@ai-matrx/auth 0.2.0 → 0.2.2

package/dist/guest.js

@@ -0,0 +1,192 @@
+// src/guest.ts
+import { createServerClient } from "@supabase/ssr";
+var VISITOR_ID = /^[A-Za-z0-9]{16,200}$/;
+function looksLikeVisitorId(id) {
+  return typeof id === "string" && !id.startsWith("temp_") && VISITOR_ID.test(id);
+}
+function isGuestCookieName(guestCookieName, name) {
+  return name === guestCookieName || name.startsWith(`${guestCookieName}.`);
+}
+var DEFAULT_GUEST_CARRIER_COOKIE = "matrx_guest_visitor";
+function createGuestHandover(options) {
+  const carrier = options.carrierCookieName ?? DEFAULT_GUEST_CARRIER_COOKIE;
+  const loud = options.log ?? ((m) => console.error(`[session-handover] LOUD: ${m}`));
+  const isGuestCookie = (name) => isGuestCookieName(options.guestCookieName, name);
+  const msg = (err) => err instanceof Error ? err.message : String(err);
+  async function readClaims(jar) {
+    if (options.readGuestClaims) return options.readGuestClaims(jar);
+    if (!options.supabase) return null;
+    const guest = createServerClient(options.supabase.url, options.supabase.publishableKey, {
+      cookieOptions: { name: options.guestCookieName },
+      cookies: { getAll: () => jar.getAll(), setAll: () => void 0 }
+    });
+    const { data } = await guest.auth.getClaims();
+    return data?.claims ?? null;
+  }
+  async function readGuestPossession(visitorId) {
+    const jar = await options.cookies();
+    if (jar.getAll().some((c) => isGuestCookie(c.name))) {
+      try {
+        const claims = await readClaims(jar);
+        if (claims?.sub && claims.is_anonymous === true) return { guestId: claims.sub, proof: "guest_session" };
+      } catch (err) {
+        loud(`the guest cookie could not be verified: ${msg(err)}`);
+      }
+    }
+    const candidates = [visitorId, options.visitorCookieName ? jar.get(options.visitorCookieName)?.value : void 0].filter(looksLikeVisitorId);
+    if (!candidates.length) return null;
+    const { data: ids, error } = await options.store.findGuestIdsByVisitor(candidates);
+    if (error) {
+      loud(`the visitor's guest could not be looked up: ${error.message}`);
+      return null;
+    }
+    for (const id of ids ?? []) {
+      if (await options.store.isAnonymousUser(id)) return { guestId: id, proof: "visitor_id" };
+    }
+    return null;
+  }
+  async function dropGuestCookies() {
+    try {
+      const jar = await options.cookies();
+      for (const c of jar.getAll()) if (isGuestCookie(c.name)) jar.delete(c.name);
+    } catch {
+    }
+  }
+  async function claimGuestInto(guest, accountId, via) {
+    if (guest.guestId === accountId) return { status: "same_account" };
+    const { data, error } = await options.store.claimWorkspace({ guestId: guest.guestId, targetId: accountId, via });
+    if (error) {
+      loud(`the guest's records were NOT brought into ${accountId} (${via}); the guest cookie is kept so the next sign-in retries: ${error.message}`);
+      return { status: "failed", guestId: guest.guestId, message: error.message };
+    }
+    await dropGuestCookies();
+    const records = typeof data?.records === "number" ? data.records : 0;
+    return { status: "claimed", guestId: guest.guestId, records };
+  }
+  return {
+    looksLikeVisitorId,
+    readGuestPossession,
+    claimGuestInto,
+    async handOverSession(via, replace, opts = {}) {
+      const guest = await readGuestPossession(opts.visitorId);
+      const result = await replace();
+      const user = result.error ? null : result.data?.user ?? null;
+      let guestClaim = { status: "none" };
+      if (guest && user && user.is_anonymous !== true) guestClaim = await claimGuestInto(guest, user.id, via);
+      return { ...result, guestClaim };
+    },
+    async settlePendingGuestClaim(accountId) {
+      const jar = await options.cookies();
+      if (!jar.getAll().some((c) => isGuestCookie(c.name))) return { status: "none" };
+      const guest = await readGuestPossession(null);
+      if (!guest || guest.proof !== "guest_session") return { status: "none" };
+      return claimGuestInto(guest, accountId, "password_login");
+    },
+    async promoteGuest(args) {
+      const guest = await readGuestPossession(args.visitorId);
+      if (!guest) return { kind: "no_guest" };
+      const revive = async () => {
+        const { error } = await options.store.revive(guest.guestId);
+        if (error) throw new Error(`the guest could not be reopened: ${error.message}`);
+      };
+      try {
+        await revive();
+        const { error } = await options.store.promoteUser(guest.guestId, { email: args.email, password: args.password });
+        if (error) {
+          const m = error.message.toLowerCase();
+          if (error.code === "email_exists" || m.includes("already been registered") || m.includes("already registered") || m.includes("already exists")) {
+            return { kind: "email_in_use" };
+          }
+          loud(`guest promotion failed \u2014 the guest is kept, no new account is made: ${error.message}`);
+          return { kind: "failed", message: error.message };
+        }
+        await revive();
+        const { error: stampErr } = await options.store.stampConverted(guest.guestId);
+        if (stampErr) loud(`promotion succeeded but the registry row was not stamped: ${stampErr.message}`);
+        return { kind: "promoted", userId: guest.guestId };
+      } catch (err) {
+        loud(`guest promotion failed \u2014 the guest is kept: ${msg(err)}`);
+        return { kind: "failed", message: msg(err) };
+      }
+    },
+    finishPromotion: dropGuestCookies,
+    async rememberGuestVisitorId(formData) {
+      try {
+        const id = formData?.get("guestFingerprint")?.toString();
+        if (!looksLikeVisitorId(id)) return;
+        (await options.cookies()).set(carrier, id, {
+          httpOnly: true,
+          sameSite: "lax",
+          secure: options.secureCookies ?? false,
+          path: "/",
+          maxAge: 600
+        });
+      } catch (err) {
+        loud(`the visitor id could not be kept for the OAuth round trip: ${msg(err)}`);
+      }
+    },
+    async takeGuestVisitorId() {
+      const jar = await options.cookies();
+      const id = jar.get(carrier)?.value ?? null;
+      if (id) {
+        try {
+          jar.delete(carrier);
+        } catch {
+        }
+      }
+      return looksLikeVisitorId(id) ? id : null;
+    }
+  };
+}
+function guestClientCookieOptions(cookieName, secure = typeof window !== "undefined" && window.location.protocol === "https:") {
+  return { name: cookieName, path: "/", sameSite: "lax", secure, maxAge: 60 * 60 * 24 * 400 };
+}
+function createGuestSessionEnsurer(options) {
+  const doFetch = options.fetch ?? fetch;
+  let inFlight = null;
+  async function existing() {
+    const { data } = await options.auth.getSession();
+    const user = data.session?.user;
+    if (!user?.is_anonymous) return null;
+    const orgs = [...new Set((await options.listWorkspaceIds(user.id)).filter((o) => typeof o === "string"))];
+    return orgs.length === 1 ? { organizationId: orgs[0], adoptedFrom: null } : null;
+  }
+  async function mint() {
+    const have = await existing();
+    if (have) return have;
+    const base = options.serverBaseUrl;
+    if (!base) throw new Error("The AI Matrx server address is not configured, so a guest session cannot be made.");
+    const fingerprint = await options.getFingerprint();
+    const res = await doFetch(`${base.replace(/\/$/, "")}/auth/guest/session`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ fingerprint })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => null);
+      throw new Error(body?.detail?.message ?? `A guest session could not be made (HTTP ${res.status}).`);
+    }
+    const s = await res.json();
+    const { error } = await options.auth.setSession({ access_token: s.access_token, refresh_token: s.refresh_token });
+    if (error) throw new Error(`The guest session could not be kept: ${error.message}`);
+    if (!s.organization_id) throw new Error("The guest session has no workspace to save in.");
+    return { organizationId: s.organization_id, adoptedFrom: s.adopted_from };
+  }
+  return () => {
+    inFlight ??= (async () => {
+      const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+      return locks ? locks.request(options.lockName ?? "matrx-guest-session", () => mint()) : mint();
+    })().finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  };
+}
+export {
+  DEFAULT_GUEST_CARRIER_COOKIE,
+  createGuestHandover,
+  createGuestSessionEnsurer,
+  guestClientCookieOptions,
+  isGuestCookieName,
+  looksLikeVisitorId
+};