@yboard/auth-mobile 0.0.1

package/src/client/interfaces/impersonator.interface.ts

@@ -0,0 +1,9 @@
+export interface Impersonator {
+  email: string;
+  reason: string | null;
+}
+
+export interface ImpersonatorRaw {
+  email: string;
+  reason: string | null;
+}

package/src/client/interfaces/index.ts

@@ -0,0 +1,9 @@
+export type {
+  AuthenticationResponse,
+  AuthenticationResponseRaw,
+  OnRefreshResponse,
+} from "./authentication-response.interface";
+export type { CreateClientOptions } from "./create-client-options.interface";
+export type { GetAuthorizationUrlOptions } from "./get-authorization-url-options.interface";
+export type { Impersonator, ImpersonatorRaw } from "./impersonator.interface";
+export type { User, UserRaw } from "./user.interface";

package/src/client/interfaces/user.interface.ts

@@ -0,0 +1,27 @@
+export interface User {
+  object: "user";
+  id: string;
+  email: string;
+  emailVerified: boolean;
+  profilePictureUrl: string | null;
+  firstName: string | null;
+  lastName: string | null;
+  lastSignInAt: string | null;
+  externalId: string | undefined;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface UserRaw {
+  object: "user";
+  id: string;
+  email: string;
+  email_verified: boolean;
+  profile_picture_url: string | null;
+  first_name: string | null;
+  last_name: string | null;
+  last_sign_in_at: string | null;
+  external_id: string | undefined;
+  created_at: string;
+  updated_at: string;
+}

package/src/client/serializers/authentication-response.serializer.ts

@@ -0,0 +1,27 @@
+import type {
+  AuthenticationResponse,
+  AuthenticationResponseRaw,
+} from "../interfaces";
+import { deserializeUser } from "./user.serializer";
+
+export const deserializeAuthenticationResponse = (
+  authenticationResponse: AuthenticationResponseRaw,
+): AuthenticationResponse => {
+  const {
+    user,
+    organization_id,
+    access_token,
+    refresh_token,
+    impersonator,
+    ...rest
+  } = authenticationResponse;
+
+  return {
+    user: deserializeUser(user),
+    organizationId: organization_id,
+    accessToken: access_token,
+    refreshToken: refresh_token,
+    impersonator,
+    ...rest,
+  };
+};

package/src/client/serializers/index.ts

@@ -0,0 +1,2 @@
+export { deserializeAuthenticationResponse } from "./authentication-response.serializer";
+export { deserializeUser } from "./user.serializer";

package/src/client/serializers/user.serializer.ts

@@ -0,0 +1,15 @@
+import type { User, UserRaw } from "../interfaces";
+
+export const deserializeUser = (user: UserRaw): User => ({
+  object: user.object,
+  id: user.id,
+  email: user.email,
+  emailVerified: user.email_verified,
+  firstName: user.first_name,
+  profilePictureUrl: user.profile_picture_url,
+  lastName: user.last_name,
+  lastSignInAt: user.last_sign_in_at,
+  externalId: user.external_id,
+  createdAt: user.created_at,
+  updatedAt: user.updated_at,
+});

package/src/client/utils/index.ts

@@ -0,0 +1,5 @@
+export { isRedirectCallback } from "./is-redirect-callback";
+export { memoryStorage } from "./memory-storage";
+export { createPkceChallenge } from "./pkce";
+export { setSessionData, removeSessionData } from "./session-data";
+export { storageKeys } from "./storage-keys";

package/src/client/utils/is-redirect-callback.ts

@@ -0,0 +1,28 @@
+/**
+ * Checks if the current URL is a redirect callback from the auth server.
+ *
+ * In React Native, you must pass the current URL explicitly (since window.location is not available).
+ */
+export function isRedirectCallback(
+  redirectUri: string,
+  searchParams: Record<string, any>,
+  currentUrl?: string // Pass the current URL explicitly in React Native
+) {
+  // Only support the object returned by query-string
+  const hasCode = typeof searchParams === "object" && "code" in searchParams;
+
+  if (!hasCode) return false;
+
+  // If currentUrl is provided (React Native), use it.
+  let currentUri: string;
+  if (currentUrl) {
+    // Remove query and hash from currentUrl
+    const urlObj = new URL(currentUrl);
+    currentUri = `${urlObj.protocol}//${urlObj.host}${urlObj.pathname}`;
+  } else {
+    // Can't determine current URI
+    return false;
+  }
+
+  return currentUri === redirectUri || currentUri === `${redirectUri}/`;
+}

package/src/client/utils/memory-storage.ts

@@ -0,0 +1,30 @@
+function createMemoryStorage() {
+  let _store: { [key: string]: unknown } = {};
+
+  function setItem(key: string, value: unknown): void {
+    _store[key] = value;
+  }
+
+  function getItem(key: string): unknown {
+    return _store[key];
+  }
+
+  function removeItem(key: string): void {
+    delete _store[key];
+  }
+
+  function reset(): void {
+    _store = {};
+  }
+
+  return {
+    setItem,
+    getItem,
+    removeItem,
+    reset,
+  };
+}
+
+const memoryStorage = createMemoryStorage();
+
+export { memoryStorage };

package/src/client/utils/native-storage.ts

@@ -0,0 +1,43 @@
+let AsyncStorage: any = null;
+try {
+  AsyncStorage = require("@react-native-async-storage/async-storage").default;
+} catch (e) {
+  // Not in React Native, ignore
+}
+
+function isReactNative() {
+  return (
+    typeof navigator !== "undefined" &&
+    navigator.product === "ReactNative"
+  );
+}
+
+const nativeStorage = {
+  async setItem(key: string, value: string) {
+    if (isReactNative() && AsyncStorage) {
+      await AsyncStorage.setItem(key, value);
+    } else {
+      // fallback to in-memory for web
+      (globalThis as any).__nativeMemoryStore = (globalThis as any).__nativeMemoryStore || {};
+      (globalThis as any).__nativeMemoryStore[key] = value;
+    }
+  },
+  async getItem(key: string): Promise<string | null> {
+    if (isReactNative() && AsyncStorage) {
+      return await AsyncStorage.getItem(key);
+    } else {
+      return (globalThis as any).__nativeMemoryStore?.[key] ?? null;
+    }
+  },
+  async removeItem(key: string) {
+    if (isReactNative() && AsyncStorage) {
+      await AsyncStorage.removeItem(key);
+    } else {
+      if ((globalThis as any).__nativeMemoryStore) {
+        delete (globalThis as any).__nativeMemoryStore[key];
+      }
+    }
+  }
+};
+
+export { nativeStorage };

package/src/client/utils/pkce.ts

@@ -0,0 +1,36 @@
+import * as Crypto from "expo-crypto";
+
+export async function createPkceChallenge() {
+  const codeVerifier = await generateCodeVerifier();
+  const codeChallenge = await generateCodeChallenge(codeVerifier);
+  return { codeVerifier, codeChallenge };
+}
+
+async function generateCodeVerifier(): Promise<string> {
+  // Generate 32 random bytes and encode as base64url
+  const randomBytes = await Crypto.getRandomBytesAsync(32);
+  return base64urlEncode(randomBytes);
+}
+
+async function generateCodeChallenge(codeVerifier: string): Promise<string> {
+  // Hash the code verifier using SHA-256 and encode as base64url
+  const hash = await Crypto.digestStringAsync(
+    Crypto.CryptoDigestAlgorithm.SHA256,
+    codeVerifier,
+    { encoding: Crypto.CryptoEncoding.BASE64 },
+  );
+  // Convert base64 to base64url
+  return hash.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+function base64urlEncode(uint8Array: Uint8Array): string {
+  // Convert Uint8Array to base64
+  let binary = "";
+  for (let i = 0; i < uint8Array.length; i++) {
+    binary += String.fromCharCode(uint8Array[i]);
+  }
+  const base64 = btoa(binary);
+
+  // Convert base64 to base64url
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}

package/src/client/utils/session-data.ts

@@ -0,0 +1,59 @@
+import type { AuthenticationResponse } from "../interfaces";
+import { memoryStorage } from "./memory-storage";
+import { nativeStorage } from "./native-storage";
+import { storageKeys } from "./storage-keys";
+
+interface AccessToken {
+  exp: number;
+  iat: number;
+  iss: string;
+  jti: string;
+  sid: string;
+  sub: string;
+  org_id?: string;
+  role?: string;
+  permissions?: string[];
+}
+
+// should replace this with jose if we ever need to verify the JWT
+export function getClaims(accessToken: string) {
+  return JSON.parse(atob(accessToken.split(".")[1])) as AccessToken;
+}
+
+export function setSessionData(
+  data: AuthenticationResponse,
+  { devMode = false } = {},
+) {
+  const { user, accessToken, refreshToken } = data;
+  memoryStorage.setItem(storageKeys.user, user);
+  memoryStorage.setItem(storageKeys.accessToken, accessToken);
+  if (devMode) {
+    nativeStorage.setItem(storageKeys.refreshToken, refreshToken);
+  } else {
+    memoryStorage.setItem(storageKeys.refreshToken, refreshToken);
+  }
+
+  // compute a local time version of expires at (should avoid issues with slightly-wrong clocks)
+  const { exp, iat } = getClaims(accessToken);
+  const expiresIn = exp - iat;
+  const expiresAt = Date.now() + expiresIn * 1000;
+  memoryStorage.setItem(storageKeys.expiresAt, expiresAt);
+}
+
+export function removeSessionData({ devMode = false } = {}) {
+  memoryStorage.removeItem(storageKeys.user);
+  memoryStorage.removeItem(storageKeys.accessToken);
+  if (devMode) {
+    nativeStorage.removeItem(storageKeys.refreshToken);
+  } else {
+    memoryStorage.removeItem(storageKeys.refreshToken);
+  }
+}
+
+export async function getRefreshToken({ devMode = false } = {}) {
+  if (devMode) {
+    return await nativeStorage.getItem(storageKeys.refreshToken);
+  } else {
+    return memoryStorage.getItem(storageKeys.refreshToken) as string | undefined;
+  }
+}

package/src/client/utils/storage-keys.ts

@@ -0,0 +1,7 @@
+export const storageKeys = {
+  codeVerifier: "code-verifier",
+  user: "user",
+  accessToken: "access-token",
+  refreshToken: "refresh-token",
+  expiresAt: "expires-at",
+} as const;

package/src/index.ts

@@ -0,0 +1,11 @@
+// Client exports
+export { createClient } from "./client/create-client";
+export type { RedirectOptions } from "./client/create-client";
+export { getClaims } from "./client/utils/session-data";
+export type { User, AuthenticationResponse } from "./client/interfaces";
+export { AuthKitError, LoginRequiredError } from "./client/errors";
+export { memoryStorage } from "./client/utils/memory-storage";
+
+// Provider exports
+export { YboardAuthProvider } from "./provider/authProvider";
+export { useYboardAuth } from "./provider/hook";

package/src/provider/authProvider.tsx

@@ -0,0 +1,91 @@
+import { createClient, LoginRequiredError } from "../client";
+import type { RedirectOptions } from "../client/create-client";
+import type { State } from "./state";
+import React, { useState } from "react";
+import { YboardAuthContext } from "./context";
+import { initialState } from "./state";
+
+export type Client = Pick<
+  Awaited<ReturnType<typeof createClient>>,
+  "signIn" | "signUp" | "getUser" | "getAccessToken" | "signOut"
+>;
+
+export type CreateClientOptions = NonNullable<
+  Parameters<typeof createClient>[1]
+>;
+
+type YboardAuthProviderProps = CreateClientOptions & {
+  clientId: string;
+  organizationId: string;
+  children: React.ReactNode;
+};
+
+export function YboardAuthProvider(props: YboardAuthProviderProps) {
+  const {
+    clientId,
+    apiHostname,
+    https,
+    port,
+    redirectUri,
+    children,
+    organizationId,
+    refreshBufferInterval,
+  } = props;
+  const [client, setClient] = useState<Client>(NOOP_CLIENT);
+  const [state, setState] = React.useState(initialState);
+
+  React.useEffect(() => {
+    async function initialize() {
+      try {
+        const client = await createClient(clientId, {
+          apiHostname,
+          port,
+          organizationId,
+          https,
+          redirectUri,
+          refreshBufferInterval,
+        });
+        const user = await client.getUser();
+
+        setClient({
+          getAccessToken: client.getAccessToken.bind(client),
+          getUser: client.getUser.bind(client),
+          signIn: async (...args: [Omit<RedirectOptions, "type">?]) => {
+            await client.signIn(...args);
+            const user = await client.getUser();
+            setState((prev: State) => ({ ...prev, user }));
+          },
+          signUp: async (...args: [Omit<RedirectOptions, "type">?]) => {
+            await client.signUp(...args);
+            const user = await client.getUser();
+            setState((prev: State) => ({ ...prev, user }));
+          },
+          signOut: async (...args: [{ returnTo: string }?]) => {
+            await client.signOut(...args);
+            setState((prev: State) => ({ ...prev, user: null }));
+          },
+        });
+        setState((prev: State) => ({ ...prev, isLoading: false, user }));
+      } catch (err) {
+        console.error("Error initializing auth client:", err);
+        setState((prev: State) => ({ ...prev, isLoading: false, user: null }));
+      }
+    }
+
+    initialize();
+  }, []);
+
+  return (
+    <YboardAuthContext.Provider value={{ ...client, ...state }}>
+      {children}
+    </YboardAuthContext.Provider>
+  );
+}
+
+const NOOP_CLIENT: Client = {
+  signIn: async () => {},
+  signUp: async () => {},
+  getUser: () => Promise.resolve(null),
+  getAccessToken: () => Promise.reject(new LoginRequiredError()),
+  signOut: async () => Promise.resolve(),
+};

package/src/provider/context.ts

@@ -0,0 +1,12 @@
+"use client";
+
+import * as React from "react";
+
+import { type State, initialState } from "./state";
+import type { Client } from "./authProvider";
+
+export interface ContextValue extends Client, State { }
+
+export const YboardAuthContext = React.createContext<ContextValue>(
+    initialState as ContextValue,
+);

package/src/provider/hook.ts

@@ -0,0 +1,13 @@
+import * as React from "react";
+import { YboardAuthContext } from "./context";
+import { initialState } from "./state";
+
+export function useYboardAuth() {
+    const context = React.useContext(YboardAuthContext);
+
+    if (context === initialState) {
+        throw new Error("useYboardAuth must be used within a YboardAuthProvider");
+    }
+
+    return context;
+}

package/src/provider/state.ts

@@ -0,0 +1,17 @@
+import type { User } from "../client/interfaces";
+
+export interface State {
+    isLoading: boolean;
+    user: User | null;
+    role: string | null;
+    organizationId: string | null;
+    permissions: string[];
+}
+
+export const initialState: State = {
+    isLoading: true,
+    user: null,
+    role: null,
+    organizationId: null,
+    permissions: [],
+};