hamid
17a82832ab
Replace the username/password stub with Balinyaar's real credential (phone-OTP) and add the role router every authenticated screen sits behind. - services/auth rewritten for OTP over the b2 contract: types/keys/constants, clientApi+mockApi behind a config'd seam, hooks (useRequestOtp/useVerifyOtp/ useMe/useRefresh/useLogout/useSelectRole/useSessionRoleSync). Stub removed. - A1/A2 customer login + B1/B2 nurse switch as one OTP flow at /login (PhoneStep/OtpStep: auto-verify, resend countdown, wrong/expired/lockout states). - Role router: pure resolveRoleDestination + RoleRouter -> family / nurse / admin / select-role, with a splash while /me loads (no wrong-shell flash). - SelectRole first-use screen at /select-role. - Widened AuthState (roles via SessionUser), hydrated from /me by useSessionRoleSync. - Fetch-layer silent token refresh (single-flight + one retry) + shared persistAuthTokens/clearAuthTokens; useRefresh as the on-demand path. - auth i18n namespace in both locales; tests for routing branches, countdown, OtpStep state machine, RoleRouter branches; fixed jest @/ -> src alias. - Docs: client/CLAUDE.md, frontend STATUS/report, for-backend REQ-002..004. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
40 lines
1.5 KiB
TypeScript
40 lines
1.5 KiB
TypeScript
import { useMutation, useQueryClient } from '@tanstack/react-query';
|
|
|
|
import { COOKIE_NAMES } from '@/lib/cookies';
|
|
import { getClientCookie } from '@/lib/cookies/client';
|
|
import { persistAuthTokens } from '@/lib/auth/session';
|
|
import { useAuth } from '@/context/auth';
|
|
|
|
import { authApi } from '../apis';
|
|
import { authKeys } from '../keys';
|
|
import { toAppRoles } from '../routing';
|
|
import type { PublicRole } from '../types';
|
|
|
|
/**
|
|
* Self-assign a public actor role for a brand-new user. Because role claims live inside the access
|
|
* token, we rotate the token pair after selecting so subsequent role-gated calls carry the new
|
|
* claim (contract note). AuthContext and the cached `/me` are then updated so the router re-runs
|
|
* against the new role.
|
|
*/
|
|
export function useSelectRole() {
|
|
const queryClient = useQueryClient();
|
|
const [, dispatch] = useAuth();
|
|
|
|
return useMutation({
|
|
mutationFn: (role: PublicRole) => authApi.selectRole({ role }),
|
|
onSuccess: async (me) => {
|
|
const refreshToken = getClientCookie(COOKIE_NAMES.REFRESH_TOKEN);
|
|
if (refreshToken) {
|
|
try {
|
|
persistAuthTokens(await authApi.refresh({ refreshToken }));
|
|
} catch {
|
|
// A failed rotation surfaces on the next `/me`/gated call via the fetch layer; the
|
|
// role is already persisted server-side, so don't block the flow on it.
|
|
}
|
|
}
|
|
dispatch({ type: 'LOG_IN', user: { id: me.id, phone: me.phone, roles: toAppRoles(me.roles) } });
|
|
queryClient.setQueryData(authKeys.me(), me);
|
|
},
|
|
});
|
|
}
|