = createOpaqueAuth(factory);
+      await expect(login("alice@test.com", "pass")).rejects.toThrow(
+        "WASM init failed",
+      );
+    });
+
+    it("uses default serverId when not specified", async () => {
+      const { login } = createOpaqueAuth(factory);
+      await login("bob@test.com", "pass");
+
+      expect(factory).toHaveBeenCalledWith("structured.id", "bob@test.com");
+    });
+  });
+
+  describe("register", () => {
+    beforeEach(() => {
+      mockRegStart.mockResolvedValue({
+        registrationResponse: new Uint8Array([13, 14, 15]),
+        serverSetup: "setup-xyz",
+      } as unknown as OpaqueRegistrationStartResponse);
+      mockRegFinish.mockResolvedValue({
+        profileId: "profile-uuid",
+        credentialId: "cred-uuid",
+        serverPepper: new Uint8Array(),
+      } as unknown as OpaqueRegistrationFinishResponse);
+    });
+
+    it("performs full 4-step OPAQUE registration flow", async () => {
+      const { register } = createOpaqueAuth(factory, "test.server");
+      const result = await register("bob@test.com", "newpass");
+
+      expect(factory).toHaveBeenCalledWith("test.server", "bob@test.com");
+
+      // Step 1: client-side request
+      expect(fakeClient.registrationStart).toHaveBeenCalledWith("newpass");
+
+      // Step 2: gRPC start
+      expect(mockRegStart).toHaveBeenCalledWith(
+        "bob@test.com",
+        new Uint8Array([10, 11, 12]),
+      );
+
+      // Step 3: client-side record generation
+      expect(fakeClient.registrationFinish).toHaveBeenCalledWith(
+        "newpass",
+        new Uint8Array([13, 14, 15]),
+        "reg-state-opaque",
+      );
+
+      // Step 4: gRPC finish
+      expect(mockRegFinish).toHaveBeenCalledWith(
+        "bob@test.com",
+        new Uint8Array([20, 21, 22]),
+        "setup-xyz",
+      );
+
+      expect(result).toEqual({
+        profileId: "profile-uuid",
+        credentialId: "cred-uuid",
+      });
+    });
+
+    it("propagates gRPC error from registrationStart", async () => {
+      mockRegStart.mockRejectedValue(new Error("ALREADY_EXISTS"));
+
+      const { register } = createOpaqueAuth(factory);
+      await expect(register("taken@test.com", "pass")).rejects.toThrow(
+        "ALREADY_EXISTS",
+      );
+    });
+
+    it("propagates gRPC error from registrationFinish", async () => {
+      mockRegFinish.mockRejectedValue(new Error("INTERNAL"));
+
+      const { register } = createOpaqueAuth(factory);
+      await expect(register("bob@test.com", "pass")).rejects.toThrow(
+        "INTERNAL",
+      );
+    });
+  });
+
+  describe("computeRegistrationRecord", () => {
+    beforeEach(() => {
+      mockRegStart.mockResolvedValue({
+        registrationResponse: new Uint8Array([13, 14, 15]),
+        serverSetup: "setup-xyz",
+      } as unknown as OpaqueRegistrationStartResponse);
+    });
+
+    it("returns registration record without calling registrationFinish RPC", async () => {
+      const { computeRegistrationRecord } = createOpaqueAuth(
+        factory,
+        "test.server",
+      );
+      const record = await computeRegistrationRecord(
+        "alice@test.com",
+        "newpass",
+      );
+
+      expect(factory).toHaveBeenCalledWith("test.server", "alice@test.com");
+
+      // Step 1: client-side request
+      expect(fakeClient.registrationStart).toHaveBeenCalledWith("newpass");
+
+      // Step 2: gRPC start (server generates RegistrationResponse)
+      expect(mockRegStart).toHaveBeenCalledWith(
+        "alice@test.com",
+        new Uint8Array([10, 11, 12]),
+      );
+
+      // Step 3: client-side record generation
+      expect(fakeClient.registrationFinish).toHaveBeenCalledWith(
+        "newpass",
+        new Uint8Array([13, 14, 15]),
+        "reg-state-opaque",
+      );
+
+      // registrationFinish RPC must NOT be called
+      expect(mockRegFinish).not.toHaveBeenCalled();
+
+      // Returns raw record bytes
+      expect(record).toEqual(new Uint8Array([20, 21, 22]));
+    });
+
+    it("propagates gRPC error from registrationStart", async () => {
+      mockRegStart.mockRejectedValue(new Error("NOT_FOUND"));
+
+      const { computeRegistrationRecord } = createOpaqueAuth(factory);
+      await expect(
+        computeRegistrationRecord("unknown@test.com", "pass"),
+      ).rejects.toThrow("NOT_FOUND");
+    });
+
+    it("propagates client-side crypto error", async () => {
+      (
+        fakeClient.registrationFinish as ReturnType<typeof vi.fn>
+      ).mockRejectedValue(new Error("WASM crypto error"));
+
+      const { computeRegistrationRecord } = createOpaqueAuth(factory);
+      await expect(
+        computeRegistrationRecord("alice@test.com", "pass"),
+      ).rejects.toThrow("WASM crypto error");
+    });
+  });
+});