119 lines
4.5 KiB
JavaScript
119 lines
4.5 KiB
JavaScript
import { defineStore } from 'pinia'
|
|
import { authApi, employeesApi } from '../api'
|
|
|
|
export const useAuthStore = defineStore('auth', {
|
|
state: () => ({
|
|
user: JSON.parse(localStorage.getItem('user') || 'null'),
|
|
token: localStorage.getItem('token') || null
|
|
}),
|
|
|
|
getters: {
|
|
isAuthenticated: (state) => !!state.token,
|
|
username: (state) => state.user?.username || '',
|
|
roles: (state) => state.user?.roles || [],
|
|
hasRole: (state) => (role) => state.user?.roles?.includes(role) || false,
|
|
isAdmin: (state) => state.user?.roles?.includes('admin') || false,
|
|
// True if the user holds a named permission. Admins hold every permission
|
|
// (mirrors the backend require_permission admin bypass), so they pass
|
|
// regardless of the permissions list. Non-admins check their granted list.
|
|
hasPermission: (state) => (name) =>
|
|
state.user?.roles?.includes('admin')
|
|
|| state.user?.permissions?.includes(name)
|
|
|| false,
|
|
// True when an admin-set temporary password must be changed before use.
|
|
mustChangePassword: (state) => !!state.user?.mustchangepassword,
|
|
// Full name from the employee directory (falls back to username/SSO).
|
|
displayName: (state) => state.user?.directoryname || state.user?.username || '',
|
|
// Employee photo URL if the directory has one for this SSO. The directory
|
|
// resolver already returns a usable URL (self-hosted upload or external HR
|
|
// path), so it is used as-is.
|
|
avatarUrl: (state) => state.user?.directoryphotourl || null
|
|
},
|
|
|
|
actions: {
|
|
async login(username, password) {
|
|
try {
|
|
const response = await authApi.login(username, password)
|
|
const { access_token, refresh_token, user } = response.data.data
|
|
|
|
this.token = access_token
|
|
this.user = user
|
|
|
|
this.token = access_token
|
|
localStorage.setItem('token', access_token)
|
|
localStorage.setItem('refreshToken', refresh_token)
|
|
await this.enrichFromDirectory()
|
|
|
|
return { success: true }
|
|
} catch (error) {
|
|
const message = error.response?.data?.message || 'Login failed'
|
|
return { success: false, message }
|
|
}
|
|
},
|
|
|
|
async logout() {
|
|
try {
|
|
await authApi.logout()
|
|
} catch (e) {
|
|
// Ignore logout errors
|
|
}
|
|
|
|
this.token = null
|
|
this.user = null
|
|
|
|
localStorage.removeItem('token')
|
|
localStorage.removeItem('refreshToken')
|
|
localStorage.removeItem('user')
|
|
},
|
|
|
|
// Clear the forced-password-change flag after a successful change so the
|
|
// router guard stops steering the user to the change-password view.
|
|
clearMustChangePassword() {
|
|
if (this.user) {
|
|
this.user.mustchangepassword = false
|
|
localStorage.setItem('user', JSON.stringify(this.user))
|
|
}
|
|
},
|
|
|
|
// Re-read the signed-in user from the server, permissions included.
|
|
//
|
|
// The login response is the ONLY thing that used to populate this, and it
|
|
// is cached in localStorage - so granting somebody a permission did nothing
|
|
// visible until they happened to log out and back in. They were told they
|
|
// had rights, the button stayed hidden, and nothing explained why. Called
|
|
// on app boot so a permission change lands on the next page load.
|
|
//
|
|
// Only a 401 logs out. A transient failure - API restarting, network blip -
|
|
// must not throw somebody out of a session they still hold; the cached user
|
|
// is stale, not invalid.
|
|
async fetchUser() {
|
|
try {
|
|
const response = await authApi.me()
|
|
this.user = response.data.data
|
|
await this.enrichFromDirectory()
|
|
localStorage.setItem('user', JSON.stringify(this.user))
|
|
} catch (error) {
|
|
if (error.response?.status === 401) this.logout()
|
|
}
|
|
},
|
|
|
|
// Pull the logged-in user's full name + photo from the employee directory
|
|
// by their SSO (= username). Best-effort: skipped/ignored when the employees
|
|
// plugin is off, the SSO is not in the directory, or the lookup fails.
|
|
async enrichFromDirectory() {
|
|
const sso = this.user?.username
|
|
if (sso && /^\d+$/.test(sso)) {
|
|
try {
|
|
const response = await employeesApi.lookup(sso)
|
|
const emp = response.data?.data
|
|
if (emp) {
|
|
this.user.directoryname = `${emp.First_Name || ''} ${emp.Last_Name || ''}`.trim() || null
|
|
this.user.directoryphotourl = emp.photourl || null
|
|
}
|
|
} catch (err) { /* directory unavailable - fall back to username */ }
|
|
}
|
|
localStorage.setItem('user', JSON.stringify(this.user))
|
|
}
|
|
}
|
|
})
|