keystone-design-bootstrap 1.0.102 → 1.0.103

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keystone-design-bootstrap",
-  "version": "1.0.102",
+  "version": "1.0.103",
   "description": "Keystone Design Bootstrap - Sections, Elements, and Theme System for customer websites",
   "type": "module",
   "main": "./src/index.ts",

package/src/design_system/portal/LoginForm.tsx

@@ -204,7 +204,30 @@ export function LoginForm({ onSuccess, onClose }: LoginFormProps) {
         body: JSON.stringify({ phone: fullPhone, code }),
       });
       const result = await res.json().catch(() => ({}));
-      if (!res.ok || !result.verification_token) {
+      if (!res.ok) {
+        setError(result.error || 'That code is invalid or expired.');
+        captureEvent('portal_login_failed', { step: 'signin', reason: result.code || 'verification_failed' });
+        return;
+      }
+
+      // Compatibility path: verify_code may directly authenticate and set the
+      // session cookie via the route handler (no passwordless_auth needed).
+      if (result.authenticated) {
+        await setPixelUserData({ email: result.email || undefined, phone: fullPhone });
+        firePixelEvent('Lead', undefined, result?.eventId);
+        captureEvent('portal_login_step_advanced', {
+          from_step: 'signin',
+          to_step: 'authenticated',
+          reason: 'verification_direct_auth',
+        });
+        captureEvent('portal_login_completed', { flow: 'signin' });
+        setResendAvailableAt(null);
+        setSecondsUntilResend(0);
+        if (onSuccess) onSuccess(); else router.refresh();
+        return;
+      }
+
+      if (!result.verification_token) {
         setError(result.error || 'That code is invalid or expired.');
         captureEvent('portal_login_failed', { step: 'signin', reason: result.code || 'verification_failed' });
         return;

package/src/next/routes/consumer-auth.ts

@@ -51,6 +51,67 @@ function responseData(json: Record<string, unknown>): Record<string, unknown> {
   return (json.data as Record<string, unknown>) || json;
 }
 
+function readStringField(obj: Record<string, unknown>, key: string): string | null {
+  const value = obj[key];
+  return typeof value === 'string' && value.length > 0 ? value : null;
+}
+
+function readNestedStringField(
+  obj: Record<string, unknown>,
+  parentKey: string,
+  key: string
+): string | null {
+  const parent = obj[parentKey];
+  if (!parent || typeof parent !== 'object') return null;
+  const value = (parent as Record<string, unknown>)[key];
+  return typeof value === 'string' && value.length > 0 ? value : null;
+}
+
+function extractAuthToken(data: Record<string, unknown>): string | null {
+  const direct =
+    readStringField(data, 'token') ||
+    readStringField(data, 'auth_token') ||
+    readStringField(data, 'access_token') ||
+    readStringField(data, 'session_token') ||
+    readStringField(data, 'jwt') ||
+    readNestedStringField(data, 'consumer', 'token') ||
+    readNestedStringField(data, 'session', 'token');
+  if (direct) return direct;
+
+  // Compatibility fallback: some backends rename token fields without notice.
+  // Walk a few levels and accept any non-empty string on keys containing "token"/"jwt".
+  const queue: Array<{ value: unknown; depth: number }> = [{ value: data, depth: 0 }];
+  const visited = new Set<object>();
+  while (queue.length > 0) {
+    const next = queue.shift();
+    if (!next) break;
+    const { value, depth } = next;
+    if (!value || typeof value !== 'object') continue;
+    if (visited.has(value as object)) continue;
+    visited.add(value as object);
+
+    const entries = Object.entries(value as Record<string, unknown>);
+    for (const [key, candidate] of entries) {
+      // Never treat verification tokens as auth/session JWTs.
+      if (/verification[_-]?token/i.test(key)) {
+        if (depth < 4 && candidate && typeof candidate === 'object') {
+          queue.push({ value: candidate, depth: depth + 1 });
+        }
+        continue;
+      }
+      const isTokenLikeKey = /token|jwt/i.test(key);
+      if (isTokenLikeKey && typeof candidate === 'string' && candidate.length > 0) {
+        return candidate;
+      }
+      if (depth < 4 && candidate && typeof candidate === 'object') {
+        queue.push({ value: candidate, depth: depth + 1 });
+      }
+    }
+  }
+
+  return null;
+}
+
 // POST /api/consumer/initiate
 // Looks up an existing user by email or phone, creating a Contact if needed.
 // Returns { exists, firstName, hasPassword }.
@@ -108,7 +169,8 @@ async function handleLogin(request: Request, NR: NextResponseLike): Promise<Resp
     );
   }
 
-  const token = json.data?.token;
+  const data = responseData(json);
+  const token = extractAuthToken(data);
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
   const response = NR.json({});
@@ -144,15 +206,16 @@ async function handleSignup(request: Request, NR: NextResponseLike): Promise<Res
     }),
   });
 
-  const json = await res.json().catch(() => ({}));
+  const json = await res.json().catch(() => ({})) as Record<string, unknown>;
   if (!res.ok) {
     return NR.json({ error: json.error || 'Signup failed. Please try again.' }, { status: res.status });
   }
 
-  const token = json.data?.token;
+  const data = responseData(json);
+  const token = extractAuthToken(data);
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
-  const response = NR.json({ claimed: json.data?.claimed ?? false });
+  const response = NR.json({ claimed: data?.claimed ?? false });
   response.cookies.set(CONSUMER_TOKEN_COOKIE, token, {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
@@ -219,6 +282,26 @@ async function handleVerifyCode(request: Request, NR: NextResponseLike): Promise
     );
   }
 
+  // Some surfaces return a direct session token on verify.
+  const directToken = extractAuthToken(data);
+  if (directToken) {
+    const response = NR.json({
+      authenticated: true,
+      first_name: data?.first_name ?? '',
+      last_name: data?.last_name ?? '',
+      email: data?.email ?? '',
+      eventId: data?.event_id ?? undefined,
+    });
+    response.cookies.set(CONSUMER_TOKEN_COOKIE, directToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+      path: '/',
+      maxAge: COOKIE_MAX_AGE,
+    });
+    return response;
+  }
+
   return NR.json({
     verification_token: data?.verification_token,
     first_name: data?.first_name ?? '',
@@ -260,7 +343,7 @@ async function handlePasswordlessAuth(request: Request, NR: NextResponseLike): P
     );
   }
 
-  const token = data?.token;
+  const token = extractAuthToken(data);
   if (!token) return NR.json({ error: 'No token received.' }, { status: 500 });
 
   // Surface the server-side Lead event_id so the browser can fire a single deduped