feat: auth flow

js/src/stores/app-store.ts

@@ -0,0 +1,24 @@
+import { create } from "zustand";
+import { apiClient } from "@/api/client";
+import type { StartupResponse } from "@/api/types";
+
+interface AppState {
+  startupData: StartupResponse | null;
+  isLoading: boolean;
+  fetchStartup: () => Promise<void>;
+}
+
+export const useAppStore = create<AppState>((set) => ({
+  startupData: null,
+  isLoading: false,
+
+  fetchStartup: async () => {
+    set({ isLoading: true });
+    try {
+      const data = await apiClient.startup();
+      set({ startupData: data });
+    } finally {
+      set({ isLoading: false });
+    }
+  },
+}));

js/src/stores/auth-store.ts

@@ -0,0 +1,109 @@
+import { create } from "zustand";
+import { apiClient, ApiError } from "@/api/client";
+import type { Human } from "@/api/types";
+import { useSessionStore } from "./session-store";
+
+type AuthStatus = "idle" | "restoring" | "unauthenticated" | "authenticated";
+
+interface AuthState {
+  status: AuthStatus;
+  user: Human | null;
+  isRequestingCode: boolean;
+  isSigningIn: boolean;
+  isSigningOut: boolean;
+  error: string | null;
+  restoreSession: () => Promise<void>;
+  requestCode: (email: string) => Promise<void>;
+  signIn: (email: string, code: string) => Promise<void>;
+  signOut: () => Promise<void>;
+  clearError: () => void;
+}
+
+export const useAuthStore = create<AuthState>((set) => ({
+  status: "idle",
+  user: null,
+  isRequestingCode: false,
+  isSigningIn: false,
+  isSigningOut: false,
+  error: null,
+
+  restoreSession: async () => {
+    const token = useSessionStore.getState().token;
+    if (!token) {
+      set({ status: "unauthenticated" });
+      return;
+    }
+
+    set({ status: "restoring" });
+    try {
+      const user = await apiClient.me();
+      set({ status: "authenticated", user });
+    } catch {
+      useSessionStore.getState().clearToken();
+      set({ status: "unauthenticated", user: null });
+    }
+  },
+
+  requestCode: async (email: string) => {
+    set({ isRequestingCode: true, error: null });
+    try {
+      await apiClient.requestCode({ email });
+    } catch (e) {
+      const message =
+        e instanceof ApiError ? e.message : "Failed to send code";
+      set({ error: message });
+      throw e;
+    } finally {
+      set({ isRequestingCode: false });
+    }
+  },
+
+  signIn: async (email: string, code: string) => {
+    set({ isSigningIn: true, error: null });
+    try {
+      const { human, token } = await apiClient.signIn({ email, code });
+      useSessionStore.getState().setToken(token);
+      set({ status: "authenticated", user: human });
+    } catch (e) {
+      const message =
+        e instanceof ApiError ? e.message : "Failed to sign in";
+      set({ error: message });
+      throw e;
+    } finally {
+      set({ isSigningIn: false });
+    }
+  },
+
+  signOut: async () => {
+    set({ isSigningOut: true });
+    try {
+      await apiClient.signOut();
+    } catch {
+      // Best-effort — sign out locally regardless
+    } finally {
+      useSessionStore.getState().clearToken();
+      set({
+        status: "unauthenticated",
+        user: null,
+        isSigningOut: false,
+        error: null,
+      });
+    }
+  },
+
+  clearError: () => set({ error: null }),
+}));
+
+// React to token being cleared externally (e.g. 401 from API client)
+useSessionStore.subscribe((state, prevState) => {
+  if (prevState.token && !state.token) {
+    const authState = useAuthStore.getState();
+    if (authState.status === "authenticated") {
+      useAuthStore.setState({
+        status: "unauthenticated",
+        user: null,
+        error: null,
+      });
+    }
+  }
+});

js/src/stores/session-store.ts

@@ -0,0 +1,23 @@
+import { create } from "zustand";
+
+const AUTH_TOKEN_KEY = "auth_token";
+
+interface SessionState {
+  token: string | null;
+  setToken: (token: string) => void;
+  clearToken: () => void;
+}
+
+export const useSessionStore = create<SessionState>((set) => ({
+  token: localStorage.getItem(AUTH_TOKEN_KEY),
+
+  setToken: (token: string) => {
+    localStorage.setItem(AUTH_TOKEN_KEY, token);
+    set({ token });
+  },
+
+  clearToken: () => {
+    localStorage.removeItem(AUTH_TOKEN_KEY);
+    set({ token: null });
+  },
+}));