Janady13/missionmatch / frontend/src/lib/auth.ts

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / frontend/src/lib/auth.ts
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	2178e7298d0e5d9af83afa12402fd587f0ba6ed8
Branch	feature/aioe-upgrade
Path or archive member	frontend/src/lib/auth.ts
Original SHA-256	7e1845925a23b5b6411b65596ac8b130e44808a2b3de01e85d9c54b7850aae47
Git blob SHA	a39a8c5bda9573a93d900bb93506216794a8d1b5
Reading-copy SHA-256	88ec8f10fa2b5b0d17f930e7910fd5fbda1ce1ee975aae135129eb5681d6317b

Original source ↗

Recovered source transcript

Download complete source text ↓59 lines · 2.9 KB

Credential-bearing and unrelated personal details were removed from this reading copy. The source identity and original checksum remain recorded.

import { request } from './api'

// The validated session principal returned by GET /api/auth/session (a tenant route, so it 403s when
// there is no active MFA satisfied session).
export interface SessionPrincipal {
  user_id: string
  org_id: string
  role: string
  mfa_enrolled: boolean
  // The resolved permission list, computed server side from the same matrix the API enforces. Gating on
  // this rather than on role name comparisons keeps one source of truth: duplicating the matrix in
  // TypeScript is how a screen ends up offering something the API refuses.
  //
  // It decides what is OFFERED, never what is allowed. Every endpoint keeps its own gate.
  capabilities: string[]

  // The granted product set. Role says what the user may DO; this says which of the four tools exists
  // for them at all. Like capabilities it decides what is OFFERED: each tool's API route group carries
  // its own server side gate, so hiding a tool here is presentation, not the enforcement.
  tools: string[]
}

// LoginResult and the invite accept result tell the UI the next step: verify an existing TOTP, or enroll
// one for the first time. The session token itself is the HttpOnly cookie, never in the JSON. When
// mfa_required is false (a pilot deployment with MFA disabled) the issued session is already active, so
// the UI skips the MFA step entirely.
export interface AuthStepResult {
  mfa_enrolled: boolean
  mfa_required: boolean
}

// EnrollResult carries the otpauth uri (rendered as a QR) and the raw secret (for manual entry).
export interface EnrollResult {
  otpauth_uri: string
  secret: string
}

export const authApi = {
  login: (email: string, password: [credential removed] =>
    request<AuthStepResult>('/auth/login', { method: 'POST', body: JSON.stringify({ email, password }) }),
  inviteAccept: (token: string, password: [credential removed] =>
    request<AuthStepResult>('/auth/invite/accept', { method: 'POST', body: JSON.stringify({ token, password }) }),
  mfaEnroll: () => request<EnrollResult>('/auth/mfa/enroll', { method: 'POST' }),
  mfaActivate: (code: string) =>
    request<AuthStepResult>('/auth/mfa/activate', { method: 'POST', body: JSON.stringify({ code }) }),
  mfaVerify: (code: string) =>
    request<{ ok: boolean }>('/auth/mfa/verify', { method: 'POST', body: JSON.stringify({ code }) }),
  mfaRecover: (code: string) =>
    request<{ ok: boolean }>('/auth/mfa/recover', { method: 'POST', body: JSON.stringify({ code }) }),
  session: () => request<SessionPrincipal>('/auth/session'),
  logout: () => request<{ status: string }>('/auth/logout', { method: 'POST' }),
  logoutAll: () => request<{ status: string }>('/auth/logout-all', { method: 'POST' }),
  changePassword: [credential removed] string, new_password: [credential removed] =>
    request<{ status: string }>('/auth/password/change', {
      method: 'POST',
      body: JSON.stringify({ old_password, new_password }),
    }),
}