@atlasauth/chrome-extension 0.1.0 → 0.2.0

package/README.md

@@ -88,3 +88,23 @@ Add the `storage` permission and the Atlas FAPI origin as a host permission:
   "host_permissions": ["https://fapi.your-instance.atlasauth.net/*"]
 }
 ```
+
+## Native session (first-party OAuth → session)
+
+A first-party extension holding an Atlas OAuth access token can trade it for a
+cookie-free session with `createNativeSessionManager`. It persists each rotated
+refresh token in `chrome.storage` under its own key, so a woken service worker
+rehydrates it and auto-refreshes the short-lived JWT:
+
+```ts
+import { createNativeSessionManager, exchangeForSession } from '@atlasauth/chrome-extension';
+
+const mgr = await createNativeSessionManager({
+  frontendApi: 'https://fapi.your-instance.atlasauth.net',
+  publishableKey: 'pk_...',
+});
+const session = await exchangeForSession({ baseUrl, clientId, accessToken });
+if (session) mgr.setSession(session);
+
+const headers = await mgr.authHeaders(); // { Authorization, 'x-publishable-key' }
+```

package/dist/background.d.ts

@@ -20,3 +20,4 @@
  */
 export * from './storage';
 export * from './client';
+export * from './native-session';

package/dist/background.js

@@ -36,4 +36,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 __exportStar(require("./storage"), exports);
 __exportStar(require("./client"), exports);
+__exportStar(require("./native-session"), exports);
 //# sourceMappingURL=background.js.map

package/dist/background.js.map

@@ -1 +1 @@
-{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,4CAA0B;AAC1B,2CAAyB"}
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,4CAA0B;AAC1B,2CAAyB;AACzB,mDAAiC"}

package/dist/index.d.ts

@@ -13,3 +13,4 @@
  */
 export * from './storage';
 export * from './client';
+export * from './native-session';

package/dist/index.js

@@ -29,4 +29,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 __exportStar(require("./storage"), exports);
 __exportStar(require("./client"), exports);
+__exportStar(require("./native-session"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,4CAA0B;AAC1B,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,4CAA0B;AAC1B,2CAAyB;AACzB,mDAAiC"}

package/dist/native-session.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Native session for a Chrome / MV3 extension.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStore} over `chrome.storage`.
+ * The core manager owns the exchange/refresh/rotation; this file persists each
+ * rotated session into `chrome.storage.local` (so the rotating refresh token
+ * survives the service worker being torn down AND is readable from every
+ * extension surface) and rehydrates the manager from it on each cold start.
+ *
+ * The whole session is stored as one JSON string under its OWN key, separate
+ * from {@link StorageCache}'s session-token slot, so the two coexist.
+ */
+import { NativeSessionManager } from '@atlasauth/js';
+import { type TokenStore } from './storage';
+/** The `chrome.storage` key the serialized native session is kept under. */
+export declare const DEFAULT_NATIVE_SESSION_KEY = "__atlas_native_session";
+export interface NativeSessionOptions {
+    /** The instance's FAPI origin, e.g. `https://fapi.acme.atlasauth.net`. */
+    frontendApi: string;
+    /** The publishable key — sent on the refresh call and in `authHeaders()`. */
+    publishableKey: string;
+    /** The first-party OAuth client id (for a later in-manager exchange). */
+    clientId?: string;
+    /**
+     * Where the session is persisted. Defaults to a {@link StorageCache} over
+     * `chrome.storage.local` under {@link DEFAULT_NATIVE_SESSION_KEY}. Inject a
+     * memory-backed store (see `createMemoryStorageArea`) in tests.
+     */
+    store?: TokenStore;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock, epoch ms. Defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Build a {@link NativeSessionManager} wired to `chrome.storage`.
+ *
+ * Async because `chrome.storage` is async: it reads whatever session the store
+ * holds and seeds the manager, so a freshly-woken service worker (or a reopened
+ * popup) is signed in before its first request. Thereafter every rotation is
+ * written straight back through the manager's `persist` hook, so the next
+ * surface — and the next cold start — picks up the rotated refresh token.
+ */
+export declare function createNativeSessionManager(options: NativeSessionOptions): Promise<NativeSessionManager>;
+/** Clear the persisted native session (sign-out). */
+export declare function clearNativeSession(store: TokenStore): Promise<void>;
+export { NativeSessionManager, type NativeSession } from '@atlasauth/js';
+export { exchangeForSession, refreshNativeSession } from '@atlasauth/js';

package/dist/native-session.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Native session for a Chrome / MV3 extension.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStore} over `chrome.storage`.
+ * The core manager owns the exchange/refresh/rotation; this file persists each
+ * rotated session into `chrome.storage.local` (so the rotating refresh token
+ * survives the service worker being torn down AND is readable from every
+ * extension surface) and rehydrates the manager from it on each cold start.
+ *
+ * The whole session is stored as one JSON string under its OWN key, separate
+ * from {@link StorageCache}'s session-token slot, so the two coexist.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = exports.DEFAULT_NATIVE_SESSION_KEY = void 0;
+exports.createNativeSessionManager = createNativeSessionManager;
+exports.clearNativeSession = clearNativeSession;
+const js_1 = require("@atlasauth/js");
+const storage_1 = require("./storage");
+/** The `chrome.storage` key the serialized native session is kept under. */
+exports.DEFAULT_NATIVE_SESSION_KEY = '__atlas_native_session';
+/**
+ * Build a {@link NativeSessionManager} wired to `chrome.storage`.
+ *
+ * Async because `chrome.storage` is async: it reads whatever session the store
+ * holds and seeds the manager, so a freshly-woken service worker (or a reopened
+ * popup) is signed in before its first request. Thereafter every rotation is
+ * written straight back through the manager's `persist` hook, so the next
+ * surface — and the next cold start — picks up the rotated refresh token.
+ */
+async function createNativeSessionManager(options) {
+    const store = options.store ?? new storage_1.StorageCache({ key: exports.DEFAULT_NATIVE_SESSION_KEY });
+    const initial = (0, js_1.parseNativeSession)(await store.getToken()) ?? undefined;
+    return new js_1.NativeSessionManager({
+        baseUrl: options.frontendApi,
+        publishableKey: options.publishableKey,
+        clientId: options.clientId,
+        initial,
+        fetchImpl: options.fetchImpl,
+        now: options.now,
+        // Fire-and-forget: `chrome.storage` writes are async and a failure must not
+        // break the live session held in memory.
+        persist: (session) => {
+            void store.setToken((0, js_1.serializeNativeSession)(session)).catch(() => undefined);
+        },
+    });
+}
+/** Clear the persisted native session (sign-out). */
+async function clearNativeSession(store) {
+    await store.removeToken();
+}
+var js_2 = require("@atlasauth/js");
+Object.defineProperty(exports, "NativeSessionManager", { enumerable: true, get: function () { return js_2.NativeSessionManager; } });
+var js_3 = require("@atlasauth/js");
+Object.defineProperty(exports, "exchangeForSession", { enumerable: true, get: function () { return js_3.exchangeForSession; } });
+Object.defineProperty(exports, "refreshNativeSession", { enumerable: true, get: function () { return js_3.refreshNativeSession; } });
+//# sourceMappingURL=native-session.js.map

package/dist/native-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../src/native-session.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAyCH,gEAmBC;AAGD,gDAEC;AA/DD,sCAKuB;AACvB,uCAA0D;AAE1D,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,wBAAwB,CAAC;AAqBnE;;;;;;;;GAQG;AACI,KAAK,UAAU,0BAA0B,CAC9C,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,sBAAY,CAAC,EAAE,GAAG,EAAE,kCAA0B,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC;IAExE,OAAO,IAAI,yBAAoB,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,WAAW;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,4EAA4E;QAC5E,yCAAyC;QACzC,OAAO,EAAE,CAAC,OAAsB,EAAE,EAAE;YAClC,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,kBAAkB,CAAC,KAAiB;IACxD,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,oCAAyE;AAAhE,0GAAA,oBAAoB,OAAA;AAC7B,oCAAyE;AAAhE,wGAAA,kBAAkB,OAAA;AAAE,0GAAA,oBAAoB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/chrome-extension",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -18,8 +18,8 @@
     }
   },
   "dependencies": {
-    "@atlasauth/js": "0.1.4",
-    "@atlasauth/react": "0.1.13"
+    "@atlasauth/js": "0.2.0",
+    "@atlasauth/react": "0.1.30"
   },
   "peerDependencies": {
     "react": ">=18"