05/02 Phase B

2026-05-02 11:46:28 -04:00
parent ef0a6448cf
commit 8bdcbecd73
22 changed files with 3262 additions and 69 deletions
@@ -0,0 +1,132 @@
+// Auth/AuthManager.swift
+// ----------------------
+// Observable class that manages the entire authentication lifecycle:
+//   - Login (POST /api/v1/auth/login)
+//   - Logout (POST /api/v1/auth/logout)
+//   - Session restoration on app launch (GET /api/v1/auth/me)
+//   - Keychain persistence of tokens and user info
+
+import Foundation
+import SwiftUI
+import Combine
+
+@MainActor
+class AuthManager: ObservableObject {
+
+    // ── Published State ───────────────────────────────────────────────────
+
+    @Published var isAuthenticated = false
+    @Published var isLoading = false
+    @Published var errorMessage: String?
+
+    @Published var currentUserId: Int = 0
+    @Published var currentUsername: String = ""
+    @Published var currentUserRole: String = ""
+    @Published var currentDisplayName: String = ""
+
+    // ── Singleton ─────────────────────────────────────────────────────────
+    static let shared = AuthManager()
+    private init() {}
+
+    // ── App Launch: Restore Session ───────────────────────────────────────
+
+    /// Called once on app launch. Checks if a valid session exists in Keychain.
+    /// If an access token is present, verifies it with /api/v1/auth/me.
+    /// If expired, attempts a refresh. If all fails, shows the login screen.
+    func restoreSession() async {
+        guard KeychainHelper.get(Constants.Keychain.accessToken) != nil else {
+            isAuthenticated = false
+            return
+        }
+
+        isLoading = true
+        defer { isLoading = false }
+
+        do {
+            let response: MeResponseData = try await APIClient.shared.request("/api/v1/auth/me")
+            applyUser(response.user)
+            isAuthenticated = true
+        } catch APIError.notAuthenticated {
+            // Refresh failed (APIClient tried automatically) — need fresh login
+            KeychainHelper.clearAll()
+            isAuthenticated = false
+        } catch {
+            // Network error — still show as authenticated using cached Keychain data
+            // so the inspector can work offline
+            restoreUserFromKeychain()
+            isAuthenticated = true
+        }
+    }
+
+    // ── Login ─────────────────────────────────────────────────────────────
+
+    func login(username: String, password: String) async {
+        isLoading = true
+        errorMessage = nil
+        defer { isLoading = false }
+
+        do {
+            let response: LoginResponseData = try await APIClient.shared.post(
+                "/api/v1/auth/login",
+                body: ["username": username, "password": password]
+            )
+
+            // Store tokens in Keychain
+            KeychainHelper.set(response.accessToken,  forKey: Constants.Keychain.accessToken)
+            KeychainHelper.set(response.refreshToken, forKey: Constants.Keychain.refreshToken)
+
+            applyUser(response.user)
+            isAuthenticated = true
+
+        } catch APIError.serverError(let msg) {
+            errorMessage = msg
+        } catch APIError.networkError {
+            errorMessage = "Cannot reach the server. Please check your connection."
+        } catch {
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    // ── Logout ────────────────────────────────────────────────────────────
+
+    func logout() async {
+        // Best-effort server-side logout (revokes refresh token)
+        if let refreshToken = KeychainHelper.get(Constants.Keychain.refreshToken) {
+            _ = try? await APIClient.shared.post(
+                "/api/v1/auth/logout",
+                body: ["refresh_token": refreshToken]
+            ) as EmptyDecodable
+        }
+
+        KeychainHelper.clearAll()
+        isAuthenticated = false
+        currentUserId = 0
+        currentUsername = ""
+        currentUserRole = ""
+        currentDisplayName = ""
+    }
+
+    // ── Helpers ───────────────────────────────────────────────────────────
+
+    private func applyUser(_ user: APIUser) {
+        currentUserId      = user.id
+        currentUsername    = user.username
+        currentUserRole    = user.role
+        currentDisplayName = user.displayName
+
+        KeychainHelper.set(String(user.id), forKey: Constants.Keychain.userId)
+        KeychainHelper.set(user.role,       forKey: Constants.Keychain.userRole)
+        KeychainHelper.set(user.username,   forKey: Constants.Keychain.username)
+        KeychainHelper.set(user.displayName, forKey: Constants.Keychain.displayName)
+    }
+
+    private func restoreUserFromKeychain() {
+        currentUserId      = Int(KeychainHelper.get(Constants.Keychain.userId) ?? "0") ?? 0
+        currentUserRole    = KeychainHelper.get(Constants.Keychain.userRole)    ?? ""
+        currentUsername    = KeychainHelper.get(Constants.Keychain.username)    ?? ""
+        currentDisplayName = KeychainHelper.get(Constants.Keychain.displayName) ?? ""
+    }
+}
+
+// Used for logout response decoding (empty data field)
+struct EmptyDecodable: Decodable {}