@pheme-ai/auth

Session authentication utilities for Pheme prototypes.

The package provides a small Angular auth layer for demo and prototype chat applications that use cookie-backed sessions and XSRF-protected state-changing requests.

Exports

Primary entrypoint @pheme-ai/auth:

• provideSessionAuth and SESSION_AUTH_CONFIG for configuring auth endpoints and routes.
• SessionAuthService for login, logout, and local authenticated state.
• sessionAuthGuard for protecting routes.
• sessionAuthInterceptor for adding XSRF headers to state-changing requests.

Secondary entrypoint @pheme-ai/auth/pages/login:

• LoginPage for a ready-to-use Material login screen.

API Expectations

The default configuration uses /api as the base URL and expects these endpoints:

• GET /csrf to issue or refresh the XSRF-TOKEN cookie.
• POST /login to authenticate and create a session cookie.
• POST /logout to end the current session.

The interceptor reads the XSRF-TOKEN cookie and sends it as X-XSRF-TOKEN on mutating API requests.

Configuration

Register the package in the consuming application configuration:

import { provideHttpClient, withInterceptors } from '@angular/common/http';
import { provideSessionAuth, sessionAuthInterceptor } from '@pheme-ai/auth';

export const appConfig = {
  providers: [
    provideSessionAuth({ apiBaseUrl: '/api' }),
    provideHttpClient(withInterceptors([sessionAuthInterceptor])),
  ],
};

Available configuration fields:

• apiBaseUrl - base URL for auth API requests.
• brandLogoUrl - optional logo URL displayed on the login page.
• brandName - optional brand name displayed on the login page.
• csrfPath - path used to request an XSRF cookie.
• loginPath - path used to submit credentials.
• loginRoute - router commands used when redirecting unauthenticated users.
• storageKey - local storage key used for the lightweight authenticated flag.

Build And Test

From the workspace root:

ng build @pheme-ai/auth
ng test @pheme-ai/auth

Status

This package is intentionally minimal. It is useful for chat prototypes that need realistic route protection and request behavior without bringing in a full identity provider integration.