f022beb585
Token is no longer hardcoded in source — injected at build time. Build with: VITE_ERP_TOKEN="key:secret" npx quasar build Prevents accidental token invalidation and keeps secrets out of git. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
52 lines
2.3 KiB
JavaScript
52 lines
2.3 KiB
JavaScript
// ── Auth store — Authentik forwardAuth ──────────────────────────────────────
|
|
// Authentik handles login at the Traefik level. If the user reaches the app,
|
|
// they are already authenticated. We fetch their identity from the /api/ proxy
|
|
// which forwards Authentik headers to ERPNext.
|
|
// ERPNext API calls use a service token (not user session).
|
|
// ─────────────────────────────────────────────────────────────────────────────
|
|
import { defineStore } from 'pinia'
|
|
import { ref } from 'vue'
|
|
import { BASE_URL } from 'src/config/erpnext'
|
|
|
|
// Service token for ERPNext API — all dispatch API calls use this
|
|
const ERP_SERVICE_TOKEN = import.meta.env.VITE_ERP_TOKEN || window.__ERP_TOKEN__ || ''
|
|
|
|
export const useAuthStore = defineStore('auth', () => {
|
|
const user = ref(null)
|
|
const loading = ref(true)
|
|
const error = ref('')
|
|
|
|
async function checkSession () {
|
|
loading.value = true
|
|
try {
|
|
// Fetch user identity — the /api/ proxy passes Authentik headers to ERPNext
|
|
// We use the service token to query who we are
|
|
const res = await fetch(BASE_URL + '/api/method/frappe.auth.get_logged_user', {
|
|
headers: { Authorization: 'token ' + ERP_SERVICE_TOKEN },
|
|
})
|
|
if (res.ok) {
|
|
const data = await res.json()
|
|
// For now, use the service account identity
|
|
// The actual Authentik user email is in the response headers (X-authentik-email)
|
|
// but those are only available at the Traefik level
|
|
user.value = data.message || 'authenticated'
|
|
} else {
|
|
user.value = 'authenticated' // Authentik guarantees auth, ERPNext may not know the user
|
|
}
|
|
} catch {
|
|
user.value = 'authenticated' // If ERPNext is down, user is still authenticated via Authentik
|
|
} finally {
|
|
loading.value = false
|
|
}
|
|
}
|
|
|
|
async function doLogout () {
|
|
// Redirect to Authentik logout
|
|
window.location.href = 'https://auth.targo.ca/application/o/gigafibre-dispatch/end-session/'
|
|
}
|
|
|
|
return { user, loading, error, checkSession, doLogin: checkSession, doLogout }
|
|
})
|
|
|
|
export function getServiceToken () { return ERP_SERVICE_TOKEN }
|