mirror of
https://github.com/openfrontio/OpenFrontIO.git
synced 2026-06-28 00:34:17 +00:00
Evan
a09f0c67f1
## Description: The previous login system used long lived jwts which could be stolen by XSS. The current system uses long lived refresh tokens that are stored as http-only cookies. Then the client calls /refresh to get a short lived jwt using the refresh token. The jwt is stored in memory only so it's discarded on page close. This way a XSS can only steal the short-lived jwt. It also updates how accounts work: players get an account automatically when they join the webpage. They can see their stats even if not logged in. If a player wants to keep their account, they can tie it to their Discord or email, allowing them to log in if cookies are lost. ## Please complete the following: - [x] I have added screenshots for all UI updates - [x] I process any text displayed to the user through translateText() and I've added it to the en.json file - [x] I have added relevant tests to the test directory - [x] I confirm I have thoroughly tested these changes and take full responsibility for any bugs introduced ## Please put your Discord username so you can be contacted if a bug or regression is found: evan
95 lines
2.4 KiB
TypeScript
95 lines
2.4 KiB
TypeScript
import { UserMeResponse } from "../core/ApiSchemas";
|
|
import {
|
|
ColorPalette,
|
|
Cosmetics,
|
|
CosmeticsSchema,
|
|
Pattern,
|
|
} from "../core/CosmeticSchemas";
|
|
import { createCheckoutSession, getApiBase } from "./Api";
|
|
|
|
export async function handlePurchase(
|
|
pattern: Pattern,
|
|
colorPalette: ColorPalette | null,
|
|
) {
|
|
if (pattern.product === null) {
|
|
alert("This pattern is not available for purchase.");
|
|
return;
|
|
}
|
|
|
|
const url = await createCheckoutSession(
|
|
pattern.product.priceId,
|
|
colorPalette?.name ?? null,
|
|
);
|
|
if (url === false) {
|
|
alert("Failed to create checkout session.");
|
|
return;
|
|
}
|
|
|
|
// Redirect to Stripe checkout
|
|
window.location.href = url;
|
|
}
|
|
|
|
export async function fetchCosmetics(): Promise<Cosmetics | null> {
|
|
try {
|
|
const response = await fetch(`${getApiBase()}/cosmetics.json`);
|
|
if (!response.ok) {
|
|
console.error(`HTTP error! status: ${response.status}`);
|
|
return null;
|
|
}
|
|
const result = CosmeticsSchema.safeParse(await response.json());
|
|
if (!result.success) {
|
|
console.error(`Invalid cosmetics: ${result.error.message}`);
|
|
return null;
|
|
}
|
|
return result.data;
|
|
} catch (error) {
|
|
console.error("Error getting cosmetics:", error);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export function patternRelationship(
|
|
pattern: Pattern,
|
|
colorPalette: { name: string; isArchived?: boolean } | null,
|
|
userMeResponse: UserMeResponse | false,
|
|
affiliateCode: string | null,
|
|
): "owned" | "purchasable" | "blocked" {
|
|
const flares =
|
|
userMeResponse === false ? [] : (userMeResponse.player.flares ?? []);
|
|
if (flares.includes("pattern:*")) {
|
|
return "owned";
|
|
}
|
|
|
|
if (colorPalette === null) {
|
|
// For backwards compatibility only show non-colored patterns if they are owned.
|
|
if (flares.includes(`pattern:${pattern.name}`)) {
|
|
return "owned";
|
|
}
|
|
return "blocked";
|
|
}
|
|
|
|
const requiredFlare = `pattern:${pattern.name}:${colorPalette.name}`;
|
|
|
|
if (flares.includes(requiredFlare)) {
|
|
return "owned";
|
|
}
|
|
|
|
if (pattern.product === null) {
|
|
// We don't own it and it's not for sale, so don't show it.
|
|
return "blocked";
|
|
}
|
|
|
|
if (colorPalette?.isArchived) {
|
|
// We don't own the color palette, and it's archived, so don't show it.
|
|
return "blocked";
|
|
}
|
|
|
|
if (affiliateCode !== pattern.affiliateCode) {
|
|
// Pattern is for sale, but it's not the right store to show it on.
|
|
return "blocked";
|
|
}
|
|
|
|
// Patterns is for sale, and it's the right store to show it on.
|
|
return "purchasable";
|
|
}
|