@team-codeme/crud-forge 0.0.0-stage → 1.0.1

package/src/templates/angular/auth/auth.service.ts.ejs

@@ -0,0 +1,594 @@
+import { isPlatformBrowser } from '@angular/common';
+import { HttpClient, HttpErrorResponse, HttpHeaders } from '@angular/common/http';
+import { Injectable, PLATFORM_ID, inject, signal, computed } from '@angular/core';
+import { Router } from '@angular/router';
+import { Observable, catchError, finalize, of, share, switchMap, tap, throwError } from 'rxjs';
+import { environment } from '@/environments/environment';
+import { mapCurrentUser } from '../utils/current-user';
+import { AuthUtils } from '../utils/auth.utils';
+
+export interface TokenResponse {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  token_type: string;
+}
+
+export type AuthUserPayload = {
+  sub?: string;
+  preferred_username?: string;
+  username?: string;
+  email?: string;
+  name?: string;
+  realm_access?: { roles?: string[] };
+  resource_access?: Record<string, { roles?: string[] } | undefined>;
+  attributes?: Record<string, string | string[] | undefined>;
+  [key: string]: unknown;
+};
+
+export type SignOutReason = 'user' | 'unauthorized' | 'session-timeout' | 'account-disabled';
+
+const USER_ACTIVITY_EVENTS = ['pointerdown', 'keydown', 'mousemove', 'scroll', 'touchstart'] as const;
+const ACTIVITY_THROTTLE_MS = 1000;
+
+@Injectable({ providedIn: 'root' })
+export class AuthService {
+  static readonly MOCK_TOKEN = 'mock-access-token';
+  static readonly MOCK_REFRESH_TOKEN = 'mock-refresh-token';
+
+  private readonly http = inject(HttpClient);
+  private readonly router = inject(Router);
+  private readonly platformId = inject(PLATFORM_ID);
+  private authenticated = false;
+  private refreshing$: Observable<TokenResponse> | null = null;
+  private idleTimer: ReturnType<typeof setTimeout> | null = null;
+  private statusProbeTimer: ReturnType<typeof setInterval> | null = null;
+  private activityListenersBound = false;
+  private focusListenerBound = false;
+  private storageListenerBound = false;
+  private lastActivityResetAt = 0;
+  private disabledAccountFlowActive = false;
+  private disabledAccountCountdownTimer: ReturnType<typeof setInterval> | null = null;
+
+  readonly currentUser = signal<AuthUserPayload | null>(null);
+  readonly profile = computed(() => mapCurrentUser(this.currentUser()));
+  readonly currentUserId = signal<string | null>(null);
+  readonly disabledAccountOverlayVisible = signal(false);
+  readonly disabledAccountOverlayCountdown = signal(0);
+
+  private readonly storageNamespace = `cforge:${environment.kcRealm}:${environment.kcClientId}`;
+
+  constructor() {
+    this.restoreSession();
+    this.bindCrossTabSync();
+    if (this.authenticated) {
+      this.startSessionMonitoring();
+    }
+  }
+
+  get isAuthenticated(): boolean {
+    return this.authenticated;
+  }
+
+  get accessToken(): string {
+    return this.getItem('accessToken');
+  }
+
+  set accessToken(value: string) {
+    this.setItem('accessToken', value);
+  }
+
+  get refreshToken(): string {
+    return this.getItem('refreshToken');
+  }
+
+  set refreshToken(value: string) {
+    this.setItem('refreshToken', value);
+  }
+
+  signIn(credentials: { username: string; password: string }): Observable<TokenResponse> {
+    if (this.authenticated) {
+      return throwError(() => new Error('User is already logged in.'));
+    }
+
+    if (environment.useMockAuth) {
+      const allowedUser =
+        credentials.username === 'admin' || credentials.username === 'demo@crudforge.com';
+      if (!allowedUser || credentials.password !== 'admin') {
+        return throwError(() => ({ status: 401, message: 'Invalid username or password' }));
+      }
+      const response: TokenResponse = {
+        access_token: AuthService.MOCK_TOKEN,
+        refresh_token: AuthService.MOCK_REFRESH_TOKEN,
+        expires_in: 3600,
+        token_type: 'Bearer',
+      };
+      return of(response).pipe(tap((token) => this.afterSignIn(token)));
+    }
+
+    const body = new URLSearchParams();
+    body.set('grant_type', 'password');
+    body.set('username', credentials.username);
+    body.set('password', credentials.password);
+    body.set('scope', 'openid');
+    body.set('client_id', environment.kcClientId);
+    // Public-client password grant: do not send client_secret.
+
+    return this.requestToken(body).pipe(tap((token) => this.afterSignIn(token)));
+  }
+
+  refreshAccessToken(): Observable<TokenResponse> {
+    if (environment.useMockAuth) {
+      return of({
+        access_token: AuthService.MOCK_TOKEN,
+        refresh_token: AuthService.MOCK_REFRESH_TOKEN,
+        expires_in: 3600,
+        token_type: 'Bearer',
+      }).pipe(tap((token) => this.storeTokens(token)));
+    }
+
+    if (!this.refreshToken) {
+      return throwError(() => new Error('No refresh token available'));
+    }
+    if (this.refreshing$) {
+      return this.refreshing$;
+    }
+
+    const body = new URLSearchParams();
+    const requestedRefreshToken = this.refreshToken;
+    body.set('grant_type', 'refresh_token');
+    body.set('refresh_token', requestedRefreshToken);
+    body.set('client_id', environment.kcClientId);
+
+    this.refreshing$ = this.requestToken(body).pipe(
+      tap((token) => {
+        // A response from the previous account must not restore its profile after logout.
+        if (this.refreshToken !== requestedRefreshToken) throw new Error('Session changed while refreshing');
+        this.storeTokens(token);
+        this.authenticated = true;
+      }),
+      catchError((error) => {
+        if (this.refreshToken !== requestedRefreshToken) return throwError(() => error);
+        if (this.tryStartDisabledAccountLockFromAuthError(error)) {
+          return throwError(() => error);
+        }
+        // Only clear session for terminal auth failures — keep session on network/5xx.
+        if (this.isTerminalAuthError(error)) {
+          this.clearSession();
+        }
+        return throwError(() => error);
+      }),
+      finalize(() => {
+        this.refreshing$ = null;
+      }),
+      share()
+    );
+
+    return this.refreshing$;
+  }
+
+  /**
+   * Refresh when access token is near expiry (or missing). Safe to call often.
+   */
+  refreshTokenIfDue(skewSeconds = 60): void {
+    if (!this.authenticated || environment.useMockAuth || !this.refreshToken) {
+      return;
+    }
+    if (!AuthUtils.shouldRefreshAccessToken(this.accessToken, skewSeconds)) {
+      return;
+    }
+    this.refreshAccessToken().subscribe({
+      error: (error) => {
+        if (this.tryStartDisabledAccountLockFromAuthError(error)) {
+          return;
+        }
+        if (this.isTerminalAuthError(error)) {
+          this.signOut('unauthorized');
+        }
+      },
+    });
+  }
+
+  check(): Observable<boolean> {
+    if (environment.useMockAuth) {
+      const ok =
+        this.accessToken === AuthService.MOCK_TOKEN ||
+        this.refreshToken === AuthService.MOCK_REFRESH_TOKEN;
+      this.authenticated = ok;
+      return of(ok);
+    }
+
+    if (!this.refreshToken) {
+      return of(false);
+    }
+
+    if (this.authenticated && this.accessToken && !AuthUtils.isTokenExpired(this.accessToken, 30)) {
+      return of(true);
+    }
+
+    return this.refreshAccessToken().pipe(
+      switchMap(() => of(true)),
+      catchError((error) => {
+        if (this.tryStartDisabledAccountLockFromAuthError(error)) {
+          return of(this.authenticated);
+        }
+        if (this.isTerminalAuthError(error)) {
+          this.clearSession();
+          return of(false);
+        }
+        // Transient failure: keep existing session if we still have a refresh token.
+        return of(this.authenticated && !!this.refreshToken);
+      })
+    );
+  }
+
+  signOut(reason: SignOutReason = 'user'): void {
+    void reason;
+    this.stopSessionMonitoring();
+    this.clearDisabledAccountOverlayState();
+    const token = this.refreshToken;
+    this.clearSession();
+
+    const goSignIn = () => this.router.navigate(['/auth/sign-in']);
+    if (token && !environment.useMockAuth && this.isBrowser) {
+      const logoutUrl = environment.sso.replace(/\/token$/, '/logout');
+      const headers = new HttpHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' });
+      const body = new URLSearchParams();
+      body.set('client_id', environment.kcClientId);
+      body.set('refresh_token', token);
+      this.http.post(logoutUrl, body.toString(), { headers }).pipe(
+        catchError(() => of(null)),
+        finalize(goSignIn)
+      ).subscribe();
+      return;
+    }
+    goSignIn();
+  }
+
+  /**
+   * Interceptor / refresh: start overlay only for an explicit disabled-account grant error.
+   * Returns true when handled so the caller must not sign out immediately.
+   */
+  tryStartDisabledAccountLockFromAuthError(error: unknown): boolean {
+    if (!(environment as { disabledAccountEnabled?: boolean }).disabledAccountEnabled) {
+      return false;
+    }
+    if (!this.authenticated || !this.isAccountDisabledAuthError(error)) {
+      return false;
+    }
+    this.startDisabledAccountLockFlow();
+    return true;
+  }
+
+  resetInactivityTimer(): void {
+    if (!this.isBrowser || !this.authenticated) {
+      return;
+    }
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    const timeoutMs = this.idleTimeoutMs;
+    if (timeoutMs <= 0) {
+      return;
+    }
+    this.idleTimer = setTimeout(() => {
+      if (this.authenticated) {
+        this.signOut('session-timeout');
+      }
+    }, timeoutMs);
+  }
+
+  private get idleTimeoutMs(): number {
+    const value = Number(environment.sessionIdleTimeoutMs);
+    return Number.isFinite(value) && value > 0 ? value : 0;
+  }
+
+  private get refreshOnFocus(): boolean {
+    return (environment as { sessionRefreshOnFocus?: boolean }).sessionRefreshOnFocus !== false;
+  }
+
+  private get crossTabSync(): boolean {
+    return (environment as { sessionCrossTabSync?: boolean }).sessionCrossTabSync !== false;
+  }
+
+  private get statusProbeIntervalMs(): number {
+    const value = Number((environment as { sessionStatusProbeIntervalMs?: number }).sessionStatusProbeIntervalMs);
+    return Number.isFinite(value) && value > 0 ? value : 60_000;
+  }
+
+  private get disabledCountdownSeconds(): number {
+    const value = Number((environment as { disabledAccountCountdownSeconds?: number }).disabledAccountCountdownSeconds);
+    return Number.isFinite(value) && value > 0 ? value : 20;
+  }
+
+  private startSessionMonitoring(): void {
+    this.bindActivityListeners();
+    this.bindFocusRefresh();
+    this.resetInactivityTimer();
+    this.startStatusProbe();
+  }
+
+  private stopSessionMonitoring(): void {
+    this.unbindActivityListeners();
+    this.unbindFocusRefresh();
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    this.stopStatusProbe();
+  }
+
+  private startStatusProbe(): void {
+    if (
+      !this.isBrowser ||
+      environment.useMockAuth ||
+      this.statusProbeTimer
+    ) {
+      return;
+    }
+    this.statusProbeTimer = setInterval(() => {
+      this.refreshTokenIfDue();
+    }, this.statusProbeIntervalMs);
+  }
+
+  private stopStatusProbe(): void {
+    if (this.statusProbeTimer) {
+      clearInterval(this.statusProbeTimer);
+      this.statusProbeTimer = null;
+    }
+  }
+
+  private bindActivityListeners(): void {
+    // Idle activity tracking is opt-in (idleTimeoutMs > 0). Default 0 = stay signed in.
+    if (!this.isBrowser || this.activityListenersBound || this.idleTimeoutMs <= 0) {
+      return;
+    }
+    this.activityListenersBound = true;
+    for (const eventName of USER_ACTIVITY_EVENTS) {
+      window.addEventListener(eventName, this.onUserActivity, { passive: true, capture: true });
+    }
+  }
+
+  private unbindActivityListeners(): void {
+    if (!this.isBrowser || !this.activityListenersBound) {
+      return;
+    }
+    this.activityListenersBound = false;
+    for (const eventName of USER_ACTIVITY_EVENTS) {
+      window.removeEventListener(eventName, this.onUserActivity, { capture: true } as EventListenerOptions);
+    }
+  }
+
+  private bindFocusRefresh(): void {
+    if (!this.isBrowser || !this.refreshOnFocus || this.focusListenerBound) {
+      return;
+    }
+    this.focusListenerBound = true;
+    document.addEventListener('visibilitychange', this.onVisibilityChange);
+  }
+
+  private unbindFocusRefresh(): void {
+    if (!this.isBrowser || !this.focusListenerBound) {
+      return;
+    }
+    this.focusListenerBound = false;
+    document.removeEventListener('visibilitychange', this.onVisibilityChange);
+  }
+
+  private readonly onUserActivity = (): void => {
+    const now = Date.now();
+    if (now - this.lastActivityResetAt < ACTIVITY_THROTTLE_MS) {
+      return;
+    }
+    this.lastActivityResetAt = now;
+    this.resetInactivityTimer();
+  };
+
+  private readonly onVisibilityChange = (): void => {
+    if (document.visibilityState !== 'visible' || !this.authenticated) {
+      return;
+    }
+    this.lastActivityResetAt = Date.now();
+    this.resetInactivityTimer();
+    this.refreshTokenIfDue();
+  };
+
+  private bindCrossTabSync(): void {
+    if (!this.isBrowser || !this.crossTabSync || this.storageListenerBound) {
+      return;
+    }
+    this.storageListenerBound = true;
+    window.addEventListener('storage', (event: StorageEvent) => {
+      const accessKey = this.scopedKey('accessToken');
+      const refreshKey = this.scopedKey('refreshToken');
+      const tokenRemoved =
+        (event.key === accessKey || event.key === refreshKey || event.key === 'accessToken' || event.key === 'refreshToken') &&
+        !event.newValue;
+      const allCleared = event.key === null;
+      if ((tokenRemoved || allCleared) && this.authenticated) {
+        this.signOut('unauthorized');
+      }
+    });
+  }
+
+  private startDisabledAccountLockFlow(): void {
+    if (this.disabledAccountFlowActive || !this.authenticated) {
+      return;
+    }
+    this.disabledAccountFlowActive = true;
+    const expiresAt = Date.now() + this.disabledCountdownSeconds * 1000;
+    this.resumeDisabledAccountLockFlow(expiresAt);
+  }
+
+  private resumeDisabledAccountLockFlow(expiresAt: number): void {
+    const updateCountdown = () => {
+      const remainingSeconds = Math.max(0, Math.ceil((expiresAt - Date.now()) / 1000));
+      this.disabledAccountOverlayCountdown.set(remainingSeconds);
+      if (remainingSeconds === 0) {
+        this.clearDisabledAccountOverlayState();
+        this.signOut('account-disabled');
+        return false;
+      }
+      return true;
+    };
+
+    this.disabledAccountOverlayVisible.set(true);
+    if (this.disabledAccountCountdownTimer) {
+      clearInterval(this.disabledAccountCountdownTimer);
+    }
+    if (!updateCountdown()) {
+      return;
+    }
+    this.disabledAccountCountdownTimer = setInterval(() => {
+      updateCountdown();
+    }, 1000);
+  }
+
+  private clearDisabledAccountOverlayState(): void {
+    if (this.disabledAccountCountdownTimer) {
+      clearInterval(this.disabledAccountCountdownTimer);
+      this.disabledAccountCountdownTimer = null;
+    }
+    this.disabledAccountFlowActive = false;
+    this.disabledAccountOverlayVisible.set(false);
+    this.disabledAccountOverlayCountdown.set(0);
+  }
+
+  private isAccountDisabledAuthError(error: unknown): boolean {
+    const text = this.authErrorText(error);
+    if (!text) {
+      return false;
+    }
+    return /account[_ ]disabled|user[_ ]is[_ ]disabled|user disabled|account is disabled/i.test(text);
+  }
+
+  isTerminalAuthError(error: unknown): boolean {
+    if (!(error instanceof HttpErrorResponse) || error.status === 0 || error.status >= 500 || error.status === 403) {
+      return false;
+    }
+    const onTokenEndpoint = error.url?.includes('/protocol/openid-connect/token');
+    if (error.status === 401 && onTokenEndpoint) return true;
+    return error.status === 400 && /invalid_grant|invalid_token|expired[_ ]token|refresh[_ ]token|session[_ ]not[_ ]active|token[_ ]is[_ ]not[_ ]active|already[_ ]used/i.test(this.authErrorText(error));
+  }
+
+  private authErrorText(error: unknown): string {
+    if (error instanceof HttpErrorResponse) {
+      const body = error.error;
+      if (typeof body === 'string') {
+        return `${error.status} ${body}`;
+      }
+      if (body && typeof body === 'object') {
+        const record = body as Record<string, unknown>;
+        return [record['error'], record['error_description'], record['message'], error.message]
+          .filter((part) => typeof part === 'string' && part.trim())
+          .join(' ');
+      }
+      return `${error.status} ${error.message || ''}`;
+    }
+    if (error && typeof error === 'object') {
+      const record = error as Record<string, unknown>;
+      return [record['error'], record['error_description'], record['message']]
+        .filter((part) => typeof part === 'string' && part.trim())
+        .join(' ');
+    }
+    return typeof error === 'string' ? error : '';
+  }
+
+  private requestToken(body: URLSearchParams): Observable<TokenResponse> {
+    let headers = new HttpHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' });
+    if (environment.kcForwardedProto) {
+      headers = headers.set('X-Forwarded-Proto', environment.kcForwardedProto);
+    }
+    return this.http.post<TokenResponse>(environment.sso, body.toString(), { headers });
+  }
+
+  private afterSignIn(token: TokenResponse): void {
+    this.storeTokens(token);
+    this.authenticated = true;
+    this.startSessionMonitoring();
+  }
+
+  private storeTokens(response: TokenResponse): void {
+    this.accessToken = response.access_token;
+    this.refreshToken = response.refresh_token;
+    this.hydrateUser();
+  }
+
+  private hydrateUser(): void {
+    const token = this.accessToken;
+    if (!token || token === AuthService.MOCK_TOKEN) {
+      if (environment.useMockAuth && token === AuthService.MOCK_TOKEN) {
+        this.currentUser.set({
+          sub: 'mock-admin',
+          preferred_username: 'admin',
+          email: 'demo@crudforge.com',
+          realm_access: { roles: environment.adminRoles },
+        });
+        this.currentUserId.set('mock-admin');
+        return;
+      }
+      this.currentUser.set(null);
+      this.currentUserId.set(null);
+      return;
+    }
+
+    const payload = AuthUtils.decodePayload(token) as AuthUserPayload | null;
+    this.currentUser.set(payload);
+    this.currentUserId.set(typeof payload?.sub === 'string' ? payload.sub : null);
+  }
+
+  private restoreSession(): void {
+    this.hydrateUser();
+    if (environment.useMockAuth) {
+      this.authenticated =
+        this.accessToken === AuthService.MOCK_TOKEN ||
+        this.refreshToken === AuthService.MOCK_REFRESH_TOKEN;
+      return;
+    }
+    this.authenticated =
+      (!!this.accessToken && !AuthUtils.isTokenExpired(this.accessToken, 30)) || !!this.refreshToken;
+  }
+
+  private clearSession(): void {
+    if (this.idleTimer) {
+      clearTimeout(this.idleTimer);
+      this.idleTimer = null;
+    }
+    this.authenticated = false;
+    this.removeItem('accessToken');
+    this.removeItem('refreshToken');
+    this.currentUser.set(null);
+    this.currentUserId.set(null);
+  }
+
+  private get isBrowser(): boolean {
+    return isPlatformBrowser(this.platformId);
+  }
+
+  private scopedKey(key: string): string {
+    return `${this.storageNamespace}:${key}`;
+  }
+
+  private getItem(key: string): string {
+    if (!this.isBrowser) {
+      return '';
+    }
+    return localStorage.getItem(this.scopedKey(key)) ?? localStorage.getItem(key) ?? '';
+  }
+
+  private setItem(key: string, value: string): void {
+    if (!this.isBrowser) {
+      return;
+    }
+    localStorage.setItem(this.scopedKey(key), value);
+  }
+
+  private removeItem(key: string): void {
+    if (!this.isBrowser) {
+      return;
+    }
+    localStorage.removeItem(this.scopedKey(key));
+    localStorage.removeItem(key);
+  }
+}

package/src/templates/angular/auth/auth.utils.ts.ejs

@@ -0,0 +1,28 @@
+export class AuthUtils {
+  static decodePayload(token: string): Record<string, unknown> | null {
+    if (!token || token.split('.').length < 2) {
+      return null;
+    }
+
+    try {
+      const payload = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+      const padded = payload.padEnd(payload.length + (4 - (payload.length % 4)) % 4, '=');
+      return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(padded), char => char.charCodeAt(0)))) as Record<string, unknown>;
+    } catch {
+      return null;
+    }
+  }
+
+  static isTokenExpired(token: string, offsetSeconds = 0): boolean {
+    const payload = this.decodePayload(token);
+    const exp = typeof payload?.['exp'] === 'number' ? payload['exp'] : null;
+    if (!exp) {
+      return true;
+    }
+    return Date.now() >= (exp - offsetSeconds) * 1000;
+  }
+
+  static shouldRefreshAccessToken(token: string, skewSeconds = 60): boolean {
+    return !token || this.isTokenExpired(token, skewSeconds);
+  }
+}

package/src/templates/angular/auth/current-user.ts.ejs

@@ -0,0 +1,24 @@
+import type { AuthUserPayload } from '../services/auth.service';
+
+export interface CurrentUserProfile {
+  id: string;
+  name: string;
+  email: string;
+  avatar: string;
+  initials: string;
+}
+
+/** Display data comes from the configured provider's authenticated token claims. */
+export function mapCurrentUser(user: AuthUserPayload | null): CurrentUserProfile | null {
+  if (!user) return null;
+  const text = (value: unknown): string => typeof value === 'string' ? value.trim() : '';
+  const username = text(user.preferred_username) || text(user.username);
+  const email = text(user.email);
+  const name = text(user.name) || [text(user['given_name']), text(user['family_name'])].filter(Boolean).join(' ') || username || email || 'User';
+  const pictureClaim = user['picture'] ?? user.attributes?.['picture'];
+  const picture = text(Array.isArray(pictureClaim) ? pictureClaim[0] : pictureClaim);
+  // Avoid unsafe schemes; relative asset paths and HTTPS/HTTP provider pictures are supported.
+  const avatar = /^(https?:\/\/|\/(?!\/))/i.test(picture) ? picture : '';
+  return { id: text(user.sub), name, email, avatar,
+    initials: name.split(/\s+/).slice(0, 2).map(part => Array.from(part)[0]).join('').toUpperCase() };
+}