Auth sluoksnis — PicaApi, TokenStorage, AuthRepository

Keturi failai kodo stulpelyje kaip skirtukai, tokia tvarka, kokia priklauso vienas nuo kito: PicaApi.kt → TokenStorage.kt → SecureTokenStorage.kt → AuthRepository.kt.

1. PicaApi.kt (modify) — 5 pamokos interfeisas paauga: gauna register ir login endpoint'us plius AuthRequest/AuthResponse kūnus. Diff parodo tik naujas eilutes; menu endpoint'as lieka lygiai toks pat.

@POST("login")
suspend fun login(@Body request: AuthRequest): AuthResponse

@Serializable data class AuthResponse(val token: String)   // ← kontraktas: serveris grąžina žetoną

2. TokenStorage.kt (create) — saugyklos kontraktas (kaip saugom žetoną, atsiejam nuo kur). AuthRepository priklauso nuo šios sąsajos, ne nuo šifruotos klasės.

3. SecureTokenStorage.kt (create) — šifruota realizacija (DataStore + Google Tink AEAD). Esmė — ne pati Tink, o kad žetonas diske yra šifruotas, ir kad hasValidToken() tikrina galiojimą pagal JWT exp lauką. Pilnas failas — skirtuke; kriptografija yra šablonas, kurį gali perpanaudoti.

4. AuthRepository.kt (create) — trumpa, nes visą darbą atlieka kontraktas: login()/register() iškviečia serverį ir išsaugo grąžintą žetoną. isLoggedIn() tik pažiūri, ar saugykloje yra galiojantis žetonas.

Patarimas. AuthResponse(val token: String) — tai visas „prisijungimo" rezultatas. Jokių slaptažodžių, jokio vartotojo objekto: vienas žetonas. Kuo mažiau laikai telefone, tuo mažiau turi ką prarasti.

PicaApi.kt MODIFIKUOTI 18 eilučių pakeista

Redaguok šį failą kataloge app/src/main/java/eif/viko/lt/pica/core/data/network/

package eif.viko.lt.pica.core.data.network

import eif.viko.lt.pica.feature.menu.data.MenuItemDto
import kotlinx.serialization.Serializable
import retrofit2.http.Body
import retrofit2.http.GET
import retrofit2.http.POST

// Retrofit turns this interface into a working HTTP client. Each function is
// one endpoint; `suspend` means it runs on a coroutine (off the main thread).
interface PicaApi {

    @GET("menu")
    suspend fun getMenu(): List<MenuItemDto>

    @POST("register")
    suspend fun register(@Body request: AuthRequest): AuthResponse

    @POST("login")
    suspend fun login(@Body request: AuthRequest): AuthResponse

    // orders / create-payment-intent / auth/google are added in their own
    // lessons — one interface, growing as the app needs more endpoints.
}

// Request/response bodies — match the Go backend's JSON exactly.
@Serializable
data class AuthRequest(val email: String, val password: String)

@Serializable
data class AuthResponse(val token: String)   // ← the contract: server returns a token

TokenStorage.kt SUKURTI

Sukurk šį failą kataloge app/src/main/java/eif/viko/lt/pica/core/data/auth/

package eif.viko.lt.pica.core.data.auth

// The storage CONTRACT — how we store a token, decoupled from WHERE.
// The repository depends on this interface, not on the encrypted implementation.
interface TokenStorage {
    suspend fun saveToken(token: String)
    suspend fun getToken(): String?
    suspend fun clearToken()
    suspend fun hasValidToken(): Boolean
}

SecureTokenStorage.kt SUKURTI

Sukurk šį failą kataloge app/src/main/java/eif/viko/lt/pica/core/data/auth/

package eif.viko.lt.pica.core.data.auth

import android.app.Application
import android.content.Context
import android.util.Base64
import androidx.datastore.preferences.core.edit
import androidx.datastore.preferences.core.stringPreferencesKey
import androidx.datastore.preferences.preferencesDataStore
import com.google.crypto.tink.Aead
import com.google.crypto.tink.KeysetHandle
import com.google.crypto.tink.RegistryConfiguration
import com.google.crypto.tink.aead.AeadConfig
import com.google.crypto.tink.aead.AesGcmKeyManager
import com.google.crypto.tink.integration.android.AndroidKeysetManager
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.flow.first
import kotlinx.coroutines.flow.map
import kotlinx.coroutines.withContext
import org.json.JSONObject

// The encrypted implementation: DataStore for persistence, Google Tink (AEAD)
// to encrypt the token before it ever touches disk, decrypt it on read.
class SecureTokenStorage(
    private val context: Application
) : TokenStorage {

    private val Context.dataStore by preferencesDataStore(name = DATASTORE_NAME)

    // Configure Tink AEAD (lazily, on first use)
    private val aead: Aead by lazy {
        AeadConfig.register()
        val keysetHandle: KeysetHandle = AndroidKeysetManager.Builder()
            .withSharedPref(context, MASTER_KEYSET, MASTER_PREFS)
            .withKeyTemplate(AesGcmKeyManager.aes256GcmTemplate())
            .withMasterKeyUri(MASTER_KEY_URI)
            .build()
            .keysetHandle
        keysetHandle.getPrimitive(RegistryConfiguration.get(), Aead::class.java)
    }

    private fun encrypt(plainText: String): String {
        val encrypted = aead.encrypt(plainText.toByteArray(), null)
        return Base64.encodeToString(encrypted, Base64.NO_WRAP)
    }

    private fun decrypt(cipherText: String): String {
        val decrypted = aead.decrypt(Base64.decode(cipherText, Base64.NO_WRAP), null)
        return String(decrypted)
    }

    override suspend fun saveToken(token: String): Unit = withContext(Dispatchers.IO) {
        val encrypted = encrypt(token)
        context.dataStore.edit { prefs -> prefs[TOKEN_KEY] = encrypted }
    }

    override suspend fun getToken(): String? = withContext(Dispatchers.IO) {
        context.dataStore.data.map { prefs ->
            prefs[TOKEN_KEY]?.let { decrypt(it) }
        }.first()
    }

    override suspend fun clearToken(): Unit = withContext(Dispatchers.IO) {
        context.dataStore.edit { prefs -> prefs.remove(TOKEN_KEY) }
    }

    override suspend fun hasValidToken(): Boolean {
        val token = getToken()
        return token != null && !isTokenExpired(token)   // reads the JWT `exp` field
    }

    private fun isTokenExpired(token: String): Boolean {
        return try {
            val parts = token.split(".")
            if (parts.size != 3) return true
            val payloadJson = String(Base64.decode(parts[1], Base64.URL_SAFE))
            val exp = JSONObject(payloadJson).optLong("exp", 0)
            val now = System.currentTimeMillis() / 1000
            exp < now
        } catch (e: Exception) {
            true // invalid = expired
        }
    }

    private companion object {
        private const val DATASTORE_NAME = "auth_prefs"
        private val TOKEN_KEY = stringPreferencesKey("auth_token")
        private const val MASTER_KEYSET = "master_keyset"
        private const val MASTER_PREFS = "master_prefs"
        private const val MASTER_KEY_URI = "android-keystore://master_key"
    }
}

AuthRepository.kt SUKURTI

Sukurk šį failą kataloge app/src/main/java/eif/viko/lt/pica/feature/auth/data/

package eif.viko.lt.pica.feature.auth.data

import eif.viko.lt.pica.core.data.auth.TokenStorage
import eif.viko.lt.pica.core.data.network.AuthRequest
import eif.viko.lt.pica.core.data.network.PicaApi

// The whole email/password flow in one small class. login()/register() both hit
// the Go server and get back ONE thing: a session token (a JWT). We save it —
// that saved token IS "being logged in". No passwords are kept on the device.
class AuthRepository(
    private val api: PicaApi,
    private val tokenStorage: TokenStorage
) {
    suspend fun login(email: String, password: String) {
        val response = api.login(AuthRequest(email, password))
        tokenStorage.saveToken(response.token)   // ← store the JWT
    }

    suspend fun register(email: String, password: String) {
        val response = api.register(AuthRequest(email, password))
        tokenStorage.saveToken(response.token)   // register also returns a token
    }

    suspend fun isLoggedIn(): Boolean = tokenStorage.hasValidToken()

    suspend fun logout() = tokenStorage.clearToken()
}