82 lines
3.1 KiB
TypeScript
82 lines
3.1 KiB
TypeScript
import axios, { InternalAxiosRequestConfig } from 'axios';
|
|
import { getApiBaseUrl } from '../config';
|
|
import { triggerSessionExpired, isUserSyncEndpoint, isTenantEndpoint } from './sessionExpiration';
|
|
import { isUserSyncedInBrowser, isActivationPending, syncUserAccount } from './userSyncService';
|
|
|
|
export const BASE_API_URL = getApiBaseUrl();
|
|
|
|
// Create Axios Instance
|
|
export const apiClient = axios.create({
|
|
baseURL: BASE_API_URL,
|
|
headers: {
|
|
'Content-Type': 'application/json; version=1',
|
|
Accept: 'application/json; version=1',
|
|
},
|
|
timeout: 15000,
|
|
});
|
|
|
|
// Request Interceptor to dynamically set baseURL and attach Bearer Token
|
|
apiClient.interceptors.request.use(
|
|
async (config: InternalAxiosRequestConfig) => {
|
|
// Dynamically synchronize baseURL from runtime configuration
|
|
config.baseURL = getApiBaseUrl();
|
|
const token = localStorage.getItem('pfm_access_token');
|
|
if (token && config.headers) {
|
|
config.headers.Authorization = `Bearer ${token}`;
|
|
}
|
|
|
|
// User Sync & Tenant Lifecycle Guard:
|
|
// All API calls require an authenticated and enabled user in the backend system.
|
|
const isLifecycleRequest = isUserSyncEndpoint(config.url) || isTenantEndpoint(config.url);
|
|
if (token && !isLifecycleRequest) {
|
|
// If user account is flagged as pending administrator activation, block downstream API calls
|
|
if (isActivationPending()) {
|
|
return Promise.reject(new Error('User account is pending administrator activation'));
|
|
}
|
|
|
|
const storedSub = localStorage.getItem('pfm_user_sub') || '';
|
|
if (!isUserSyncedInBrowser(storedSub, token)) {
|
|
const syncRes = await syncUserAccount(storedSub, token);
|
|
if (!syncRes.success) {
|
|
return Promise.reject(new Error(syncRes.errorMessage || 'User account sync pending activation'));
|
|
}
|
|
}
|
|
}
|
|
|
|
return config;
|
|
},
|
|
(error) => Promise.reject(error)
|
|
);
|
|
|
|
// Response Interceptor for global HTTP 401 detection
|
|
apiClient.interceptors.response.use(
|
|
(response) => response,
|
|
(error) => {
|
|
if (error?.response?.status === 401) {
|
|
const requestUrl = error.config?.url;
|
|
const isLifecycleEndpoint = isUserSyncEndpoint(requestUrl) || isTenantEndpoint(requestUrl);
|
|
|
|
// Handle 401 Unauthorized errors
|
|
if (!isLifecycleEndpoint) {
|
|
// Working endpoint returned HTTP 401: trigger session expiration prompt
|
|
const detailMsg =
|
|
error?.response?.data?.detail ||
|
|
error?.response?.data?.message ||
|
|
'Authentication session expired or security token invalidated (HTTP 401).';
|
|
|
|
triggerSessionExpired(detailMsg, requestUrl);
|
|
} else {
|
|
// User sync endpoint returned HTTP 401: clear cached auth state
|
|
if (typeof window !== 'undefined') {
|
|
localStorage.removeItem('pfm_access_token');
|
|
localStorage.removeItem('pfm_access_user');
|
|
localStorage.removeItem('pfm_user_sync_record');
|
|
localStorage.removeItem('pfm_user_pending_activation');
|
|
localStorage.removeItem('pfm_user_pending_activation_reason');
|
|
}
|
|
}
|
|
}
|
|
return Promise.reject(error);
|
|
}
|
|
);
|