tehran_tala/apps/user-app-v2/src/stores/session.ts

import { defineStore } from 'pinia';

const TOKEN_KEY = 'gold-bank:token';
const CUSTOMER_ID_KEY = 'gold-bank:customerId';
const MOBILE_KEY = 'gold-bank:mobile';
/** Legacy's isUserLoggedIn() (Mixins/checkAccess.ts) reads this key. */
const LEGACY_FLAG_KEY = 'appToken';
/** D21 — cached so the expert menu entries render before whoami resolves. */
const EXPERT_KEY = 'gold-bank:isSalesExpert';

/**
 * The logged-in customer's session.
 *
 * `token` is the credential. It is a real customer JWT issued by
 * POST /api/customer/auth/verify-otp after the SMS code is checked server-side,
 * and it is what every /customer/me* request is authorised with.
 *
 * `customerId` is kept for display and for cart bookkeeping only — it is NOT an
 * identity claim any more. Until the OTP migration, the app sent this id in the
 * URL of /customers/:id and the server trusted it, which meant anyone could
 * read anyone's profile, orders and ledger by changing the value. The API no
 * longer has an id-bearing customer route at all; the server derives the
 * customer from the token. See SEC-08 in docs/parity/ISSUES.md.
 */
export const useSessionStore = defineStore('session', {
  state: () => ({
    token: localStorage.getItem(TOKEN_KEY) as string | null,
    customerId: localStorage.getItem(CUSTOMER_ID_KEY) as string | null,
    mobile: localStorage.getItem(MOBILE_KEY) as string | null,
    /**
     * D21 — whether this session belongs to a sales expert.
     *
     * A CONVENIENCE ONLY: it decides whether the two expert entries are
     * rendered. It is never an authorisation claim — the server scopes both
     * expert routes on the AdminUser id inside the token and answers 403 for
     * an ordinary customer, so flipping this in devtools reveals nothing.
     */
    isSalesExpert: localStorage.getItem(EXPERT_KEY) === '1',
  }),
  getters: {
    /** Authenticated means holding a token, not merely knowing an id. */
    isLoggedIn: (state) => Boolean(state.token),
  },
  actions: {
    login(token: string, customerId: string, mobile: string) {
      this.token = token;
      this.customerId = customerId;
      this.mobile = mobile;
      localStorage.setItem(TOKEN_KEY, token);
      localStorage.setItem(CUSTOMER_ID_KEY, customerId);
      localStorage.setItem(MOBILE_KEY, mobile);
      localStorage.setItem(LEGACY_FLAG_KEY, token);
    },

    /** Set from GET /expert/whoami right after login. */
    setSalesExpert(value: boolean) {
      this.isSalesExpert = value;
      if (value) localStorage.setItem(EXPERT_KEY, '1');
      else localStorage.removeItem(EXPERT_KEY);
    },
    /**
     * Clears everything. Called on explicit logout and by the API client when a
     * request comes back 401 — an expired or revoked token must not leave stale
     * personal data on screen.
     */
    logout() {
      this.token = null;
      this.customerId = null;
      this.mobile = null;
      this.isSalesExpert = false;
      localStorage.removeItem(EXPERT_KEY);
      localStorage.removeItem(TOKEN_KEY);
      localStorage.removeItem(CUSTOMER_ID_KEY);
      localStorage.removeItem(MOBILE_KEY);
      localStorage.removeItem(LEGACY_FLAG_KEY);
    },
  },
});