authscape 1.0.766 → 1.0.772

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authscape",
-  "version": "1.0.766",
+  "version": "1.0.772",
   "description": "",
   "main": "index.js",
   "files": [

package/src/components/AuthScapeApp.js

@@ -4,7 +4,7 @@ import Head from "next/head";
 
 // Re-export toast and transitions so pages can import from authscape
 export { toast, Bounce, Slide, Zoom, Flip };
-import { useSearchParams, usePathname } from "next/navigation";
+import { useRouter } from "next/router";
 import axios from "axios";
 import querystring from "query-string";
 import Router from "next/router";
@@ -17,18 +17,33 @@ import { HubConnectionBuilder, LogLevel, HttpTransportType } from '@microsoft/si
 import Cookies from 'js-cookie';
 
 // ============================================================================
-// Cookie utility function
+// Auth Redirect Circuit Breaker
 // ============================================================================
-const setCookie = (name, value, options = {}) => {
-  return new Promise((resolve) => {
-    let cookieString = `${name}=${value};`;
-    if (options.maxAge) cookieString += `max-age=${options.maxAge};`;
-    if (options.path) cookieString += `path=${options.path};`;
-    if (options.domain) cookieString += `domain=${options.domain};`;
-    if (options.secure) cookieString += `secure;`;
-    document.cookie = cookieString;
-    resolve();
-  });
+const AUTH_REDIRECT_KEY = 'authscape_redirect_count';
+const AUTH_REDIRECT_TS_KEY = 'authscape_redirect_ts';
+const AUTH_MAX_REDIRECTS = 3;
+const AUTH_REDIRECT_WINDOW_MS = 30000; // 30 seconds
+
+const checkAndIncrementRedirect = () => {
+  if (typeof window === 'undefined') return false;
+  const now = Date.now();
+  const storedTs = parseInt(sessionStorage.getItem(AUTH_REDIRECT_TS_KEY) || '0', 10);
+  let count = parseInt(sessionStorage.getItem(AUTH_REDIRECT_KEY) || '0', 10);
+
+  if (now - storedTs > AUTH_REDIRECT_WINDOW_MS) {
+    count = 0;
+    sessionStorage.setItem(AUTH_REDIRECT_TS_KEY, String(now));
+  }
+
+  count += 1;
+  sessionStorage.setItem(AUTH_REDIRECT_KEY, String(count));
+  return count <= AUTH_MAX_REDIRECTS;
+};
+
+const resetRedirectCounter = () => {
+  if (typeof window === 'undefined') return;
+  sessionStorage.removeItem(AUTH_REDIRECT_KEY);
+  sessionStorage.removeItem(AUTH_REDIRECT_TS_KEY);
 };
 
 // ============================================================================
@@ -484,10 +499,24 @@ export function AuthScapeApp({
   const queryCodeUsed = useRef(null);
   const ga4React = useRef(null);
   const errorTrackingInitializedRef = useRef(false);
-
-  const searchParams = useSearchParams();
-  const queryCode = searchParams?.get("code") ?? null;
-  const pathname = usePathname();
+  const loginRedirectPending = useRef(false);
+
+  // Use Pages Router's `useRouter` instead of `useSearchParams`/`usePathname`
+  // from `next/navigation`. The `next/navigation` hooks don't hydrate query
+  // params reliably on the 404 page in Webkit/Safari — when the IDP redirects
+  // back to /signin-oidc (a URL with no Next.js page in the consumer project),
+  // useSearchParams() returns null and the PKCE code is never picked up.
+  // The Pages Router router parses query from `asPath` and works on 404 too.
+  const router = useRouter();
+  const rawQueryCode = router.isReady ? router.query.code : null;
+  // router.query values can be string | string[] — coerce to a single string.
+  const queryCode = typeof rawQueryCode === "string"
+    ? rawQueryCode
+    : (Array.isArray(rawQueryCode) ? rawQueryCode[0] : null);
+  // Pages Router's `router.pathname` returns the route file path (e.g. "/_error"
+  // for the 404 page). The auth-redirect guard below compares against
+  // "/signin-oidc", so we derive the actual URL path from `asPath` instead.
+  const pathname = (router.asPath || "").split("?")[0].split("#")[0];
 
   const signInValidator = async (codeFromQuery) => {
     if (queryCodeUsed.current === codeFromQuery) return;
@@ -500,7 +529,8 @@ export function AuthScapeApp({
     const codeVerifier = window.localStorage.getItem("verifier");
     if (!codeFromQuery || !codeVerifier) {
       window.localStorage.clear();
-      module.exports.authService().login();
+      setIsSigningIn(false);
+      setFrontEndLoadedState(true);
       return;
     }
 
@@ -526,34 +556,72 @@ export function AuthScapeApp({
 
       window.localStorage.removeItem("verifier");
 
-      await setCookie("access_token", response.data.access_token, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("access_token", response.data.access_token, {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
-      await setCookie("expires_in", response.data.expires_in, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("expires_in", String(response.data.expires_in), {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
-      await setCookie("refresh_token", response.data.refresh_token, {
-        maxAge: 60 * 60 * 24 * 365,
+      Cookies.set("refresh_token", response.data.refresh_token, {
+        expires: 365,
         path: "/",
         domain: domainHost,
         secure: true,
       });
 
+      resetRedirectCounter();
+
       const redirectUri = window.localStorage.getItem("redirectUri") || "/";
       window.localStorage.clear();
 
-      window.location.href = redirectUri;
+      // Pre-load user while spinner is still showing — eliminates the
+      // second GetCurrentUser call (and resulting re-renders) on the destination page.
+      let usr = null;
+      try {
+        usr = await module.exports.apiService().GetCurrentUser();
+      } catch (fetchErr) {
+        console.warn("[AuthScape] GetCurrentUser failed after token exchange:", fetchErr);
+      }
+      const enrichedUser = ensureUserHelpers(usr);
+
+      signedInUser.current = enrichedUser;
+      setSignedInUserState(enrichedUser);
+      setFrontEndLoadedState(true);
+
+      // Prevent the useEffect from calling GetCurrentUser again when queryCode → null.
+      loadingAuth.current = true;
+
+      if (enableErrorTracking && enrichedUser && !errorTrackingInitializedRef.current) {
+        initializeErrorTracking(enrichedUser);
+        errorTrackingInitializedRef.current = true;
+      }
+
+      if (onUserLoaded && enrichedUser) {
+        onUserLoaded(enrichedUser);
+      }
+
+      // Dismiss spinner before navigating so destination renders logged-in UI on first paint.
+      setIsSigningIn(false);
+
+      // Client-side navigation preserves the React component tree and all ref values,
+      // eliminating the hard-reload → remount → re-render chain.
+      // Fall back to hard navigation for absolute external URLs.
+      if (redirectUri.startsWith("http://") || redirectUri.startsWith("https://")) {
+        window.location.href = redirectUri;
+      } else {
+        Router.push(redirectUri);
+      }
     } catch (exp) {
       console.error("PKCE sign-in failed", exp);
       window.localStorage.clear();
       setIsSigningIn(false);
-      module.exports.authService().login();
+      setFrontEndLoadedState(true);
     }
   };
 
@@ -653,8 +721,14 @@ export function AuthScapeApp({
       enforceLoggedIn &&
       pathname !== "/signin-oidc" &&
       frontEndLoadedState &&
-      !signedInUserState
+      !signedInUserState &&
+      !loginRedirectPending.current
     ) {
+      if (!checkAndIncrementRedirect()) {
+        console.warn('[AuthScape] Auth redirect loop detected — halting redirects.');
+        return;
+      }
+      loginRedirectPending.current = true;
       module.exports.authService().login();
     }
   }, [signedInUserState, enforceLoggedIn, frontEndLoadedState, pathname]);
@@ -780,3 +854,8 @@ export function AuthScapeApp({
     </>
   );
 }
+
+// AuthScapeProvider is the umbrella component that bundles the three always-on AuthScape
+// features (auth, error tracking, analytics) plus optional in-app notifications. Wrap your
+// NextJS _app.js return value with it. Existing call sites can continue using AuthScapeApp.
+export const AuthScapeProvider = AuthScapeApp;

package/src/services/apiService.js

@@ -3,19 +3,6 @@ import querystring from 'query-string';
 import fileDownload from 'js-file-download';
 import Cookies from 'js-cookie';
 
-// Cookie utility function
-const setCookie = (name, value, options = {}) => {
-  return new Promise((resolve) => {
-    let cookieString = `${name}=${value};`;
-    if (options.maxAge) cookieString += `max-age=${options.maxAge};`;
-    if (options.path) cookieString += `path=${options.path};`;
-    if (options.domain) cookieString += `domain=${options.domain};`;
-    if (options.secure) cookieString += `secure;`;
-    document.cookie = cookieString;
-    resolve();
-  });
-};
-
 const setupDefaultOptions = async (ctx = null) => {
     let defaultOptions = {};
     if (ctx == null) {
@@ -42,46 +29,58 @@ const setupDefaultOptions = async (ctx = null) => {
 }
 
 const RefreshToken = async (originalRequest, instance) => {
-    let accessToken = Cookies.get('access_token') || '';
-    let refreshToken = Cookies.get('refresh_token') || '';
-
-    let response = await instance.post(process.env.authorityUri + "/connect/token",
-        querystring.stringify({
-            grant_type: 'refresh_token',
-            client_id: process.env.client_id,
-            client_secret: process.env.client_secret,
-            refresh_token: refreshToken
-        }), {
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            "Authorization": "Bearer " + accessToken
-        }
-    });
+    try {
+        let accessToken = Cookies.get('access_token') || '';
+        let refreshToken = Cookies.get('refresh_token') || '';
 
-    if (response != null && response.status == 200) {
-        let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-        originalRequest.headers['Authorization'] = 'Bearer ' + response.data.access_token;
+        if (!refreshToken) {
+            return false;
+        }
 
-        await setCookie('access_token', response.data.access_token, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
+        let response = await instance.post(process.env.authorityUri + "/connect/token",
+            querystring.stringify({
+                grant_type: 'refresh_token',
+                client_id: process.env.client_id,
+                client_secret: process.env.client_secret,
+                refresh_token: refreshToken
+            }), {
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                "Authorization": "Bearer " + accessToken
+            }
         });
 
-        await setCookie('expires_in', response.data.expires_in, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
+        if (response != null && response.status == 200) {
+            let domainHost = window.location.hostname.split('.').slice(-2).join('.');
+            originalRequest.headers['Authorization'] = 'Bearer ' + response.data.access_token;
+
+            Cookies.set('access_token', response.data.access_token, {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            Cookies.set('expires_in', String(response.data.expires_in), {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            Cookies.set('refresh_token', response.data.refresh_token, {
+                expires: 365,
+                path: '/',
+                domain: domainHost,
+                secure: true
+            });
+
+            return true;
+        }
 
-        await setCookie('refresh_token', response.data.refresh_token, {
-            maxAge: 60 * 60 * 24 * 365,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
+        return false;
+    } catch (err) {
+        return false;
     }
 }
 
@@ -107,16 +106,19 @@ export const apiService = (ctx = null) => {
             if (error.response) {
                 if (error.response.status === 401 && !originalConfig._retry) {
                     originalConfig._retry = true;
-                    await RefreshToken(originalConfig, instance);
-                    return instance.request(originalConfig);
+                    const refreshed = await RefreshToken(originalConfig, instance);
+                    if (refreshed) {
+                        return instance.request(originalConfig);
+                    }
+                    return Promise.reject(error);
                 }
 
                 if (error.response.status === 400) {
                     if (error.response.config.url.includes("/connect/token")) {
                         let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-                        Cookies.remove('access_token', { path: '/', domain: domainHost });
-                        Cookies.remove('refresh_token', { path: '/', domain: domainHost });
-                        Cookies.remove('expires_in', { path: '/', domain: domainHost });
+                        Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
+                        Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
+                        Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
                     }
                     return Promise.reject(error);
                 }

package/src/services/authService.js

@@ -5,7 +5,7 @@ export const authService = () => {
     return {
 
         dec2hex: (dec) => {
-            return ('0' + dec.toString(16)).substr(-2)
+            return ('0' + dec.toString(16)).slice(-2)
         },
         generateRandomString: () => {
             var array = new Uint32Array(56/2);
@@ -64,9 +64,10 @@ export const authService = () => {
 
             return response;
         },
-        login: async (redirectUserUri = null, dnsRecord = null, deviceId = null) => {
+        login: async (redirectUserUri = null, deviceId = null) => {
+
+            let state = authService().generateRandomString();
 
-            let state = "1234";
             if (redirectUserUri != null)
             {
                 localStorage.setItem("redirectUri", redirectUserUri);
@@ -75,18 +76,8 @@ export const authService = () => {
             let verifier = authService().generateRandomString();
             var challenge = await authService().challenge_from_verifier(verifier);
 
-            console.log('[PKCE] Login initiated');
-            console.log('[PKCE] Verifier generated | length:', verifier.length, '| preview:', verifier.substring(0, 10) + '...');
-            console.log('[PKCE] Challenge generated | value:', challenge);
-            console.log('[PKCE] authorityUri:', process.env.authorityUri);
-            console.log('[PKCE] client_id:', process.env.client_id);
-
             window.localStorage.setItem("verifier", verifier);
 
-            const storedVerifier = window.localStorage.getItem("verifier");
-            console.log('[PKCE] Verifier stored successfully:', storedVerifier === verifier);
-            console.log('[PKCE] Stored verifier length:', storedVerifier?.length);
-
             let redirectUri = window.location.origin + "/signin-oidc";
             let loginUri = process.env.authorityUri + "/connect/authorize?response_type=code&state=" + state + "&client_id=" + process.env.client_id + "&scope=email%20openid%20offline_access%20profile%20api1&redirect_uri=" + redirectUri + "&code_challenge=" + challenge + "&code_challenge_method=S256";
 
@@ -95,7 +86,6 @@ export const authService = () => {
                 loginUri += "&deviceId=" + deviceId; // will be for chrome extention and mobile apps later
             }
 
-            console.log('[PKCE] Redirecting to:', loginUri);
             window.location.href = loginUri;
         },
         signUp: (redirectUrl = null) => {
@@ -126,40 +116,18 @@ export const authService = () => {
             let domainHost = window.location.hostname.split('.').slice(-2).join('.');
             let AuthUri = process.env.authorityUri;
 
+            Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
+            Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
+            Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
 
-            Cookies.remove('access_token', { path: '/', domain: domainHost });
-            Cookies.remove('refresh_token', { path: '/', domain: domainHost });
-            Cookies.remove('expires_in', { path: '/', domain: domainHost });
-
-
-            // destroyCookie({}, "access_token", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            // destroyCookie({}, "refresh_token", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            // destroyCookie({}, "expires_in", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            setTimeout(() => {
-                if (redirectUri == null)
-                {
-                    window.location.href = AuthUri + "/connect/logout?redirect=" + window.location.href;
-                }
-                else
-                {
-                    window.location.href = AuthUri + "/connect/logout?redirect=" + redirectUri;
-                }
-            }, 500);
+            if (redirectUri == null)
+            {
+                window.location.href = AuthUri + "/connect/logout?redirect=" + window.location.href;
+            }
+            else
+            {
+                window.location.href = AuthUri + "/connect/logout?redirect=" + redirectUri;
+            }
 
         },
     }

package/src/services/signInValidator.js

@@ -1,117 +0,0 @@
-import React, { useEffect, useState } from 'react';
-import axios from 'axios';
-import querystring from "query-string";
-// import Cookies from 'js-cookie';
-
-export const signInValidator = async (queryCode) => {
-
-  let codeVerifier = window.localStorage.getItem("verifier");
-
-      console.log('[PKCE] signInValidator called');
-      console.log('[PKCE] queryCode present:', !!queryCode, '| value:', queryCode);
-      console.log('[PKCE] codeVerifier present:', !!codeVerifier, '| length:', codeVerifier?.length);
-
-      if (queryCode != null && codeVerifier != null)
-      {
-        const headers = {'Content-Type': 'application/x-www-form-urlencoded'}
-
-        const tokenParams = {
-          code: queryCode,
-          grant_type: "authorization_code",
-          redirect_uri: window.location.origin + "/signin-oidc",
-          client_id: process.env.client_id,
-          client_secret: process.env.client_secret,
-          code_verifier: codeVerifier
-        };
-
-        console.log('[PKCE] Token request params:', {
-          ...tokenParams,
-          client_secret: tokenParams.client_secret ? '***' : '(missing!)',
-          code: tokenParams.code?.substring(0, 10) + '...',
-          code_verifier: tokenParams.code_verifier?.substring(0, 10) + '... (length: ' + tokenParams.code_verifier?.length + ')',
-        });
-        console.log('[PKCE] Token endpoint:', process.env.authorityUri + '/connect/token');
-        console.log('[PKCE] redirect_uri:', tokenParams.redirect_uri);
-
-        let queryString = querystring.stringify(tokenParams);
-
-        let response;
-        try {
-          response = await axios.post(process.env.authorityUri + '/connect/token', queryString, {
-            headers: headers
-          });
-          console.log('[PKCE] Token response status:', response.status);
-          console.log('[PKCE] Token response has access_token:', !!response.data?.access_token);
-          console.log('[PKCE] Token response has refresh_token:', !!response.data?.refresh_token);
-        } catch (err) {
-          console.error('[PKCE] Token request FAILED');
-          console.error('[PKCE] Status:', err.response?.status);
-          console.error('[PKCE] Error data:', JSON.stringify(err.response?.data));
-          console.error('[PKCE] Error message:', err.message);
-          throw err;
-        }
-
-        let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-        window.localStorage.removeItem("verifier");
-
-
-
-        await setCookie('access_token', response.data.access_token, {
-            maxAge: 60 * 60 * 24 * 365, // 1 year,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
-
-        await setCookie('expires_in', response.data.expires_in, {
-            maxAge: 60 * 60 * 24 * 365, // 1 year,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
-
-        await setCookie('refresh_token', response.data.refresh_token, {
-          maxAge: 60 * 60 * 24 * 365, // 1 year,
-          path: '/',
-          domain: domainHost,
-          secure: true
-        });
-
-
-        // await setCookie(null, "access_token", response.data.access_token,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-    
-        // await setCookie(null, "expires_in", response.data.expires_in,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-    
-        // await setCookie(null, "refresh_token", response.data.refresh_token,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-
-
-        let redirectUri = localStorage.getItem("redirectUri")
-        localStorage.clear();
-        if (redirectUri != null)
-        {
-          window.location.href = redirectUri;
-        }
-        else
-        {
-          window.location.href = "/";
-        }
-    }
-}