@ursalock/client 0.2.2

package/dist/index.js

@@ -0,0 +1,866 @@
+import { ZKCredentials } from '@z-base/zero-knowledge-credentials';
+import { useCallback, useSyncExternalStore } from 'react';
+
+// src/passkey.ts
+
+// src/interfaces/http-client.ts
+var FetchHttpClient = class {
+  async fetch(url, options) {
+    return fetch(url, options);
+  }
+};
+
+// src/passkey.ts
+var PasskeyAuth = class _PasskeyAuth {
+  options;
+  httpClient;
+  constructor(options) {
+    this.options = {
+      serverUrl: options.serverUrl.replace(/\/$/, ""),
+      rpName: options.rpName ?? "ursalock",
+      httpClient: options.httpClient ?? new FetchHttpClient()
+    };
+    this.httpClient = this.options.httpClient;
+  }
+  getName() {
+    return "passkey";
+  }
+  /**
+   * Check if passkeys with PRF are supported in this browser
+   * Implements IAuthProvider.isSupported
+   */
+  isSupported() {
+    return _PasskeyAuth.isSupported();
+  }
+  /**
+   * Check if passkeys with PRF are supported in this browser (static helper)
+   */
+  static isSupported() {
+    if (typeof window === "undefined") return false;
+    if (!window.PublicKeyCredential) return false;
+    return true;
+  }
+  /**
+   * Sign up - Register a new passkey
+   * Creates a passkey with PRF extension and derives encryption keys
+   * Implements IAuthProvider.signUp
+   */
+  async signUp(options) {
+    const opts = options;
+    const displayName = opts?.displayName ?? "User";
+    if (!_PasskeyAuth.isSupported()) {
+      return { success: false, error: "Passkeys not supported in this browser" };
+    }
+    try {
+      await ZKCredentials.registerCredential(
+        displayName,
+        "cross-platform"
+        // Allow platform + cross-platform authenticators
+      );
+      const credential = await ZKCredentials.discoverCredential();
+      const registerRes = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/zkc/register`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            opaqueId: credential.id,
+            displayName
+          })
+        }
+      );
+      if (!registerRes.ok) {
+        const err = await registerRes.json();
+        return { success: false, error: err.message ?? "Failed to register" };
+      }
+      const result = await registerRes.json();
+      return {
+        success: true,
+        user: result.user,
+        token: result.token,
+        credential
+      };
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.name === "NotAllowedError" || error.message.includes("aborted")) {
+          return { success: false, error: "Registration cancelled" };
+        }
+        return { success: false, error: error.message };
+      }
+      return { success: false, error: String(error) };
+    }
+  }
+  /**
+   * Legacy method - kept for backward compatibility
+   * @deprecated Use signUp() instead
+   */
+  async register(displayName) {
+    return this.signUp({ displayName });
+  }
+  /**
+   * Sign in - Authenticate with an existing passkey
+   * Uses discoverCredential to authenticate and derive keys
+   * Implements IAuthProvider.signIn
+   */
+  async signIn(_options) {
+    if (!_PasskeyAuth.isSupported()) {
+      return { success: false, error: "Passkeys not supported in this browser" };
+    }
+    try {
+      const credential = await ZKCredentials.discoverCredential();
+      const authRes = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/zkc/authenticate`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            opaqueId: credential.id
+          })
+        }
+      );
+      if (!authRes.ok) {
+        const err = await authRes.json();
+        return { success: false, error: err.message ?? "Authentication failed" };
+      }
+      const result = await authRes.json();
+      return {
+        success: true,
+        user: result.user,
+        token: result.token,
+        credential
+      };
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.name === "NotAllowedError" || error.message.includes("aborted")) {
+          return { success: false, error: "Authentication cancelled" };
+        }
+        if (error.message.includes("no-credential")) {
+          return { success: false, error: "No passkey found. Please sign up first." };
+        }
+        return { success: false, error: error.message };
+      }
+      return { success: false, error: String(error) };
+    }
+  }
+  /**
+   * Legacy method - kept for backward compatibility
+   * @deprecated Use signIn() instead
+   */
+  async authenticate() {
+    return this.signIn({});
+  }
+  /**
+   * Check if user has any registered passkeys
+   */
+  async hasPasskey(opaqueId) {
+    try {
+      const res = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/zkc/check`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ opaqueId })
+        }
+      );
+      if (!res.ok) return false;
+      const data = await res.json();
+      return data.hasPasskey === true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/email.ts
+var EmailAuth = class {
+  options;
+  httpClient;
+  constructor(options) {
+    this.options = {
+      serverUrl: options.serverUrl.replace(/\/$/, ""),
+      httpClient: options.httpClient ?? new FetchHttpClient()
+    };
+    this.httpClient = this.options.httpClient;
+  }
+  getName() {
+    return "email";
+  }
+  isSupported() {
+    return true;
+  }
+  /**
+   * Sign up - Register a new account with email/password
+   * Implements IAuthProvider.signUp
+   */
+  async signUp(options) {
+    const { email, password } = options;
+    if (!email || !this.isValidEmail(email)) {
+      return { success: false, error: "Invalid email address" };
+    }
+    if (!password || password.length < 8) {
+      return { success: false, error: "Password must be at least 8 characters" };
+    }
+    try {
+      const res = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/email/register`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email, password })
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json();
+        return {
+          success: false,
+          error: err.message ?? "Registration failed"
+        };
+      }
+      const result = await res.json();
+      return {
+        success: true,
+        user: result.user,
+        token: result.token
+        // Email auth doesn't provide encryption keys
+      };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
+  /**
+   * Sign in - Authenticate with email/password
+   * Implements IAuthProvider.signIn
+   */
+  async signIn(options) {
+    const { email, password } = options;
+    if (!email || !password) {
+      return { success: false, error: "Email and password required" };
+    }
+    try {
+      const res = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/email/login`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email, password })
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json();
+        if (res.status === 401) {
+          return { success: false, error: "Invalid email or password" };
+        }
+        return { success: false, error: err.message ?? "Login failed" };
+      }
+      const result = await res.json();
+      return {
+        success: true,
+        user: result.user,
+        token: result.token
+        // Email auth doesn't provide encryption keys
+      };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
+  /**
+   * Legacy method - kept for backward compatibility
+   * @deprecated Use signUp() instead
+   */
+  async register(credentials) {
+    return this.signUp(credentials);
+  }
+  /**
+   * Request password reset email
+   */
+  async forgotPassword(email) {
+    if (!this.isValidEmail(email)) {
+      return { success: false, error: "Invalid email address" };
+    }
+    try {
+      await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/email/forgot-password`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ email })
+        }
+      );
+      return { success: true };
+    } catch {
+      return { success: true };
+    }
+  }
+  /**
+   * Reset password with token
+   */
+  async resetPassword(token, newPassword) {
+    if (!newPassword || newPassword.length < 8) {
+      return { success: false, error: "Password must be at least 8 characters" };
+    }
+    try {
+      const res = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/email/reset-password`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token, password: newPassword })
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json();
+        return { success: false, error: err.message ?? "Reset failed" };
+      }
+      return { success: true };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
+  /**
+   * Change password (when logged in)
+   */
+  async changePassword(currentPassword, newPassword, authToken) {
+    if (!newPassword || newPassword.length < 8) {
+      return { success: false, error: "New password must be at least 8 characters" };
+    }
+    try {
+      const res = await this.httpClient.fetch(
+        `${this.options.serverUrl}/auth/email/change-password`,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${authToken}`
+          },
+          body: JSON.stringify({ currentPassword, newPassword })
+        }
+      );
+      if (!res.ok) {
+        const err = await res.json();
+        return { success: false, error: err.message ?? "Change failed" };
+      }
+      return { success: true };
+    } catch {
+      return { success: false, error: "Network error" };
+    }
+  }
+  /**
+   * Validate email format
+   */
+  isValidEmail(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+  }
+};
+
+// src/token.ts
+var TokenManager = class _TokenManager {
+  token = null;
+  refreshTimer = null;
+  options;
+  listeners = /* @__PURE__ */ new Set();
+  isRefreshing = false;
+  constructor(options = {}) {
+    this.options = {
+      storageKey: options.storageKey ?? "ursalock:token",
+      serverUrl: options.serverUrl,
+      onExpire: options.onExpire ?? (() => {
+      }),
+      refreshBuffer: options.refreshBuffer ?? 5 * 60 * 1e3,
+      // 5 minutes
+      autoRefresh: options.autoRefresh ?? !!options.serverUrl
+    };
+    this.loadFromStorage();
+  }
+  /**
+   * Set a new token
+   */
+  setToken(token) {
+    this.token = token;
+    this.saveToStorage();
+    this.scheduleRefresh();
+    this.notifyListeners();
+  }
+  /**
+   * Get current token
+   */
+  getToken() {
+    if (!this.token) return null;
+    if (Date.now() >= this.token.expiresAt) {
+      this.clearToken();
+      return null;
+    }
+    return this.token;
+  }
+  /**
+   * Get access token string (convenience method)
+   */
+  getAccessToken() {
+    return this.getToken()?.accessToken ?? null;
+  }
+  /**
+   * Check if token is valid
+   */
+  isValid() {
+    const token = this.getToken();
+    return token !== null && Date.now() < token.expiresAt;
+  }
+  /**
+   * Clear token
+   */
+  clearToken() {
+    this.token = null;
+    this.clearRefreshTimer();
+    this.removeFromStorage();
+    this.notifyListeners();
+  }
+  /**
+   * Subscribe to token changes
+   */
+  subscribe(callback) {
+    this.listeners.add(callback);
+    return () => this.listeners.delete(callback);
+  }
+  /**
+   * Manually refresh the token
+   * Returns true if refresh succeeded
+   */
+  async refresh() {
+    if (!this.options.serverUrl || !this.token) return false;
+    if (this.isRefreshing) return false;
+    this.isRefreshing = true;
+    try {
+      const res = await fetch(`${this.options.serverUrl}/auth/refresh`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${this.token.accessToken}`
+        },
+        body: this.token.refreshToken ? JSON.stringify({ refreshToken: this.token.refreshToken }) : void 0
+      });
+      if (!res.ok) {
+        this.isRefreshing = false;
+        return false;
+      }
+      const data = await res.json();
+      const payload = _TokenManager.parseToken(data.token);
+      const expiresAt = payload?.exp ? payload.exp * 1e3 : Date.now() + (data.expiresIn ?? 3600) * 1e3;
+      this.setToken({
+        accessToken: data.token,
+        expiresAt,
+        refreshToken: this.token.refreshToken
+      });
+      this.isRefreshing = false;
+      return true;
+    } catch {
+      this.isRefreshing = false;
+      return false;
+    }
+  }
+  /**
+   * Parse JWT payload (without verification)
+   */
+  static parseToken(token) {
+    try {
+      const [, payload] = token.split(".");
+      const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+      return JSON.parse(decoded);
+    } catch {
+      return null;
+    }
+  }
+  // Private methods
+  loadFromStorage() {
+    if (typeof window === "undefined") return;
+    try {
+      const stored = localStorage.getItem(this.options.storageKey);
+      if (stored) {
+        const token = JSON.parse(stored);
+        if (Date.now() < token.expiresAt) {
+          this.token = token;
+          this.scheduleRefresh();
+        } else {
+          this.removeFromStorage();
+        }
+      }
+    } catch {
+    }
+  }
+  saveToStorage() {
+    if (typeof window === "undefined" || !this.token) return;
+    try {
+      localStorage.setItem(this.options.storageKey, JSON.stringify(this.token));
+    } catch {
+    }
+  }
+  removeFromStorage() {
+    if (typeof window === "undefined") return;
+    try {
+      localStorage.removeItem(this.options.storageKey);
+    } catch {
+    }
+  }
+  scheduleRefresh() {
+    this.clearRefreshTimer();
+    if (!this.token) return;
+    const timeUntilExpiry = this.token.expiresAt - Date.now();
+    const refreshIn = Math.max(0, timeUntilExpiry - this.options.refreshBuffer);
+    this.refreshTimer = setTimeout(async () => {
+      if (this.options.autoRefresh && this.options.serverUrl) {
+        const success = await this.refresh();
+        if (success) return;
+      }
+      this.options.onExpire();
+    }, refreshIn);
+  }
+  clearRefreshTimer() {
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+  }
+  notifyListeners() {
+    for (const listener of this.listeners) {
+      listener(this.token);
+    }
+  }
+};
+
+// src/client.ts
+var VaultClient = class {
+  options;
+  passkeyAuth;
+  emailAuth;
+  tokenManager;
+  state;
+  listeners = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.options = {
+      serverUrl: options.serverUrl.replace(/\/$/, ""),
+      rpName: options.rpName ?? "ursalock",
+      preferPasskey: options.preferPasskey ?? true,
+      storageKey: options.storageKey ?? "ursalock:auth"
+    };
+    this.passkeyAuth = new PasskeyAuth({
+      serverUrl: this.options.serverUrl,
+      rpName: this.options.rpName
+    });
+    this.emailAuth = new EmailAuth({
+      serverUrl: this.options.serverUrl
+    });
+    this.tokenManager = new TokenManager({
+      storageKey: `${this.options.storageKey}:token`,
+      onExpire: () => this.handleTokenExpire()
+    });
+    this.state = {
+      isAuthenticated: false,
+      user: null,
+      isLoading: true,
+      error: null,
+      credential: null
+    };
+    this.initialize();
+  }
+  // ==================
+  // Public Auth Methods
+  // ==================
+  /**
+   * Sign up a new user
+   */
+  async signUp(options = {}) {
+    const usePasskey = options.usePasskey ?? (this.options.preferPasskey && PasskeyAuth.isSupported() && !options.password);
+    let result;
+    if (usePasskey) {
+      result = await this.passkeyAuth.register(options.displayName ?? options.email);
+    } else {
+      if (!options.email || !options.password) {
+        return { success: false, error: "Email and password required" };
+      }
+      const emailResult = await this.emailAuth.register({
+        email: options.email,
+        password: options.password
+      });
+      result = {
+        success: emailResult.success,
+        user: emailResult.user,
+        token: emailResult.token,
+        error: emailResult.error
+      };
+    }
+    if (result.success && result.token) {
+      this.handleAuthSuccess(result);
+    }
+    return result;
+  }
+  /**
+   * Sign in an existing user
+   */
+  async signIn(options = {}) {
+    const usePasskey = options.usePasskey ?? (this.options.preferPasskey && PasskeyAuth.isSupported() && !options.password);
+    let result;
+    if (usePasskey) {
+      result = await this.passkeyAuth.authenticate();
+    } else {
+      if (!options.email || !options.password) {
+        return { success: false, error: "Email and password required" };
+      }
+      const emailResult = await this.emailAuth.signIn({
+        email: options.email,
+        password: options.password
+      });
+      result = {
+        success: emailResult.success,
+        user: emailResult.user,
+        token: emailResult.token,
+        error: emailResult.error
+      };
+    }
+    if (result.success && result.token) {
+      this.handleAuthSuccess(result);
+    }
+    return result;
+  }
+  /**
+   * Sign out
+   */
+  async signOut() {
+    const token = this.tokenManager.getAccessToken();
+    if (token) {
+      try {
+        await fetch(`${this.options.serverUrl}/auth/logout`, {
+          method: "POST",
+          headers: { "Authorization": `Bearer ${token}` }
+        });
+      } catch {
+      }
+    }
+    this.tokenManager.clearToken();
+    this.clearUserFromStorage();
+    this.updateState({
+      isAuthenticated: false,
+      user: null,
+      isLoading: false,
+      error: null,
+      credential: null
+    });
+  }
+  /**
+   * Check if passkeys are supported
+   */
+  supportsPasskey() {
+    return PasskeyAuth.isSupported();
+  }
+  // ==================
+  // State Management
+  // ==================
+  /**
+   * Get current auth state
+   * Returns the same reference unless state changes (required for useSyncExternalStore)
+   */
+  getState() {
+    return this.state;
+  }
+  /**
+   * Get current user
+   */
+  getUser() {
+    return this.state.user;
+  }
+  /**
+   * Get current ZK credential (with encryption keys)
+   */
+  getCredential() {
+    return this.state.credential;
+  }
+  /**
+   * Check if authenticated
+   */
+  isAuthenticated() {
+    return this.state.isAuthenticated;
+  }
+  /**
+   * Subscribe to auth state changes
+   */
+  subscribe(callback) {
+    this.listeners.add(callback);
+    callback(this.state);
+    return () => this.listeners.delete(callback);
+  }
+  // ==================
+  // API Methods
+  // ==================
+  /**
+   * Get authorization header
+   */
+  getAuthHeader() {
+    const token = this.tokenManager.getAccessToken();
+    return token ? { "Authorization": `Bearer ${token}` } : {};
+  }
+  /**
+   * Make authenticated API request
+   */
+  async fetch(path, options = {}) {
+    const url = path.startsWith("http") ? path : `${this.options.serverUrl}${path}`;
+    return fetch(url, {
+      ...options,
+      headers: {
+        ...this.getAuthHeader(),
+        ...options.headers
+      }
+    });
+  }
+  // ==================
+  // Private Methods
+  // ==================
+  async initialize() {
+    if (this.tokenManager.isValid()) {
+      try {
+        const res = await this.fetch("/auth/me");
+        if (res.ok) {
+          const data = await res.json();
+          this.updateState({
+            isAuthenticated: true,
+            user: data.user,
+            isLoading: false,
+            error: null,
+            credential: null
+            // Will need to re-authenticate to get credential
+          });
+          return;
+        } else {
+          this.tokenManager.clearToken();
+          this.clearUserFromStorage();
+        }
+      } catch {
+        const user = this.loadUserFromStorage();
+        if (user) {
+          this.updateState({
+            isAuthenticated: true,
+            user,
+            isLoading: false,
+            error: null,
+            credential: null
+          });
+          return;
+        }
+      }
+    }
+    this.tokenManager.clearToken();
+    this.clearUserFromStorage();
+    this.updateState({
+      isAuthenticated: false,
+      user: null,
+      isLoading: false,
+      error: null,
+      credential: null
+    });
+  }
+  handleAuthSuccess(result) {
+    if (!result.token || !result.user) return;
+    const payload = TokenManager.parseToken(result.token);
+    const expiresAt = payload?.exp ? payload.exp * 1e3 : Date.now() + 7 * 24 * 60 * 60 * 1e3;
+    this.tokenManager.setToken({
+      accessToken: result.token,
+      expiresAt
+    });
+    this.saveUserToStorage(result.user);
+    this.updateState({
+      isAuthenticated: true,
+      user: result.user,
+      isLoading: false,
+      error: null,
+      credential: result.credential ?? null
+    });
+  }
+  handleTokenExpire() {
+    this.updateState({
+      isAuthenticated: false,
+      user: null,
+      isLoading: false,
+      error: new Error("Session expired"),
+      credential: null
+    });
+  }
+  updateState(newState) {
+    this.state = newState;
+    for (const listener of this.listeners) {
+      listener(this.state);
+    }
+  }
+  saveUserToStorage(user) {
+    if (typeof window === "undefined") return;
+    try {
+      localStorage.setItem(`${this.options.storageKey}:user`, JSON.stringify(user));
+    } catch {
+    }
+  }
+  loadUserFromStorage() {
+    if (typeof window === "undefined") return null;
+    try {
+      const stored = localStorage.getItem(`${this.options.storageKey}:user`);
+      return stored ? JSON.parse(stored) : null;
+    } catch {
+      return null;
+    }
+  }
+  clearUserFromStorage() {
+    if (typeof window === "undefined") return;
+    try {
+      localStorage.removeItem(`${this.options.storageKey}:user`);
+    } catch {
+    }
+  }
+};
+function useAuth(client) {
+  const subscribe = useCallback(
+    (callback) => {
+      return client.subscribe(callback);
+    },
+    [client]
+  );
+  const getSnapshot = useCallback(() => client.getState(), [client]);
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}
+function useSignUp(client) {
+  const state = useAuth(client);
+  const signUp = useCallback(
+    async (options) => {
+      return client.signUp(options ?? {});
+    },
+    [client]
+  );
+  return {
+    signUp,
+    isLoading: state.isLoading,
+    error: state.error
+  };
+}
+function useSignIn(client) {
+  const state = useAuth(client);
+  const signIn = useCallback(
+    async (options) => {
+      return client.signIn(options ?? {});
+    },
+    [client]
+  );
+  return {
+    signIn,
+    isLoading: state.isLoading,
+    error: state.error
+  };
+}
+function useSignOut(client) {
+  return useCallback(() => client.signOut(), [client]);
+}
+function useUser(client) {
+  const state = useAuth(client);
+  return state.user;
+}
+function useCredential(client) {
+  const state = useAuth(client);
+  return state.credential;
+}
+function usePasskeySupport(client) {
+  return client.supportsPasskey();
+}
+
+export { EmailAuth, FetchHttpClient, PasskeyAuth, TokenManager, VaultClient, useAuth, useCredential, usePasskeySupport, useSignIn, useSignOut, useSignUp, useUser };