AuthFlow™ integrationfor organization owners

// lib/auth.ts using fetch with React statefulness
  
import { UserRole } from './types'
import { updateState } from './store'

// Cookie helpers — use Secure + SameSite=Strict for security.

function setCookie(name: string, value: string, days = 7): void {
  if (typeof document === 'undefined') return
  const expires = new Date(Date.now() + days * 864e5).toUTCString()
  document.cookie = `${name}=${encodeURIComponent(value)}; expires=${expires}; path=/; SameSite=Strict; Secure`
}

function getCookie(name: string): string | null {
  if (typeof document === 'undefined') return null
  const match = document.cookie.match(new RegExp('(?:^|;\s*)' + name + '=([^;]*)'))
  return match ? decodeURIComponent(match[1]) : null
}

function deleteCookie(name: string): void {
  if (typeof document === 'undefined') return
  const isLocalhost = window.location.hostname === 'localhost'
  document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; SameSite=Strict; Secure`
}

export interface AuthUser {
  email: string
  fullname: string
  org_id: string
  role: UserRole
  token: string
}

export interface AuthState {
  user: AuthUser | null
  isLoading: boolean
  isAuthenticated: boolean
}

class AuthFlowClient {
  private baseUrl: string
  private apiKey: string

  constructor() {
    const isLocalhost = typeof window !== 'undefined' && window.location.hostname === 'localhost'
    this.baseUrl = process.env.AUTHFLOW_API_URL
    this.apiKey = process.env.AUTHFLOW_API_KEY
  }

  private async makeRequest(endpoint: string, params: Record<string, string>): Promise<{ data: any; status: number }> {
    const url = new URL(`${this.baseUrl}${endpoint}`)
    Object.entries(params).forEach(([key, value]) => {
      url.searchParams.append(key, value)
    })

    const response = await fetch(url.toString())
    
    let data: any
    const contentType = response.headers.get('content-type')
    
    if (contentType && contentType.includes('application/json')) {
      data = await response.json()
    } else {
      // Handle non-JSON responses (like plain text error messages)
      const text = await response.text()
      data = { message: text, status: response.status }
    }

    return { data, status: response.status }
  }

  async getFooBarToken(email: string, role?: string): Promise<string> {
    const { data: response } = await this.makeRequest('/auth/fooBar', { identity: email, api_key: this.apiKey, ...(role && { role }) })
    return response.token
  }

  async signUp(email: string, password: string, fullname: string, role?: string): Promise<AuthUser> {
    const foobar = await this.getFooBarToken(email, role)

    const { data: response, status } = await this.makeRequest('/auth/signUp', {
      foobar,
      api_key: this.apiKey,
      email,
      password,
      fullname,
      disclaimed: 'true',
      ...(role && { role })
    })

    // Handle different error status codes
    if (status === 400) {
      if (response.message?.includes('Password does not meet complexity')) {
        throw new Error('Password must be at least 8 characters long and contain uppercase, lowercase, and numbers')
      } else if (response.message?.includes('Missing required fields')) {
        throw new Error('Please fill in all required fields')
      } else {
        throw new Error('Invalid signup information. Please check your details and try again.')
      }
    } else if (status === 401) {
      if (response.message?.includes('Invalid or expired token')) {
        throw new Error('Signup session expired. Please refresh the page and try again.')
      } else if (response.message?.includes('Invalid api_key')) {
        throw new Error('Service temporarily unavailable. Please try again later.')
      } else if (response.message?.includes('email verification')) {
        throw new Error('Email verification is required. Please check your email for verification instructions.')
      } else {
        throw new Error('Unable to create account. Please try again later.')
      }
    } else if (status === 409) {
      throw new Error('An account with this email and role already exists. Please sign in instead or choose a different role.')
    } else if (status === 500) {
      throw new Error('Server error. Please try again later.')
    } else if (status !== 200) {
      throw new Error('Unable to create account. Please try again.')
    }

    if (role === 'admin') {
      const adminUserData = {
        email: response?.email || email,
        fullname: response?.fullname || fullname,
        org_id: response?.org_id || '',
        role: 'admin' as UserRole,
        token: '',
      }
      // Update the app store with the admin user data
      updateState({ user: adminUserData })
      return adminUserData
    }

    // For non-admin roles, login after signup to get the token
    return this.signIn(email, password, role)
  }

  async signIn(email: string, password: string, role?: string): Promise<AuthUser> {
    const foobar = await this.getFooBarToken(email, role)

    const { data: response, status } = await this.makeRequest('/auth/login', {
      foobar,
      email,
      password,
      api_key: this.apiKey,
      ...(role && { role })
    })

    // Handle different error status codes
    if (status === 400) {
      throw new Error('Please provide both email and password')
    } else if (status === 401) {
      if (response.message?.includes('Incorrect password')) {
        throw new Error('Incorrect password. Please check your password and try again.')
      } else if (response.message?.includes('Invalid api_key')) {
        throw new Error('Service temporarily unavailable. Please try again later.')
      } else {
        throw new Error('Invalid login credentials. Please check your email and password.')
      }
    } else if (status === 404) {
      throw new Error('There is no user with that signin info, please use the signup link.')
    } else if (status === 500) {
      throw new Error('Server error. Please try again later.')
    } else if (status !== 200) {
      throw new Error('Unable to sign in. Please try again.')
    }

    if (response.requires2FA) {
      // TODO: 2FA implementation - this is a placeholder to indicate where 2FA logic would go
      throw new Error('2FA required - not implemented yet')
    }

    // Get user details using /auth/me
    const { data: userResponse, status: meStatus } = await this.makeRequest('/auth/me', {
      sessionToken: response.token
    })

    if (meStatus !== 200) {
      if (meStatus === 401) {
        throw new Error('Session expired. Please sign in again.')
      } else {
        throw new Error('Unable to retrieve user information. Please try again.')
      }
    }

    // Ensure we have valid user data
    if (!userResponse || typeof userResponse !== 'object' || !userResponse.email) {
      throw new Error('Invalid user data received. Please try again.')
    }

    const userData = {
      email: userResponse.email,
      fullname: userResponse.fullname,
      org_id: userResponse.org_id,
      role: userResponse.role as UserRole,
      token: response.token
    }

    // Update the app store with the authenticated user data
    updateState({ user: userData })

    return userData
  }

  async signOut(token: string, email: string): Promise<void> {
    await this.makeRequest('/auth/logout', {
      sessionToken: token,
      email
    })
    // Clear the user data from the app store
    updateState({ user: null })
  }

  async validateToken(token: string, email: string): Promise<boolean> {
    try {
      await this.makeRequest('/auth/validate', {
        sessionToken: token,
        email
      })
      return true
    } catch {
      return false
    }
  }

  async changePassword(sessionToken: string, email: string, oldPassword: string, newPassword: string): Promise<void> {
    const { status } = await this.makeRequest('/auth/changePassword', {
      sessionToken,
      email,
      oldPassword,
      newPassword
    })

    // Handle different error status codes
    if (status === 400) {
      if (newPassword.length < 8 || !/(?=.*[a-z])(?=.*[A-Z])(?=.*d)/.test(newPassword)) {
        throw new Error('Password must be at least 8 characters long and contain uppercase, lowercase, and numbers')
      } else {
        throw new Error('Missing required fields. Please provide email, old password, and new password.')
      }
    } else if (status === 401) {
      throw new Error('Invalid session or incorrect old password. Please check your credentials and try again.')
    } else if (status === 404) {
      throw new Error('User not found. Please check your email address.')
    } else if (status === 500) {
      throw new Error('Server error. Please try again later.')
    } else if (status !== 200) {
      throw new Error('Unable to change password. Please try again.')
    }
  }
}

export const authFlowClient = new AuthFlowClient()

// Auth state management
let authState: AuthState = {
  user: null,
  isLoading: false,
  isAuthenticated: false
}

const listeners: ((state: AuthState) => void)[] = []

export function subscribeToAuthState(listener: (state: AuthState) => void) {
  listeners.push(listener)
  return () => {
    const index = listeners.indexOf(listener)
    if (index > -1) {
      listeners.splice(index, 1)
    }
  }
}

function notifyListeners() {
  listeners.forEach(listener => listener(authState))
}

export function getAuthState(): AuthState {
  return { ...authState }
}

export async function signUp(email: string, password: string, fullname: string, role?: string): Promise<AuthUser> {
  authState.isLoading = true
  notifyListeners()

  try {
    const user = await authFlowClient.signUp(email, password, fullname, role)
    authState.user = user.token ? user : null
    authState.isAuthenticated = Boolean(user.token)
    authState.isLoading = false
    notifyListeners()

    if (user.token) {
      setCookie('auth_user', JSON.stringify(user))
    }

    return user
  } catch (error) {
    authState.isLoading = false
    notifyListeners()
    throw error
  }
}

export async function signIn(email: string, password: string, role?: string): Promise<AuthUser> {
  authState.isLoading = true
  notifyListeners()

  try {
    const user = await authFlowClient.signIn(email, password, role)
    authState.user = user
    authState.isAuthenticated = true
    authState.isLoading = false
    notifyListeners()

    // Store in secure cookie
    setCookie('auth_user', JSON.stringify(user))

    return user
  } catch (error) {
    authState.isLoading = false
    notifyListeners()
    throw error
  }
}

export async function signOut(): Promise<void> {
  if (authState.user) {
    try {
      await authFlowClient.signOut(authState.user.token, authState.user.email)
    } catch (error) {
      console.error('Error signing out:', error)
    }
  }

  authState.user = null
  authState.isAuthenticated = false
  authState.isLoading = false
  notifyListeners()

  // Clear auth cookie
  deleteCookie('auth_user')
}

export async function initializeAuth(): Promise<void> {
  const stored = getCookie('auth_user')
  if (stored) {
    try {
      const user = JSON.parse(stored)
      // Validate token
      const isValid = await authFlowClient.validateToken(user.token, user.email)
      if (isValid) {
        authState.user = user
        authState.isAuthenticated = true
        notifyListeners()
        // Update the app store with the restored user data
        updateState({ user })
      } else {
        deleteCookie('auth_user')
        // Clear the user data from the app store
        updateState({ user: null })
      }
    } catch (error) {
      console.error('Error initializing auth:', error)
      deleteCookie('auth_user')
      // Clear the user data from the app store
      updateState({ user: null })
    }
  }
}