feat: migrate telegram + ed25519 auth implementation into @marketplaces/auth

packages/auth/src/telegram/admin-auth-headers.interceptor.ts

@@ -0,0 +1,32 @@
+import { HttpInterceptorFn } from '@angular/common/http';
+import { inject } from '@angular/core';
+import { AdminAuthService } from './admin-auth.service';
+
+/** Backend paths that require an active AdminWebSessionID. Adjust to match your API surface if consuming this outside marketplaces. */
+const ADMIN_GATED_PATH_SEGMENTS = ['/admin/', '/backoffice/', '/builder/', '/media/'];
+
+/**
+ * Attaches admin session/token headers only to admin API requests. Scoped to
+ * admin-gated paths so it never touches customer requests and never reads
+ * the customer AuthService's session.
+ */
+export const adminAuthHeadersInterceptor: HttpInterceptorFn = (req, next) => {
+  const isAdminRequest = ADMIN_GATED_PATH_SEGMENTS.some(segment => req.url.includes(segment));
+  if (!isAdminRequest) {
+    return next(req);
+  }
+
+  const adminAuth = inject(AdminAuthService);
+  const session = adminAuth.session();
+  const token = adminAuth.getAdminToken();
+
+  let headers = req.headers;
+  if (session?.sessionId) {
+    headers = headers.set('AdminWebSessionID', session.sessionId);
+  }
+  if (token) {
+    headers = headers.set('Authorization', `Bearer ${token}`);
+  }
+
+  return next(req.clone({ headers }));
+};

packages/auth/src/telegram/admin-auth.guard.ts

@@ -0,0 +1,15 @@
+import { inject } from '@angular/core';
+import { CanActivateFn } from '@angular/router';
+import { AdminAuthService } from './admin-auth.service';
+
+/** Guards `/admin/**`-style routes. Never shares state with the customer auth guard/service. */
+export const adminAuthGuard: CanActivateFn = () => {
+  const adminAuth = inject(AdminAuthService);
+
+  if (adminAuth.isAuthenticated()) {
+    return true;
+  }
+
+  adminAuth.requestLogin();
+  return false;
+};

packages/auth/src/telegram/admin-auth.service.ts

@@ -0,0 +1,210 @@
+import { Injectable, signal, computed, inject, isDevMode } from '@angular/core';
+import { Observable, tap } from 'rxjs';
+import { AdminAuthStatus, AuthSession, WebSessionStart } from './models/session.model';
+import { TelegramSessionApiService } from './telegram-session-api.service';
+
+/**
+ * Admin login uses the exact same Telegram QR/session API as the customer
+ * login (TelegramSessionApiService) - there is no separate admin backend
+ * endpoint, and none should be invented client-side. Only the *storage* is
+ * kept separate from AuthService, so an admin QR scan never authenticates
+ * the customer session or vice versa: distinct cookie name, distinct
+ * signals, distinct guard/interceptor.
+ *
+ * Since the session API itself has no concept of "admin", the frontend
+ * cannot tell an admin Telegram session from a regular one. Actual admin
+ * authorization must be enforced server-side when admin API calls are made
+ * with the resulting session id - the frontend only decides where to
+ * *store* the result.
+ */
+const ADMIN_SESSION_COOKIE = 'adminSessionID';
+const ADMIN_TOKEN_STORAGE_KEY = 'adminToken';
+const ADMIN_REFRESH_STORAGE_KEY = 'adminRefreshToken';
+const ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60;
+
+@Injectable({ providedIn: 'root' })
+export class AdminAuthService {
+  private readonly api = inject(TelegramSessionApiService);
+
+  private readonly sessionSignal = signal<AuthSession | null>(null);
+  private readonly statusSignal = signal<AdminAuthStatus>('unknown');
+  private readonly showLoginSignal = signal(false);
+
+  readonly session = this.sessionSignal.asReadonly();
+  readonly status = this.statusSignal.asReadonly();
+  readonly isAuthenticated = computed(() => this.statusSignal() === 'authenticated');
+  readonly showLoginDialog = this.showLoginSignal.asReadonly();
+  readonly displayName = computed(() => this.sessionSignal()?.displayName ?? null);
+
+  private sessionCheckTimer?: ReturnType<typeof setTimeout>;
+
+  constructor() {
+    this.checkSession();
+  }
+
+  checkSession(): void {
+    const webSessionID = this.getStoredAdminSessionID();
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.statusSignal.set('checking');
+    this.checkSessionOnce(webSessionID).subscribe(session => {
+      if (!session?.active) {
+        this.clearAuthState('unauthenticated');
+      }
+    });
+  }
+
+  /** Check session without mutating internal state beyond activating on success (used for polling). */
+  checkSessionOnce(webSessionID = this.getStoredAdminSessionID()): Observable<AuthSession | null> {
+    return this.api.checkSessionOnce(webSessionID).pipe(
+      tap(session => {
+        if (session?.active) {
+          this.activateSession(session);
+        }
+      })
+    );
+  }
+
+  /** Create a backend web session - identical call to the customer login (TelegramSessionApiService.createSession). */
+  createWebSession(): Observable<WebSessionStart> {
+    return this.api.createSession();
+  }
+
+  getAdminAppLoginUrl(webSessionID: string): string {
+    return this.api.getBotAppLoginUrl(webSessionID);
+  }
+
+  onLoginComplete(): void {
+    this.hideLogin();
+    if (!this.isAuthenticated()) {
+      this.checkSession();
+    }
+  }
+
+  requestLogin(): void {
+    this.showLoginSignal.set(true);
+  }
+
+  /**
+   * Dev-only shortcut for local testing without a reachable Telegram/session
+   * backend: fabricates a local session and activates it directly, skipping
+   * the QR flow entirely. No-ops in production builds (checked via Angular's
+   * isDevMode() at runtime, not just build-time, so it is safe even if this
+   * code ships). Never call this from anywhere reachable in a production build.
+   */
+  devBypassLogin(): void {
+    if (!isDevMode()) {
+      return;
+    }
+    this.hideLogin();
+    this.activateSession({
+      sessionId: `dev-bypass-${Date.now()}`,
+      userId: 0,
+      username: 'dev-admin',
+      displayName: 'Dev Admin (local bypass)',
+      active: true,
+      expires: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    });
+  }
+
+  hideLogin(): void {
+    this.showLoginSignal.set(false);
+  }
+
+  logout(): void {
+    const webSessionID = this.sessionSignal()?.sessionId || this.getStoredAdminSessionID();
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.api.logout(webSessionID).subscribe(() => this.clearAuthState('unauthenticated'));
+  }
+
+  /** JWT pair storage, reserved for once the backend issues admin access/refresh tokens. Unused until then. */
+  getAdminToken(): string | null {
+    return typeof localStorage === 'undefined' ? null : localStorage.getItem(ADMIN_TOKEN_STORAGE_KEY);
+  }
+
+  setAdminTokens(token: string, refreshToken: string): void {
+    if (typeof localStorage === 'undefined') {
+      return;
+    }
+    localStorage.setItem(ADMIN_TOKEN_STORAGE_KEY, token);
+    localStorage.setItem(ADMIN_REFRESH_STORAGE_KEY, refreshToken);
+  }
+
+  clearAdminTokens(): void {
+    if (typeof localStorage === 'undefined') {
+      return;
+    }
+    localStorage.removeItem(ADMIN_TOKEN_STORAGE_KEY);
+    localStorage.removeItem(ADMIN_REFRESH_STORAGE_KEY);
+  }
+
+  private activateSession(session: AuthSession): void {
+    this.sessionSignal.set(session);
+    this.statusSignal.set('authenticated');
+    this.setStoredAdminSessionID(session.sessionId);
+    this.scheduleSessionRefresh(session.expires);
+  }
+
+  private clearAuthState(status: AdminAuthStatus): void {
+    this.sessionSignal.set(null);
+    this.statusSignal.set(status);
+    this.clearStoredAdminSessionID();
+    this.clearAdminTokens();
+    this.clearSessionRefresh();
+  }
+
+  private scheduleSessionRefresh(expiresAt: string): void {
+    this.clearSessionRefresh();
+    const expiresMs = new Date(expiresAt).getTime();
+    const nowMs = Date.now();
+    const refreshIn = Number.isFinite(expiresMs)
+      ? Math.max(expiresMs - nowMs - 60_000, 30_000)
+      : ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS * 1000;
+
+    this.sessionCheckTimer = setTimeout(() => this.checkSession(), refreshIn);
+  }
+
+  private clearSessionRefresh(): void {
+    if (this.sessionCheckTimer) {
+      clearTimeout(this.sessionCheckTimer);
+      this.sessionCheckTimer = undefined;
+    }
+  }
+
+  private getStoredAdminSessionID(): string | null {
+    if (typeof document === 'undefined') {
+      return null;
+    }
+    const cookie = document.cookie.split('; ').find(row => row.startsWith(`${ADMIN_SESSION_COOKIE}=`));
+    if (!cookie) {
+      return null;
+    }
+    try {
+      return decodeURIComponent(cookie.substring(ADMIN_SESSION_COOKIE.length + 1));
+    } catch {
+      return null;
+    }
+  }
+
+  private setStoredAdminSessionID(webSessionID: string): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+    const secure = typeof window !== 'undefined' && window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${ADMIN_SESSION_COOKIE}=${encodeURIComponent(webSessionID)}; Max-Age=${ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Strict${secure}`;
+  }
+
+  private clearStoredAdminSessionID(): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+    document.cookie = `${ADMIN_SESSION_COOKIE}=; Max-Age=0; Path=/; SameSite=Strict`;
+  }
+}

packages/auth/src/telegram/auth.service.ts

@@ -0,0 +1,190 @@
+import { Injectable, signal, computed, inject } from '@angular/core';
+import { Observable, tap } from 'rxjs';
+import { AuthSession, AuthStatus, WebSessionStart } from './models/session.model';
+import { TelegramSessionApiService } from './telegram-session-api.service';
+
+const WEB_SESSION_COOKIE = 'webSessionID';
+const WEB_SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60;
+
+/** Customer-facing Telegram QR/session auth. Distinct storage/state from AdminAuthService by design. */
+@Injectable({
+  providedIn: 'root'
+})
+export class AuthService {
+  private readonly api = inject(TelegramSessionApiService);
+
+  private sessionSignal = signal<AuthSession | null>(null);
+  private statusSignal = signal<AuthStatus>('unknown');
+  private showLoginSignal = signal(false);
+
+  /** Current auth session */
+  readonly session = this.sessionSignal.asReadonly();
+  /** Current auth status */
+  readonly status = this.statusSignal.asReadonly();
+  /** Whether user is fully authenticated */
+  readonly isAuthenticated = computed(() => this.statusSignal() === 'authenticated');
+  /** Whether to show login dialog */
+  readonly showLoginDialog = this.showLoginSignal.asReadonly();
+  /** Display name of authenticated user */
+  readonly displayName = computed(() => this.sessionSignal()?.displayName ?? null);
+
+  private sessionCheckTimer?: ReturnType<typeof setTimeout>;
+
+  constructor() {
+    // On init, check existing session via cookie
+    this.checkSession();
+  }
+
+  /** Check the current webSessionID cookie against the auth backend. */
+  checkSession(): void {
+    const webSessionID = this.getStoredWebSessionID();
+
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.statusSignal.set('checking');
+
+    this.checkSessionOnce(webSessionID).subscribe(session => {
+      if (!session?.active) {
+        this.clearAuthState('unauthenticated');
+      }
+    });
+  }
+
+  /** Check session without updating internal state beyond activating on success (used for polling). */
+  checkSessionOnce(webSessionID = this.getStoredWebSessionID()): Observable<AuthSession | null> {
+    return this.api.checkSessionOnce(webSessionID).pipe(
+      tap(session => {
+        if (session?.active) {
+          this.activateSession(session);
+        }
+      })
+    );
+  }
+
+  /**
+   * Called after user completes Telegram login.
+   */
+  onTelegramLoginComplete(): void {
+    this.hideLogin();
+
+    if (!this.isAuthenticated()) {
+      this.checkSession();
+    }
+  }
+
+  /** Generate the Telegram login URL for bot-based auth */
+  getTelegramLoginUrl(webSessionID: string): string {
+    return this.api.getBotLoginUrl(webSessionID);
+  }
+
+  /** Generate a Telegram app deep link for mobile login without opening a browser tab. */
+  getTelegramAppLoginUrl(webSessionID: string): string {
+    return this.api.getBotAppLoginUrl(webSessionID);
+  }
+
+  /** Create a backend web session and return the Telegram start link for it. */
+  createWebSession(): Observable<WebSessionStart> {
+    return this.api.createSession();
+  }
+
+  /** Show login dialog (called when user tries to pay without being logged in) */
+  requestLogin(): void {
+    this.showLoginSignal.set(true);
+  }
+
+  /** Hide login dialog */
+  hideLogin(): void {
+    this.showLoginSignal.set(false);
+  }
+
+  /** Logout — clears session on backend and locally */
+  logout(): void {
+    const webSessionID = this.sessionSignal()?.sessionId || this.getStoredWebSessionID();
+
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.api.logout(webSessionID).subscribe(() => {
+      this.clearAuthState('unauthenticated');
+    });
+  }
+
+  private activateSession(session: AuthSession): void {
+    this.sessionSignal.set(session);
+    this.statusSignal.set('authenticated');
+    this.setStoredWebSessionID(session.sessionId);
+    this.scheduleSessionRefresh(session.expires);
+  }
+
+  private clearAuthState(status: AuthStatus): void {
+    this.sessionSignal.set(null);
+    this.statusSignal.set(status);
+    this.clearStoredWebSessionID();
+    this.clearSessionRefresh();
+  }
+
+  /** Schedule a session re-check before it expires */
+  private scheduleSessionRefresh(expiresAt: string): void {
+    this.clearSessionRefresh();
+
+    const expiresMs = new Date(expiresAt).getTime();
+    const nowMs = Date.now();
+    // Re-check 60 seconds before expiry, minimum 30s from now
+    const refreshIn = Number.isFinite(expiresMs)
+      ? Math.max(expiresMs - nowMs - 60_000, 30_000)
+      : WEB_SESSION_COOKIE_MAX_AGE_SECONDS * 1000;
+
+    this.sessionCheckTimer = setTimeout(() => {
+      this.checkSession();
+    }, refreshIn);
+  }
+
+  private clearSessionRefresh(): void {
+    if (this.sessionCheckTimer) {
+      clearTimeout(this.sessionCheckTimer);
+      this.sessionCheckTimer = undefined;
+    }
+  }
+
+  private getStoredWebSessionID(): string | null {
+    if (typeof document === 'undefined') {
+      return null;
+    }
+
+    const cookie = document.cookie
+      .split('; ')
+      .find(row => row.startsWith(`${WEB_SESSION_COOKIE}=`));
+
+    if (!cookie) {
+      return null;
+    }
+
+    try {
+      return decodeURIComponent(cookie.substring(WEB_SESSION_COOKIE.length + 1));
+    } catch {
+      return null;
+    }
+  }
+
+  private setStoredWebSessionID(webSessionID: string): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+
+    const secure = typeof window !== 'undefined' && window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${WEB_SESSION_COOKIE}=${encodeURIComponent(webSessionID)}; Max-Age=${WEB_SESSION_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax${secure}`;
+  }
+
+  private clearStoredWebSessionID(): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+
+    document.cookie = `${WEB_SESSION_COOKIE}=; Max-Age=0; Path=/; SameSite=Lax`;
+  }
+}

packages/auth/src/telegram/models/session.model.ts

@@ -0,0 +1,16 @@
+export interface AuthSession {
+  sessionId: string;
+  userId: number | null;
+  username: string | null;
+  displayName: string;
+  active: boolean;
+  expires: string;
+}
+
+export interface WebSessionStart {
+  webSessionID: string;
+  url: string;
+}
+
+export type AuthStatus = 'unknown' | 'checking' | 'authenticated' | 'expired' | 'unauthenticated';
+export type AdminAuthStatus = 'unknown' | 'checking' | 'authenticated' | 'expired' | 'unauthenticated';

packages/auth/src/telegram/telegram-session-api.service.ts

@@ -0,0 +1,157 @@
+import { Injectable, inject, Optional } from '@angular/core';
+import { HttpClient } from '@angular/common/http';
+import { Observable, of, catchError, map } from 'rxjs';
+import { AuthSession, WebSessionStart } from './models/session.model';
+import { AUTH_API_URL, TELEGRAM_BOT_USERNAME } from '../config';
+import { generateGuid } from '../util/guid.util';
+
+const SESSION_MAX_AGE_SECONDS = 60 * 60;
+const DEFAULT_TELEGRAM_BOT_USERNAME = 'DexarSupport_bot';
+
+/**
+ * The one Telegram QR/session API (`{authApiUrl}/users/sessions`). Customer
+ * login (AuthService) and admin login (AdminAuthService) both call this same
+ * service against this same endpoint - there is no separate admin backend.
+ * This class only does the HTTP call + response normalization; it holds no
+ * session state and writes no cookies, so each caller manages its own
+ * storage/signals independently on top of it.
+ */
+@Injectable({ providedIn: 'root' })
+export class TelegramSessionApiService {
+  private readonly http = inject(HttpClient);
+  private readonly authApiUrl = inject(AUTH_API_URL);
+  @Optional() private readonly telegramBotUsername = inject(TELEGRAM_BOT_USERNAME, { optional: true });
+
+  createSession(): Observable<WebSessionStart> {
+    const webSessionID = generateGuid();
+
+    return this.http.post<Record<string, unknown>>(
+      `${this.authApiUrl}/users/sessions`,
+      { webSessionID },
+      { headers: { WebSessionID: webSessionID } }
+    ).pipe(
+      map(response => {
+        const responseWebSessionID = this.extractSessionId(response, webSessionID);
+        return {
+          webSessionID: responseWebSessionID,
+          url: this.getBotLoginUrl(responseWebSessionID),
+        };
+      })
+    );
+  }
+
+  checkSessionOnce(webSessionID: string | null): Observable<AuthSession | null> {
+    if (!webSessionID) {
+      return of(null);
+    }
+
+    return this.http.get<Record<string, unknown>>(
+      `${this.authApiUrl}/users/sessions/${encodeURIComponent(webSessionID)}`
+    ).pipe(
+      map(response => this.normalizeWebSession(response, webSessionID)),
+      catchError(() => of(null))
+    );
+  }
+
+  logout(webSessionID: string): Observable<unknown> {
+    return this.http.delete(`${this.authApiUrl}/users/sessions/${encodeURIComponent(webSessionID)}`, {
+      headers: { WebSessionID: webSessionID }
+    }).pipe(catchError(() => of(null)));
+  }
+
+  getBotLoginUrl(webSessionID: string): string {
+    return `https://t.me/${this.getBotUsername()}?start=${encodeURIComponent(webSessionID)}`;
+  }
+
+  getBotAppLoginUrl(webSessionID: string): string {
+    return `tg://resolve?domain=${encodeURIComponent(this.getBotUsername())}&start=${encodeURIComponent(webSessionID)}`;
+  }
+
+  private getBotUsername(): string {
+    return this.telegramBotUsername || DEFAULT_TELEGRAM_BOT_USERNAME;
+  }
+
+  private normalizeWebSession(response: Record<string, unknown> | null, fallbackSessionId: string): AuthSession | null {
+    if (!response) {
+      return null;
+    }
+
+    const user = this.asRecord(this.readFirst(response, ['user', 'User', 'telegramUser', 'TelegramUser'])) ?? response;
+    const status = this.readFirst(response, [
+      'status', 'Status', 'active', 'Active', 'loggedIn', 'LoggedIn',
+      'isLoggedIn', 'IsLoggedIn', 'authenticated', 'Authenticated'
+    ]);
+    const active = this.isActiveStatus(status);
+    const sessionId = this.extractSessionId(response, fallbackSessionId);
+    const username = this.readString(this.readFirst(user, ['username', 'Username']))
+      ?? this.readString(this.readFirst(response, ['username', 'Username']));
+    const firstName = this.readString(this.readFirst(user, ['firstName', 'first_name', 'FirstName', 'First_name']));
+    const lastName = this.readString(this.readFirst(user, ['lastName', 'last_name', 'LastName', 'Last_name']));
+    const fullName = [firstName, lastName].filter(Boolean).join(' ');
+    const explicitDisplayName = this.readString(this.readFirst(response, ['displayName', 'DisplayName', 'name', 'Name']))
+      ?? this.readString(this.readFirst(user, ['displayName', 'DisplayName', 'name', 'Name']));
+    const displayName = explicitDisplayName ?? username ?? (fullName || 'Telegram User');
+    const telegramUserId = this.readNumber(this.readFirst(user, ['userId', 'telegramUserId', 'telegramUserID', 'TelegramUserID', 'id', 'ID']))
+      ?? this.readNumber(this.readFirst(response, ['userId', 'telegramUserId', 'telegramUserID', 'TelegramUserID', 'userID', 'UserID', 'UserId']))
+      ?? null;
+    const expiresAt = this.readString(this.readFirst(response, ['expiresAt', 'ExpiresAt', 'expires', 'Expires']))
+      ?? new Date(Date.now() + SESSION_MAX_AGE_SECONDS * 1000).toISOString();
+
+    return { sessionId, userId: telegramUserId, username, displayName, active, expires: expiresAt };
+  }
+
+  private extractSessionId(response: Record<string, unknown> | null, fallbackSessionId: string): string {
+    if (!response) {
+      return fallbackSessionId;
+    }
+    return this.readString(this.readFirst(response, [
+      'webSessionID', 'WebSessionID', 'webSessionId', 'sessionID', 'SessionID', 'sessionId', 'id', 'ID'
+    ])) ?? fallbackSessionId;
+  }
+
+  private readFirst(source: Record<string, unknown>, keys: string[]): unknown {
+    for (const key of keys) {
+      if (Object.prototype.hasOwnProperty.call(source, key)) {
+        return source[key];
+      }
+    }
+    return undefined;
+  }
+
+  private readString(value: unknown): string | null {
+    if (typeof value === 'string' && value.trim()) {
+      return value;
+    }
+    if (typeof value === 'number' || typeof value === 'bigint') {
+      return value.toString();
+    }
+    return null;
+  }
+
+  private readNumber(value: unknown): number | null {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return value;
+    }
+    if (typeof value === 'string') {
+      const parsed = Number(value);
+      return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+  }
+
+  private asRecord(value: unknown): Record<string, unknown> | null {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+      ? value as Record<string, unknown>
+      : null;
+  }
+
+  private isActiveStatus(status: unknown): boolean {
+    if (status === true || status === 1) {
+      return true;
+    }
+    if (typeof status !== 'string') {
+      return false;
+    }
+    return ['true', '1', 'active', 'authenticated', 'confirmed', 'success', 'logged_in'].includes(status.toLowerCase());
+  }
+}