Service Integration Guide

// 1. Handle SSO callback (put this in your login page)
function handleSSO() {
    const urlParams = new URLSearchParams(window.location.search);
    const ssoToken = urlParams.get('sso_token');
    const userDataStr = urlParams.get('user');
    
    if (ssoToken && userDataStr) {
        localStorage.setItem('hub_jwt_token', ssoToken);
        localStorage.setItem('hub_user_data', userDataStr);
        window.location.href = '/dashboard';
    }
}

// 2. Check if user is logged in (put this everywhere)
function checkAuth() {
    const token = localStorage.getItem('hub_jwt_token');
    if (!token) {
        window.location.href = `https://hub.regardingwork.com/login?redirect=${encodeURIComponent(window.location.href)}`;
        return false;
    }
    return true;
}

// 3. Validate token (optional - only if you need fresh user data)
async function validateUser() {
    const token = localStorage.getItem('hub_jwt_token');
    const response = await fetch('https://hub.regardingwork.com/api/auth/validate', {
        headers: { 'Authorization': `Bearer ${token}` }
    });
    
    if (response.ok) {
        const data = await response.json();
        return data.user; // Use data.user.username, data.user.email, etc.
    } else {
        checkAuth(); // Redirect to login
        return null;
    }
}

// 4. Call on page load
document.addEventListener('DOMContentLoaded', function() {
    handleSSO();  // Check for SSO callback
    checkAuth();  // Ensure user is logged in
});

// Robust fetch with retry logic and specific error handling
async function fetchWithRetry(url, options, retries = 3) {
    for (let i = 0; i < retries; i++) {
        try {
            const response = await fetch(url, options);
            
            // Handle specific HTTP status codes
            if (!response.ok) {
                if (response.status === 401) {
                    throw new Error('Invalid or expired token - redirecting to login');
                }
                if (response.status === 403) {
                    throw new Error('Unauthorized access - insufficient permissions');
                }
                if (response.status === 404) {
                    throw new Error('Endpoint not found - check Hub URL');
                }
                if (response.status >= 500) {
                    throw new Error(`Hub server error: ${response.status}`);
                }
                throw new Error(`HTTP ${response.status}: ${response.statusText}`);
            }
            
            return response.json();
        } catch (error) {
            console.log(`Attempt ${i + 1} failed:`, error.message);
            
            // Don't retry on authentication errors
            if (error.message.includes('401') || error.message.includes('403')) {
                throw error;
            }
            
            // Retry on network/server errors
            if (i === retries - 1) throw error;
            
            // Exponential backoff
            await new Promise(resolve => setTimeout(resolve, 1000 * Math.pow(2, i)));
        }
    }
}

// Enhanced validation with error handling
async function validateUserWithRetry() {
    const token = localStorage.getItem('hub_jwt_token');
    
    if (!token) {
        console.log('No token found - redirecting to login');
        redirectToLogin();
        return null;
    }
    
    try {
        const data = await fetchWithRetry('https://hub.regardingwork.com/api/auth/validate', {
            headers: { 'Authorization': `Bearer ${token}` }
        });
        
        console.log('✅ User validated:', data.user);
        return data.user;
        
    } catch (error) {
        console.error('❌ Validation failed:', error.message);
        
        if (error.message.includes('Invalid or expired token')) {
            localStorage.removeItem('hub_jwt_token');
            redirectToLogin();
        }
        
        return null;
    }
}

import os
import jwt

# Environment configuration
JWT_SECRET_KEY = os.environ.get('JWT_SECRET_KEY')
JWT_ALGORITHM = 'HS256'

def validate_hub_jwt(token):
    """Validate JWT token from RegardingWork Hub"""
    try:
        payload = jwt.decode(
            token, 
            JWT_SECRET_KEY,
            algorithms=[JWT_ALGORITHM]
        )
        
        # Extract user info from Hub token
        return {
            'valid': True,
            'user_id': payload.get('user_id'),
            'username': payload.get('username'),
            'email': payload.get('email')
        }
        
    except jwt.ExpiredSignatureError:
        return {'valid': False, 'error': 'Token expired'}
    except jwt.InvalidTokenError:
        return {'valid': False, 'error': 'Invalid token'}

from functools import wraps
from flask import request, jsonify

def require_hub_auth(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        auth_header = request.headers.get('Authorization')
        
        if not auth_header or not auth_header.startswith('Bearer '):
            return jsonify({'error': 'Authorization header required'}), 401
        
        token = auth_header.split(' ')[1]
        validation = validate_hub_jwt(token)
        
        if not validation['valid']:
            return jsonify({'error': validation['error']}), 401
        
        # Add user info to request context
        request.current_user = validation
        return f(*args, **kwargs)
    
    return decorated_function

# Usage example
@app.route('/api/user-data')
@require_hub_auth
def get_user_data():
    user = request.current_user
    return jsonify({
        'message': f'Hello {user["username"]}!',
        'user_data': user
    })

https://teams.regardingwork.com/login?sso_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...&user=%7B%22id%22%3A%2229%22%2C%22username%22%3A%22michelini%22%7D

// CORRECT: Handle SSO callback
function handleSSOCallback() {
    const urlParams = new URLSearchParams(window.location.search);
    
    // ✅ CORRECT parameter names
    const ssoToken = urlParams.get('sso_token');  // NOT 'token'
    const userDataStr = urlParams.get('user');    // JSON string
    
    if (ssoToken && userDataStr) {
        try {
            // Store token with standard key name
            localStorage.setItem('hub_jwt_token', ssoToken);
            
            // Parse user data
            const userData = JSON.parse(decodeURIComponent(userDataStr));
            localStorage.setItem('hub_user_data', JSON.stringify(userData));
            
            // Clean URL
            window.history.replaceState({}, document.title, window.location.pathname);
            
            // Redirect to dashboard
            window.location.href = '/dashboard';
            
        } catch (error) {
            console.error('SSO callback error:', error);
        }
    }
}

// ✅ CORRECT: Mini-app token validation
async function validateToken() {
    const token = localStorage.getItem('hub_jwt_token');
    
    if (!token) {
        redirectToLogin();
        return null;
    }
    
    try {
        const response = await fetch('https://hub.regardingwork.com/api/auth/validate', {
            headers: {
                'Authorization': `Bearer ${token}`  // Must include 'Bearer '
            }
        });
        
        if (response.ok) {
            const data = await response.json();
            // ✅ CORRECT: Use data.user.username (NOT data.username)
            return data.user;
        } else {
            // Token invalid, redirect to login
            redirectToLogin();
            return null;
        }
    } catch (error) {
        console.error('Token validation error:', error);
        redirectToLogin();
        return null;
    }
}

function redirectToLogin() {
    localStorage.removeItem('hub_jwt_token');
    localStorage.removeItem('hub_user_data');
    window.location.href = `https://hub.regardingwork.com/login?redirect=${encodeURIComponent(window.location.href)}`;
}

// Simple login check for mini-apps
function checkLoginStatus() {
    const token = localStorage.getItem('hub_jwt_token');
    const userData = localStorage.getItem('hub_user_data');
    
    if (!token || !userData) {
        redirectToLogin();
        return false;
    }
    
    // Optional: Validate token freshness
    // validateToken();
    
    return true;
}

app.get('/auth/callback', async (req, res) => {
  const token = req.query.token;
  const result = await validateToken(token);
  const userData = encodeURIComponent(JSON.stringify(result.user));
  
  // ✅ ALWAYS redirect to login component for processing
  res.redirect(`/login?sso_token=${internalJWT}&user=${userData}`);
});

useEffect(() => {
  const ssoToken = urlParams.get('sso_token');
  if (ssoToken) {
    // Process token, set auth, redirect to dashboard
    setAuthToken(ssoToken);
    setLocation('/dashboard'); 
  }
}, []);

// Verify token format in console:
const token = localStorage.getItem('hub_jwt_token');
console.log('Token parts:', token.split('.').length); // Should be 3
console.log('Token preview:', token.substring(0, 50) + '...');