create-astram-app 0.1.3 → 0.3.0

package/template/frontend/src/pages/Login.jsx

@@ -0,0 +1,393 @@
+/**
+ * Login — astram3 sign-in (shadcn/ui). Calls the framework auth API via
+ * useAuth().login() (@astram/frontend-core logic, unchanged). On success → the return path or
+ * /dashboard. An account with MFA enrolled runs a second step: login returns a
+ * challengeToken and we prompt for the 6-digit TOTP code, then complete via
+ * useAuth().completeMfa() to establish the session exactly as a plain login would.
+ */
+import { useRef, useState } from 'react';
+import { Link, useLocation, useNavigate } from 'react-router-dom';
+import { AlertCircle, ArrowLeft, Eye, EyeOff, Loader2, LogIn, ShieldCheck } from 'lucide-react';
+import { useAuth } from '@/auth/AuthContext';
+import { loadReturnPath, clearReturnPath } from '@/platform/returnPathStore';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { InputOTP, InputOTPGroup, InputOTPSlot } from '@/components/ui/input-otp';
+import { Checkbox } from '@/components/ui/checkbox';
+import { Card, CardContent } from '@/components/ui/card';
+import ThemeToggle from '@/theme/ThemeToggle';
+import { branding } from '@/config/branding';
+
+export default function Login() {
+  const { login, completeMfa } = useAuth();
+  const navigate = useNavigate();
+  const location = useLocation();
+  // Where to land after a successful login: the router's in-memory `from` (set when
+  // RequireAuth bounced the user this same page-session) if present, else the PERSISTED
+  // return path (survives a reload / explicit logout / browser restart — the OCA
+  // "return you where you left off" feature), else the dashboard.
+  const from = location.state?.from ?? loadReturnPath() ?? '/dashboard';
+  // Consume the persisted return path once we've captured it, so a later fresh login
+  // (deliberately hitting /login) doesn't resurrect a stale destination.
+  const goAfterLogin = (path) => {
+    clearReturnPath();
+    navigate(path, { replace: true });
+  };
+
+  // Two-step: 'credentials' (username + password) → 'mfa' (6-digit TOTP code). The
+  // challengeToken from the login step + the identity hint the user typed are carried
+  // into the MFA step (the hint is threaded to completeMfa so the same interim label
+  // is kept when the session is established).
+  const [step, setStep] = useState('credentials');
+  const [challengeToken, setChallengeToken] = useState('');
+
+  const [identityHint, setIdentityHint] = useState('');
+  const [password, setPassword] = useState('');
+  const [remember, setRemember] = useState(false);
+  const [showPw, setShowPw] = useState(false);
+  const [code, setCode] = useState('');
+  const [error, setError] = useState('');
+  const [busy, setBusy] = useState(false);
+
+  // MFA second-factor kind: 'totp' (the boxed 6-digit authenticator code, default) or
+  // 'recovery_code' (a saved xxxxx-xxxxx code, for a lost device). The toggle swaps the
+  // input and the `factor` sent to completeMfa; either shares the single `code` field.
+  const [mfaFactor, setMfaFactor] = useState('totp');
+
+  // The boxed-OTP input element (input-otp forwards its ref to the real <input>). After a
+  // wrong code we clear the boxes and refocus this so the user can retype immediately —
+  // otherwise the async verify (which disabled + blurred the input) leaves it unfocused,
+  // and backspace/typing does nothing until the user clicks a box first.
+  const otpRef = useRef(null);
+
+  const submit = async () => {
+    setError('');
+    if (busy) return;
+    if (!identityHint.trim() || !password) {
+      setError('Enter your username and password.');
+      return;
+    }
+    setBusy(true);
+    const r = await login(identityHint.trim(), password);
+    setBusy(false);
+    if (r.ok === true) goAfterLogin(from);
+    else if (r.ok === 'mfa') {
+      // MFA enrolled: hold the challenge and move to the code step. The password is
+      // no longer needed (the challengeToken carries the pending login server-side).
+      setChallengeToken(r.challengeToken);
+      setPassword('');
+      setCode('');
+      setMfaFactor('totp');
+      setStep('mfa');
+    } else setError(r.error);
+  };
+
+  const verify = async () => {
+    setError('');
+    if (busy) return;
+    const entered = code.trim();
+    // A TOTP code is exactly 6 digits; a recovery code is a free-form xxxxx-xxxxx token.
+    if (mfaFactor === 'totp' ? entered.length !== 6 : entered.length === 0) {
+      setError(mfaFactor === 'totp' ? 'Enter the 6-digit code.' : 'Enter a recovery code.');
+      return;
+    }
+    setBusy(true);
+    // Bug fix: `factor` is now the 3rd positional arg (was mistakenly the identityHint);
+    // identityHint is 4th. This lets us send factor:'recovery_code' for a lost device.
+    const r = await completeMfa(challengeToken, entered, mfaFactor, identityHint.trim());
+    setBusy(false);
+    if (r.ok === true) {
+      // A recovery-code login lands the session in the forced re-enroll flow — the
+      // router (mustReenroll) pins it to /account/reenroll, so send there and drop any
+      // saved return path (the user must re-secure first). Otherwise return where they
+      // left off. Both consume the persisted return path via goAfterLogin.
+      if (r.mfaRecoveryUsed === true) goAfterLogin('/account/reenroll');
+      else goAfterLogin(from);
+      return;
+    }
+    // Generic message (anti-enumeration): a wrong code and an expired/spent challenge
+    // are indistinguishable. Stay on the code step so the user can retry a fresh code;
+    // "Start over" below returns to credentials for the expired/single-use case.
+    setError(
+      mfaFactor === 'totp' ? 'Incorrect or expired code.' : 'Incorrect or expired recovery code.',
+    );
+    // Reset for the retry: clear the boxes and refocus the OTP input. The input was
+    // disabled (→ blurred) during the async verify; without this refocus, backspace/typing
+    // is dead until the user clicks a box. Deferred so the refocus runs after the
+    // busy:false re-render re-enables the input. TOTP only — the recovery-code text input
+    // keeps its value (a long code shouldn't be wiped on a transient failure).
+    if (mfaFactor === 'totp') {
+      setCode('');
+      setTimeout(() => otpRef.current?.focus(), 0);
+    }
+  };
+
+  // Swap between the authenticator (boxed OTP) and the recovery-code (text) inputs. The
+  // shared `code` field is cleared so a half-typed value doesn't carry across factors.
+  const useRecoveryCode = () => {
+    setMfaFactor('recovery_code');
+    setCode('');
+    setError('');
+  };
+  const useAuthenticatorCode = () => {
+    setMfaFactor('totp');
+    setCode('');
+    setError('');
+  };
+
+  // Return to the credentials step, clearing the (single-use) challenge + code. Used
+  // by both the "Back" link and the expired-challenge "start over" path.
+  const backToCredentials = () => {
+    setStep('credentials');
+    setChallengeToken('');
+    setCode('');
+    setMfaFactor('totp');
+    setError('');
+  };
+
+  const onSubmit = (e) => {
+    e.preventDefault();
+    if (step === 'mfa') void verify();
+    else void submit();
+  };
+
+  // Belt-and-suspenders: submit on Enter from any field, in case a browser/
+  // password-manager quirk swallows the implicit form submit.
+  const onFieldKeyDown = (e) => {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      if (step === 'mfa') void verify();
+      else void submit();
+    }
+  };
+
+  return (
+    <div className="grid-bg relative flex min-h-screen items-center justify-center bg-background p-6">
+      <div className="absolute right-4 top-4">
+        <ThemeToggle compact />
+      </div>
+
+      <Card className="w-full max-w-md shadow-xl">
+        <CardContent className="p-8">
+          {/* Brand logo — color in light, white in dark (from branding config). */}
+          <div className="mb-6 flex justify-center">
+            <img src={branding.logo.light} alt={branding.appName} className="h-9 w-auto dark:hidden" />
+            <img
+              src={branding.logo.dark}
+              alt={branding.appName}
+              className="hidden h-9 w-auto dark:block"
+            />
+          </div>
+
+          <div className="mb-7 text-center">
+            {step === 'mfa' ? (
+              <>
+                <h1 className="text-2xl font-bold tracking-tight">Two-factor authentication</h1>
+                <p className="mt-1 text-sm text-muted-foreground">
+                  {mfaFactor === 'totp'
+                    ? 'Enter the 6-digit code from your authenticator app'
+                    : 'Enter one of your saved recovery codes'}
+                </p>
+              </>
+            ) : (
+              <>
+                <h1 className="text-2xl font-bold tracking-tight">{branding.tagline}</h1>
+                <p className="mt-1 text-sm text-muted-foreground">{branding.subTagline}</p>
+              </>
+            )}
+          </div>
+
+          {error && (
+            <div className="mb-4 flex items-start gap-2 rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-2.5 text-sm text-destructive">
+              <AlertCircle className="mt-0.5 size-4 shrink-0" />
+              <span>{error}</span>
+            </div>
+          )}
+
+          {step === 'mfa' ? (
+            <form onSubmit={onSubmit} className="space-y-4" noValidate>
+              {mfaFactor === 'totp' ? (
+                <div className="space-y-1.5">
+                  <label
+                    htmlFor="mfaCode"
+                    className="block text-[11px] font-semibold uppercase tracking-wider text-muted-foreground"
+                  >
+                    Authentication code
+                  </label>
+                  {/* Boxed segmented OTP: one box per digit, auto-focus box 1, auto-advance,
+                      backspace-to-previous, paste fills all 6, active-box focus ring. On the
+                      6th digit we auto-submit (belt-and-suspenders with the Verify button). */}
+                  <div className="flex justify-center py-1">
+                    <InputOTP
+                      ref={otpRef}
+                      id="mfaCode"
+                      autoFocus
+                      maxLength={6}
+                      inputMode="numeric"
+                      pattern="[0-9]*"
+                      autoComplete="one-time-code"
+                      value={code}
+                      onChange={(v) => setCode(v)}
+                      onComplete={() => {
+                        if (!busy) void verify();
+                      }}
+                      disabled={busy}
+                    >
+                      <InputOTPGroup>
+                        <InputOTPSlot index={0} />
+                        <InputOTPSlot index={1} />
+                        <InputOTPSlot index={2} />
+                        <InputOTPSlot index={3} />
+                        <InputOTPSlot index={4} />
+                        <InputOTPSlot index={5} />
+                      </InputOTPGroup>
+                    </InputOTP>
+                  </div>
+                </div>
+              ) : (
+                <div className="space-y-1.5">
+                  <label
+                    htmlFor="recoveryCode"
+                    className="block text-[11px] font-semibold uppercase tracking-wider text-muted-foreground"
+                  >
+                    Recovery code
+                  </label>
+                  <Input
+                    id="recoveryCode"
+                    autoFocus
+                    autoComplete="one-time-code"
+                    value={code}
+                    onChange={(e) => setCode(e.target.value)}
+                    onKeyDown={onFieldKeyDown}
+                    placeholder="xxxxx-xxxxx"
+                    className="h-11 bg-secondary/60 text-center font-mono text-base tracking-widest"
+                  />
+                </div>
+              )}
+
+              <Button
+                type="submit"
+                disabled={busy}
+                className="h-11 w-full bg-primary font-mono text-xs font-semibold uppercase tracking-widest text-primary-foreground hover:bg-primary/90"
+              >
+                {busy ? (
+                  <Loader2 className="size-4 animate-spin" />
+                ) : (
+                  <>
+                    <ShieldCheck className="size-4" />
+                    Verify
+                  </>
+                )}
+              </Button>
+
+              {/* Recovery-code toggle — swap the boxed OTP for a recovery-code input (a
+                  lost-device escape) and back. Sets factor to 'recovery_code' / 'totp'. */}
+              <button
+                type="button"
+                onClick={mfaFactor === 'totp' ? useRecoveryCode : useAuthenticatorCode}
+                disabled={busy}
+                className="mx-auto flex text-sm font-medium text-primary hover:underline disabled:opacity-50"
+              >
+                {mfaFactor === 'totp'
+                  ? 'Use a recovery code instead'
+                  : 'Use authenticator code instead'}
+              </button>
+
+              {/* Back / start over: an expired or spent (single-use, TTL'd) challenge
+                  means the user must re-enter credentials to get a fresh one. */}
+              <button
+                type="button"
+                onClick={backToCredentials}
+                disabled={busy}
+                className="mx-auto flex items-center gap-1.5 text-sm font-medium text-muted-foreground hover:text-foreground disabled:opacity-50"
+              >
+                <ArrowLeft className="size-4" />
+                Back to sign in
+              </button>
+            </form>
+          ) : (
+          <form onSubmit={onSubmit} className="space-y-4" noValidate>
+            <div className="space-y-1.5">
+              <label
+                htmlFor="identityHint"
+                className="block text-[11px] font-semibold uppercase tracking-wider text-muted-foreground"
+              >
+                Email or username
+              </label>
+              <Input
+                id="identityHint"
+                autoComplete="username"
+                autoFocus
+                value={identityHint}
+                onChange={(e) => setIdentityHint(e.target.value)}
+                onKeyDown={onFieldKeyDown}
+                placeholder="you@example.com"
+                className="h-11 bg-secondary/60"
+              />
+            </div>
+
+            <div className="space-y-1.5">
+              <label
+                htmlFor="password"
+                className="block text-[11px] font-semibold uppercase tracking-wider text-muted-foreground"
+              >
+                Password
+              </label>
+              <div className="relative">
+                <Input
+                  id="password"
+                  type={showPw ? 'text' : 'password'}
+                  autoComplete="current-password"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                  onKeyDown={onFieldKeyDown}
+                  placeholder="••••••••"
+                  className="h-11 bg-secondary/60 pr-10"
+                />
+                <button
+                  type="button"
+                  onClick={() => setShowPw((s) => !s)}
+                  className="absolute right-2 top-1/2 -translate-y-1/2 rounded p-1 text-muted-foreground hover:text-foreground"
+                  aria-label={showPw ? 'Hide password' : 'Show password'}
+                >
+                  {showPw ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
+                </button>
+              </div>
+            </div>
+
+            {/* Remember me + Forgot password, inline below the password. */}
+            <div className="flex items-center justify-between pt-0.5">
+              <label htmlFor="remember" className="flex items-center gap-2 text-sm text-muted-foreground">
+                <Checkbox id="remember" checked={remember} onCheckedChange={(v) => setRemember(Boolean(v))} />
+                Remember me
+              </label>
+              <Link to="/forgot-password" className="text-sm font-medium text-primary hover:underline">
+                Forgot password?
+              </Link>
+            </div>
+
+            <Button
+              type="submit"
+              disabled={busy}
+              className="h-11 w-full bg-primary font-mono text-xs font-semibold uppercase tracking-widest text-primary-foreground hover:bg-primary/90"
+            >
+              {busy ? (
+                <Loader2 className="size-4 animate-spin" />
+              ) : (
+                <>
+                  <LogIn className="size-4" />
+                  Log in
+                </>
+              )}
+            </Button>
+          </form>
+          )}
+
+          <p className="mt-6 text-center text-[11px] tracking-wide text-muted-foreground">
+            Powered by <span className="font-semibold text-foreground/70">{branding.poweredBy}</span>
+          </p>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

package/template/frontend/src/pages/ResetPassword.jsx

@@ -0,0 +1,159 @@
+/**
+ * ResetPassword — the page the emailed reset link opens (`/reset-password?token=…`).
+ * Reads the raw token from the URL query, collects a new password + confirmation, and
+ * submits to the framework's `POST /auth/reset-password` via the shared
+ * `authService.resetPassword` (through AuthContext). On success → toast + redirect to
+ * /login (the reset revokes ALL sessions server-side, so the user re-signs-in with the
+ * new password). On 400 → an "invalid or expired link" message with a way back to
+ * request a fresh link.
+ */
+import { useState } from 'react';
+import { Link, useNavigate, useSearchParams } from 'react-router-dom';
+import { toast } from 'sonner';
+import { AlertCircle, ArrowLeft, KeyRound, Loader2 } from 'lucide-react';
+import { useAuth } from '@/auth/AuthContext';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import { Card, CardContent } from '@/components/ui/card';
+import ThemeToggle from '@/theme/ThemeToggle';
+import { branding } from '@/config/branding';
+
+const MIN_PASSWORD_LEN = 8;
+
+export default function ResetPassword() {
+  const { auth } = useAuth();
+  const navigate = useNavigate();
+  const [params] = useSearchParams();
+  const token = params.get('token') ?? '';
+
+  const [next, setNext] = useState('');
+  const [confirm, setConfirm] = useState('');
+  const [error, setError] = useState('');
+  // When true, the link itself is invalid/expired (400) → offer a fresh request.
+  const [linkDead, setLinkDead] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  const onSubmit = async (e) => {
+    e.preventDefault();
+    setError('');
+    if (busy) return;
+
+    if (!token) {
+      setLinkDead(true);
+      setError('This reset link is missing its token.');
+      return;
+    }
+    // Client-side pre-checks (the server is authoritative; these are just UX).
+    if (next.length < MIN_PASSWORD_LEN) {
+      setError(`New password must be at least ${MIN_PASSWORD_LEN} characters.`);
+      return;
+    }
+    if (next !== confirm) {
+      setError('New password and confirmation do not match.');
+      return;
+    }
+
+    setBusy(true);
+    const r = await auth.resetPassword(token, next);
+    setBusy(false);
+
+    if (r.ok) {
+      toast.success('Your password has been reset. Please sign in with your new password.');
+      navigate('/login', { replace: true });
+      return;
+    }
+    // 400 → the link is invalid/expired; surface a path to request a new one.
+    if (r.status === 400) setLinkDead(true);
+    setError(r.error);
+  };
+
+  return (
+    <div className="grid-bg relative flex min-h-screen items-center justify-center bg-background p-6">
+      <div className="absolute right-4 top-4">
+        <ThemeToggle compact />
+      </div>
+
+      <Card className="w-full max-w-md shadow-xl">
+        <CardContent className="p-8">
+          <div className="mb-7 flex flex-col items-center gap-4">
+            {/* Brand logo — color in light, white in dark (from branding config). */}
+            <img src={branding.logo.light} alt={branding.appName} className="h-9 w-auto dark:hidden" />
+            <img
+              src={branding.logo.dark}
+              alt={branding.appName}
+              className="hidden h-9 w-auto dark:block"
+            />
+            <div className="text-center">
+              <h1 className="text-xl font-bold tracking-tight">Choose a new password</h1>
+              <p className="mt-1 text-sm text-muted-foreground">
+                Enter a new password for your account.
+              </p>
+            </div>
+          </div>
+
+          {error && (
+            <div className="mb-4 flex items-start gap-2 rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-2.5 text-sm text-destructive">
+              <AlertCircle className="mt-0.5 size-4 shrink-0" />
+              <span>{error}</span>
+            </div>
+          )}
+
+          {linkDead ? (
+            <div className="text-center">
+              <Link
+                to="/forgot-password"
+                className="inline-flex items-center gap-1.5 text-sm font-medium text-primary hover:underline"
+              >
+                Request a new reset link
+              </Link>
+            </div>
+          ) : (
+            <form onSubmit={onSubmit} className="space-y-4" noValidate>
+              <div className="space-y-1.5">
+                <Label htmlFor="rp-new">New password</Label>
+                <Input
+                  id="rp-new"
+                  type="password"
+                  autoComplete="new-password"
+                  autoFocus
+                  value={next}
+                  onChange={(e) => setNext(e.target.value)}
+                  placeholder="••••••••"
+                />
+              </div>
+              <div className="space-y-1.5">
+                <Label htmlFor="rp-confirm">Confirm new password</Label>
+                <Input
+                  id="rp-confirm"
+                  type="password"
+                  autoComplete="new-password"
+                  value={confirm}
+                  onChange={(e) => setConfirm(e.target.value)}
+                  placeholder="••••••••"
+                />
+              </div>
+              <Button type="submit" disabled={busy} className="w-full">
+                {busy ? (
+                  <Loader2 className="size-4 animate-spin" />
+                ) : (
+                  <>
+                    <KeyRound className="size-4" />
+                    Reset password
+                  </>
+                )}
+              </Button>
+            </form>
+          )}
+
+          <div className="mt-6 text-center">
+            <Link to="/login" className="inline-flex items-center gap-1.5 text-sm font-medium text-primary hover:underline">
+              <ArrowLeft className="size-4" />
+              Back to sign in
+            </Link>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}