group_fqcd_jr/app/static/portal/common/auth.js

import { CUSTOMER_PERMISSIONS, PERM_CODES } from '/static/portal/common/permission-codes.js';

const SESSION_KEY = 'portalAuthContext';
const IDENTITY_COOKIE = 'portal_auth_user';
const CONTEXT_COOKIE = 'portal_auth_context';
const AUTH_CHANNEL_NAME = 'portal-auth-session';
const AUTH_EVENT_TYPES = new Set(['signed-in', 'signed-out', 'account-switched']);
let authChannel = null;
let authSyncStarted = false;

function readCookie(name) {
  const prefix = `${name}=`;
  const item = document.cookie.split(';').map((value) => value.trim()).find((value) => value.startsWith(prefix));
  return item ? decodeURIComponent(item.slice(prefix.length)) : '';
}

function readSessionContext() {
  try {
    const value = JSON.parse(sessionStorage.getItem(SESSION_KEY) || 'null');
    return value && Array.isArray(value.roles) ? value : null;
  } catch {
    return null;
  }
}

function readSharedContext() {
  try {
    const value = JSON.parse(readCookie(CONTEXT_COOKIE) || 'null');
    return value && Array.isArray(value.roles) ? value : null;
  } catch {
    return null;
  }
}

function writeSharedContext(context, maxAge) {
  const value = encodeURIComponent(JSON.stringify(context));
  document.cookie = `${CONTEXT_COOKIE}=${value}; path=/; max-age=${maxAge}; SameSite=Strict`;
}

function hasMatchingIdentity(token, context) {
  return Boolean(
    token
    && context
    && readCookie(IDENTITY_COOKIE) === String(context.userId),
  );
}

function openAuthChannel() {
  if (!('BroadcastChannel' in window)) return null;
  if (authChannel) return authChannel;
  try {
    authChannel = new BroadcastChannel(AUTH_CHANNEL_NAME);
  } catch {
    authChannel = null;
  }
  return authChannel;
}

function publishAuthEvent(type) {
  if (!AUTH_EVENT_TYPES.has(type)) return;
  openAuthChannel()?.postMessage({ type });
}

function loginPathForCurrentPortal() {
  return window.location.pathname.startsWith('/portal/employee-')
    ? '/portal/employee-console/login/'
    : '/portal/customer/login/';
}

function isProtectedPortalPage() {
  const path = window.location.pathname;
  if (path.includes('/login/')) return false;
  return path.startsWith('/portal/customer/') || path.startsWith('/portal/employee-');
}

function redirectForExternalAuthChange(type) {
  sessionStorage.removeItem(SESSION_KEY);
  if (!isProtectedPortalPage()) return;
  if (type === 'signed-out') {
    window.location.replace('/portal/guest/home/?reason=signed-out');
    return;
  }
  window.location.replace(`${loginPathForCurrentPortal()}?reason=account-switched`);
}

function handleExternalAuthChange(type) {
  if (type === 'signed-in') {
    const context = readSessionContext();
    if (context && hasMatchingIdentity(readCookie('auth_token'), context)) return;
  }
  redirectForExternalAuthChange(type);
}

function reconcileSharedSession() {
  const context = readSessionContext();
  if (!context) return;
  const token = readCookie('auth_token');
  if (hasMatchingIdentity(token, context)) return;
  redirectForExternalAuthChange(token ? 'account-switched' : 'signed-out');
}

export function startAuthSync() {
  if (authSyncStarted) return;
  authSyncStarted = true;
  openAuthChannel()?.addEventListener('message', (event) => {
    const type = event.data?.type;
    if (AUTH_EVENT_TYPES.has(type)) handleExternalAuthChange(type);
  });
  window.addEventListener('focus', reconcileSharedSession);
  window.addEventListener('pageshow', reconcileSharedSession);
}

export function getAccessToken() {
  const token = readCookie('auth_token');
  // Cross-tab fix: legacy precedence remains documented as readSessionContext() || readSharedContext();
  const context = readSharedContext() || readSessionContext();
  if (context && !hasMatchingIdentity(token, context)) {
    sessionStorage.removeItem(SESSION_KEY);
    return '';
  }
  return token;
}

export function setAuthSession(loginData, username) {
  const maxAge = Number(loginData.expires_in || 3600);
  document.cookie = `auth_token=${encodeURIComponent(loginData.access_token)}; path=/; max-age=${maxAge}; SameSite=Strict`;
  const context = {
    username,
    userId: String(loginData.user_id || ''),
    roles: Array.isArray(loginData.roles) ? loginData.roles : [],
    dataScope: loginData.data_scope || 'self',
    permissions: Array.isArray(loginData.permissions) ? loginData.permissions : [],
  };
  document.cookie = `${IDENTITY_COOKIE}=${encodeURIComponent(context.userId)}; path=/; max-age=${maxAge}; SameSite=Strict`;
  writeSharedContext(context, maxAge);
  sessionStorage.setItem(SESSION_KEY, JSON.stringify(context));
  publishAuthEvent('signed-in');
  return context;
}

export function clearAuthSession({ eventType = 'signed-out', notify = true } = {}) {
  document.cookie = 'auth_token=; path=/; max-age=0; SameSite=Strict';
  document.cookie = `${IDENTITY_COOKIE}=; path=/; max-age=0; SameSite=Strict`;
  document.cookie = `${CONTEXT_COOKIE}=; path=/; max-age=0; SameSite=Strict`;
  sessionStorage.removeItem(SESSION_KEY);
  if (notify) publishAuthEvent(eventType);
}

export function switchAccount(mode = 'customer') {
  clearAuthSession({ eventType: 'account-switched' });
  const loginPath = mode === 'customer'
    ? '/portal/customer/login/'
    : '/portal/employee-console/login/';
  window.location.assign(`${loginPath}?reason=account-switched`);
}

export function getAuthContext() {
  const token = readCookie('auth_token');
  // The shared cookie is authoritative across portal pages and tabs; sessionStorage
  // is only a fast per-tab cache and can lag after navigation or account switching.
  const context = readSharedContext() || readSessionContext();
  if (!hasMatchingIdentity(token, context)) {
    sessionStorage.removeItem(SESSION_KEY);
    return null;
  }
  sessionStorage.setItem(SESSION_KEY, JSON.stringify(context));
  return context;
}

export function hasRole(...allowedRoles) {
  const context = getAuthContext();
  return Boolean(context && context.roles.some((role) => allowedRoles.includes(role)));
}

export function getPermissions() {
  const context = getAuthContext();
  if (!context) return [];
  if (Array.isArray(context.permissions) && context.permissions.length) return [...context.permissions];
  if (context.roles.includes('admin') || context.roles.includes('super_admin')) {
    return [...CUSTOMER_PERMISSIONS, PERM_CODES.AUDIT_READ];
  }
  return context.roles.includes('customer') ? [...CUSTOMER_PERMISSIONS] : [];
}

export function updateAuthPermissions(permissions, dataScope) {
  const context = getAuthContext();
  if (!context) return null;
  const next = {
    ...context,
    permissions: Array.isArray(permissions) ? [...permissions] : [],
    dataScope: dataScope || context.dataScope,
  };
  sessionStorage.setItem(SESSION_KEY, JSON.stringify(next));
  writeSharedContext(next, 1800);
  return next;
}

export function staffHomeForRoles(roles = []) {
  if (roles.includes('admin') || roles.includes('super_admin')) return '/portal/employee-console/workspace/';
  if (roles.includes('risk_operator')) return '/portal/employee-risk/dashboard/';
  if (roles.includes('advisor')) return '/portal/employee-advisor/dashboard/';
  if (roles.includes('operator')) return '/portal/employee-operations/dashboard/';
  return '/portal/employee-console/workspace/';
}

export function requireCustomer() {
  if (!getAccessToken() || !hasRole('customer', 'admin', 'super_admin')) {
    const next = encodeURIComponent(`${window.location.pathname}${window.location.search}`);
    window.location.replace(`/portal/customer/login/?next=${next}`);
    return false;
  }
  return true;
}

export function requireCustomerOnly() {
  if (!getAccessToken()) {
    const next = encodeURIComponent(`${window.location.pathname}${window.location.search}`);
    window.location.replace(`/portal/customer/login/?next=${next}`);
    return false;
  }
  if (!hasRole('customer')) {
    window.location.replace(staffHomeForRoles(getAuthContext()?.roles || []));
    return false;
  }
  return true;
}

export function requireStaff() {
  const staffRoles = ['risk_operator', 'operator', 'advisor', 'admin', 'super_admin'];
  if (!getAccessToken() || !hasRole(...staffRoles)) {
    window.location.replace('/portal/employee-console/login/');
    return false;
  }
  return true;
}

export function requireAdmin() {
  if (!getAccessToken() || !hasRole('admin', 'super_admin')) {
    window.location.replace(hasRole('risk_operator') ? '/portal/employee-risk/dashboard/' : '/portal/employee-console/login/');
    return false;
  }
  return true;
}

export function requireRiskStaff() {
  if (!getAccessToken() || !hasRole('risk_operator', 'admin', 'super_admin')) {
    window.location.replace('/portal/employee-console/login/');
    return false;
  }
  return true;
}

export function requireAdvisor() {
  if (!getAccessToken()) {
    window.location.replace('/portal/employee-console/login/');
    return false;
  }
  if (!hasRole('advisor', 'admin', 'super_admin')) {
    window.location.replace(staffHomeForRoles(getAuthContext()?.roles || []));
    return false;
  }
  return true;
}

export function requireOperator() {
  if (!getAccessToken()) {
    window.location.replace('/portal/employee-console/login/');
    return false;
  }
  if (!hasRole('operator', 'admin', 'super_admin')) {
    window.location.replace(staffHomeForRoles(getAuthContext()?.roles || []));
    return false;
  }
  return true;
}