Client Auth

import { PortalAuth } from '@portal-hq/core'

export const portalAuth = new PortalAuth({
  authEnvironmentId: 'YOUR_AUTH_ENVIRONMENT_ID',
  redirectUrl: 'myapp://auth/callback',
  // Required only by sendMagicLink()
  magicLink: {
    fromEmail: 'hello@auth.example.com',
    templateId: 'YOUR_TEMPLATE_ID',
  },
  // Optional: whether the client Portal creates uses gas sponsorship
  // isAccountAbstracted: true,
})

import type { AuthMethodsResult } from '@portal-hq/core'

import { portalAuth } from './portalAuth'

const loadMethods = async (): Promise<AuthMethodsResult> => {
  const methods = await portalAuth.getMethods()

  console.log('✅ enabled:', methods.allowedAuthMethods) // ['GOOGLE', 'EMAIL_MAGIC_LINK']
  console.log('✅ autoCreateWallet:', methods.autoCreateWallet)

  return methods
}

import { Linking } from 'react-native'

import { AuthMethod } from '@portal-hq/core'
import { portalAuth } from './portalAuth'

const signInWithProvider = async (method: AuthMethod.Google | AuthMethod.Apple) => {
  const { authorizeUrl } =
    method === AuthMethod.Google
      ? await portalAuth.loginWithGoogle()
      : await portalAuth.loginWithApple()

  await Linking.openURL(authorizeUrl)
}

import { portalAuth } from './portalAuth'

const sendMagicLink = async (input: string) => {
  // The API requires a lowercase address and rejects anything else with a 400.
  const email = input.trim().toLowerCase()

  await portalAuth.sendMagicLink(email)

  console.log(`✅ magic link sent — check ${email}`)
}

import { useEffect, useState } from 'react'
import { Linking } from 'react-native'

import type { PortalSession, TotpRequiredResult } from '@portal-hq/core'
import { PortalAuthError, PortalAuthErrorReason } from '@portal-hq/core'

import { portalAuth } from './portalAuth'

/**
 * Module scope, deliberately: `getInitialURL()` keeps returning the URL the app
 * was launched with, so a component that remounts would hand the same, already
 * spent, grant to `handleRedirect()` again and surface a `GrantRejected` that
 * is not a real failure. A `useRef` only guards one mount.
 */
let initialUrlRead = false

export const useClientAuth = () => {
  const [session, setSession] = useState<PortalSession | null>(null)
  const [totpChallenge, setTotpChallenge] = useState<TotpRequiredResult | null>(
    null,
  )

  useEffect(() => {
    const handleUrl = async (url: string) => {
      try {
        const result = await portalAuth.handleRedirect(url)

        // Not a Client Auth redirect — let the rest of your router handle it.
        if (!result) return

        if (result.status === 'totpRequired') {
          setTotpChallenge(result)
          return
        }

        setSession(result.session)
      } catch (error) {
        if (PortalAuthError.is(error)) {
          if (error.reason === PortalAuthErrorReason.ProviderRejected) {
            console.error('❌ the user did not complete the provider sign-in')
          } else if (error.reason === PortalAuthErrorReason.GrantRejected) {
            console.error('❌ this sign-in link is spent or expired — start a new sign-in')
          }
          return
        }

        console.error('❌ handleRedirect failed:', error)
      }
    }

    const subscription = Linking.addEventListener('url', ({ url }) => {
      void handleUrl(url)
    })

    // Cold start: the redirect may be what launched the app. Once per process.
    if (!initialUrlRead) {
      initialUrlRead = true
      Linking.getInitialURL()
        .then((url) => {
          if (url) void handleUrl(url)
        })
        .catch((error: unknown) => console.error('❌ getInitialURL failed:', error))
    }

    return () => subscription.remove()
  }, [])

  return { session, totpChallenge }
}

import type { PortalSession, TotpRequiredResult } from '@portal-hq/core'

import { portalAuth } from './portalAuth'

const verifyTotp = async (
  challenge: TotpRequiredResult,
  code: string,
): Promise<PortalSession | null> => {
  try {
    const result = await portalAuth.verifyTotp(code, challenge.userJwt)

    // The same session the non-TOTP path returns. Pass it to createPortal().
    return result.session
  } catch (error) {
    // A rejected code does not consume the userJwt, so prompting again is normal.
    console.error('❌ verifyTotp failed — ask for the next code:', error)
    return null
  }
}

const { session, totpChallenge } = useClientAuth()

const submitTotpCode = async (code: string) => {
  if (!totpChallenge) return

  const verified = await verifyTotp(totpChallenge, code)

  if (verified) {
    // Continue exactly as for a session from handleRedirect().
    const portal = createPortal(verified)
  }
}

import { BackupMethods, Portal } from '@portal-hq/core'
import type { PortalSession } from '@portal-hq/core'
import GoogleDriveStorage from '@portal-hq/gdrive-storage'
import { PasswordStorage } from '@portal-hq/utils/src/definitions'

const createPortal = (session: PortalSession): Portal => {
  const gDriveStorage = new GoogleDriveStorage({
    androidClientId: 'YOUR_ANDROID_CLIENT_ID',
    iosClientId: 'YOUR_IOS_CLIENT_ID',
  })

  return new Portal({
    credentials: session,
    backup: {
      [BackupMethods.GoogleDrive]: gDriveStorage,
      [BackupMethods.Password]: new PasswordStorage(),
    },
  })
}

import type { Portal } from '@portal-hq/core'
import type { AddressesByNamespace } from '@portal-hq/utils/types'

import { portalAuth } from './portalAuth'

const resolveWallet = async (portal: Portal): Promise<AddressesByNamespace | undefined> => {
  const existing = await portal.addresses

  if (existing && Object.values(existing).some(Boolean)) {
    console.log('✅ reusing the existing wallet')
    return existing
  }

  const { autoCreateWallet } = await portalAuth.getMethods()

  if (!autoCreateWallet) {
    console.log('✅ autoCreateWallet is off — not creating a wallet')
    return undefined
  }

  const created = await portal.createWallet()
  console.log('✅ wallet created:', created)

  return created
}

import { portalAuth } from './portalAuth'

const restore = async () => {
  try {
    const session = await portalAuth.restoreSession()

    if (!session) {
      console.log('✅ nothing stored — show the sign-in screen')
      return null
    }

    return session
  } catch (error) {
    // Storage held something unreadable. Clear it and sign in again.
    console.error('❌ restoreSession failed:', error)
    await portalAuth.clearPersistedSession()
    return null
  }
}

import type { Portal } from '@portal-hq/core'

import { portalAuth } from './portalAuth'

// Signing the current user out.
const signOut = async (portal: Portal) => {
  await portal.clearSession()
}

// Clearing storage when there is no Portal to clear through.
const clearStoredSession = async () => {
  await portalAuth.clearPersistedSession()
}

import { useEffect } from 'react'

import type { Portal } from '@portal-hq/core'

const useSessionInvalidated = (portal: Portal | null, signOut: () => void) => {
  useEffect(() => {
    if (!portal) return

    return portal.onSessionInvalidated(signOut)
  }, [portal, signOut])
}

import {
  PortalAuthError,
  PortalAuthErrorReason,
  PortalCredentialError,
} from '@portal-hq/core'

const describe = (error: unknown): string => {
  if (PortalAuthError.is(error)) {
    return error.reason === PortalAuthErrorReason.GrantRejected
      ? 'That sign-in link has expired. Please try again.'
      : 'Sign-in was not completed.'
  }

  if (PortalCredentialError.is(error)) {
    return error.requiresReauthentication
      ? 'Your session ended. Please sign in again.'
      : 'Could not read your session. Please try again.'
  }

  return 'Something went wrong.'
}