Files
goodgo-platform/apps/web/lib/admin-api.ts
Ho Ngoc Hai 6389dcf78e fix(auth): migrate tokens from localStorage to httpOnly cookies + CSRF hardening
Backend:
- Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh
- JWT strategy reads token from cookie first, falls back to Authorization header
- Added POST /auth/logout to clear auth cookies
- Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange
- Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat)
- CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout)

Frontend:
- Removed all localStorage token storage (goodgo_tokens key)
- Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies)
- All API calls use credentials:'include' for cookie-based auth
- Updated auth-store: no more token state, uses isAuthenticated flag from cookie
- Updated admin-api, listings-api to remove explicit token parameters
- Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing
- OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies
- Auth provider simplified (no client-side cookie management needed)

Security improvements:
- JWT no longer accessible via JavaScript (XSS-safe)
- Refresh token scoped to /auth path only
- Server-side goodgo_authenticated cookie with SameSite=Lax
- Access token cookie with SameSite=Strict

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 06:25:11 +07:00

180 lines
4.4 KiB
TypeScript

import { apiClient } from './api-client';
// ── Types ──
export interface DashboardStats {
totalUsers: number;
totalListings: number;
activeListings: number;
pendingModerationCount: number;
totalAgents: number;
verifiedAgents: number;
totalTransactions: number;
newUsersLast30Days: number;
newListingsLast30Days: number;
}
export interface RevenueStatsItem {
period: string;
totalRevenue: number;
subscriptionRevenue: number;
listingFeeRevenue: number;
featuredListingRevenue: number;
transactionCount: number;
}
export interface ModerationQueueItem {
listingId: string;
propertyTitle: string;
propertyType: string;
transactionType: string;
priceVND: number;
sellerName: string;
sellerId: string;
moderationScore: number | null;
createdAt: string;
}
export interface PaginatedResult<T> {
data: T[];
total: number;
page: number;
limit: number;
totalPages: number;
}
export interface UserListItem {
id: string;
email: string | null;
phone: string;
fullName: string;
role: string;
kycStatus: string;
isActive: boolean;
createdAt: string;
}
export interface UserDetail {
id: string;
email: string | null;
phone: string;
fullName: string;
avatarUrl: string | null;
role: string;
kycStatus: string;
kycData: unknown;
isActive: boolean;
createdAt: string;
updatedAt: string;
listingsCount: number;
activeListingsCount: number;
transactionsCount: number;
subscription: {
planTier: string;
status: string;
currentPeriodEnd: string;
} | null;
recentActivity: Array<{
type: string;
description: string;
createdAt: string;
}>;
}
export interface KycQueueItem {
userId: string;
fullName: string;
email: string | null;
phone: string;
role: string;
kycStatus: string;
kycData: unknown;
createdAt: string;
}
// ── API ──
export const adminApi = {
// Dashboard
getDashboardStats: () =>
apiClient.get<DashboardStats>('/admin/dashboard'),
getRevenueStats: (startDate: string, endDate: string, groupBy: 'day' | 'month' = 'month') =>
apiClient.get<RevenueStatsItem[]>(
`/admin/revenue?startDate=${startDate}&endDate=${endDate}&groupBy=${groupBy}`,
),
// Moderation
getModerationQueue: (page = 1, limit = 20) =>
apiClient.get<PaginatedResult<ModerationQueueItem>>(
`/admin/moderation?page=${page}&limit=${limit}`,
),
approveListing: (listingId: string, moderationNotes?: string) =>
apiClient.post<{ success: boolean }>('/admin/moderation/approve', {
listingId,
moderationNotes,
}),
rejectListing: (listingId: string, reason: string) =>
apiClient.post<{ success: boolean }>('/admin/moderation/reject', {
listingId,
reason,
}),
bulkModerate: (listingIds: string[], action: 'approve' | 'reject', reason?: string) =>
apiClient.post<{ success: boolean }>('/admin/moderation/bulk', {
listingIds,
action,
reason,
}),
// Users
getUsers: (params: { page?: number; limit?: number; role?: string; isActive?: boolean; search?: string } = {}) => {
const query = new URLSearchParams();
if (params.page) query.set('page', String(params.page));
if (params.limit) query.set('limit', String(params.limit));
if (params.role) query.set('role', params.role);
if (params.isActive !== undefined) query.set('isActive', String(params.isActive));
if (params.search) query.set('search', params.search);
return apiClient.get<PaginatedResult<UserListItem>>(
`/admin/users?${query.toString()}`,
);
},
getUserDetail: (userId: string) =>
apiClient.get<UserDetail>(`/admin/users/${userId}`),
updateUserStatus: (userId: string, isActive: boolean, reason?: string) =>
apiClient.post<{ success: boolean }>('/admin/users/status', {
userId,
isActive,
reason,
}),
banUser: (userId: string, reason: string, unban = false) =>
apiClient.post<{ success: boolean }>('/admin/users/ban', {
userId,
reason,
unban,
}),
// KYC
getKycQueue: (page = 1, limit = 20) =>
apiClient.get<PaginatedResult<KycQueueItem>>(
`/admin/kyc?page=${page}&limit=${limit}`,
),
approveKyc: (userId: string, notes?: string) =>
apiClient.post<{ success: boolean }>('/admin/kyc/approve', {
userId,
notes,
}),
rejectKyc: (userId: string, reason: string) =>
apiClient.post<{ success: boolean }>('/admin/kyc/reject', {
userId,
reason,
}),
};