@structured-id/ui-core 4.12.0 → 4.14.0

package/src/profile/composables/useIdentityApi.ts

@@ -4,15 +4,28 @@
  * The account API through the BFF (`getAccountTransport`), which adds the
  * session's Bearer token. Shared between profile-ui-ce, profile-ui-ee, and
  * frontend.
+ *
+ * Self-service listings name no Profile: the server resolves the caller's
+ * own from its session, so the page never needs its own ProfileId.
  */
 import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import {
+  CredentialId,
+  DeviceId,
+  PrincipalId,
+  ProfileEmailId,
+  ProfileId,
+  SessionId,
+  optional,
+  required,
+} from "@structured-id/ids";
 import { getAccountTransport } from "../../index";
 import { IdentityServiceClient } from "@structured-id/proto/sid/v1/identity/identity.client";
 import {
-  type Profile,
-  type Session,
-  type Credential,
-  type Principal,
+  type Profile as WireProfile,
+  type Session as WireSession,
+  type Credential as WireCredential,
+  type Principal as WirePrincipal,
   ProfileStatus,
   PrincipalType,
   CredentialType,
@@ -20,6 +33,7 @@ import {
 } from "@structured-id/proto/sid/v1/identity/identity";
 import { Timestamp } from "@structured-id/proto/google/protobuf/timestamp";
 import { authMeta } from "../auth";
+import type { WithId } from "./useAuthApi";
 
 function client(transport?: RpcTransport): IdentityServiceClient {
   return new IdentityServiceClient(transport ?? getAccountTransport());
@@ -27,22 +41,36 @@ function client(transport?: RpcTransport): IdentityServiceClient {
 
 // ── Profile ──
 
-export type { Profile, Principal };
+/** A Profile as answered, its id read into a typed identifier. */
+export type Profile = WithId<WireProfile, "id", ProfileId>;
+
+function profile(wire: WireProfile | undefined): Profile {
+  if (!wire) throw new TypeError("the answer carries no profile");
+  return { ...wire, id: required(ProfileId, wire.id) };
+}
 
-export async function fetchCurrentProfile(): Promise<Profile> {
-  const { response } = await client().getCurrentProfile(
+/**
+ * The signed-in user's own profile. `transport`: the sign-in surface's
+ * transport when a sign-in step reads it; the account API otherwise.
+ */
+export async function fetchCurrentProfile(
+  transport?: RpcTransport,
+): Promise<Profile> {
+  const { response } = await client(transport).getCurrentProfile(
     {},
     { meta: authMeta() },
   );
-  return response.profile!;
+  return profile(response.profile);
 }
 
 /**
+ * Update the profile `id` (the one {@link fetchCurrentProfile} answered).
+ *
  * `transport`: the sign-in surface's transport when a sign-in step (a
  * required profile update) makes the call; the account API otherwise.
  */
 export async function updateProfile(
-  id: string,
+  id: ProfileId,
   update: {
     givenName?: string;
     familyName?: string;
@@ -53,7 +81,7 @@ export async function updateProfile(
 ): Promise<Profile> {
   const { response } = await client(transport).updateProfile(
     {
-      id,
+      id: id.toWire(),
       givenName: update.givenName,
       familyName: update.familyName,
       middleName: update.middleName,
@@ -61,66 +89,93 @@ export async function updateProfile(
     },
     { meta: authMeta() },
   );
-  return response.profile!;
+  return profile(response.profile);
 }
 
 // ── Sessions ──
 
-export type { Session };
+/** A session as answered, with its own and its device's typed ids. */
+export type Session = WithId<
+  WithId<WireSession, "id", SessionId>,
+  "deviceId",
+  DeviceId | undefined
+>;
+
+/** The caller's own sessions. */
+export async function fetchSessions(): Promise<Session[]> {
+  const { response } = await client().listSessions({}, { meta: authMeta() });
+  return response.sessions.map((s) => ({
+    ...s,
+    id: required(SessionId, s.id),
+    deviceId: optional(DeviceId, s.deviceId),
+  }));
+}
 
-export async function fetchSessions(profileId: string): Promise<Session[]> {
-  const { response } = await client().listSessions(
-    { profileId },
+export async function revokeSession(id: SessionId): Promise<void> {
+  await client().revokeSession(
+    { sessionId: id.toWire() },
     { meta: authMeta() },
   );
-  return response.sessions;
-}
-
-export async function revokeSession(sessionId: string): Promise<void> {
-  await client().revokeSession({ sessionId }, { meta: authMeta() });
 }
 
 // ── Credentials ──
 
-export type { Credential };
+/** A credential as answered, its id read into a typed identifier. */
+export type Credential = WithId<WireCredential, "id", CredentialId>;
 
-export async function fetchCredentials(
-  profileId: string,
-): Promise<Credential[]> {
-  const { response } = await client().listCredentials(
-    { profileId },
-    { meta: authMeta() },
-  );
-  return response.credentials;
+function credential(wire: WireCredential | undefined): Credential {
+  if (!wire) throw new TypeError("the answer carries no credential");
+  return { ...wire, id: required(CredentialId, wire.id) };
 }
 
-export async function revokeCredential(credentialId: string): Promise<void> {
-  await client().revokeCredential({ credentialId }, { meta: authMeta() });
+/** The caller's own credentials. */
+export async function fetchCredentials(): Promise<Credential[]> {
+  const { response } = await client().listCredentials({}, { meta: authMeta() });
+  return response.credentials.map(credential);
+}
+
+export async function revokeCredential(id: CredentialId): Promise<void> {
+  await client().revokeCredential(
+    { credentialId: id.toWire() },
+    { meta: authMeta() },
+  );
 }
 
 export async function updateCredentialLabel(
-  credentialId: string,
+  id: CredentialId,
   label: string,
 ): Promise<Credential> {
   const { response } = await client().updateCredential(
-    { credentialId, label },
+    { credentialId: id.toWire(), label },
     { meta: authMeta() },
   );
-  return response.credential!;
+  return credential(response.credential);
 }
 
 // ── Principals ──
 
-export async function fetchPrincipals(profileId: string): Promise<Principal[]> {
-  const { response } = await client().listPrincipals(
-    { profileId },
-    { meta: authMeta() },
-  );
-  return response.principals;
+/** A login handle as answered, with its own and its contact's typed ids. */
+export type Principal = WithId<
+  WithId<WirePrincipal, "id", PrincipalId>,
+  "sourceEmailId",
+  ProfileEmailId | undefined
+>;
+
+/** The caller's own login handles. */
+export async function fetchPrincipals(): Promise<Principal[]> {
+  const { response } = await client().listPrincipals({}, { meta: authMeta() });
+  return response.principals.map((p) => ({
+    ...p,
+    id: required(PrincipalId, p.id),
+    sourceEmailId: optional(ProfileEmailId, p.sourceEmailId),
+  }));
 }
 
-export async function removePrincipal(principalId: string): Promise<void> {
-  await client().removePrincipal({ principalId }, { meta: authMeta() });
+export async function removePrincipal(id: PrincipalId): Promise<void> {
+  await client().removePrincipal(
+    { principalId: id.toWire() },
+    { meta: authMeta() },
+  );
 }
 
 // Re-export enums and Timestamp for convenience

package/src/profile/composables/useLoginSuccess.test.ts

@@ -101,7 +101,7 @@ describe("useLoginSuccess (BFF cookie mode)", () => {
 
   it("calls checkBffSession and populates auth store on success", async () => {
     mockCheckBffSession.mockResolvedValue({
-      sub: "profile-uuid-1",
+      sub: "subject-1",
       name: "Alice Smith",
       email: "alice@example.com",
       preferred_username: "alice",
@@ -114,7 +114,6 @@ describe("useLoginSuccess (BFF cookie mode)", () => {
 
     expect(mockCheckBffSession).toHaveBeenCalled();
     expect(auth.isAuthenticated).toBe(true);
-    expect(auth.profileId).toBe("profile-uuid-1");
     expect(auth.displayName).toBe("Alice Smith");
     expect(auth.email).toBe("alice@example.com");
   });

package/src/profile/composables/useLoginSuccess.ts

@@ -10,12 +10,13 @@
  * Otherwise the app's own session comes from its BFF: the handler reads it
  * from the BFF's /auth/userinfo and navigates within the app.
  */
+import type { SessionId } from "@structured-id/ids";
 import { useRouter } from "vue-router";
 import { useAuthStore } from "../../index";
 import { checkBffSession } from "../../index";
 
 export interface LoginSuccessResult {
-  sessionId?: string;
+  sessionId?: SessionId;
 }
 
 /** Options of {@link useLoginSuccess}. */

package/src/profile/composables/useSecurityLevel.test.ts

@@ -20,8 +20,6 @@ function makeCred(
   opts?: { attachment?: AuthenticatorAttachment; backupState?: boolean },
 ): Credential {
   const cred: Credential = {
-    id: "cred-1",
-    profileId: "",
     type,
     data: new Uint8Array(),
     info: { oneofKind: undefined },

package/src/stores/auth.test.ts

@@ -11,7 +11,6 @@ describe("useAuthStore (BFF cookie session)", () => {
     const store = useAuthStore();
     expect(store.isAuthenticated).toBe(false);
     expect(store.sessionValid).toBe(false);
-    expect(store.profileId).toBeNull();
     expect(store.displayName).toBeNull();
     expect(store.email).toBeNull();
   });
@@ -19,7 +18,7 @@ describe("useAuthStore (BFF cookie session)", () => {
   it("setBffSession sets sessionValid and profile data", () => {
     const store = useAuthStore();
     store.setBffSession({
-      sub: "profile-uuid-123",
+      sub: "subject-123",
       email: "alice@example.com",
       name: "Alice Smith",
       preferred_username: "alice",
@@ -28,18 +27,20 @@ describe("useAuthStore (BFF cookie session)", () => {
 
     expect(store.isAuthenticated).toBe(true);
     expect(store.sessionValid).toBe(true);
-    expect(store.profileId).toBe("profile-uuid-123");
     expect(store.displayName).toBe("Alice Smith");
     expect(store.email).toBe("alice@example.com");
     expect(store.preferredUsername).toBe("alice");
   });
 
-  it("setBffSession handles null/missing optional fields", () => {
+  // Regression: the userinfo `sub` was kept as the user's ProfileId, though
+  // it is the subject this application knows the user by. The store keeps
+  // no Profile id at all.
+  it("never reads the subject as a Profile id", () => {
     const store = useAuthStore();
-    store.setBffSession({ sub: "uuid-456" });
+    store.setBffSession({ sub: "subject-456" });
 
     expect(store.isAuthenticated).toBe(true);
-    expect(store.profileId).toBe("uuid-456");
+    expect("profileId" in store).toBe(false);
     expect(store.displayName).toBeNull();
     expect(store.email).toBeNull();
     expect(store.preferredUsername).toBeNull();
@@ -47,15 +48,13 @@ describe("useAuthStore (BFF cookie session)", () => {
 
   it("setProfile updates display data", () => {
     const store = useAuthStore();
-    store.setBffSession({ sub: "uuid-1" });
+    store.setBffSession({ sub: "subject-1" });
 
     store.setProfile({
-      id: "uuid-1",
       displayName: "Bob Jones",
       email: "bob@example.com",
     });
 
-    expect(store.profileId).toBe("uuid-1");
     expect(store.displayName).toBe("Bob Jones");
     expect(store.email).toBe("bob@example.com");
   });
@@ -63,7 +62,7 @@ describe("useAuthStore (BFF cookie session)", () => {
   it("logout clears all state", () => {
     const store = useAuthStore();
     store.setBffSession({
-      sub: "uuid-1",
+      sub: "subject-1",
       name: "Alice",
       email: "alice@example.com",
       preferred_username: "alice",
@@ -73,7 +72,6 @@ describe("useAuthStore (BFF cookie session)", () => {
 
     expect(store.isAuthenticated).toBe(false);
     expect(store.sessionValid).toBe(false);
-    expect(store.profileId).toBeNull();
     expect(store.displayName).toBeNull();
     expect(store.email).toBeNull();
     expect(store.preferredUsername).toBeNull();

package/src/stores/auth.ts

@@ -24,9 +24,11 @@ export const useAuthStore = defineStore("auth", () => {
   const sessionId = ref<string | null>(null);
 
   // ── Profile info (populated from BFF /auth/userinfo) ──────────────
+  //
+  // No Profile id: the userinfo `sub` is the subject this application
+  // knows the user by, not a ProfileId, and self-service calls name no
+  // Profile at all.
 
-  /** Profile ID of the authenticated user (= sub from BFF userinfo). */
-  const profileId = ref<string | null>(null);
   /** Display name. */
   const displayName = ref<string | null>(null);
   /** Email address. */
@@ -46,7 +48,6 @@ export const useAuthStore = defineStore("auth", () => {
    */
   function setBffSession(info: BffUserInfo): void {
     sessionValid.value = true;
-    profileId.value = info.sub;
     displayName.value = info.name ?? null;
     email.value = info.email ?? null;
     preferredUsername.value = info.preferred_username ?? null;
@@ -56,11 +57,9 @@ export const useAuthStore = defineStore("auth", () => {
    * Update profile display data (e.g., after profile edit).
    */
   function setProfile(profile: {
-    id: string;
     displayName?: string | null;
     email?: string | null;
   }): void {
-    profileId.value = profile.id;
     displayName.value = profile.displayName ?? null;
     email.value = profile.email ?? null;
   }
@@ -71,7 +70,6 @@ export const useAuthStore = defineStore("auth", () => {
   function logout(): void {
     sessionValid.value = false;
     sessionId.value = null;
-    profileId.value = null;
     displayName.value = null;
     email.value = null;
     preferredUsername.value = null;
@@ -80,7 +78,6 @@ export const useAuthStore = defineStore("auth", () => {
   return {
     sessionValid,
     sessionId,
-    profileId,
     displayName,
     email,
     preferredUsername,

package/src/types/auth.ts

@@ -4,8 +4,6 @@ export interface AuthState {
   sessionValid: boolean;
   /** Server-side session identifier (for step-up, session management). */
   sessionId: string | null;
-  /** Profile ID of the authenticated user (UUID). */
-  profileId: string | null;
   /** Display name of the authenticated user. */
   displayName: string | null;
   /** Email address (may be null if not in session claims). */