Authenticate with Kantuta POS: JWT Login and Token Refresh

// Auth request / response types

interface LoginRequest {
  email: string;    // Must be a valid email address
  password: string; // User's password
}

interface LoginResponse {
  access_token: string;
  refresh_token: string;
  user: Usuario; // See the Overview page for the full Usuario interface
}

interface RefreshTokenResponse {
  access_token: string;
}

interface RequestCodeRequest {
  email: string;
}

interface ConfirmCodeRequest {
  email: string;
  code: string; // 6-character alphanumeric code, e.g. "A1B2C3"
}

interface ResetConfirmRequest {
  email: string;
  newPassword: string;
}

interface GeneralMessageResponse {
  message: string;
}

// src/components/auth/SignInForm.tsx (excerpt)
const response = await authService.login({ email, password });

if (response.status === 201 || response.status === 200) {
  const { access_token, refresh_token, user } = response.data;
  loginStorage(access_token, refresh_token, user);
}

import axios from "axios";
import { API_BASE_URL } from "./services/urlBase";

const api = axios.create({
  baseURL: API_BASE_URL,
  headers: {
    "Content-Type": "application/json",
  },
});

// Interceptor 1 — inject the current access token on every outgoing request
api.interceptors.request.use(
  (config) => {
    const token = localStorage.getItem("access_token");
    if (token && config.headers) {
      config.headers.Authorization = `Bearer ${token}`;
    }
    return config;
  },
  (error) => Promise.reject(error),
);

// Interceptor 2 — on 401, swap tokens and replay the original request
api.interceptors.response.use(
  (response) => response,
  async (error) => {
    const originalRequest = error.config;

    if (error.response?.status === 401 && !originalRequest._retry) {
      originalRequest._retry = true; // Prevent infinite retry loops

      try {
        const refreshToken = localStorage.getItem("refresh_token");

        // Use a raw axios call to bypass the request interceptor above
        const res = await axios.post(
          `${API_BASE_URL}/auth/refresh_token`,
          {},
          {
            headers: { Authorization: `Bearer ${refreshToken}` },
          },
        );

        const newAccessToken = res.data.access_token;
        localStorage.setItem("access_token", newAccessToken);

        // Replay the original failed request with the refreshed token
        originalRequest.headers.Authorization = `Bearer ${newAccessToken}`;
        return api(originalRequest);
      } catch (refreshError) {
        // Both tokens are expired — redirect to the sign-in page
        localStorage.removeItem("access_token");
        localStorage.removeItem("refresh_token");
        window.location.href = "/signin";
        return Promise.reject(refreshError);
      }
    }

    return Promise.reject(error);
  },
);

export default api;