@indusaction/cms-auth

@indusaction/cms-auth

Shared OTP + cookie JWT authentication for IndusAction CMS web (campaign-fe) and mobile (case-fe).

Works with campaign-be: HttpOnly {appSource}_cms_token cookies, withCredentials, 401 → refresh.

Install

npm install @indusaction/cms-auth axios js-cookie antd react react-dom react-router-dom

# Optional — wrap the app with ThemeProvider from the UI package for brand colors
npm install @indusaction/cms-design-system

Quick start

import {
  createAuthClient,
  AuthProvider,
  IdentifierForm,
  OtpForm,
  ProtectedRoute,
  GuestRoute,
  MOBILE_SEND_OTP_PATH,
} from "@indusaction/cms-auth";
import { ThemeProvider } from "@indusaction/cms-design-system";

// campaign-fe (web)
const authClient = createAuthClient({
  baseURL: import.meta.env.VITE_IA_CMS_BASEURL,
  appSource: import.meta.env.VITE_APP_SOURCE, // e.g. campaign-local
  profilePrefix: "campaign",
});

// case-fe (mobile) — only send-otp path differs
const caseAuthClient = createAuthClient({
  baseURL: import.meta.env.VITE_API_BASE_URL,
  appSource: import.meta.env.VITE_APP_SOURCE, // e.g. case-local
  profilePrefix: "case",
  paths: {
    sendOtp: MOBILE_SEND_OTP_PATH,
    login: "auth/login/",
    refresh: "auth/token/refresh/",
    logout: "auth/logout/",
  },
  loginPath: "/auth/login",
});

function App() {
  return (
    <ThemeProvider>
      <AuthProvider
        client={authClient}
        onLoginSuccess={() => {
          window.location.assign("/");
        }}
      >
        {/* routes */}
      </AuthProvider>
    </ThemeProvider>
  );
}

Use authClient.api for authenticated API calls (same Axios instance with refresh interceptor).

Package surface

App-specific flows (permissions routes, Glific, public Bearer session, offline sync) stay in each app.