authscape 1.0.768 → 1.0.773

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authscape",
-  "version": "1.0.768",
+  "version": "1.0.773",
   "description": "",
   "main": "index.js",
   "files": [
@@ -27,11 +27,13 @@
   "devDependencies": {
     "@babel/cli": "^7.27.0",
     "@babel/core": "^7.26.10",
+    "@babel/plugin-transform-runtime": "^7.29.0",
     "@babel/preset-env": "^7.26.9",
     "@babel/preset-react": "^7.26.3",
     "react-dom": "^18.3.1"
   },
   "dependencies": {
+    "@babel/runtime": "^7.29.2",
     "@lexical/code": "^0.21.0",
     "@lexical/html": "^0.21.0",
     "@lexical/link": "^0.21.0",
@@ -40,7 +42,6 @@
     "@lexical/rich-text": "^0.21.0",
     "@lexical/selection": "^0.21.0",
     "@microsoft/signalr": "^8.0.0",
-    "lexical": "^0.21.0",
     "audit": "^0.0.6",
     "axios": "^1.6.1",
     "eslint-config-next": "^16.0.3",
@@ -50,6 +51,7 @@
     "js-cookie": "^3.0.5",
     "js-file-download": "^0.4.12",
     "jspdf": "^4.0.0",
+    "lexical": "^0.21.0",
     "query-string": "^7.1.1",
     "react": "^18.2.0",
     "react-color": "^2.19.3",

package/src/components/AuthScapeApp.js

@@ -4,7 +4,7 @@ import Head from "next/head";
 
 // Re-export toast and transitions so pages can import from authscape
 export { toast, Bounce, Slide, Zoom, Flip };
-import { useSearchParams, usePathname } from "next/navigation";
+import { useRouter } from "next/router";
 import axios from "axios";
 import querystring from "query-string";
 import Router from "next/router";
@@ -501,9 +501,22 @@ export function AuthScapeApp({
   const errorTrackingInitializedRef = useRef(false);
   const loginRedirectPending = useRef(false);
 
-  const searchParams = useSearchParams();
-  const queryCode = searchParams?.get("code") ?? null;
-  const pathname = usePathname();
+  // Use Pages Router's `useRouter` instead of `useSearchParams`/`usePathname`
+  // from `next/navigation`. The `next/navigation` hooks don't hydrate query
+  // params reliably on the 404 page in Webkit/Safari — when the IDP redirects
+  // back to /signin-oidc (a URL with no Next.js page in the consumer project),
+  // useSearchParams() returns null and the PKCE code is never picked up.
+  // The Pages Router router parses query from `asPath` and works on 404 too.
+  const router = useRouter();
+  const rawQueryCode = router.isReady ? router.query.code : null;
+  // router.query values can be string | string[] — coerce to a single string.
+  const queryCode = typeof rawQueryCode === "string"
+    ? rawQueryCode
+    : (Array.isArray(rawQueryCode) ? rawQueryCode[0] : null);
+  // Pages Router's `router.pathname` returns the route file path (e.g. "/_error"
+  // for the 404 page). The auth-redirect guard below compares against
+  // "/signin-oidc", so we derive the actual URL path from `asPath` instead.
+  const pathname = (router.asPath || "").split("?")[0].split("#")[0];
 
   const signInValidator = async (codeFromQuery) => {
     if (queryCodeUsed.current === codeFromQuery) return;
@@ -547,19 +560,19 @@ export function AuthScapeApp({
         expires: 365,
         path: "/",
         domain: domainHost,
-        secure: true,
+        secure: (typeof window !== "undefined" && window.location.protocol === "https:"),
       });
       Cookies.set("expires_in", String(response.data.expires_in), {
         expires: 365,
         path: "/",
         domain: domainHost,
-        secure: true,
+        secure: (typeof window !== "undefined" && window.location.protocol === "https:"),
       });
       Cookies.set("refresh_token", response.data.refresh_token, {
         expires: 365,
         path: "/",
         domain: domainHost,
-        secure: true,
+        secure: (typeof window !== "undefined" && window.location.protocol === "https:"),
       });
 
       resetRedirectCounter();
@@ -567,7 +580,43 @@ export function AuthScapeApp({
       const redirectUri = window.localStorage.getItem("redirectUri") || "/";
       window.localStorage.clear();
 
-      window.location.href = redirectUri;
+      // Pre-load user while spinner is still showing — eliminates the
+      // second GetCurrentUser call (and resulting re-renders) on the destination page.
+      let usr = null;
+      try {
+        usr = await module.exports.apiService().GetCurrentUser();
+      } catch (fetchErr) {
+        console.warn("[AuthScape] GetCurrentUser failed after token exchange:", fetchErr);
+      }
+      const enrichedUser = ensureUserHelpers(usr);
+
+      signedInUser.current = enrichedUser;
+      setSignedInUserState(enrichedUser);
+      setFrontEndLoadedState(true);
+
+      // Prevent the useEffect from calling GetCurrentUser again when queryCode → null.
+      loadingAuth.current = true;
+
+      if (enableErrorTracking && enrichedUser && !errorTrackingInitializedRef.current) {
+        initializeErrorTracking(enrichedUser);
+        errorTrackingInitializedRef.current = true;
+      }
+
+      if (onUserLoaded && enrichedUser) {
+        onUserLoaded(enrichedUser);
+      }
+
+      // Dismiss spinner before navigating so destination renders logged-in UI on first paint.
+      setIsSigningIn(false);
+
+      // Client-side navigation preserves the React component tree and all ref values,
+      // eliminating the hard-reload → remount → re-render chain.
+      // Fall back to hard navigation for absolute external URLs.
+      if (redirectUri.startsWith("http://") || redirectUri.startsWith("https://")) {
+        window.location.href = redirectUri;
+      } else {
+        Router.push(redirectUri);
+      }
     } catch (exp) {
       console.error("PKCE sign-in failed", exp);
       window.localStorage.clear();
@@ -805,3 +854,8 @@ export function AuthScapeApp({
     </>
   );
 }
+
+// AuthScapeProvider is the umbrella component that bundles the three always-on AuthScape
+// features (auth, error tracking, analytics) plus optional in-app notifications. Wrap your
+// NextJS _app.js return value with it. Existing call sites can continue using AuthScapeApp.
+export const AuthScapeProvider = AuthScapeApp;

package/src/services/apiService.js

@@ -58,21 +58,21 @@ const RefreshToken = async (originalRequest, instance) => {
                 expires: 365,
                 path: '/',
                 domain: domainHost,
-                secure: true
+                secure: (typeof window !== "undefined" && window.location.protocol === "https:")
             });
 
             Cookies.set('expires_in', String(response.data.expires_in), {
                 expires: 365,
                 path: '/',
                 domain: domainHost,
-                secure: true
+                secure: (typeof window !== "undefined" && window.location.protocol === "https:")
             });
 
             Cookies.set('refresh_token', response.data.refresh_token, {
                 expires: 365,
                 path: '/',
                 domain: domainHost,
-                secure: true
+                secure: (typeof window !== "undefined" && window.location.protocol === "https:")
             });
 
             return true;
@@ -116,9 +116,9 @@ export const apiService = (ctx = null) => {
                 if (error.response.status === 400) {
                     if (error.response.config.url.includes("/connect/token")) {
                         let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-                        Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
-                        Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
-                        Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
+                        Cookies.remove('access_token', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
+                        Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
+                        Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
                     }
                     return Promise.reject(error);
                 }

package/src/services/authService.js

@@ -5,7 +5,7 @@ export const authService = () => {
     return {
 
         dec2hex: (dec) => {
-            return ('0' + dec.toString(16)).substr(-2)
+            return ('0' + dec.toString(16)).slice(-2)
         },
         generateRandomString: () => {
             var array = new Uint32Array(56/2);
@@ -64,9 +64,10 @@ export const authService = () => {
 
             return response;
         },
-        login: async (redirectUserUri = null, dnsRecord = null, deviceId = null) => {
+        login: async (redirectUserUri = null, deviceId = null) => {
+
+            let state = authService().generateRandomString();
 
-            let state = "1234";
             if (redirectUserUri != null)
             {
                 localStorage.setItem("redirectUri", redirectUserUri);
@@ -75,18 +76,8 @@ export const authService = () => {
             let verifier = authService().generateRandomString();
             var challenge = await authService().challenge_from_verifier(verifier);
 
-            console.log('[PKCE] Login initiated');
-            console.log('[PKCE] Verifier generated | length:', verifier.length, '| preview:', verifier.substring(0, 10) + '...');
-            console.log('[PKCE] Challenge generated | value:', challenge);
-            console.log('[PKCE] authorityUri:', process.env.authorityUri);
-            console.log('[PKCE] client_id:', process.env.client_id);
-
             window.localStorage.setItem("verifier", verifier);
 
-            const storedVerifier = window.localStorage.getItem("verifier");
-            console.log('[PKCE] Verifier stored successfully:', storedVerifier === verifier);
-            console.log('[PKCE] Stored verifier length:', storedVerifier?.length);
-
             let redirectUri = window.location.origin + "/signin-oidc";
             let loginUri = process.env.authorityUri + "/connect/authorize?response_type=code&state=" + state + "&client_id=" + process.env.client_id + "&scope=email%20openid%20offline_access%20profile%20api1&redirect_uri=" + redirectUri + "&code_challenge=" + challenge + "&code_challenge_method=S256";
 
@@ -95,7 +86,6 @@ export const authService = () => {
                 loginUri += "&deviceId=" + deviceId; // will be for chrome extention and mobile apps later
             }
 
-            console.log('[PKCE] Redirecting to:', loginUri);
             window.location.href = loginUri;
         },
         signUp: (redirectUrl = null) => {
@@ -126,40 +116,18 @@ export const authService = () => {
             let domainHost = window.location.hostname.split('.').slice(-2).join('.');
             let AuthUri = process.env.authorityUri;
 
+            Cookies.remove('access_token', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
+            Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
+            Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: (typeof window !== "undefined" && window.location.protocol === "https:") });
 
-            Cookies.remove('access_token', { path: '/', domain: domainHost, secure: true });
-            Cookies.remove('refresh_token', { path: '/', domain: domainHost, secure: true });
-            Cookies.remove('expires_in', { path: '/', domain: domainHost, secure: true });
-
-
-            // destroyCookie({}, "access_token", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            // destroyCookie({}, "refresh_token", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            // destroyCookie({}, "expires_in", {
-            //     maxAge: 2147483647,
-            //     path: '/',
-            //     domain: domainHost
-            // });
-
-            setTimeout(() => {
-                if (redirectUri == null)
-                {
-                    window.location.href = AuthUri + "/connect/logout?redirect=" + window.location.href;
-                }
-                else
-                {
-                    window.location.href = AuthUri + "/connect/logout?redirect=" + redirectUri;
-                }
-            }, 500);
+            if (redirectUri == null)
+            {
+                window.location.href = AuthUri + "/connect/logout?redirect=" + window.location.href;
+            }
+            else
+            {
+                window.location.href = AuthUri + "/connect/logout?redirect=" + redirectUri;
+            }
 
         },
     }

package/src/services/signInValidator.js

@@ -1,117 +0,0 @@
-import React, { useEffect, useState } from 'react';
-import axios from 'axios';
-import querystring from "query-string";
-// import Cookies from 'js-cookie';
-
-export const signInValidator = async (queryCode) => {
-
-  let codeVerifier = window.localStorage.getItem("verifier");
-
-      console.log('[PKCE] signInValidator called');
-      console.log('[PKCE] queryCode present:', !!queryCode, '| value:', queryCode);
-      console.log('[PKCE] codeVerifier present:', !!codeVerifier, '| length:', codeVerifier?.length);
-
-      if (queryCode != null && codeVerifier != null)
-      {
-        const headers = {'Content-Type': 'application/x-www-form-urlencoded'}
-
-        const tokenParams = {
-          code: queryCode,
-          grant_type: "authorization_code",
-          redirect_uri: window.location.origin + "/signin-oidc",
-          client_id: process.env.client_id,
-          client_secret: process.env.client_secret,
-          code_verifier: codeVerifier
-        };
-
-        console.log('[PKCE] Token request params:', {
-          ...tokenParams,
-          client_secret: tokenParams.client_secret ? '***' : '(missing!)',
-          code: tokenParams.code?.substring(0, 10) + '...',
-          code_verifier: tokenParams.code_verifier?.substring(0, 10) + '... (length: ' + tokenParams.code_verifier?.length + ')',
-        });
-        console.log('[PKCE] Token endpoint:', process.env.authorityUri + '/connect/token');
-        console.log('[PKCE] redirect_uri:', tokenParams.redirect_uri);
-
-        let queryString = querystring.stringify(tokenParams);
-
-        let response;
-        try {
-          response = await axios.post(process.env.authorityUri + '/connect/token', queryString, {
-            headers: headers
-          });
-          console.log('[PKCE] Token response status:', response.status);
-          console.log('[PKCE] Token response has access_token:', !!response.data?.access_token);
-          console.log('[PKCE] Token response has refresh_token:', !!response.data?.refresh_token);
-        } catch (err) {
-          console.error('[PKCE] Token request FAILED');
-          console.error('[PKCE] Status:', err.response?.status);
-          console.error('[PKCE] Error data:', JSON.stringify(err.response?.data));
-          console.error('[PKCE] Error message:', err.message);
-          throw err;
-        }
-
-        let domainHost = window.location.hostname.split('.').slice(-2).join('.');
-        window.localStorage.removeItem("verifier");
-
-
-
-        await setCookie('access_token', response.data.access_token, {
-            maxAge: 60 * 60 * 24 * 365, // 1 year,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
-
-        await setCookie('expires_in', response.data.expires_in, {
-            maxAge: 60 * 60 * 24 * 365, // 1 year,
-            path: '/',
-            domain: domainHost,
-            secure: true
-        });
-
-        await setCookie('refresh_token', response.data.refresh_token, {
-          maxAge: 60 * 60 * 24 * 365, // 1 year,
-          path: '/',
-          domain: domainHost,
-          secure: true
-        });
-
-
-        // await setCookie(null, "access_token", response.data.access_token,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-    
-        // await setCookie(null, "expires_in", response.data.expires_in,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-    
-        // await setCookie(null, "refresh_token", response.data.refresh_token,
-        // {
-        //     maxAge: 2147483647,
-        //     path: '/',
-        //     domain: domainHost,
-        //     secure: true
-        // });
-
-
-        let redirectUri = localStorage.getItem("redirectUri")
-        localStorage.clear();
-        if (redirectUri != null)
-        {
-          window.location.href = redirectUri;
-        }
-        else
-        {
-          window.location.href = "/";
-        }
-    }
-}