@workfort/auth 0.0.1

package/dist/client.d.ts

@@ -0,0 +1,24 @@
+import type { User, Session, AuthEventMap } from './types.js';
+type Listener<T> = (data: T) => void;
+export declare class AuthClient {
+    private _user;
+    private _session;
+    private _listeners;
+    private _lastVisible;
+    private _visHandler;
+    getUser(): User | null;
+    getSession(): Session | null;
+    get isAuthenticated(): boolean;
+    init(): Promise<void>;
+    refresh(): Promise<void>;
+    /** Clears session and emits events. Redirect to login is the shell's responsibility
+     *  (it listens for the 'logout' event and navigates accordingly). */
+    logout(): Promise<void>;
+    on<K extends keyof AuthEventMap>(event: K, listener: Listener<AuthEventMap[K]>): void;
+    off<K extends keyof AuthEventMap>(event: K, listener: Listener<AuthEventMap[K]>): void;
+    destroy(): void;
+    private _fetchSession;
+    private _setupVisibilityListener;
+    private _emit;
+}
+export {};

package/dist/client.js

@@ -0,0 +1,97 @@
+import { AuthInitError } from './types.js';
+const SESSION_ENDPOINT = '/api/auth/v1/session';
+const SIGNOUT_ENDPOINT = '/api/auth/v1/sign-out';
+const VISIBILITY_THRESHOLD_MS = 5 * 60 * 1000;
+export class AuthClient {
+    _user = null;
+    _session = null;
+    _listeners = new Map();
+    _lastVisible = Date.now();
+    _visHandler = null;
+    getUser() { return this._user; }
+    getSession() { return this._session; }
+    get isAuthenticated() { return this._user !== null; }
+    async init() {
+        await this._fetchSession();
+        this._setupVisibilityListener();
+    }
+    async refresh() {
+        const wasAuth = this.isAuthenticated;
+        await this._fetchSession();
+        if (wasAuth && !this.isAuthenticated) {
+            this._emit('logout', undefined);
+        }
+    }
+    /** Clears session and emits events. Redirect to login is the shell's responsibility
+     *  (it listens for the 'logout' event and navigates accordingly). */
+    async logout() {
+        try {
+            await fetch(SIGNOUT_ENDPOINT, { method: 'POST', credentials: 'include' });
+        }
+        catch { /* best-effort */ }
+        this._user = null;
+        this._session = null;
+        this._emit('logout', undefined);
+        this._emit('change', null);
+    }
+    on(event, listener) {
+        if (!this._listeners.has(event))
+            this._listeners.set(event, new Set());
+        this._listeners.get(event).add(listener);
+    }
+    off(event, listener) {
+        this._listeners.get(event)?.delete(listener);
+    }
+    destroy() {
+        if (this._visHandler) {
+            document.removeEventListener('visibilitychange', this._visHandler);
+            this._visHandler = null;
+        }
+    }
+    async _fetchSession() {
+        let res;
+        try {
+            res = await fetch(SESSION_ENDPOINT, { credentials: 'include' });
+        }
+        catch (err) {
+            throw new AuthInitError('Failed to reach auth service', { cause: err });
+        }
+        if (res.status === 401) {
+            this._user = null;
+            this._session = null;
+            this._emit('change', null);
+            return;
+        }
+        if (!res.ok) {
+            throw new AuthInitError(`Auth service returned ${res.status}`);
+        }
+        let data;
+        try {
+            data = await res.json();
+        }
+        catch (err) {
+            throw new AuthInitError('Invalid JSON from auth service', { cause: err });
+        }
+        this._user = data.user;
+        this._session = data.session;
+        this._emit('change', this._user);
+    }
+    _setupVisibilityListener() {
+        if (typeof document === 'undefined')
+            return;
+        this._visHandler = () => {
+            if (document.visibilityState === 'visible') {
+                if (Date.now() - this._lastVisible > VISIBILITY_THRESHOLD_MS) {
+                    this.refresh().catch(() => { });
+                }
+            }
+            else {
+                this._lastVisible = Date.now();
+            }
+        };
+        document.addEventListener('visibilitychange', this._visHandler);
+    }
+    _emit(event, data) {
+        this._listeners.get(event)?.forEach((fn) => fn(data));
+    }
+}

package/dist/client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/client.test.js

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { AuthClient } from './client.js';
+import { AuthInitError } from './types.js';
+const mockUser = {
+    id: 'user-1',
+    username: 'kazw',
+    name: 'Kaz Walker',
+    displayName: 'Kaz',
+    type: 'user',
+};
+const mockSession = {
+    id: 'session-1',
+    expiresAt: '2026-12-31T00:00:00Z',
+    refreshedAt: '2026-03-12T00:00:00Z',
+};
+function mockFetchResponse(status, body) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        json: () => Promise.resolve(body),
+        headers: new Headers(),
+    };
+}
+describe('AuthClient', () => {
+    let client;
+    beforeEach(() => {
+        client = new AuthClient();
+        vi.restoreAllMocks();
+    });
+    afterEach(() => {
+        client.destroy();
+    });
+    describe('init', () => {
+        it('fetches session and populates user', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }));
+            await client.init();
+            expect(client.getUser()).toEqual(mockUser);
+            expect(client.getSession()).toEqual(mockSession);
+            expect(client.isAuthenticated).toBe(true);
+        });
+        it('sets user to null on 401', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(mockFetchResponse(401));
+            await client.init();
+            expect(client.getUser()).toBeNull();
+            expect(client.getSession()).toBeNull();
+            expect(client.isAuthenticated).toBe(false);
+        });
+        it('throws AuthInitError on network failure', async () => {
+            vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('network down'));
+            await expect(client.init()).rejects.toThrow(AuthInitError);
+            await expect(client.init()).rejects.toThrow('Failed to reach auth service');
+        });
+        it('throws AuthInitError on non-401 error status', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockFetchResponse(500));
+            await expect(client.init()).rejects.toThrow(AuthInitError);
+            await expect(client.init()).rejects.toThrow('Auth service returned 500');
+        });
+        it('throws AuthInitError on invalid JSON', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
+                ok: true,
+                status: 200,
+                json: () => Promise.reject(new SyntaxError('Unexpected token')),
+                headers: new Headers(),
+            });
+            await expect(client.init()).rejects.toThrow('Invalid JSON from auth service');
+        });
+    });
+    describe('events', () => {
+        it('emits change event with user on successful init', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }));
+            const changes = [];
+            client.on('change', (u) => changes.push(u));
+            await client.init();
+            expect(changes).toEqual([mockUser]);
+        });
+        it('emits change event with null on 401', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(mockFetchResponse(401));
+            const changes = [];
+            client.on('change', (u) => changes.push(u));
+            await client.init();
+            expect(changes).toEqual([null]);
+        });
+        it('off removes listener', async () => {
+            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }));
+            const changes = [];
+            const listener = (u) => changes.push(u);
+            client.on('change', listener);
+            client.off('change', listener);
+            await client.init();
+            expect(changes).toEqual([]);
+        });
+    });
+    describe('logout', () => {
+        it('clears user and session', async () => {
+            vi.spyOn(globalThis, 'fetch')
+                .mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }))
+                .mockResolvedValueOnce(mockFetchResponse(200)); // sign-out call
+            await client.init();
+            expect(client.isAuthenticated).toBe(true);
+            await client.logout();
+            expect(client.getUser()).toBeNull();
+            expect(client.getSession()).toBeNull();
+            expect(client.isAuthenticated).toBe(false);
+        });
+        it('emits logout and change events', async () => {
+            vi.spyOn(globalThis, 'fetch')
+                .mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }))
+                .mockResolvedValueOnce(mockFetchResponse(200));
+            await client.init();
+            const events = [];
+            client.on('logout', () => events.push('logout'));
+            client.on('change', () => events.push('change'));
+            await client.logout();
+            expect(events).toEqual(['logout', 'change']);
+        });
+        it('still clears state if sign-out request fails', async () => {
+            vi.spyOn(globalThis, 'fetch')
+                .mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }))
+                .mockRejectedValueOnce(new Error('network down'));
+            await client.init();
+            await client.logout();
+            expect(client.isAuthenticated).toBe(false);
+        });
+    });
+    describe('refresh', () => {
+        it('emits logout when session expires between refreshes', async () => {
+            vi.spyOn(globalThis, 'fetch')
+                .mockResolvedValueOnce(mockFetchResponse(200, { user: mockUser, session: mockSession }))
+                .mockResolvedValueOnce(mockFetchResponse(401));
+            await client.init();
+            expect(client.isAuthenticated).toBe(true);
+            const events = [];
+            client.on('logout', () => events.push('logout'));
+            await client.refresh();
+            expect(client.isAuthenticated).toBe(false);
+            expect(events).toEqual(['logout']);
+        });
+        it('does not emit logout if was already unauthenticated', async () => {
+            vi.spyOn(globalThis, 'fetch')
+                .mockResolvedValueOnce(mockFetchResponse(401))
+                .mockResolvedValueOnce(mockFetchResponse(401));
+            await client.init();
+            const events = [];
+            client.on('logout', () => events.push('logout'));
+            await client.refresh();
+            expect(events).toEqual([]);
+        });
+    });
+});

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+import { AuthClient } from './client.js';
+export { AuthClient } from './client.js';
+export { AuthInitError } from './types.js';
+export type { User, Session, AuthEventMap } from './types.js';
+/** Returns the singleton AuthClient. All adapters use this internally. */
+export declare function getAuthClient(): AuthClient;
+/** @internal Reset singleton for testing only. */
+export declare function _resetAuthClient(): void;

package/dist/index.js

@@ -0,0 +1,16 @@
+import { AuthClient } from './client.js';
+export { AuthClient } from './client.js';
+export { AuthInitError } from './types.js';
+let instance = null;
+/** Returns the singleton AuthClient. All adapters use this internally. */
+export function getAuthClient() {
+    if (!instance)
+        instance = new AuthClient();
+    return instance;
+}
+/** @internal Reset singleton for testing only. */
+export function _resetAuthClient() {
+    if (instance)
+        instance.destroy();
+    instance = null;
+}

package/dist/types.d.ts

@@ -0,0 +1,22 @@
+export interface User {
+    id: string;
+    username: string;
+    name: string;
+    displayName: string;
+    type: 'user' | 'agent' | 'service';
+}
+export interface Session {
+    id: string;
+    expiresAt: string;
+    refreshedAt: string;
+}
+export type AuthEventMap = {
+    change: User | null;
+    logout: void;
+};
+export declare class AuthInitError extends Error {
+    cause?: unknown;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}

package/dist/types.js

@@ -0,0 +1,10 @@
+export class AuthInitError extends Error {
+    cause;
+    constructor(message, options) {
+        super(message);
+        this.name = 'AuthInitError';
+        if (options?.cause) {
+            this.cause = options.cause;
+        }
+    }
+}

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@workfort/auth",
+  "version": "0.0.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "prepublishOnly": "tsc"
+  },
+  "devDependencies": {
+    "typescript": "^5.8.2",
+    "vitest": "^4.1.0"
+  }
+}