Authentication & Security

// Set JWT token (most common approach)
api.setAuthToken('your-jwt-token-here');

// All subsequent requests will include:
// Authorization: Bearer your-jwt-token-here

// Example: Login and set token
async function loginUser(credentials) {
  try {
    const response = await api.post('/auth/login', credentials);
    const { token, user } = response;
    
    // Store token in Apisto
    api.setAuthToken(token);
    
    // Optionally store in localStorage
    localStorage.setItem('authToken', token);
    localStorage.setItem('user', JSON.stringify(user));
    
    return user;
  } catch (error) {
    console.error('Login failed:', error);
    throw error;
  }
}

// Example: Logout
function logoutUser() {
  api.clearAuth();
  localStorage.removeItem('authToken');
  localStorage.removeItem('user');
  window.location.href = '/login';
}

// Auto-set token on page load
const savedToken = localStorage.getItem('authToken');
if (savedToken) {
  api.setAuthToken(savedToken);
}
            

// JWT with automatic token refresh
class JwtAuthManager {
  constructor(api) {
    this.api = api;
    this.isRefreshing = false;
    this.refreshSubscribers = [];
  }

  async login(credentials) {
    const response = await this.api.post('/auth/login', credentials);
    this.setTokens(response);
    return response.user;
  }

  setTokens({ accessToken, refreshToken, expiresIn }) {
    this.api.setAuthToken(accessToken);
    localStorage.setItem('accessToken', accessToken);
    localStorage.setItem('refreshToken', refreshToken);
    localStorage.setItem('tokenExpiry', Date.now() + (expiresIn * 1000));
  }

  async refreshToken() {
    if (this.isRefreshing) {
      return new Promise(resolve => {
        this.refreshSubscribers.push(resolve);
      });
    }

    this.isRefreshing = true;
    
    try {
      const refreshToken = localStorage.getItem('refreshToken');
      const response = await this.api.post('/auth/refresh', { refreshToken });
      
      this.setTokens(response);
      this.isRefreshing = false;
      
      // Resolve all pending requests
      this.refreshSubscribers.forEach(resolve => resolve());
      this.refreshSubscribers = [];
      
      return response.accessToken;
    } catch (error) {
      this.isRefreshing = false;
      this.refreshSubscribers = [];
      this.logout();
      throw error;
    }
  }

  isTokenExpired() {
    const expiry = localStorage.getItem('tokenExpiry');
    return !expiry || Date.now() >= parseInt(expiry);
  }

  logout() {
    this.api.clearAuth();
    localStorage.removeItem('accessToken');
    localStorage.removeItem('refreshToken');
    localStorage.removeItem('tokenExpiry');
  }

  // Add to request interceptor for auto-refresh
  setupAutoRefresh() {
    this.api.addRequestInterceptor(async (options, url) => {
      // Skip auth for login/refresh endpoints
      if (url.includes('/auth/')) return options;
      
      // Refresh token if expired or about to expire
      if (this.isTokenExpired()) {
        await this.refreshToken();
      }
      
      return options;
    });
  }
}

// Usage
const authManager = new JwtAuthManager(api);
authManager.setupAutoRefresh();
            

// Set API key in header (most secure)
api.setApiKey('your-api-key-here', 'X-API-Key');

// All requests will include:
// X-API-Key: your-api-key-here

// Alternative: Use AuthStrategy directly
api.useAuth(AuthStrategy.apiKey('your-key', 'X-API-Key'));

// Multiple API keys for different services
const weatherApi = new Apisto({
  baseURL: 'https://api.weatherapi.com'
});
weatherApi.setApiKey('weather-key', 'X-API-Key');

const paymentApi = new Apisto({
  baseURL: 'https://api.payments.com'
});
paymentApi.setApiKey('payment-key', 'X-Payment-Key');

// Environment-based keys
const apiKey = process.env.API_KEY || 
               import.meta.env.VITE_API_KEY || 
               'fallback-key';

api.setApiKey(apiKey, 'X-API-Key');
            

// Some APIs require keys in query parameters
class QueryParamAuth {
  constructor(api, keyName = 'api_key') {
    this.api = api;
    this.keyName = keyName;
    this.apiKey = null;
    
    // Add request interceptor to include API key
    this.api.addRequestInterceptor(async (options, url) => {
      if (this.apiKey && !options.skipAuth) {
        const urlObj = new URL(url, window.location.origin);
        urlObj.searchParams.set(this.keyName, this.apiKey);
        options.url = urlObj.pathname + urlObj.search;
      }
      return options;
    });
  }
  
  setApiKey(key) {
    this.apiKey = key;
  }
  
  clearAuth() {
    this.apiKey = null;
  }
}

// Usage
const queryAuth = new QueryParamAuth(api, 'api_key');
queryAuth.setApiKey('your-api-key');

// Now all requests will include: ?api_key=your-api-key

// For specific APIs that need both header and query auth
api.setApiKey('header-key', 'X-API-Key'); // Header
queryAuth.setApiKey('query-key'); // Query parameter
            

// HMAC authentication for secure API calls
class HmacAuth {
  constructor(api, secretKey) {
    this.api = api;
    this.secretKey = secretKey;
    this.setupHmacAuth();
  }

  setupHmacAuth() {
    this.api.addRequestInterceptor(async (options, url) => {
      if (options.skipAuth) return options;

      const timestamp = Date.now().toString();
      const method = options.method?.toUpperCase() || 'GET';
      const path = new URL(url).pathname;
      const body = options.body ? await this.hashBody(options.body) : '';
      
      const message = `${method}\n${path}\n${timestamp}\n${body}`;
      const signature = await this.generateSignature(message);

      options.headers['X-Auth-Timestamp'] = timestamp;
      options.headers['X-Auth-Signature'] = signature;
      options.headers['X-Auth-Version'] = '1.0';

      return options;
    });
  }

  async generateSignature(message) {
    const encoder = new TextEncoder();
    const key = await crypto.subtle.importKey(
      'raw',
      encoder.encode(this.secretKey),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['sign']
    );

    const signature = await crypto.subtle.sign(
      'HMAC',
      key,
      encoder.encode(message)
    );

    return Array.from(new Uint8Array(signature))
      .map(b => b.toString(16).padStart(2, '0'))
      .join('');
  }

  async hashBody(body) {
    if (!body) return '';
    
    const encoder = new TextEncoder();
    const data = encoder.encode(typeof body === 'string' ? body : JSON.stringify(body));
    const hash = await crypto.subtle.digest('SHA-256', data);
    
    return Array.from(new Uint8Array(hash))
      .map(b => b.toString(16).padStart(2, '0'))
      .join('');
  }
}

// Usage (similar to AWS signature v4)
const hmacAuth = new HmacAuth(api, 'your-secret-key');

// All requests will now include HMAC signatures
// Server can verify by recreating the signature with the same algorithm
            

// Multi-factor authentication flow
class MFAAuth {
  constructor(api) {
    this.api = api;
    this.mfaRequired = false;
  }

  async login(credentials) {
    try {
      const response = await this.api.post('/auth/login', credentials);
      
      if (response.mfa_required) {
        this.mfaRequired = true;
        this.showMFAForm();
        return { mfaRequired: true };
      }
      
      // Regular login successful
      this.api.setAuthToken(response.token);
      return response;
    } catch (error) {
      throw error;
    }
  }

  async verifyMFA(code, method = 'totp') {
    try {
      const response = await this.api.post('/auth/mfa/verify', {
        code,
        method
      });

      this.api.setAuthToken(response.token);
      this.mfaRequired = false;
      return response;
    } catch (error) {
      throw error;
    }
  }

  async setupMFA() {
    const response = await this.api.post('/auth/mfa/setup');
    
    // Show QR code for TOTP setup
    this.showQRCode(response.qr_code);
    
    return response;
  }

  async confirmMFASetup(code) {
    const response = await this.api.post('/auth/mfa/confirm', { code });
    return response;
  }

  showMFAForm() {
    // Show MFA input form in your UI
    document.getElementById('mfa-section').classList.remove('hidden');
    document.getElementById('mfa-code').focus();
  }

  showQRCode(qrCodeData) {
    // Display QR code for TOTP app setup
    const qrCodeElement = document.getElementById('qr-code');
    qrCodeElement.innerHTML = `<img src="${qrCodeData}" alt="MFA QR Code">`;
    document.getElementById('mfa-setup').classList.remove('hidden');
  }
}

// Usage in login flow
const mfaAuth = new MFAAuth(api);

async function handleLogin(credentials) {
  try {
    const result = await mfaAuth.login(credentials);
    
    if (result.mfaRequired) {
      // Wait for MFA code input
      return;
    }
    
    // Login successful without MFA
    redirectToDashboard();
  } catch (error) {
    showError('Login failed: ' + error.message);
  }
}

// Handle MFA verification
document.getElementById('mfa-form').addEventListener('submit', async (e) => {
  e.preventDefault();
  const code = document.getElementById('mfa-code').value;
  
  try {
    await mfaAuth.verifyMFA(code);
    redirectToDashboard();
  } catch (error) {
    showError('MFA verification failed: ' + error.message);
  }
});