mirror of
https://github.com/Sea-Haven-Industries/proposal-system.git
synced 2026-10-07 12:48:57 +00:00
refactor(web): fold Redux auth/ui slices into SHOC-shape auth context + storage module
Phase 4 tail of the SHOC-alignment plan. Matches SHOC's auth shape (lib/auth storage module + providers/ context split) while keeping the deliberate divergences: - sessionStorage, not localStorage (WEB-C1 stands; SHOC's localStorage is on the SHOULD-NOT-ALIGN list) - token acquisition stays in the auth pages (Cognito code exchange / dev-login) — the provider only owns session state - 401 interceptor clears storage directly (WEB-M2 behavior preserved; full-page redirect resets provider state) Sidebar open state moves to plain layout state in App passed down as props (SHOC (protected)/_layout.tsx pattern), keeping localStorage persistence. Drops @reduxjs/toolkit and react-redux. Tests: authSlice tests replaced by authStorage + AuthProvider suites (QA-C5 coverage preserved); client interceptor tests updated for the storage-based 401 path. 59 vitest green, tsc clean, vite build OK. Verified end-to-end headless: login redirect, seeded-session shell, sidebar toggle persistence, logout, expired/malformed token handling, RoleGuard bounce; recipe persisted as web/.claude/skills/verify.
This commit is contained in:
parent
1f55a59445
commit
8fbca7f780
23 changed files with 407 additions and 434 deletions
42
web/.claude/skills/verify/SKILL.md
Normal file
42
web/.claude/skills/verify/SKILL.md
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
---
|
||||
name: verify
|
||||
description: Drive the proposal-system web SPA headlessly to verify changes at the browser surface (no API required for auth/shell flows).
|
||||
---
|
||||
|
||||
# Verify web changes (headless, no API)
|
||||
|
||||
Build/launch:
|
||||
|
||||
```bash
|
||||
cd web && npm run dev # vite on http://localhost:5173
|
||||
```
|
||||
|
||||
Drive with Playwright resolved from the SHOC checkout (this repo doesn't ship it),
|
||||
using the cached headless chromium:
|
||||
|
||||
```js
|
||||
const { chromium } = require('/Users/adammoussa/Documents/repositories/seahaven/shoc-frontend-new/node_modules/playwright');
|
||||
const browser = await chromium.launch({
|
||||
executablePath: '/Users/adammoussa/Library/Caches/ms-playwright/chromium_headless_shell-1228/chrome-headless-shell-mac-arm64/chrome-headless-shell',
|
||||
});
|
||||
```
|
||||
|
||||
Fake a session without the API by seeding sessionStorage with a future-exp JWT
|
||||
(AuthUser shape: `{ id, email, displayName, role, token }`, roles: SysAdmin/Admin/Dispatcher):
|
||||
|
||||
```js
|
||||
await ctx.addInitScript((v) => sessionStorage.setItem('proposal_system_token', v), userJson);
|
||||
```
|
||||
|
||||
Gotchas:
|
||||
- `addInitScript` re-runs on every document load — a full-page reload re-seeds the
|
||||
token, so "logged-out then reload" probes need a fresh un-seeded context.
|
||||
- Dev-login buttons on /login call the real API (`/auth/dev-login`) — they fail
|
||||
without the .NET API running; seed storage instead.
|
||||
- Sidebar drawer width: expanded 244px, collapsed 76px — read
|
||||
`.MuiDrawer-paper` bounding rect to assert toggles.
|
||||
|
||||
Flows worth driving: unauthenticated redirect to /login, seeded session renders
|
||||
shell (user chip + role-gated nav groups), sidebar toggle + localStorage
|
||||
persistence, logout (toast, storage cleared), expired/malformed token treated as
|
||||
unauthenticated, Dispatcher bounced from /admin by RoleGuard.
|
||||
98
web/package-lock.json
generated
98
web/package-lock.json
generated
|
|
@ -17,14 +17,12 @@
|
|||
"@mui/icons-material": "^9.2.0",
|
||||
"@mui/material": "^9.1.1",
|
||||
"@proposal-system/api-contracts": "file:../shared/api-contracts",
|
||||
"@reduxjs/toolkit": "^2.11.2",
|
||||
"@tanstack/react-query": "^5.101.2",
|
||||
"axios": "^1.18.1",
|
||||
"lucide-react": "^1.24.0",
|
||||
"react": "^19.2.7",
|
||||
"react-dom": "^19.2.7",
|
||||
"react-hook-form": "^7.81.0",
|
||||
"react-redux": "^9.2.0",
|
||||
"react-router-dom": "^7.18.1",
|
||||
"react-toastify": "^11.0.5",
|
||||
"zod": "^4.4.3"
|
||||
|
|
@ -950,32 +948,6 @@
|
|||
"resolved": "../shared/api-contracts",
|
||||
"link": true
|
||||
},
|
||||
"node_modules/@reduxjs/toolkit": {
|
||||
"version": "2.12.0",
|
||||
"resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.12.0.tgz",
|
||||
"integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@standard-schema/spec": "^1.0.0",
|
||||
"@standard-schema/utils": "^0.3.0",
|
||||
"immer": "^11.0.0",
|
||||
"redux": "^5.0.1",
|
||||
"redux-thunk": "^3.1.0",
|
||||
"reselect": "^5.1.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
|
||||
"react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"react": {
|
||||
"optional": true
|
||||
},
|
||||
"react-redux": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/@rolldown/binding-android-arm64": {
|
||||
"version": "1.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
|
||||
|
|
@ -1244,6 +1216,7 @@
|
|||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
|
||||
"integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@standard-schema/utils": {
|
||||
|
|
@ -1452,12 +1425,6 @@
|
|||
"@types/react": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/use-sync-external-store": {
|
||||
"version": "0.0.6",
|
||||
"resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
|
||||
"integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@typescript/typescript-aix-ppc64": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
|
||||
|
|
@ -2586,16 +2553,6 @@
|
|||
"node": ">= 6"
|
||||
}
|
||||
},
|
||||
"node_modules/immer": {
|
||||
"version": "11.1.11",
|
||||
"resolved": "https://registry.npmjs.org/immer/-/immer-11.1.11.tgz",
|
||||
"integrity": "sha512-qzXuyXAkPySAGYkfsAwodDPWT8Zm7/Uo5BNt4BjhMhG5WlWyZZ4wQqnWwdS8kjlQ1Cwu6gjw3A6+0gTQwlyYtw==",
|
||||
"license": "MIT",
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/immer"
|
||||
}
|
||||
},
|
||||
"node_modules/import-fresh": {
|
||||
"version": "3.3.1",
|
||||
"resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
|
||||
|
|
@ -3345,29 +3302,6 @@
|
|||
"integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/react-redux": {
|
||||
"version": "9.3.0",
|
||||
"resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
|
||||
"integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@types/use-sync-external-store": "^0.0.6",
|
||||
"use-sync-external-store": "^1.4.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@types/react": "^18.2.25 || ^19",
|
||||
"react": "^18.0 || ^19",
|
||||
"redux": "^5.0.0"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"@types/react": {
|
||||
"optional": true
|
||||
},
|
||||
"redux": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/react-router": {
|
||||
"version": "7.18.1",
|
||||
"resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
|
||||
|
|
@ -3449,21 +3383,6 @@
|
|||
"node": ">=8"
|
||||
}
|
||||
},
|
||||
"node_modules/redux": {
|
||||
"version": "5.0.1",
|
||||
"resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
|
||||
"integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/redux-thunk": {
|
||||
"version": "3.1.0",
|
||||
"resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
|
||||
"integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
|
||||
"license": "MIT",
|
||||
"peerDependencies": {
|
||||
"redux": "^5.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/require-from-string": {
|
||||
"version": "2.0.2",
|
||||
"resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
|
||||
|
|
@ -3474,12 +3393,6 @@
|
|||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/reselect": {
|
||||
"version": "5.2.0",
|
||||
"resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
|
||||
"integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/resolve": {
|
||||
"version": "1.22.12",
|
||||
"resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
|
||||
|
|
@ -3790,15 +3703,6 @@
|
|||
"node": ">=20.18.1"
|
||||
}
|
||||
},
|
||||
"node_modules/use-sync-external-store": {
|
||||
"version": "1.6.0",
|
||||
"resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
|
||||
"integrity": "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
|
||||
"license": "MIT",
|
||||
"peerDependencies": {
|
||||
"react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/vite": {
|
||||
"version": "8.1.4",
|
||||
"resolved": "https://registry.npmjs.org/vite/-/vite-8.1.4.tgz",
|
||||
|
|
|
|||
|
|
@ -20,14 +20,12 @@
|
|||
"@mui/icons-material": "^9.2.0",
|
||||
"@mui/material": "^9.1.1",
|
||||
"@proposal-system/api-contracts": "file:../shared/api-contracts",
|
||||
"@reduxjs/toolkit": "^2.11.2",
|
||||
"@tanstack/react-query": "^5.101.2",
|
||||
"axios": "^1.18.1",
|
||||
"lucide-react": "^1.24.0",
|
||||
"react": "^19.2.7",
|
||||
"react-dom": "^19.2.7",
|
||||
"react-hook-form": "^7.81.0",
|
||||
"react-redux": "^9.2.0",
|
||||
"react-router-dom": "^7.18.1",
|
||||
"react-toastify": "^11.0.5",
|
||||
"zod": "^4.4.3"
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
import { useState } from 'react';
|
||||
import { Routes, Route, Navigate } from 'react-router-dom';
|
||||
import { Box, Button, Card, CardContent, Typography } from '@mui/material';
|
||||
import { STORAGE_KEY_SIDEBAR } from './constants';
|
||||
import PeopleIcon from '@mui/icons-material/People';
|
||||
import ProtectedRoute, { RoleGuard } from './components/ProtectedRoute';
|
||||
import Topbar from './components/Topbar';
|
||||
|
|
@ -16,6 +18,16 @@ import CustomerManagementPage from './pages/admin/customers/CustomerManagementPa
|
|||
import PricingLibraryPage from './pages/admin/pricing-library/PricingLibraryPage';
|
||||
|
||||
export default function App() {
|
||||
// SHOC shell pattern (mirrors (protected)/_layout.tsx): sidebar open state is
|
||||
// plain layout state passed down as props, persisted across visits.
|
||||
const [sidebarOpen, setSidebarOpenState] = useState(
|
||||
() => window.localStorage.getItem(STORAGE_KEY_SIDEBAR) !== 'false',
|
||||
);
|
||||
const setSidebarOpen = (open: boolean) => {
|
||||
setSidebarOpenState(open);
|
||||
window.localStorage.setItem(STORAGE_KEY_SIDEBAR, String(open));
|
||||
};
|
||||
|
||||
return (
|
||||
<Routes>
|
||||
<Route path="/login" element={<LoginPage />} />
|
||||
|
|
@ -27,9 +39,9 @@ export default function App() {
|
|||
<ProtectedRoute>
|
||||
{/* SHOC shell composition (ADR 0003): sidebar column + [topbar / scrolling main] */}
|
||||
<Box sx={{ display: 'flex', height: '100vh', width: '100%', overflow: 'hidden', backgroundColor: 'var(--background)' }}>
|
||||
<Sidebar />
|
||||
<Sidebar open={sidebarOpen} onOpenChange={setSidebarOpen} />
|
||||
<Box sx={{ display: 'flex', flexDirection: 'column', flex: 1, minWidth: 0, height: '100vh', overflow: 'hidden' }}>
|
||||
<Topbar />
|
||||
<Topbar onToggleSidebar={() => setSidebarOpen(!sidebarOpen)} />
|
||||
<Box
|
||||
component="main"
|
||||
sx={{
|
||||
|
|
|
|||
|
|
@ -1,114 +0,0 @@
|
|||
/**
|
||||
* QA-C5: Auth slice tests.
|
||||
*
|
||||
* Tests the Redux auth state management:
|
||||
* - setUser stores user and marks authenticated
|
||||
* - logout clears user and marks unauthenticated
|
||||
* - Expired token sets isAuthenticated to false
|
||||
*/
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
||||
import authReducer, { setUser, logout, selectUser, selectIsAuthenticated } from '../slices/authSlice';
|
||||
import type { AuthUser } from '../../lib/api/auth';
|
||||
|
||||
// Mock localStorage
|
||||
const mockStorage: Record<string, string> = {};
|
||||
vi.stubGlobal('localStorage', {
|
||||
getItem: (key: string) => mockStorage[key] ?? null,
|
||||
setItem: (key: string, value: string) => { mockStorage[key] = value; },
|
||||
removeItem: (key: string) => { delete mockStorage[key]; },
|
||||
clear: () => { Object.keys(mockStorage).forEach(k => delete mockStorage[k]); },
|
||||
});
|
||||
|
||||
function createValidToken(): string {
|
||||
// Create a JWT-like token with exp far in the future
|
||||
const header = btoa(JSON.stringify({ alg: 'HS256' }));
|
||||
const payload = btoa(JSON.stringify({
|
||||
sub: 'test-user',
|
||||
exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour from now
|
||||
}));
|
||||
return `${header}.${payload}.fake-signature`;
|
||||
}
|
||||
|
||||
function createExpiredToken(): string {
|
||||
const header = btoa(JSON.stringify({ alg: 'HS256' }));
|
||||
const payload = btoa(JSON.stringify({
|
||||
sub: 'test-user',
|
||||
exp: Math.floor(Date.now() / 1000) - 3600, // 1 hour ago
|
||||
}));
|
||||
return `${header}.${payload}.fake-signature`;
|
||||
}
|
||||
|
||||
describe('authSlice', () => {
|
||||
beforeEach(() => {
|
||||
Object.keys(mockStorage).forEach(k => delete mockStorage[k]);
|
||||
});
|
||||
|
||||
it('QA-C5: setUser stores user and marks authenticated with valid token', () => {
|
||||
const user: AuthUser = {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createValidToken(),
|
||||
};
|
||||
|
||||
const initialState = { user: null, isAuthenticated: false, loading: false, error: null };
|
||||
const state = authReducer(initialState, setUser(user));
|
||||
|
||||
expect(state.user).toEqual(user);
|
||||
expect(state.isAuthenticated).toBe(true);
|
||||
expect(state.loading).toBe(false);
|
||||
expect(state.error).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: setUser with expired token sets isAuthenticated to false', () => {
|
||||
const user: AuthUser = {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createExpiredToken(),
|
||||
};
|
||||
|
||||
const initialState = { user: null, isAuthenticated: false, loading: false, error: null };
|
||||
const state = authReducer(initialState, setUser(user));
|
||||
|
||||
expect(state.user).toEqual(user);
|
||||
expect(state.isAuthenticated).toBe(false);
|
||||
});
|
||||
|
||||
it('QA-C5: logout clears user and isAuthenticated', () => {
|
||||
const user: AuthUser = {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createValidToken(),
|
||||
};
|
||||
|
||||
const loggedInState = { user, isAuthenticated: true, loading: false, error: null };
|
||||
const state = authReducer(loggedInState, logout());
|
||||
|
||||
expect(state.user).toBeNull();
|
||||
expect(state.isAuthenticated).toBe(false);
|
||||
expect(state.error).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: selectUser returns user from state', () => {
|
||||
const user: AuthUser = {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createValidToken(),
|
||||
};
|
||||
|
||||
const state = { auth: { user, isAuthenticated: true, loading: false, error: null } };
|
||||
expect(selectUser(state)).toEqual(user);
|
||||
});
|
||||
|
||||
it('QA-C5: selectIsAuthenticated returns false when no user', () => {
|
||||
const state = { auth: { user: null, isAuthenticated: false, loading: false, error: null } };
|
||||
expect(selectIsAuthenticated(state)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
import { createSlice, PayloadAction } from '@reduxjs/toolkit';
|
||||
import { STORAGE_KEY_TOKEN } from '../../constants';
|
||||
import type { AuthUser } from '../../lib/api/auth';
|
||||
|
||||
interface AuthState {
|
||||
user: AuthUser | null;
|
||||
isAuthenticated: boolean;
|
||||
loading: boolean;
|
||||
error: string | null;
|
||||
}
|
||||
|
||||
// Fix: WEB-C1 — use sessionStorage instead of localStorage to limit JWT exposure.
|
||||
// Tokens are cleared when the browser tab closes, reducing XSS token-theft window.
|
||||
// Follow-up: move to httpOnly cookies once the API supports Set-Cookie auth flow.
|
||||
const getUserFromStorage = (): AuthUser | null => {
|
||||
try {
|
||||
const result = window.sessionStorage.getItem(STORAGE_KEY_TOKEN);
|
||||
return result ? JSON.parse(result) : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
};
|
||||
|
||||
const isTokenValid = (token: string): boolean => {
|
||||
if (!token) return false;
|
||||
try {
|
||||
const part = token.split('.')[1];
|
||||
if (!part) return false;
|
||||
const payload = JSON.parse(atob(part));
|
||||
return new Date(payload.exp * 1000) > new Date();
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
};
|
||||
|
||||
const storedUser = getUserFromStorage();
|
||||
|
||||
const initialState: AuthState = {
|
||||
user: storedUser,
|
||||
isAuthenticated: storedUser?.token ? isTokenValid(storedUser.token) : false,
|
||||
loading: false,
|
||||
error: null,
|
||||
};
|
||||
|
||||
const authSlice = createSlice({
|
||||
name: 'auth',
|
||||
initialState,
|
||||
reducers: {
|
||||
setUser: (state, action: PayloadAction<AuthUser>) => {
|
||||
state.user = action.payload;
|
||||
state.isAuthenticated = action.payload.token ? isTokenValid(action.payload.token) : false;
|
||||
state.loading = false;
|
||||
state.error = null;
|
||||
window.sessionStorage.setItem(STORAGE_KEY_TOKEN, JSON.stringify(action.payload)); // WEB-C1
|
||||
},
|
||||
logout: (state) => {
|
||||
state.user = null;
|
||||
state.isAuthenticated = false;
|
||||
state.error = null;
|
||||
window.sessionStorage.removeItem(STORAGE_KEY_TOKEN); // WEB-C1
|
||||
},
|
||||
setLoading: (state, action: PayloadAction<boolean>) => {
|
||||
state.loading = action.payload;
|
||||
},
|
||||
setError: (state, action: PayloadAction<string>) => {
|
||||
state.error = action.payload;
|
||||
state.loading = false;
|
||||
},
|
||||
clearError: (state) => {
|
||||
state.error = null;
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
export const { setUser, logout, setLoading, setError, clearError } = authSlice.actions;
|
||||
|
||||
export const selectUser = (state: { auth: AuthState }) => state.auth.user;
|
||||
export const selectIsAuthenticated = (state: { auth: AuthState }) => state.auth.isAuthenticated;
|
||||
export const selectAuthLoading = (state: { auth: AuthState }) => state.auth.loading;
|
||||
export const selectAuthError = (state: { auth: AuthState }) => state.auth.error;
|
||||
export const selectToken = (state: { auth: AuthState }) => state.auth.user?.token;
|
||||
|
||||
export default authSlice.reducer;
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
import { createSlice, PayloadAction } from '@reduxjs/toolkit';
|
||||
import { STORAGE_KEY_SIDEBAR } from '../../constants';
|
||||
|
||||
interface UiState {
|
||||
sidebarOpen: boolean;
|
||||
}
|
||||
|
||||
const initialState: UiState = {
|
||||
sidebarOpen: window.localStorage.getItem(STORAGE_KEY_SIDEBAR) !== 'false',
|
||||
};
|
||||
|
||||
const uiSlice = createSlice({
|
||||
name: 'ui',
|
||||
initialState,
|
||||
reducers: {
|
||||
toggleSidebar: (state) => {
|
||||
state.sidebarOpen = !state.sidebarOpen;
|
||||
window.localStorage.setItem(STORAGE_KEY_SIDEBAR, String(state.sidebarOpen));
|
||||
},
|
||||
setSidebarOpen: (state, action: PayloadAction<boolean>) => {
|
||||
state.sidebarOpen = action.payload;
|
||||
window.localStorage.setItem(STORAGE_KEY_SIDEBAR, String(action.payload));
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
export const { toggleSidebar, setSidebarOpen } = uiSlice.actions;
|
||||
export const selectSidebarOpen = (state: { ui: UiState }) => state.ui.sidebarOpen;
|
||||
export default uiSlice.reducer;
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
import { configureStore } from '@reduxjs/toolkit';
|
||||
import authReducer from './slices/authSlice';
|
||||
import uiReducer from './slices/uiSlice';
|
||||
|
||||
export const store = configureStore({
|
||||
reducer: {
|
||||
auth: authReducer,
|
||||
ui: uiReducer,
|
||||
},
|
||||
middleware: (getDefaultMiddleware) =>
|
||||
getDefaultMiddleware({
|
||||
serializableCheck: {
|
||||
ignoredActions: ['auth/setUser'],
|
||||
},
|
||||
}),
|
||||
});
|
||||
|
||||
export type RootState = ReturnType<typeof store.getState>;
|
||||
export type AppDispatch = typeof store.dispatch;
|
||||
|
|
@ -3,9 +3,9 @@ import { Box, CircularProgress } from '@mui/material';
|
|||
import { useAuth } from '../hooks/useAuth';
|
||||
|
||||
export default function ProtectedRoute({ children }: { children: React.ReactNode }) {
|
||||
const { isAuthenticated, loading } = useAuth();
|
||||
const { isAuthenticated, isLoading } = useAuth();
|
||||
|
||||
if (loading) {
|
||||
if (isLoading) {
|
||||
return (
|
||||
<Box sx={{ display: 'flex', justifyContent: 'center', alignItems: 'center', minHeight: '100vh' }}>
|
||||
<CircularProgress />
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
// Expanded 244px / collapsed 76px; brand header row; grouped nav with SHOC
|
||||
// active treatment (white card bg + shadow + 3px left accent bar).
|
||||
import { useLocation, useNavigate } from 'react-router-dom';
|
||||
import { useSelector, useDispatch } from 'react-redux';
|
||||
import { Drawer, Box, Tooltip, useMediaQuery, useTheme } from '@mui/material';
|
||||
import {
|
||||
LayoutDashboard,
|
||||
|
|
@ -15,9 +14,7 @@ import {
|
|||
Users,
|
||||
type LucideIcon,
|
||||
} from 'lucide-react';
|
||||
import { selectSidebarOpen, setSidebarOpen } from '../app/slices/uiSlice';
|
||||
import { selectUser } from '../app/slices/authSlice';
|
||||
import type { RootState } from '../app/store';
|
||||
import { useAuth } from '../hooks/useAuth';
|
||||
import { DRAWER_WIDTH } from '../constants';
|
||||
import BrandLockup, { BrandMark } from './brand/BrandLockup';
|
||||
|
||||
|
|
@ -135,13 +132,17 @@ function NavItem({
|
|||
return row;
|
||||
}
|
||||
|
||||
export default function Sidebar() {
|
||||
export default function Sidebar({
|
||||
open,
|
||||
onOpenChange,
|
||||
}: {
|
||||
open: boolean;
|
||||
onOpenChange: (open: boolean) => void;
|
||||
}) {
|
||||
const navigate = useNavigate();
|
||||
const location = useLocation();
|
||||
const dispatch = useDispatch();
|
||||
const theme = useTheme();
|
||||
const open = useSelector((state: RootState) => selectSidebarOpen(state));
|
||||
const user = useSelector((state: RootState) => selectUser(state));
|
||||
const { user } = useAuth();
|
||||
|
||||
const isMobile = useMediaQuery(theme.breakpoints.down('md')); // <900px
|
||||
|
||||
|
|
@ -156,7 +157,7 @@ export default function Sidebar() {
|
|||
const handleNavClick = (path: string) => {
|
||||
navigate(path);
|
||||
if (isMobile) {
|
||||
dispatch(setSidebarOpen(false));
|
||||
onOpenChange(false);
|
||||
}
|
||||
};
|
||||
|
||||
|
|
@ -189,7 +190,7 @@ export default function Sidebar() {
|
|||
<Drawer
|
||||
variant={isMobile ? 'temporary' : 'permanent'}
|
||||
open={isMobile ? open : true}
|
||||
onClose={() => dispatch(setSidebarOpen(false))}
|
||||
onClose={() => onOpenChange(false)}
|
||||
sx={{
|
||||
width: isMobile ? 0 : width,
|
||||
flexShrink: 0,
|
||||
|
|
|
|||
|
|
@ -1,12 +1,9 @@
|
|||
// App shell top bar — SHOC design system port (ADR 0003, mirrors app-topbar.tsx).
|
||||
import { useDispatch } from 'react-redux';
|
||||
import { AppBar, Toolbar, IconButton, Box, Avatar, Typography } from '@mui/material';
|
||||
import { Menu as MenuIcon, LogOut } from 'lucide-react';
|
||||
import { toggleSidebar } from '../app/slices/uiSlice';
|
||||
import { useAuth } from '../hooks/useAuth';
|
||||
|
||||
export default function Topbar() {
|
||||
const dispatch = useDispatch();
|
||||
export default function Topbar({ onToggleSidebar }: { onToggleSidebar: () => void }) {
|
||||
const { user, logout } = useAuth();
|
||||
|
||||
const initials = user?.displayName
|
||||
|
|
@ -29,7 +26,7 @@ export default function Topbar() {
|
|||
>
|
||||
<Toolbar disableGutters sx={{ height: 'var(--spacing-topbar)', minHeight: 'var(--spacing-topbar)', gap: '18px', pl: '16px', pr: '22px' }}>
|
||||
<IconButton
|
||||
onClick={() => dispatch(toggleSidebar())}
|
||||
onClick={onToggleSidebar}
|
||||
aria-label="Toggle sidebar menu"
|
||||
sx={{
|
||||
width: 38,
|
||||
|
|
|
|||
|
|
@ -72,7 +72,7 @@ describe('RoleGuard', () => {
|
|||
mockUseAuth.mockReturnValue({
|
||||
isAuthenticated: true,
|
||||
user: { id: '1', email: 'admin@test.com', displayName: 'Admin', role: 'Admin', token: 'tok' },
|
||||
loading: false,
|
||||
isLoading: false,
|
||||
});
|
||||
|
||||
renderWithRouter(
|
||||
|
|
@ -88,7 +88,7 @@ describe('RoleGuard', () => {
|
|||
mockUseAuth.mockReturnValue({
|
||||
isAuthenticated: true,
|
||||
user: { id: '2', email: 'dispatch@test.com', displayName: 'Dispatcher', role: 'Dispatcher', token: 'tok' },
|
||||
loading: false,
|
||||
isLoading: false,
|
||||
});
|
||||
|
||||
renderWithRouter(
|
||||
|
|
@ -105,7 +105,7 @@ describe('RoleGuard', () => {
|
|||
mockUseAuth.mockReturnValue({
|
||||
isAuthenticated: false,
|
||||
user: null,
|
||||
loading: false,
|
||||
isLoading: false,
|
||||
});
|
||||
|
||||
renderWithRouter(
|
||||
|
|
@ -122,7 +122,7 @@ describe('RoleGuard', () => {
|
|||
mockUseAuth.mockReturnValue({
|
||||
isAuthenticated: true,
|
||||
user: { id: '3', email: 'sysadmin@test.com', displayName: 'SysAdmin', role: 'SysAdmin', token: 'tok' },
|
||||
loading: false,
|
||||
isLoading: false,
|
||||
});
|
||||
|
||||
renderWithRouter(
|
||||
|
|
@ -138,7 +138,7 @@ describe('RoleGuard', () => {
|
|||
mockUseAuth.mockReturnValue({
|
||||
isAuthenticated: true,
|
||||
user: { id: '4', email: 'admin@test.com', displayName: 'Admin', role: 'Admin', token: 'tok' },
|
||||
loading: false,
|
||||
isLoading: false,
|
||||
});
|
||||
|
||||
renderWithRouter(
|
||||
|
|
|
|||
|
|
@ -1,26 +1,16 @@
|
|||
import { useSelector, useDispatch } from 'react-redux';
|
||||
import { useNavigate } from 'react-router-dom';
|
||||
import {
|
||||
selectUser,
|
||||
selectIsAuthenticated,
|
||||
selectAuthLoading,
|
||||
selectAuthError,
|
||||
logout as logoutAction,
|
||||
} from '../app/slices/authSlice';
|
||||
import { toast } from 'react-toastify';
|
||||
import type { RootState } from '../app/store';
|
||||
import { useAuthContext } from '../providers/authContext';
|
||||
|
||||
// Thin wrapper over the auth context (SHOC shape) that layers on the
|
||||
// router/toast side effects components expect from logout.
|
||||
export function useAuth() {
|
||||
const dispatch = useDispatch();
|
||||
const { user, isAuthenticated, isLoading, error, login, logout: clearSession, setError, setLoading } =
|
||||
useAuthContext();
|
||||
const navigate = useNavigate();
|
||||
|
||||
const user = useSelector((state: RootState) => selectUser(state));
|
||||
const isAuthenticated = useSelector((state: RootState) => selectIsAuthenticated(state));
|
||||
const loading = useSelector((state: RootState) => selectAuthLoading(state));
|
||||
const error = useSelector((state: RootState) => selectAuthError(state));
|
||||
|
||||
const logout = () => {
|
||||
dispatch(logoutAction());
|
||||
clearSession();
|
||||
toast.info('You have been logged out');
|
||||
navigate('/login');
|
||||
};
|
||||
|
|
@ -28,8 +18,11 @@ export function useAuth() {
|
|||
return {
|
||||
user,
|
||||
isAuthenticated,
|
||||
loading,
|
||||
isLoading,
|
||||
error,
|
||||
login,
|
||||
logout,
|
||||
setError,
|
||||
setLoading,
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
* Tests that:
|
||||
* - Request interceptor attaches Bearer token from sessionStorage
|
||||
* - Request interceptor handles missing/invalid token data gracefully
|
||||
* - Response interceptor dispatches Redux logout and redirects on 401
|
||||
* - Response interceptor clears the stored session and redirects on 401
|
||||
* - Response interceptor returns friendly error message on 403
|
||||
* - Response interceptor returns friendly error message on 404
|
||||
* - Response interceptor extracts server error detail from response body
|
||||
|
|
@ -14,34 +14,14 @@ import { describe, it, expect, vi, beforeAll, beforeEach } from 'vitest';
|
|||
import type { InternalAxiosRequestConfig } from 'axios';
|
||||
|
||||
// vi.hoisted returns values accessible in both the hoisted mock scope and test scope.
|
||||
const { interceptors, mockDispatch } = vi.hoisted(() => {
|
||||
const { interceptors } = vi.hoisted(() => {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const state: Record<string, any> = {};
|
||||
const dispatch = vi.fn();
|
||||
return {
|
||||
interceptors: state,
|
||||
mockDispatch: dispatch,
|
||||
};
|
||||
});
|
||||
|
||||
// Mock the Redux store
|
||||
vi.mock('../../../app/store', () => ({
|
||||
store: {
|
||||
dispatch: (...args: unknown[]) => mockDispatch(...args),
|
||||
getState: () => ({ auth: { user: null, isAuthenticated: false, loading: false, error: null } }),
|
||||
subscribe: vi.fn(),
|
||||
replaceReducer: vi.fn(),
|
||||
[Symbol.observable]: vi.fn(),
|
||||
},
|
||||
}));
|
||||
|
||||
// Mock the authSlice logout action
|
||||
vi.mock('../../../app/slices/authSlice', () => ({
|
||||
logout: () => ({ type: 'auth/logout' }),
|
||||
setUser: (user: unknown) => ({ type: 'auth/setUser', payload: user }),
|
||||
default: (state: unknown) => state,
|
||||
}));
|
||||
|
||||
// Mock axios
|
||||
vi.mock('axios', () => {
|
||||
const mockInstance = {
|
||||
|
|
@ -161,7 +141,8 @@ describe('API client interceptors', () => {
|
|||
});
|
||||
|
||||
describe('response interceptor', () => {
|
||||
it('WEB-M2: 401 response dispatches Redux logout and redirects to /login', async () => {
|
||||
it('WEB-M2: 401 response clears the stored session and redirects to /login', async () => {
|
||||
sessionStorageData['proposal_system_token'] = JSON.stringify({ token: 'stale-jwt' });
|
||||
const error = {
|
||||
response: {
|
||||
status: 401,
|
||||
|
|
@ -173,11 +154,12 @@ describe('API client interceptors', () => {
|
|||
const promise = interceptors.responseRejected(error);
|
||||
|
||||
await expect(promise).rejects.toThrow('Session expired. Please log in again.');
|
||||
expect(mockDispatch).toHaveBeenCalledWith({ type: 'auth/logout' });
|
||||
expect(sessionStorageData['proposal_system_token']).toBeUndefined();
|
||||
expect(mockLocation.href).toBe('/login');
|
||||
});
|
||||
|
||||
it('WEB-M2: 403 response returns permission error without dispatching logout', async () => {
|
||||
it('WEB-M2: 403 response returns permission error without clearing the session', async () => {
|
||||
sessionStorageData['proposal_system_token'] = JSON.stringify({ token: 'valid-jwt' });
|
||||
const error = {
|
||||
response: {
|
||||
status: 403,
|
||||
|
|
@ -189,7 +171,8 @@ describe('API client interceptors', () => {
|
|||
const promise = interceptors.responseRejected(error);
|
||||
|
||||
await expect(promise).rejects.toThrow('You do not have permission to perform this action.');
|
||||
expect(mockDispatch).not.toHaveBeenCalled();
|
||||
expect(sessionStorageData['proposal_system_token']).toBeDefined();
|
||||
expect(mockLocation.href).toBe('');
|
||||
});
|
||||
|
||||
it('404 response returns resource-not-found error', async () => {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
import axios from 'axios';
|
||||
import { API_URL, STORAGE_KEY_TOKEN } from '../../constants';
|
||||
import { store } from '../../app/store';
|
||||
import { logout } from '../../app/slices/authSlice';
|
||||
import { clearAuth } from '../auth/authStorage';
|
||||
|
||||
const apiClient = axios.create({
|
||||
baseURL: API_URL,
|
||||
|
|
@ -36,8 +35,9 @@ apiClient.interceptors.response.use(
|
|||
const { status, data } = error.response;
|
||||
|
||||
if (status === 401) {
|
||||
// Fix: WEB-M2 — dispatch Redux logout to clear auth state in addition to storage
|
||||
store.dispatch(logout());
|
||||
// Fix: WEB-M2 — clear the stored session before redirecting; the full-page
|
||||
// navigation resets the AuthProvider, so context state re-derives as logged out.
|
||||
clearAuth();
|
||||
window.location.href = '/login';
|
||||
return Promise.reject(new Error('Session expired. Please log in again.'));
|
||||
}
|
||||
|
|
|
|||
76
web/src/lib/auth/__tests__/authStorage.test.ts
Normal file
76
web/src/lib/auth/__tests__/authStorage.test.ts
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
/**
|
||||
* QA-C5: Auth storage module tests (replaces the Redux authSlice tests).
|
||||
*
|
||||
* Tests the sessionStorage-backed session persistence (WEB-C1):
|
||||
* - setAuthUser/getAuthUser round-trip
|
||||
* - getAuthUser tolerates malformed stored JSON
|
||||
* - clearAuth removes the stored session
|
||||
* - isTokenValid accepts unexpired JWTs and rejects expired/malformed ones
|
||||
*/
|
||||
import { describe, it, expect, beforeEach } from 'vitest';
|
||||
import type { AuthUser } from '@proposal-system/api-contracts';
|
||||
import { getAuthUser, setAuthUser, clearAuth, isTokenValid } from '../authStorage';
|
||||
import { STORAGE_KEY_TOKEN } from '../../../constants';
|
||||
|
||||
function createToken(expOffsetSeconds: number): string {
|
||||
const header = btoa(JSON.stringify({ alg: 'HS256' }));
|
||||
const payload = btoa(JSON.stringify({
|
||||
sub: 'test-user',
|
||||
exp: Math.floor(Date.now() / 1000) + expOffsetSeconds,
|
||||
}));
|
||||
return `${header}.${payload}.fake-signature`;
|
||||
}
|
||||
|
||||
const user: AuthUser = {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createToken(3600),
|
||||
};
|
||||
|
||||
describe('authStorage', () => {
|
||||
beforeEach(() => {
|
||||
window.sessionStorage.clear();
|
||||
});
|
||||
|
||||
it('QA-C5: setAuthUser persists to sessionStorage and getAuthUser reads it back', () => {
|
||||
setAuthUser(user);
|
||||
|
||||
expect(window.sessionStorage.getItem(STORAGE_KEY_TOKEN)).not.toBeNull();
|
||||
expect(getAuthUser()).toEqual(user);
|
||||
});
|
||||
|
||||
it('QA-C5: getAuthUser returns null when nothing is stored', () => {
|
||||
expect(getAuthUser()).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: getAuthUser returns null for malformed stored JSON', () => {
|
||||
window.sessionStorage.setItem(STORAGE_KEY_TOKEN, 'not-valid-json{{{');
|
||||
|
||||
expect(getAuthUser()).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: clearAuth removes the stored session', () => {
|
||||
setAuthUser(user);
|
||||
clearAuth();
|
||||
|
||||
expect(window.sessionStorage.getItem(STORAGE_KEY_TOKEN)).toBeNull();
|
||||
expect(getAuthUser()).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: isTokenValid accepts a token expiring in the future', () => {
|
||||
expect(isTokenValid(createToken(3600))).toBe(true);
|
||||
});
|
||||
|
||||
it('QA-C5: isTokenValid rejects an expired token', () => {
|
||||
expect(isTokenValid(createToken(-3600))).toBe(false);
|
||||
});
|
||||
|
||||
it('QA-C5: isTokenValid rejects missing or malformed tokens', () => {
|
||||
expect(isTokenValid(null)).toBe(false);
|
||||
expect(isTokenValid(undefined)).toBe(false);
|
||||
expect(isTokenValid('')).toBe(false);
|
||||
expect(isTokenValid('not-a-jwt')).toBe(false);
|
||||
});
|
||||
});
|
||||
35
web/src/lib/auth/authStorage.ts
Normal file
35
web/src/lib/auth/authStorage.ts
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
// Plain auth-storage module — SHOC shape (mirrors lib/auth/auth-storage.ts).
|
||||
// Fix: WEB-C1 — use sessionStorage instead of localStorage to limit JWT exposure.
|
||||
// Tokens are cleared when the browser tab closes, reducing XSS token-theft window.
|
||||
// Follow-up: move to httpOnly cookies once the API supports Set-Cookie auth flow.
|
||||
import type { AuthUser } from '@proposal-system/api-contracts';
|
||||
import { STORAGE_KEY_TOKEN } from '../../constants';
|
||||
|
||||
export function getAuthUser(): AuthUser | null {
|
||||
try {
|
||||
const raw = window.sessionStorage.getItem(STORAGE_KEY_TOKEN);
|
||||
return raw ? JSON.parse(raw) : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
export function setAuthUser(user: AuthUser): void {
|
||||
window.sessionStorage.setItem(STORAGE_KEY_TOKEN, JSON.stringify(user)); // WEB-C1
|
||||
}
|
||||
|
||||
export function clearAuth(): void {
|
||||
window.sessionStorage.removeItem(STORAGE_KEY_TOKEN); // WEB-C1
|
||||
}
|
||||
|
||||
export function isTokenValid(token: string | null | undefined): boolean {
|
||||
if (!token) return false;
|
||||
try {
|
||||
const part = token.split('.')[1];
|
||||
if (!part) return false;
|
||||
const payload = JSON.parse(atob(part));
|
||||
return new Date(payload.exp * 1000) > new Date();
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,21 +1,20 @@
|
|||
import React from 'react';
|
||||
import ReactDOM from 'react-dom/client';
|
||||
import { BrowserRouter } from 'react-router-dom';
|
||||
import { Provider } from 'react-redux';
|
||||
import { QueryClientProvider } from '@tanstack/react-query';
|
||||
import { ThemeProvider, CssBaseline } from '@mui/material';
|
||||
import { ToastContainer } from 'react-toastify';
|
||||
import 'react-toastify/dist/ReactToastify.css';
|
||||
import './styles/globals.css';
|
||||
import './index.css';
|
||||
import { store } from './app/store';
|
||||
import AuthProvider from './providers/AuthProvider';
|
||||
import { queryClient } from './lib/queryClient';
|
||||
import { theme } from './theme';
|
||||
import App from './App';
|
||||
|
||||
ReactDOM.createRoot(document.getElementById('root')!).render(
|
||||
<React.StrictMode>
|
||||
<Provider store={store}>
|
||||
<AuthProvider>
|
||||
<QueryClientProvider client={queryClient}>
|
||||
<ThemeProvider theme={theme}>
|
||||
<CssBaseline />
|
||||
|
|
@ -26,6 +25,6 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
|
|||
</BrowserRouter>
|
||||
</ThemeProvider>
|
||||
</QueryClientProvider>
|
||||
</Provider>
|
||||
</AuthProvider>
|
||||
</React.StrictMode>
|
||||
);
|
||||
|
|
|
|||
|
|
@ -1,13 +1,12 @@
|
|||
import { useEffect, useRef } from 'react';
|
||||
import { useNavigate, useSearchParams } from 'react-router-dom';
|
||||
import { useDispatch } from 'react-redux';
|
||||
import { Box, CircularProgress, Typography } from '@mui/material';
|
||||
import { setUser, setError, setLoading } from '../../app/slices/authSlice';
|
||||
import { useAuth } from '../../hooks/useAuth';
|
||||
import { authApi } from '../../lib/api/auth';
|
||||
|
||||
export default function AuthCallback() {
|
||||
const navigate = useNavigate();
|
||||
const dispatch = useDispatch();
|
||||
const { login, setError, setLoading } = useAuth();
|
||||
const [searchParams] = useSearchParams();
|
||||
const processed = useRef(false);
|
||||
|
||||
|
|
@ -19,29 +18,29 @@ export default function AuthCallback() {
|
|||
const error = searchParams.get('error');
|
||||
|
||||
if (error) {
|
||||
dispatch(setError(error));
|
||||
setError(error);
|
||||
navigate('/login', { replace: true });
|
||||
return;
|
||||
}
|
||||
|
||||
if (!code) {
|
||||
dispatch(setError('No authorization code received'));
|
||||
setError('No authorization code received');
|
||||
navigate('/login', { replace: true });
|
||||
return;
|
||||
}
|
||||
|
||||
dispatch(setLoading(true));
|
||||
setLoading(true);
|
||||
authApi
|
||||
.exchangeCode(code, `${window.location.origin}/callback`)
|
||||
.then((user) => {
|
||||
dispatch(setUser(user));
|
||||
login(user);
|
||||
navigate('/', { replace: true });
|
||||
})
|
||||
.catch((err) => {
|
||||
dispatch(setError(err.message || 'Authentication failed'));
|
||||
setError(err.message || 'Authentication failed');
|
||||
navigate('/login', { replace: true });
|
||||
});
|
||||
}, [searchParams, dispatch, navigate]);
|
||||
}, [searchParams, login, setError, setLoading, navigate]);
|
||||
|
||||
return (
|
||||
<Box
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
// centered 384px card on --color-bg-page, brand lockup, Montserrat heading.
|
||||
import { useEffect, useState } from 'react';
|
||||
import { useNavigate } from 'react-router-dom';
|
||||
import { useDispatch } from 'react-redux';
|
||||
import { Alert, Box, Button, Typography, Divider, Stack } from '@mui/material';
|
||||
import GoogleIcon from '@mui/icons-material/Google';
|
||||
import AdminPanelSettingsIcon from '@mui/icons-material/AdminPanelSettings';
|
||||
|
|
@ -10,7 +9,6 @@ import EngineeringIcon from '@mui/icons-material/Engineering';
|
|||
import PersonIcon from '@mui/icons-material/Person';
|
||||
import { useAuth } from '../../hooks/useAuth';
|
||||
import { authApi } from '../../lib/api/auth';
|
||||
import { setUser, setError } from '../../app/slices/authSlice';
|
||||
import BrandLockup from '../../components/brand/BrandLockup';
|
||||
|
||||
const COGNITO_DOMAIN = import.meta.env.VITE_COGNITO_DOMAIN || '';
|
||||
|
|
@ -35,8 +33,7 @@ const devButtonSx = {
|
|||
|
||||
export default function LoginPage() {
|
||||
const navigate = useNavigate();
|
||||
const dispatch = useDispatch();
|
||||
const { isAuthenticated, error } = useAuth();
|
||||
const { isAuthenticated, error, login, setError } = useAuth();
|
||||
const [loading, setLoading] = useState(false);
|
||||
|
||||
const isDevMode = !CLIENT_ID;
|
||||
|
|
@ -58,10 +55,10 @@ export default function LoginPage() {
|
|||
try {
|
||||
const dev = devUsers[role] ?? devUsers['SysAdmin']!;
|
||||
const user = await authApi.devLogin(dev.email, dev.name, role);
|
||||
dispatch(setUser(user));
|
||||
login(user);
|
||||
navigate('/', { replace: true });
|
||||
} catch (err) {
|
||||
dispatch(setError(err instanceof Error ? err.message : 'Dev login failed'));
|
||||
setError(err instanceof Error ? err.message : 'Dev login failed');
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
|
|
|
|||
49
web/src/providers/AuthProvider.tsx
Normal file
49
web/src/providers/AuthProvider.tsx
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
// Auth provider — SHOC shape (mirrors providers/auth-provider.tsx).
|
||||
// Session persistence is delegated to lib/auth/authStorage (sessionStorage, WEB-C1);
|
||||
// this provider only owns the in-memory state. Token acquisition (Cognito code
|
||||
// exchange, dev-login) stays in the auth pages — they hand the resolved AuthUser
|
||||
// to login().
|
||||
import { useCallback, useMemo, useState, type ReactNode } from 'react';
|
||||
import type { AuthUser } from '@proposal-system/api-contracts';
|
||||
import { clearAuth, getAuthUser, isTokenValid, setAuthUser } from '../lib/auth/authStorage';
|
||||
import { AuthContext, type AuthContextValue } from './authContext';
|
||||
|
||||
export default function AuthProvider({ children }: { children: ReactNode }) {
|
||||
const [user, setUser] = useState<AuthUser | null>(() => getAuthUser());
|
||||
const [isLoading, setIsLoading] = useState(false);
|
||||
const [error, setErrorState] = useState<string | null>(null);
|
||||
|
||||
const login = useCallback((nextUser: AuthUser) => {
|
||||
setAuthUser(nextUser);
|
||||
setUser(nextUser);
|
||||
setErrorState(null);
|
||||
setIsLoading(false);
|
||||
}, []);
|
||||
|
||||
const logout = useCallback(() => {
|
||||
clearAuth();
|
||||
setUser(null);
|
||||
setErrorState(null);
|
||||
}, []);
|
||||
|
||||
const setError = useCallback((message: string | null) => {
|
||||
setErrorState(message);
|
||||
setIsLoading(false);
|
||||
}, []);
|
||||
|
||||
const value = useMemo<AuthContextValue>(
|
||||
() => ({
|
||||
user,
|
||||
isAuthenticated: isTokenValid(user?.token),
|
||||
isLoading,
|
||||
error,
|
||||
login,
|
||||
logout,
|
||||
setError,
|
||||
setLoading: setIsLoading,
|
||||
}),
|
||||
[user, isLoading, error, login, logout, setError],
|
||||
);
|
||||
|
||||
return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
|
||||
}
|
||||
106
web/src/providers/__tests__/AuthProvider.test.tsx
Normal file
106
web/src/providers/__tests__/AuthProvider.test.tsx
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
/**
|
||||
* QA-C5: AuthProvider tests (replaces the Redux authSlice tests).
|
||||
*
|
||||
* Tests the context state management:
|
||||
* - login stores the user and marks authenticated
|
||||
* - login with an expired token leaves isAuthenticated false
|
||||
* - logout clears the user, the error, and the stored session
|
||||
* - state initializes from an existing stored session
|
||||
* - setError records the message and ends loading
|
||||
*/
|
||||
import { act, renderHook } from '@testing-library/react';
|
||||
import { describe, it, expect, beforeEach } from 'vitest';
|
||||
import type { AuthUser } from '@proposal-system/api-contracts';
|
||||
import AuthProvider from '../AuthProvider';
|
||||
import { useAuthContext } from '../authContext';
|
||||
import { setAuthUser } from '../../lib/auth/authStorage';
|
||||
import { STORAGE_KEY_TOKEN } from '../../constants';
|
||||
|
||||
function createToken(expOffsetSeconds: number): string {
|
||||
const header = btoa(JSON.stringify({ alg: 'HS256' }));
|
||||
const payload = btoa(JSON.stringify({
|
||||
sub: 'test-user',
|
||||
exp: Math.floor(Date.now() / 1000) + expOffsetSeconds,
|
||||
}));
|
||||
return `${header}.${payload}.fake-signature`;
|
||||
}
|
||||
|
||||
function createUser(expOffsetSeconds = 3600): AuthUser {
|
||||
return {
|
||||
id: 'user-1',
|
||||
email: 'admin@test.com',
|
||||
displayName: 'Admin',
|
||||
role: 'Admin',
|
||||
token: createToken(expOffsetSeconds),
|
||||
};
|
||||
}
|
||||
|
||||
function renderAuth() {
|
||||
return renderHook(() => useAuthContext(), { wrapper: AuthProvider });
|
||||
}
|
||||
|
||||
describe('AuthProvider', () => {
|
||||
beforeEach(() => {
|
||||
window.sessionStorage.clear();
|
||||
});
|
||||
|
||||
it('QA-C5: login stores the user and marks authenticated with a valid token', () => {
|
||||
const user = createUser();
|
||||
const { result } = renderAuth();
|
||||
|
||||
act(() => result.current.login(user));
|
||||
|
||||
expect(result.current.user).toEqual(user);
|
||||
expect(result.current.isAuthenticated).toBe(true);
|
||||
expect(result.current.error).toBeNull();
|
||||
expect(window.sessionStorage.getItem(STORAGE_KEY_TOKEN)).not.toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: login with an expired token leaves isAuthenticated false', () => {
|
||||
const user = createUser(-3600);
|
||||
const { result } = renderAuth();
|
||||
|
||||
act(() => result.current.login(user));
|
||||
|
||||
expect(result.current.user).toEqual(user);
|
||||
expect(result.current.isAuthenticated).toBe(false);
|
||||
});
|
||||
|
||||
it('QA-C5: logout clears the user, the error, and the stored session', () => {
|
||||
const { result } = renderAuth();
|
||||
|
||||
act(() => result.current.login(createUser()));
|
||||
act(() => result.current.logout());
|
||||
|
||||
expect(result.current.user).toBeNull();
|
||||
expect(result.current.isAuthenticated).toBe(false);
|
||||
expect(result.current.error).toBeNull();
|
||||
expect(window.sessionStorage.getItem(STORAGE_KEY_TOKEN)).toBeNull();
|
||||
});
|
||||
|
||||
it('QA-C5: initializes from an existing stored session', () => {
|
||||
const user = createUser();
|
||||
setAuthUser(user);
|
||||
|
||||
const { result } = renderAuth();
|
||||
|
||||
expect(result.current.user).toEqual(user);
|
||||
expect(result.current.isAuthenticated).toBe(true);
|
||||
});
|
||||
|
||||
it('QA-C5: setError records the message and ends loading', () => {
|
||||
const { result } = renderAuth();
|
||||
|
||||
act(() => result.current.setLoading(true));
|
||||
act(() => result.current.setError('Authentication failed'));
|
||||
|
||||
expect(result.current.error).toBe('Authentication failed');
|
||||
expect(result.current.isLoading).toBe(false);
|
||||
});
|
||||
|
||||
it('QA-C5: useAuthContext throws outside AuthProvider', () => {
|
||||
expect(() => renderHook(() => useAuthContext())).toThrow(
|
||||
'useAuthContext must be used within AuthProvider',
|
||||
);
|
||||
});
|
||||
});
|
||||
27
web/src/providers/authContext.ts
Normal file
27
web/src/providers/authContext.ts
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
// Auth context — SHOC shape (mirrors providers/auth-context.ts).
|
||||
// Context/provider split keeps this file component-free for fast refresh.
|
||||
import { createContext, useContext } from 'react';
|
||||
import type { AuthUser } from '@proposal-system/api-contracts';
|
||||
|
||||
export interface AuthContextValue {
|
||||
user: AuthUser | null;
|
||||
isAuthenticated: boolean;
|
||||
isLoading: boolean;
|
||||
error: string | null;
|
||||
/** Store a resolved session (Cognito code exchange or dev-login) and mark it active. */
|
||||
login: (user: AuthUser) => void;
|
||||
/** Clear the stored session. Navigation/toast live in useAuth. */
|
||||
logout: () => void;
|
||||
setError: (message: string | null) => void;
|
||||
setLoading: (loading: boolean) => void;
|
||||
}
|
||||
|
||||
export const AuthContext = createContext<AuthContextValue | null>(null);
|
||||
|
||||
export function useAuthContext(): AuthContextValue {
|
||||
const context = useContext(AuthContext);
|
||||
if (!context) {
|
||||
throw new Error('useAuthContext must be used within AuthProvider');
|
||||
}
|
||||
return context;
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue