trails/apps/mobile/lib/server-config.ts
Ullrich Schäfer 1ae406a8aa
Implement OAuth2 PKCE auth, discovery, and mobile API client
Journal server (Phase 1.4 + 1.5):
- Add oauth_clients, oauth_codes, oauth_tokens tables to journal schema
- Implement GET /oauth/authorize with PKCE flow and login redirect
- Implement POST /oauth/token (authorization_code + refresh_token grants)
- Add validateBearerToken() + getAuthenticatedUser() middleware
- Seed trails-cool-mobile as trusted OAuth client on server startup
- Add GET /.well-known/trails-cool discovery endpoint
- Add returnTo support to login page and magic link verify
- Add @trails-cool/api workspace dependency to journal

Mobile app (Phase 1.5 + 1.6):
- Login screen with server URL input and discovery validation
- OAuth2 PKCE login via expo-web-browser with expo-crypto for Hermes
- Token storage in expo-secure-store with auto-refresh on 401
- API client with bearer token injection and typed errors
- Server URL persistence with localhost default in dev mode
- API version compatibility check on app foreground
- Log out + switch server on Profile tab
- iOS ATS exception for local networking

Tests:
- PKCE crypto verification, OAuthError, token generation
- Discovery endpoint response shape
- API version semver compatibility
- API client error types

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 00:41:40 +02:00

100 lines
2.7 KiB
TypeScript

import * as SecureStore from "expo-secure-store";
import { API_VERSION } from "@trails-cool/api";
const STORE_KEY_SERVER_URL = "server_url";
const DEFAULT_SERVER_URL = __DEV__ ? "http://localhost:3000" : "https://trails.cool";
export interface DiscoveryResponse {
apiVersion: string;
instanceName: string;
apiBaseUrl: string;
tileUrl?: string;
}
/**
* Get the stored server URL, or the default.
*/
export async function getServerUrl(): Promise<string> {
const stored = await SecureStore.getItemAsync(STORE_KEY_SERVER_URL);
return stored ?? DEFAULT_SERVER_URL;
}
/**
* Store a new server URL.
*/
export async function setServerUrl(url: string): Promise<void> {
await SecureStore.setItemAsync(STORE_KEY_SERVER_URL, url);
}
/**
* Clear the stored server URL (resets to default).
*/
export async function clearServerUrl(): Promise<void> {
await SecureStore.deleteItemAsync(STORE_KEY_SERVER_URL);
}
/**
* Fetch and validate the discovery endpoint for a server URL.
* Returns the parsed discovery response or throws.
*/
export async function fetchDiscovery(serverUrl: string): Promise<DiscoveryResponse> {
const url = `${serverUrl.replace(/\/+$/, "")}/.well-known/trails-cool`;
console.log("[Discovery] Fetching:", url);
let resp: Response;
try {
const controller = new AbortController();
const timer = setTimeout(() => controller.abort(), 10_000);
resp = await fetch(url, {
headers: { Accept: "application/json" },
signal: controller.signal,
});
clearTimeout(timer);
} catch (err) {
console.error("[Discovery] Fetch failed:", err);
throw new ServerConfigError("network_error", (err as Error).message);
}
console.log("[Discovery] Response status:", resp.status);
if (!resp.ok) {
throw new ServerConfigError(
"discovery_failed",
`Server returned ${resp.status}`,
);
}
const data = await resp.json();
if (!data.apiVersion || !data.instanceName || !data.apiBaseUrl) {
throw new ServerConfigError(
"invalid_discovery",
"Server returned an invalid discovery response",
);
}
return data as DiscoveryResponse;
}
/**
* Parse the major version number from a semver string.
*/
function majorVersion(semver: string): number {
const match = semver.match(/^(\d+)/);
return match ? Number(match[1]) : 0;
}
/**
* Check if the server's API version is compatible with this app.
* Compares major versions — the server must match the app's major version.
*/
export function isApiVersionCompatible(serverVersion: string): boolean {
return majorVersion(serverVersion) === majorVersion(API_VERSION);
}
export class ServerConfigError extends Error {
constructor(
public code: string,
message: string,
) {
super(message);
}
}