s.esmaeiliandClaude Opus 5
f71fd5bfe1
Both expert screens are built in user-app and user-app-v2, with byte-identical
template and script and a per-app style block only — verified by diffing
everything above <style>:
ChildOrdersView "سفارش مشتریان" — legacy ChildOrders.vue. Keeps the
reference's title, search, infinite paging, and per-card item count, total
weight, customer name and the fixed «تحویل مسئول فروش» chip (the endpoint
only returns that status, ApiMobileController:766).
CustomerChoiceView "لیست مشتریان" — legacy customerChoice.vue. Keeps its
title, per-search re-query and the reference's choice to LIST inactive
customers (its active() scope is commented out at :187).
Reachable from inside the app, not just by URL: routes carry the reference's own
paths and names, the dashboard grows the two entries only for an expert (v1 as
tiles, v2 as its own rows), and a router guard sends an ordinary customer back
to their dashboard. None of that is relied on for safety — the server scopes
both endpoints on the AdminUser id in the token and answers 403 otherwise.
Not ported, both recorded in D21: the act-as api_token minting (:197-201) and
the child-order edit drawer, which recomputed an order's money from client-sent
values. The card opens a read-only summary instead.
APP-02 fixed: user-app-v2 gained getHomeSlider and now prefers admin-configured
slides, keeping its category-derived hero as the fallback and its own design.
Session stores stay byte-identical across the apps.
build 5/5, jest 45/45, expert login 36/36, apps smoke 43/43, typecheck clean.
[ref: henza_pwa/src/views/user/src/components/ChildOrders.vue, customerChoice.vue]
[ref: henza_pwa/src/router/index.ts:171-188]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
79 lines
3.1 KiB
TypeScript
79 lines
3.1 KiB
TypeScript
import { defineStore } from 'pinia';
|
|
|
|
const TOKEN_KEY = 'gold-bank:token';
|
|
const CUSTOMER_ID_KEY = 'gold-bank:customerId';
|
|
const MOBILE_KEY = 'gold-bank:mobile';
|
|
/** Legacy's isUserLoggedIn() (Mixins/checkAccess.ts) reads this key. */
|
|
const LEGACY_FLAG_KEY = 'appToken';
|
|
/** D21 — cached so the expert menu entries render before whoami resolves. */
|
|
const EXPERT_KEY = 'gold-bank:isSalesExpert';
|
|
|
|
/**
|
|
* The logged-in customer's session.
|
|
*
|
|
* `token` is the credential. It is a real customer JWT issued by
|
|
* POST /api/customer/auth/verify-otp after the SMS code is checked server-side,
|
|
* and it is what every /customer/me* request is authorised with.
|
|
*
|
|
* `customerId` is kept for display and for cart bookkeeping only — it is NOT an
|
|
* identity claim any more. Until the OTP migration, the app sent this id in the
|
|
* URL of /customers/:id and the server trusted it, which meant anyone could
|
|
* read anyone's profile, orders and ledger by changing the value. The API no
|
|
* longer has an id-bearing customer route at all; the server derives the
|
|
* customer from the token. See SEC-08 in docs/parity/ISSUES.md.
|
|
*/
|
|
export const useSessionStore = defineStore('session', {
|
|
state: () => ({
|
|
token: localStorage.getItem(TOKEN_KEY) as string | null,
|
|
customerId: localStorage.getItem(CUSTOMER_ID_KEY) as string | null,
|
|
mobile: localStorage.getItem(MOBILE_KEY) as string | null,
|
|
/**
|
|
* D21 — whether this session belongs to a sales expert.
|
|
*
|
|
* A CONVENIENCE ONLY: it decides whether the two expert entries are
|
|
* rendered. It is never an authorisation claim — the server scopes both
|
|
* expert routes on the AdminUser id inside the token and answers 403 for
|
|
* an ordinary customer, so flipping this in devtools reveals nothing.
|
|
*/
|
|
isSalesExpert: localStorage.getItem(EXPERT_KEY) === '1',
|
|
}),
|
|
getters: {
|
|
/** Authenticated means holding a token, not merely knowing an id. */
|
|
isLoggedIn: (state) => Boolean(state.token),
|
|
},
|
|
actions: {
|
|
login(token: string, customerId: string, mobile: string) {
|
|
this.token = token;
|
|
this.customerId = customerId;
|
|
this.mobile = mobile;
|
|
localStorage.setItem(TOKEN_KEY, token);
|
|
localStorage.setItem(CUSTOMER_ID_KEY, customerId);
|
|
localStorage.setItem(MOBILE_KEY, mobile);
|
|
localStorage.setItem(LEGACY_FLAG_KEY, token);
|
|
},
|
|
|
|
/** Set from GET /expert/whoami right after login. */
|
|
setSalesExpert(value: boolean) {
|
|
this.isSalesExpert = value;
|
|
if (value) localStorage.setItem(EXPERT_KEY, '1');
|
|
else localStorage.removeItem(EXPERT_KEY);
|
|
},
|
|
/**
|
|
* Clears everything. Called on explicit logout and by the API client when a
|
|
* request comes back 401 — an expired or revoked token must not leave stale
|
|
* personal data on screen.
|
|
*/
|
|
logout() {
|
|
this.token = null;
|
|
this.customerId = null;
|
|
this.mobile = null;
|
|
this.isSalesExpert = false;
|
|
localStorage.removeItem(EXPERT_KEY);
|
|
localStorage.removeItem(TOKEN_KEY);
|
|
localStorage.removeItem(CUSTOMER_ID_KEY);
|
|
localStorage.removeItem(MOBILE_KEY);
|
|
localStorage.removeItem(LEGACY_FLAG_KEY);
|
|
},
|
|
},
|
|
});
|