tehran_tala/apps/user-app-v2/src/stores/session.ts

import { defineStore } from 'pinia';

const TOKEN_KEY = 'gold-bank:token';
const CUSTOMER_ID_KEY = 'gold-bank:customerId';
const MOBILE_KEY = 'gold-bank:mobile';
/** Legacy's isUserLoggedIn() (Mixins/checkAccess.ts) reads this key. */
const LEGACY_FLAG_KEY = 'appToken';
/** D21 — cached so the expert menu entries render before whoami resolves. */
const EXPERT_KEY = 'gold-bank:isSalesExpert';
/**
 * «ورود به حساب مشتری» — which of the expert's customers they are working
 * inside, if any.
 *
 * Deliberately `sessionStorage`, not `localStorage`: closing the tab ends the
 * impersonation. The reference kept the customer's own permanent api_token in
 * localStorage (myDataStore.ts:163), so it survived restarts indefinitely and
 * outlived the expert's employment. Here it is only a hint anyway — the server
 * re-checks on every request that this customer is actually theirs.
 */
const ACTING_AS_KEY = 'gold-bank:actingAs';

export interface ActingAs {
  id: string;
  name: string;
}

function readActingAs(): ActingAs | null {
  try {
    const raw = sessionStorage.getItem(ACTING_AS_KEY);
    if (!raw) return null;
    const parsed = JSON.parse(raw) as ActingAs;
    return parsed && typeof parsed.id === 'string' ? parsed : null;
  } catch {
    return null;
  }
}

/**
 * The logged-in customer's session.
 *
 * `token` is the credential. It is a real customer JWT issued by
 * POST /api/customer/auth/verify-otp after the SMS code is checked server-side,
 * and it is what every /customer/me* request is authorised with.
 *
 * `customerId` is kept for display and for cart bookkeeping only — it is NOT an
 * identity claim any more. Until the OTP migration, the app sent this id in the
 * URL of /customers/:id and the server trusted it, which meant anyone could
 * read anyone's profile, orders and ledger by changing the value. The API no
 * longer has an id-bearing customer route at all; the server derives the
 * customer from the token. See SEC-08 in docs/parity/ISSUES.md.
 */
export const useSessionStore = defineStore('session', {
  state: () => ({
    token: localStorage.getItem(TOKEN_KEY) as string | null,
    customerId: localStorage.getItem(CUSTOMER_ID_KEY) as string | null,
    mobile: localStorage.getItem(MOBILE_KEY) as string | null,
    /**
     * D21 — whether this session belongs to a sales expert.
     *
     * A CONVENIENCE ONLY: it decides whether the two expert entries are
     * rendered. It is never an authorisation claim — the server scopes both
     * expert routes on the AdminUser id inside the token and answers 403 for
     * an ordinary customer, so flipping this in devtools reveals nothing.
     */
    isSalesExpert: localStorage.getItem(EXPERT_KEY) === '1',
    /**
     * The customer this expert is currently working as, or null.
     *
     * Display and request-header state only — never an authorisation claim.
     * Putting another customer's id here gets a 403 from the server, which
     * scopes the lookup to `referredByAgentId` on every single request.
     */
    actingAs: readActingAs() as ActingAs | null,
  }),
  getters: {
    /** Authenticated means holding a token, not merely knowing an id. */
    isLoggedIn: (state) => Boolean(state.token),
  },
  actions: {
    login(token: string, customerId: string, mobile: string) {
      this.token = token;
      this.customerId = customerId;
      this.mobile = mobile;
      localStorage.setItem(TOKEN_KEY, token);
      localStorage.setItem(CUSTOMER_ID_KEY, customerId);
      localStorage.setItem(MOBILE_KEY, mobile);
      localStorage.setItem(LEGACY_FLAG_KEY, token);
    },

    /** Set from GET /expert/whoami right after login. */
    setSalesExpert(value: boolean) {
      this.isSalesExpert = value;
      if (value) localStorage.setItem(EXPERT_KEY, '1');
      else localStorage.removeItem(EXPERT_KEY);
    },

    /**
     * Enter or leave a customer's account. `null` returns the expert to their
     * own. The reference did the same through `toggleActiveUser`
     * (myDataStore.ts:159-169), which swapped the token; nothing is swapped
     * here — the API client just starts naming this customer in a header.
     */
    setActingAs(value: ActingAs | null) {
      this.actingAs = value;
      try {
        if (value) sessionStorage.setItem(ACTING_AS_KEY, JSON.stringify(value));
        else sessionStorage.removeItem(ACTING_AS_KEY);
      } catch {
        // A private window with storage blocked: the in-memory value still
        // drives this tab, which is all the feature needs.
      }
    },
    /**
     * Clears everything. Called on explicit logout and by the API client when a
     * request comes back 401 — an expired or revoked token must not leave stale
     * personal data on screen.
     */
    logout() {
      this.token = null;
      this.customerId = null;
      this.mobile = null;
      this.isSalesExpert = false;
      this.actingAs = null;
      try {
        sessionStorage.removeItem(ACTING_AS_KEY);
      } catch {
        /* storage blocked; the in-memory reset above is what matters */
      }
      localStorage.removeItem(EXPERT_KEY);
      localStorage.removeItem(TOKEN_KEY);
      localStorage.removeItem(CUSTOMER_ID_KEY);
      localStorage.removeItem(MOBILE_KEY);
      localStorage.removeItem(LEGACY_FLAG_KEY);
    },
  },
});