@aooth/auth 0.1.6 → 0.1.8

package/dist/client.cjs

@@ -0,0 +1,59 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/client/index.ts
+/**
+* Wraps `fetch` with cookie-session silent refresh. Every call forwards
+* credentials; a response whose status is in `refreshOn` (401 by default)
+* triggers a **single-flight** refresh — N concurrent failing requests share
+* exactly one `POST {refreshPath}` — and, on success, the original request is
+* retried **once**. A failed refresh fires `onLogout()` once and returns the
+* original failing response (no retry, no refresh storm).
+*
+* Browser-safe: pairs with the bundled `@aooth/auth-moost` httpOnly-cookie
+* transport, so the SPA never touches token material. The retried request reuses
+* the original `init`; passing a one-shot body (a consumed `ReadableStream`) is
+* not retry-safe — prefer string / `FormData` / `Blob` bodies.
+*
+* @example
+* ```ts
+* import { createAuthedFetch } from '@aooth/auth/client'
+* const api = createAuthedFetch({ refreshPath: '/auth/refresh', onLogout: () => location.assign('/login') })
+* const res = await api('/api/me')   // 401 → silent refresh → retried once
+* ```
+*/
+function createAuthedFetch(options = {}) {
+	const refreshPath = options.refreshPath ?? "/auth/refresh";
+	const onLogout = options.onLogout;
+	const refreshOn = options.refreshOn ?? [401];
+	const baseFetch = options.fetch ?? globalThis.fetch;
+	if (typeof baseFetch !== "function") throw new Error("createAuthedFetch: no fetch implementation available — pass options.fetch");
+	let refreshInFlight = null;
+	const runRefresh = () => {
+		if (refreshInFlight) return refreshInFlight;
+		refreshInFlight = (async () => {
+			try {
+				if ((await baseFetch(refreshPath, {
+					method: "POST",
+					credentials: "include"
+				})).ok) return true;
+			} catch {}
+			onLogout?.();
+			return false;
+		})().finally(() => {
+			refreshInFlight = null;
+		});
+		return refreshInFlight;
+	};
+	const authedFetch = async (input, init) => {
+		const withCreds = {
+			credentials: "include",
+			...init
+		};
+		const res = await baseFetch(input, withCreds);
+		if (!refreshOn.includes(res.status)) return res;
+		if (!await runRefresh()) return res;
+		return baseFetch(input, withCreds);
+	};
+	return authedFetch;
+}
+//#endregion
+exports.createAuthedFetch = createAuthedFetch;

package/dist/client.d.cts

@@ -0,0 +1,64 @@
+//#region src/client/index.d.ts
+/** Minimal structural view of a fetch `Response` this helper reads. The DOM `Response` satisfies it. */
+interface MinimalResponse {
+  readonly ok: boolean;
+  readonly status: number;
+}
+/** Subset of `RequestInit` this helper sets or forwards. The DOM `RequestInit` satisfies it. */
+interface MinimalRequestInit {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: unknown;
+  credentials?: "omit" | "same-origin" | "include";
+  signal?: unknown;
+  [key: string]: unknown;
+}
+/** A `fetch`-compatible function. The global `fetch` satisfies this. */
+type FetchFn = (input: string | URL, init?: MinimalRequestInit) => Promise<MinimalResponse>;
+/**
+ * Resolves to the ambient `fetch` type when the consumer's tsconfig includes the
+ * DOM lib — so the returned wrapper yields a real `Response` with `.json()` etc.
+ * — and falls back to the structural {@link FetchFn} otherwise. This keeps
+ * `@aooth/auth/client` free of a hard DOM-lib dependency while preserving great
+ * DX in browser projects.
+ */
+type DefaultFetch = typeof globalThis extends {
+  fetch: infer F extends FetchFn;
+} ? F : FetchFn;
+interface CreateAuthedFetchOptions<TFetch extends FetchFn = DefaultFetch> {
+  /** Refresh endpoint path or URL. Default `'/auth/refresh'`. Match your `AuthController` mount. */
+  refreshPath?: string;
+  /**
+   * Called exactly once per failed refresh attempt (non-OK response or network
+   * error). Use it to redirect to login / clear app state. Never called on a
+   * successful refresh.
+   */
+  onLogout?: () => void;
+  /** Underlying fetch implementation. Default: the global `fetch`. */
+  fetch?: TFetch;
+  /** Response status codes that trigger a refresh + single retry. Default `[401]`. */
+  refreshOn?: number[];
+}
+/**
+ * Wraps `fetch` with cookie-session silent refresh. Every call forwards
+ * credentials; a response whose status is in `refreshOn` (401 by default)
+ * triggers a **single-flight** refresh — N concurrent failing requests share
+ * exactly one `POST {refreshPath}` — and, on success, the original request is
+ * retried **once**. A failed refresh fires `onLogout()` once and returns the
+ * original failing response (no retry, no refresh storm).
+ *
+ * Browser-safe: pairs with the bundled `@aooth/auth-moost` httpOnly-cookie
+ * transport, so the SPA never touches token material. The retried request reuses
+ * the original `init`; passing a one-shot body (a consumed `ReadableStream`) is
+ * not retry-safe — prefer string / `FormData` / `Blob` bodies.
+ *
+ * @example
+ * ```ts
+ * import { createAuthedFetch } from '@aooth/auth/client'
+ * const api = createAuthedFetch({ refreshPath: '/auth/refresh', onLogout: () => location.assign('/login') })
+ * const res = await api('/api/me')   // 401 → silent refresh → retried once
+ * ```
+ */
+declare function createAuthedFetch<TFetch extends FetchFn = DefaultFetch>(options?: CreateAuthedFetchOptions<TFetch>): TFetch;
+//#endregion
+export { CreateAuthedFetchOptions, DefaultFetch, FetchFn, MinimalRequestInit, MinimalResponse, createAuthedFetch };

package/dist/client.d.mts

@@ -0,0 +1,64 @@
+//#region src/client/index.d.ts
+/** Minimal structural view of a fetch `Response` this helper reads. The DOM `Response` satisfies it. */
+interface MinimalResponse {
+  readonly ok: boolean;
+  readonly status: number;
+}
+/** Subset of `RequestInit` this helper sets or forwards. The DOM `RequestInit` satisfies it. */
+interface MinimalRequestInit {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: unknown;
+  credentials?: "omit" | "same-origin" | "include";
+  signal?: unknown;
+  [key: string]: unknown;
+}
+/** A `fetch`-compatible function. The global `fetch` satisfies this. */
+type FetchFn = (input: string | URL, init?: MinimalRequestInit) => Promise<MinimalResponse>;
+/**
+ * Resolves to the ambient `fetch` type when the consumer's tsconfig includes the
+ * DOM lib — so the returned wrapper yields a real `Response` with `.json()` etc.
+ * — and falls back to the structural {@link FetchFn} otherwise. This keeps
+ * `@aooth/auth/client` free of a hard DOM-lib dependency while preserving great
+ * DX in browser projects.
+ */
+type DefaultFetch = typeof globalThis extends {
+  fetch: infer F extends FetchFn;
+} ? F : FetchFn;
+interface CreateAuthedFetchOptions<TFetch extends FetchFn = DefaultFetch> {
+  /** Refresh endpoint path or URL. Default `'/auth/refresh'`. Match your `AuthController` mount. */
+  refreshPath?: string;
+  /**
+   * Called exactly once per failed refresh attempt (non-OK response or network
+   * error). Use it to redirect to login / clear app state. Never called on a
+   * successful refresh.
+   */
+  onLogout?: () => void;
+  /** Underlying fetch implementation. Default: the global `fetch`. */
+  fetch?: TFetch;
+  /** Response status codes that trigger a refresh + single retry. Default `[401]`. */
+  refreshOn?: number[];
+}
+/**
+ * Wraps `fetch` with cookie-session silent refresh. Every call forwards
+ * credentials; a response whose status is in `refreshOn` (401 by default)
+ * triggers a **single-flight** refresh — N concurrent failing requests share
+ * exactly one `POST {refreshPath}` — and, on success, the original request is
+ * retried **once**. A failed refresh fires `onLogout()` once and returns the
+ * original failing response (no retry, no refresh storm).
+ *
+ * Browser-safe: pairs with the bundled `@aooth/auth-moost` httpOnly-cookie
+ * transport, so the SPA never touches token material. The retried request reuses
+ * the original `init`; passing a one-shot body (a consumed `ReadableStream`) is
+ * not retry-safe — prefer string / `FormData` / `Blob` bodies.
+ *
+ * @example
+ * ```ts
+ * import { createAuthedFetch } from '@aooth/auth/client'
+ * const api = createAuthedFetch({ refreshPath: '/auth/refresh', onLogout: () => location.assign('/login') })
+ * const res = await api('/api/me')   // 401 → silent refresh → retried once
+ * ```
+ */
+declare function createAuthedFetch<TFetch extends FetchFn = DefaultFetch>(options?: CreateAuthedFetchOptions<TFetch>): TFetch;
+//#endregion
+export { CreateAuthedFetchOptions, DefaultFetch, FetchFn, MinimalRequestInit, MinimalResponse, createAuthedFetch };

package/dist/client.mjs

@@ -0,0 +1,58 @@
+//#region src/client/index.ts
+/**
+* Wraps `fetch` with cookie-session silent refresh. Every call forwards
+* credentials; a response whose status is in `refreshOn` (401 by default)
+* triggers a **single-flight** refresh — N concurrent failing requests share
+* exactly one `POST {refreshPath}` — and, on success, the original request is
+* retried **once**. A failed refresh fires `onLogout()` once and returns the
+* original failing response (no retry, no refresh storm).
+*
+* Browser-safe: pairs with the bundled `@aooth/auth-moost` httpOnly-cookie
+* transport, so the SPA never touches token material. The retried request reuses
+* the original `init`; passing a one-shot body (a consumed `ReadableStream`) is
+* not retry-safe — prefer string / `FormData` / `Blob` bodies.
+*
+* @example
+* ```ts
+* import { createAuthedFetch } from '@aooth/auth/client'
+* const api = createAuthedFetch({ refreshPath: '/auth/refresh', onLogout: () => location.assign('/login') })
+* const res = await api('/api/me')   // 401 → silent refresh → retried once
+* ```
+*/
+function createAuthedFetch(options = {}) {
+	const refreshPath = options.refreshPath ?? "/auth/refresh";
+	const onLogout = options.onLogout;
+	const refreshOn = options.refreshOn ?? [401];
+	const baseFetch = options.fetch ?? globalThis.fetch;
+	if (typeof baseFetch !== "function") throw new Error("createAuthedFetch: no fetch implementation available — pass options.fetch");
+	let refreshInFlight = null;
+	const runRefresh = () => {
+		if (refreshInFlight) return refreshInFlight;
+		refreshInFlight = (async () => {
+			try {
+				if ((await baseFetch(refreshPath, {
+					method: "POST",
+					credentials: "include"
+				})).ok) return true;
+			} catch {}
+			onLogout?.();
+			return false;
+		})().finally(() => {
+			refreshInFlight = null;
+		});
+		return refreshInFlight;
+	};
+	const authedFetch = async (input, init) => {
+		const withCreds = {
+			credentials: "include",
+			...init
+		};
+		const res = await baseFetch(input, withCreds);
+		if (!refreshOn.includes(res.status)) return res;
+		if (!await runRefresh()) return res;
+		return baseFetch(input, withCreds);
+	};
+	return authedFetch;
+}
+//#endregion
+export { createAuthedFetch };

package/dist/clock-Bdsep_1j.mjs

@@ -0,0 +1,4 @@
+//#region src/utils/clock.ts
+const defaultClock = { now: () => Date.now() };
+//#endregion
+export { defaultClock as t };

package/dist/clock-BjXa0LXb.d.cts

@@ -0,0 +1,14 @@
+//#region src/utils/clock.d.ts
+/**
+ * Minimal time abstraction shared across stores and orchestrators.
+ *
+ * Defaults to wall-clock; tests inject a fake clock to deterministically
+ * advance time. Kept tiny (single `now()` method) so any timing primitive
+ * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
+ */
+interface Clock {
+  now(): number;
+}
+declare const defaultClock: Clock;
+//#endregion
+export { defaultClock as n, Clock as t };

package/dist/clock-BjXa0LXb.d.mts

@@ -0,0 +1,14 @@
+//#region src/utils/clock.d.ts
+/**
+ * Minimal time abstraction shared across stores and orchestrators.
+ *
+ * Defaults to wall-clock; tests inject a fake clock to deterministically
+ * advance time. Kept tiny (single `now()` method) so any timing primitive
+ * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
+ */
+interface Clock {
+  now(): number;
+}
+declare const defaultClock: Clock;
+//#endregion
+export { defaultClock as n, Clock as t };

package/dist/clock-Bl-H3eqE.cjs

@@ -0,0 +1,9 @@
+//#region src/utils/clock.ts
+const defaultClock = { now: () => Date.now() };
+//#endregion
+Object.defineProperty(exports, "defaultClock", {
+	enumerable: true,
+	get: function() {
+		return defaultClock;
+	}
+});