feat: update getCurrentUser method to require token and refactor session handling

Author: ClementBobin

.idea/deploymentTargetSelector.xml

@@ -18,6 +18,11 @@ data class RegisterRequestDto(
 @Serializable
 data class LoginResponseDto(val token: String, val expiresTime: Long)
 
+/** Returned by POST /api/auth/generate-biometric-token */
+@Serializable
+data class bioTokenGenerateResponseDto(val token: String)
+
+
 @Serializable
 data class UserDto(
     val id: String,

app/src/main/java/com/mirage/bob1/data/dto/AuthDto.kt

@@ -69,28 +69,32 @@ class SessionManager(
                     runCatching {
                         fetchRemoteUser()?.onSuccess { freshUser ->
                             // Keep the existing expiresTime when updating the session profile
-                            saveSession(freshUser, token, expiresTime)
+                            saveToken(token, expiresTime)
+                            saveSession(freshUser)
                         }
                     }
                 }
             }
         }.onFailure { clearSession() }
     }
 
-    fun saveToken(token: String) {
-        _token.value = token
-    }
-
-    fun saveSession(user: User, token: String, expiresTime: Long) {
+    fun saveToken(token: String, expiresTime: Long) {
         runCatching {
             val encrypted = keystore.encrypt(sessionConfig, token)
             prefs.edit()
                 .putString("token_ct", encrypted.ciphertext)
                 .putString("token_iv", encrypted.iv)
                 .putLong("token_expires_at", expiresTime)
-                .putString("user_json", Json.encodeToString(UserDto.fromDomain(user)))
                 .apply()
             _token.value = token
+        }
+    }
+
+    fun saveSession(user: User) {
+        runCatching {
+            prefs.edit()
+                .putString("user_json", Json.encodeToString(UserDto.fromDomain(user)))
+                .apply()
             _user.value  = user
         }
     }

app/src/main/java/com/mirage/bob1/data/local/SessionManager.kt

@@ -25,15 +25,17 @@ internal class AuthAPI(private val client: HttpClient) {
     suspend fun logout(): HttpResponse =
         client.post("/api/auth/logout")
 
-    suspend fun getCurrentUser(): UserDto =
-        client.get("/api/auth/me").body()
+    suspend fun getCurrentUser(token: String): UserDto =
+        client.get("/api/auth/me") {
+            header("Authorization", "Bearer $token")
+        }.body()
 
     /**
      * Requests a long-lived biometric token from the server (requires a valid
      * session JWT). The returned token is stored encrypted on-device and later
      * replayed at [biometricLogin] — credentials never touch the client again.
      */
-    suspend fun generateBiometricToken(): LoginResponseDto =
+    suspend fun generateBiometricToken(): bioTokenGenerateResponseDto =
         client.get("/api/auth/generate-biometric-token").body()
 
     /**

app/src/main/java/com/mirage/bob1/data/remote/AuthAPI.kt

@@ -14,17 +14,19 @@ internal class AuthRepositoryImpl(
 
     override suspend fun login(email: String, password: String): Result<User> = runCatching {
         val response = authAPI.login(LoginRequestDto(email, password))
-        val user = authAPI.getCurrentUser().toDomain()
-        session.saveSession(user, response.token, response.expiresTime)
+        session.saveToken(response.token, response.expiresTime)
+        val user = authAPI.getCurrentUser(response.token).toDomain()
+        session.saveSession(user)
         user
     }
 
     override suspend fun loginWithBiometric(): Result<User> = runCatching {
         val bioToken = session.getBiometricToken()
             ?: error("Aucun token biométrique enregistré.")
         val response = authAPI.biometricLogin(bioToken)
-        val user = authAPI.getCurrentUser().toDomain()
-        session.saveSession(user, response.token, response.expiresTime)
+        session.saveToken(response.token, response.expiresTime)
+        val user = authAPI.getCurrentUser(response.token).toDomain()
+        session.saveSession(user)
         user
     }
 
@@ -54,21 +56,19 @@ internal class AuthRepositoryImpl(
         )
         // Auto-login after registering
         val response = authAPI.login(LoginRequestDto(email, password))
-        val user = authAPI.getCurrentUser().toDomain()
-        session.saveSession(user, response.token, response.expiresTime)
+        session.saveToken(response.token, response.expiresTime)
+        val user = authAPI.getCurrentUser(response.token).toDomain()
+        session.saveSession(user)
         user
     }
 
     override suspend fun logout(): Result<Unit> = runCatching {
-        if (session.hasBiometricToken()) {
-            runCatching { authAPI.removeBiometricToken() }
-            session.clearBiometricToken()
-        }
         authAPI.logout()
         session.clearSession()
     }
 
     override suspend fun getCurrentUser(): Result<User> = runCatching {
-        authAPI.getCurrentUser().toDomain()
+        val token = session.currentToken() ?: error("Aucun token de session disponible.")
+        authAPI.getCurrentUser(token).toDomain()
     }
 }