@woodsportal/hubspot-kit 1.0.41-dev.4 → 1.0.41-dev.6

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/login-email-storage.ts

@@ -0,0 +1,64 @@
+import { WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
+
+const LOGIN_EMAIL_KEY = WP_STORAGE_KEYS.c.login.email
+
+function isValidEmail(value: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim())
+}
+
+export function extractLoginEmailFromPayload(
+  payload: Record<string, unknown> | null | undefined,
+): string | null {
+  if (!payload || typeof payload !== 'object') {
+    return null
+  }
+  const loggedInDetails = payload.loggedInDetails
+  if (loggedInDetails && typeof loggedInDetails === 'object') {
+    const email = (loggedInDetails as Record<string, unknown>).email
+    if (typeof email === 'string' && isValidEmail(email)) {
+      return email.trim().toLowerCase()
+    }
+  }
+  for (const key of ['email', 'username'] as const) {
+    const value = payload[key]
+    if (typeof value === 'string' && isValidEmail(value)) {
+      return value.trim().toLowerCase()
+    }
+  }
+  return null
+}
+
+export function captureLoginEmailBeforeSessionClear(
+  resolveLoggedInEmail?: () => string | null | undefined,
+): void {
+  if (getStoredLoginEmail()) {
+    return
+  }
+  const email = resolveLoggedInEmail?.()
+  if (email) {
+    setStoredLoginEmail(email)
+  }
+}
+
+export function getStoredLoginEmail(): string | null {
+  if (typeof window === 'undefined') {
+    return null
+  }
+  const stored = sessionStorage.getItem(LOGIN_EMAIL_KEY)?.trim().toLowerCase() ?? ''
+  return stored && isValidEmail(stored) ? stored : null
+}
+
+export function setStoredLoginEmail(email: string): void {
+  if (typeof window === 'undefined') {
+    return
+  }
+  const normalized = email.trim().toLowerCase()
+  if (!isValidEmail(normalized)) {
+    return
+  }
+  sessionStorage.setItem(LOGIN_EMAIL_KEY, normalized)
+}
+
+export function clearLoginPreAuthSession(): void {
+  // starter scaffold: no pre-login passkey state
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/login-session-bridge.ts

@@ -0,0 +1,72 @@
+import { api } from '@/integrations/woodsportal-sdk'
+import {
+  navigateAfterFullAuth,
+  type AuthNavigationRouter,
+} from '@/features/auth/auth-navigation'
+import { resolvePostLoginPath } from '@/features/auth/resolve-post-login-path'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { signalSessionChanged } from 'woodsportal-client-sdk'
+import {
+  extractLoginEmailFromPayload,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+function notifyAuthSessionChanged(): void {
+  if (typeof window === 'undefined') return
+  signalSessionChanged('login')
+  window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+}
+
+type AuthRouter = AuthNavigationRouter
+
+function unwrapLoginPayload(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+): Record<string, unknown> {
+  return (response?.data ?? response ?? {}) as Record<string, unknown>
+}
+
+export type HandleAuthLoginResponseOptions = {
+  clearPreHashQuery?: () => void
+  onSubscriptionType?: (subscriptionType: string) => void
+}
+
+export type HandleAuthLoginResponseResult =
+  | { success: false; reason: 'no_token' | 'mfa_required' }
+  | { success: true; mfaRequired: true }
+  | { success: true; mfaRequired: false }
+
+/** Shown when the hub requires MFA but the project used `--auth starter` or `sso`. */
+export const MFA_REQUIRED_SCAFFOLD_MESSAGE =
+  'This hub requires MFA. Re-init with wp init --auth full (see docs/AUTH-SCAFFOLD.md).'
+
+export async function handleAuthLoginResponse(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+  router: AuthRouter,
+  options: HandleAuthLoginResponseOptions = {},
+): Promise<HandleAuthLoginResponseResult> {
+  const data = unwrapLoginPayload(response)
+  const tokenData = (data.tokenData ?? {}) as { token?: string }
+  const sessionToken = api.auth.session.getAccessToken()
+  const token = tokenData.token ?? sessionToken ?? undefined
+
+  if (!token) {
+    return { success: false, reason: 'no_token' }
+  }
+
+  const loginEmail = extractLoginEmailFromPayload(data)
+  if (loginEmail) {
+    setStoredLoginEmail(loginEmail)
+  }
+
+  if (data.twoFactorRequired === true) {
+    return { success: false, reason: 'mfa_required' }
+  }
+
+  const loggedInDetails = (data.loggedInDetails ?? {}) as { subscriptionType?: string }
+  options.onSubscriptionType?.(loggedInDetails.subscriptionType ?? 'BASIC')
+
+  options.clearPreHashQuery?.()
+  notifyAuthSessionChanged()
+  navigateAfterFullAuth(router, resolvePostLoginPath(router))
+  return { success: true, mfaRequired: false }
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/post-login-path.ts

@@ -0,0 +1,17 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+const AUTH_RETURN_PATHS = new Set<string>([
+  Routes.login,
+  Routes.twoFa,
+  Routes.unauthorized,
+  Routes.ssoLogin,
+])
+
+export function isBlockedPostLoginPath(path: string): boolean {
+  const normalized = normalizeRouterPath(path)
+  if (AUTH_RETURN_PATHS.has(normalized)) {
+    return true
+  }
+  return normalized.startsWith('/login')
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/resolve-auth-login-error-message.ts

@@ -0,0 +1,52 @@
+const GENERIC_AUTH_FAILED_MESSAGES = new Set([
+  'Authentication Failed',
+  'Invalid credentials provided.',
+])
+
+type LoginErrorPayload = {
+  errorCode?: unknown
+  errorMessage?: unknown
+  validationErrors?: unknown
+}
+
+function extractFirstValidationMessage(validationErrors: unknown): string | null {
+  if (validationErrors == null || typeof validationErrors !== 'object') {
+    return null
+  }
+  const first = Object.values(validationErrors as Record<string, unknown>)[0]
+  if (typeof first === 'string') {
+    return first
+  }
+  if (Array.isArray(first) && typeof first[0] === 'string') {
+    return first[0]
+  }
+  return null
+}
+
+export function resolveAuthLoginErrorMessage(error: unknown): string {
+  const fallback = 'Wrong email or password'
+  if (error == null || typeof error !== 'object') {
+    return fallback
+  }
+  const data = (error as { response?: { data?: LoginErrorPayload } }).response?.data
+  if (!data) {
+    return fallback
+  }
+  const validationMessage = extractFirstValidationMessage(data.validationErrors)
+  if (validationMessage) {
+    return validationMessage
+  }
+  const errorCode = typeof data.errorCode === 'string' ? data.errorCode : undefined
+  const errorMessage =
+    typeof data.errorMessage === 'string' ? data.errorMessage.trim() : ''
+  if (!errorMessage) {
+    return fallback
+  }
+  if (
+    errorCode === 'AUTHENTICATION_FAILED' &&
+    GENERIC_AUTH_FAILED_MESSAGES.has(errorMessage)
+  ) {
+    return fallback
+  }
+  return errorMessage
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/resolve-post-login-path.ts

@@ -0,0 +1,21 @@
+import { Routes } from '@/config/routes'
+import { isBlockedPostLoginPath } from '@/features/auth/post-login-path'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import type { SafeAuthRouter } from '@/utils/safe-router-navigation'
+
+export type PostLoginRouter = SafeAuthRouter & {
+  state: {
+    location?: {
+      search?: { r?: string; [key: string]: string | undefined }
+      pathname?: string
+    }
+  }
+}
+
+export function resolvePostLoginPath(router: PostLoginRouter): string {
+  const redirect = router.state.location?.search?.r
+  if (redirect && !isBlockedPostLoginPath(String(redirect))) {
+    return normalizeRouterPath(String(redirect))
+  }
+  return Routes.portal
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/sso-callback.ts

@@ -0,0 +1,120 @@
+import { Routes } from '@/config/routes'
+import { readHashPathname } from '@/features/auth/auth-route-paths'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+export type SsoCallbackParams = {
+  code: string
+  state: string
+}
+
+export const SSO_CALLBACK_EXCHANGE_TIMEOUT_MS = 30_000
+
+const processedKeys = new Set<string>()
+
+export function buildSsoCallbackKey(code: string, state: string): string {
+  return `${code}:${state}`
+}
+
+export function normalizeOAuthQueryValue(value: unknown): string {
+  if (typeof value === 'string') {
+    return value.trim()
+  }
+  if (Array.isArray(value)) {
+    const first = value.find((entry) => typeof entry === 'string' && entry.trim())
+    return typeof first === 'string' ? first.trim() : ''
+  }
+  return ''
+}
+
+export function parseSsoCallbackParams(
+  routeSearch?: { code?: unknown; state?: unknown },
+): SsoCallbackParams {
+  const fromRoute = {
+    code: normalizeOAuthQueryValue(routeSearch?.code),
+    state: normalizeOAuthQueryValue(routeSearch?.state),
+  }
+  if (fromRoute.code && fromRoute.state) {
+    return fromRoute
+  }
+  if (typeof window === 'undefined') {
+    return { code: '', state: '' }
+  }
+  const hashPart = window.location.hash || ''
+  const queryFromHash = hashPart.includes('?') ? hashPart.split('?')[1] : ''
+  const searchParams = new URLSearchParams(queryFromHash || window.location.search)
+  return {
+    code: searchParams.get('code')?.trim() ?? '',
+    state: searchParams.get('state')?.trim() ?? '',
+  }
+}
+
+export function hasOAuthCallbackInUrl(routeSearch?: { code?: unknown; state?: unknown }): boolean {
+  const { code, state } = parseSsoCallbackParams(routeSearch)
+  return Boolean(code && state)
+}
+
+export function clearPreHashQueryParams(): void {
+  if (typeof window === 'undefined' || !window.location.search) {
+    return
+  }
+  window.history.replaceState(null, '', `${window.location.pathname}${window.location.hash}`)
+}
+
+export function isSsoCallbackAlreadyProcessed(key: string): boolean {
+  return processedKeys.has(key)
+}
+
+export function markSsoCallbackProcessed(key: string): void {
+  processedKeys.add(key)
+}
+
+export async function withSsoCallbackTimeout<T>(promise: Promise<T>): Promise<T> {
+  return Promise.race([
+    promise,
+    new Promise<T>((_, reject) => {
+      window.setTimeout(
+        () => reject(new Error('sso_callback_timeout')),
+        SSO_CALLBACK_EXCHANGE_TIMEOUT_MS,
+      )
+    }),
+  ])
+}
+
+const exchangeLocks = new Map<string, Promise<void>>()
+
+export async function runSharedSsoCallbackExchange(
+  key: string,
+  exchange: () => Promise<void>,
+): Promise<void> {
+  const existing = exchangeLocks.get(key)
+  if (existing) {
+    return existing
+  }
+  const run = exchange().finally(() => {
+    exchangeLocks.delete(key)
+  })
+  exchangeLocks.set(key, run)
+  return run
+}
+
+export function ensureSsoCallbackRoute(): boolean {
+  if (typeof window === 'undefined') {
+    return false
+  }
+  const { code, state } = parseSsoCallbackParams()
+  if (!code || !state) {
+    return false
+  }
+  const hashPath = readHashPathname()
+  if (normalizeRouterPath(hashPath) === Routes.ssoLogin) {
+    if (window.location.search) {
+      clearPreHashQueryParams()
+    }
+    return true
+  }
+  if (window.location.search) {
+    clearPreHashQueryParams()
+  }
+  window.location.hash = `#${Routes.ssoLogin}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`
+  return true
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/use-portal-session.ts

@@ -0,0 +1,25 @@
+import { useEffect, useMemo, useState } from 'react'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { isFullyAuthenticatedSession, isMfaPendingSession } from '@/features/auth/auth-session'
+
+function useAuthSessionRevision(): number {
+  const [revision, setRevision] = useState(0)
+  useEffect(() => {
+    const bump = () => setRevision((value) => value + 1)
+    window.addEventListener(AUTH_SESSION_CHANGED, bump)
+    return () => window.removeEventListener(AUTH_SESSION_CHANGED, bump)
+  }, [])
+  return revision
+}
+
+export { useAuthSessionRevision }
+
+export function usePortalSession(): boolean {
+  const revision = useAuthSessionRevision()
+  return useMemo(() => isFullyAuthenticatedSession(), [revision])
+}
+
+export function useIsMfaPendingSession(): boolean {
+  const revision = useAuthSessionRevision()
+  return useMemo(() => isMfaPendingSession(), [revision])
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/use-signed-in-email.ts

@@ -0,0 +1,55 @@
+import { useEffect, useState } from 'react'
+
+import { api } from '@/integrations/woodsportal-sdk'
+import { getStoredLoginEmail } from '@/features/auth/login-email-storage'
+import { usePortalSession } from '@/features/auth/use-portal-session'
+
+function readEmailFromProfile(data: unknown): string | null {
+  if (data == null || typeof data !== 'object') {
+    return null
+  }
+  const root = data as Record<string, unknown>
+  const profile = (root.data ?? root) as Record<string, unknown>
+  const email = profile.email
+  return typeof email === 'string' && email.trim() !== '' ? email.trim() : null
+}
+
+export function useSignedInEmail(): { email: string | null; isLoading: boolean } {
+  const isAuthenticated = usePortalSession()
+  const [email, setEmail] = useState<string | null>(() => getStoredLoginEmail())
+  const [isLoading, setIsLoading] = useState(false)
+
+  useEffect(() => {
+    if (!isAuthenticated) {
+      setEmail(null)
+      setIsLoading(false)
+      return
+    }
+
+    const stored = getStoredLoginEmail()
+    if (stored) {
+      setEmail(stored)
+      return
+    }
+
+    setIsLoading(true)
+    const { me } = api.auth.me({
+      onSuccess: (data) => {
+        setEmail(readEmailFromProfile(data) ?? getStoredLoginEmail())
+        setIsLoading(false)
+      },
+      onError: () => {
+        setEmail(getStoredLoginEmail())
+        setIsLoading(false)
+      },
+      onLoadingChange: (loading) => {
+        if (!loading) {
+          setIsLoading(false)
+        }
+      },
+    })
+    void me()
+  }, [isAuthenticated])
+
+  return { email, isLoading }
+}

package/examples/greenfield/module-hybrid-cdn-auth-sso/src/features/auth/use-sso-callback-handler.ts

@@ -0,0 +1,92 @@
+import { useEffect, useState } from 'react'
+import type { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse } from '@/features/auth/login-session-bridge'
+import {
+  buildSsoCallbackKey,
+  clearPreHashQueryParams,
+  isSsoCallbackAlreadyProcessed,
+  markSsoCallbackProcessed,
+  parseSsoCallbackParams,
+  runSharedSsoCallbackExchange,
+  withSsoCallbackTimeout,
+} from '@/features/auth/sso-callback'
+import { Routes } from '@/config/routes'
+
+type SsoRouter = ReturnType<typeof useRouter>
+
+export function useSsoCallbackHandler(options: {
+  router: SsoRouter
+  routeSearch?: { code?: string; state?: string }
+}): { isLoading: boolean } {
+  const { router, routeSearch } = options
+  const [isLoading, setIsLoading] = useState(true)
+
+  useEffect(() => {
+    let cancelled = false
+
+    const run = async () => {
+      const { code, state } = parseSsoCallbackParams(routeSearch)
+      const callbackKey = buildSsoCallbackKey(code, state)
+
+      try {
+        if (!code || !state) {
+          toast.error('Missing SSO callback parameters.')
+          router.history.replace(Routes.login)
+          return
+        }
+
+        if (isSsoCallbackAlreadyProcessed(callbackKey)) {
+          toast.error('SSO callback already processed. Please try again.')
+          router.history.replace(Routes.login)
+          return
+        }
+
+        await runSharedSsoCallbackExchange(callbackKey, async () => {
+          const { callback: ssoCallback } = api.auth.sso.callback()
+          const response = await withSsoCallbackTimeout(
+            ssoCallback({ queryParams: { code, state } }),
+          )
+
+          if (cancelled) {
+            return
+          }
+
+          const result = await handleAuthLoginResponse(response, router, {
+            clearPreHashQuery: clearPreHashQueryParams,
+          })
+
+          if (!result.success) {
+            toast.error('SSO login failed.')
+            router.history.replace(Routes.login)
+            return
+          }
+
+          markSsoCallbackProcessed(callbackKey)
+          if (!result.mfaRequired) {
+            toast.success(
+              (response as { statusMsg?: string })?.statusMsg || 'Signed in with SSO',
+            )
+          }
+        })
+      } catch {
+        if (!cancelled) {
+          toast.error('SSO login failed.')
+          router.history.replace(Routes.login)
+        }
+      } finally {
+        if (!cancelled) {
+          setIsLoading(false)
+        }
+      }
+    }
+
+    void run()
+    return () => {
+      cancelled = true
+    }
+  }, [router, routeSearch])
+
+  return { isLoading }
+}