@aurabase/core 0.4.0 → 0.5.0

package/README.md

@@ -113,7 +113,7 @@ class WidgetsService extends BaseService {
   }
 
   private get prefix(): string {
-    return `/v1/widgets/${this.client.projectId}`
+    return '/v1/widgets'
   }
 
   async list(): Promise<AuraResponse<Widget[]>> {
@@ -132,16 +132,21 @@ class WidgetsService extends BaseService {
 
 `BaseAuthStore` est en mémoire (event-emitter `onChange`, stockage clé/valeur générique pour le PKCE `code_verifier`). `LocalAuthStore` l'étend avec persistance `localStorage` et des helpers cookie pour le rendu serveur.
 
+Son argument `key` est **obligatoire** et doit être SCOPÉ par projet : deux clients pointant sur deux projets dans la même page partagent un seul `localStorage` (celui de la page), et une clé constante les ferait s'écraser. Le nom canonique est `aura-${clientScope(baseUrl)}-auth` — celui que posent déjà `AuraClient` et `createServerClient`.
+
 ```ts
-import { LocalAuthStore } from '@aurabase/core'
+import { LocalAuthStore, clientScope } from '@aurabase/core'
+
+const PROJET = 'https://mon-projet.aurabase.cloud'
+const CLE = `aura-${clientScope(PROJET)}-auth`
 
 function hydrateFromCookieHeader(cookieHeader: string) {
-  const store = new LocalAuthStore('aurabase_auth')
+  const store = new LocalAuthStore(CLE)
   store.loadFromCookie(cookieHeader) // hydrate depuis l'en-tête Cookie de la requête entrante
   return store
 }
 
-const store = hydrateFromCookieHeader('aurabase_auth=%7B%22token%22%3Anull%7D')
+const store = hydrateFromCookieHeader(`${CLE}=%7B%22token%22%3Anull%7D`)
 
 // Après une mutation de session, sérialiser l'état courant en Set-Cookie.
 const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'Lax', httpOnly: true })
@@ -163,7 +168,7 @@ Cette couche (`fetchWithAuth`, `refreshOnce`) est exportée mais reste un détai
 
 - Package d'infrastructure : pas d'API « produit ». Pour construire une application, utilisez le méta-package [`aurabase`](../aurabase), qui assemble tous les services derrière un seul client.
 - `BaseAuthStore` est en mémoire — l'état est perdu au reload ; `LocalAuthStore` nécessite un `localStorage` disponible (sinon retombe silencieusement sur le comportement en mémoire, sauf via les helpers cookie explicites).
-- `AuraClientLike` est un contrat minimal (`baseUrl`, `projectId`, `apiKey`, `fetchFn`, `authStore`, `auth.refreshSession`, `retryConfig?`, `requestTimeoutMs?`) : un client maison doit l'implémenter intégralement pour rester compatible avec `BaseService`.
+- `AuraClientLike` est un contrat minimal (`baseUrl`, `apiKey`, `fetchFn`, `authStore`, `auth.refreshSession`, `retryConfig?`, `requestTimeoutMs?`) : un client maison doit l'implémenter intégralement pour rester compatible avec `BaseService`.
 - La couche fetch bas niveau (`fetchWithAuth`/`refreshOnce`) est un détail d'implémentation interne, pas une API publique stabilisée.
 
 ## Documentation

package/dist/index.cjs

@@ -33,6 +33,70 @@ function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
 
+// src/retry.ts
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
+var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var DEFAULT_MAX_RETRIES = 3;
+var BASE_MS = 500;
+var CAP_MS = 1e4;
+function isRetryableStatus(status) {
+  return RETRYABLE_STATUS.has(status);
+}
+function isRetryableMethod(method) {
+  return RETRYABLE_METHODS.has(method.toUpperCase());
+}
+function computeBackoff(attempt, rand = Math.random) {
+  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
+  return Math.floor(rand() * bound);
+}
+function parseRetryAfter(header, now = Date.now()) {
+  if (header === null) return null;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
+  const dateMs = Date.parse(trimmed);
+  if (Number.isNaN(dateMs)) return null;
+  return Math.max(0, dateMs - now);
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isAbortError(err) {
+  return typeof err === "object" && err !== null && err.name === "AbortError";
+}
+
+// src/scope.ts
+function clientScope(baseUrl) {
+  let host;
+  try {
+    host = new URL(baseUrl).host;
+  } catch {
+    host = baseUrl;
+  }
+  return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "default";
+}
+
+// src/serialize.ts
+function serializeBody(body) {
+  return JSON.stringify(
+    body,
+    (_key, value) => typeof value === "bigint" ? value.toString() : value
+  );
+}
+
 // src/types.ts
 function redactUrl(u) {
   const cut = u.search(/[?#]/);
@@ -52,6 +116,60 @@ function emitAuraEvent(onEvent, debug, event) {
   } catch {
   }
 }
+var AUTH_SETTINGS_WRITABLE_FIELDS = [
+  "allow_signup",
+  "email_confirmation_required",
+  "password_min_length",
+  "mfa_enabled",
+  "allow_anonymous_users",
+  "jwt_expiry_seconds",
+  "refresh_token_expiry_days",
+  "site_url",
+  "oauth_providers",
+  "new_device_alerts_enabled",
+  "webhook_url",
+  "webhook_secret",
+  "smtp_host",
+  "smtp_port",
+  "smtp_username",
+  "smtp_password",
+  "smtp_from_email",
+  "smtp_from_name",
+  "smtp_clear",
+  "oauth_credentials",
+  "oauth_credentials_clear",
+  "captcha_enabled",
+  "captcha_provider",
+  "captcha_site_key",
+  "captcha_secret_key",
+  "password_check_hibp",
+  "sms_provider",
+  "sms_api_key",
+  "sms_api_secret",
+  "sms_from_number",
+  "sms_clear",
+  "redirect_urls",
+  "session_inactivity_timeout_seconds",
+  "hook_send_sms_url",
+  "hook_send_email_url",
+  "hook_mfa_verification_url",
+  "hook_password_verification_url",
+  "auto_link_by_email",
+  "rate_limit_login_per_hour",
+  "rate_limit_emails_per_hour",
+  "rate_limit_signup_per_hour",
+  "revoke_on_new_device",
+  "enforce_ip_binding",
+  "allowed_email_domains",
+  "blocked_email_domains",
+  "password_require_uppercase",
+  "password_require_number",
+  "password_require_special",
+  "hook_before_signup_url",
+  "hook_after_signup_url",
+  "hook_custom_access_token_url",
+  "hook_secret"
+];
 
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
@@ -172,59 +290,6 @@ var BaseAuthStore = class {
   }
 };
 
-// src/retry.ts
-var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
-var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-var DEFAULT_MAX_RETRIES = 3;
-var BASE_MS = 500;
-var CAP_MS = 1e4;
-function isRetryableStatus(status) {
-  return RETRYABLE_STATUS.has(status);
-}
-function isRetryableMethod(method) {
-  return RETRYABLE_METHODS.has(method.toUpperCase());
-}
-function computeBackoff(attempt, rand = Math.random) {
-  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
-  return Math.floor(rand() * bound);
-}
-function parseRetryAfter(header, now = Date.now()) {
-  if (header === null) return null;
-  const trimmed = header.trim();
-  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
-  const dateMs = Date.parse(trimmed);
-  if (Number.isNaN(dateMs)) return null;
-  return Math.max(0, dateMs - now);
-}
-function abortableSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) {
-      resolve();
-      return;
-    }
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function isAbortError(err) {
-  return typeof err === "object" && err !== null && err.name === "AbortError";
-}
-
-// src/serialize.ts
-function serializeBody(body) {
-  return JSON.stringify(
-    body,
-    (_key, value) => typeof value === "bigint" ? value.toString() : value
-  );
-}
-
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
@@ -235,6 +300,56 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+async function readTextBounded(res, timeoutMs) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
+    try {
+      return { ok: true, text: await res.text() };
+    } catch (err) {
+      return {
+        ok: false,
+        timedOut: false,
+        message: err instanceof Error ? err.message : "read failed"
+      };
+    }
+  }
+  let timer;
+  const TIMED_OUT = /* @__PURE__ */ Symbol("body-timeout");
+  try {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      timer.unref?.();
+    });
+    for (; ; ) {
+      const step = await Promise.race([reader.read(), deadline]);
+      if (step === TIMED_OUT) {
+        await reader.cancel().catch(() => {
+        });
+        return {
+          ok: false,
+          timedOut: true,
+          message: `Response body not fully received within ${timeoutMs}ms`
+        };
+      }
+      if (step.done) {
+        out += decoder.decode();
+        return { ok: true, text: out };
+      }
+      if (step.value) out += decoder.decode(step.value, { stream: true });
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      timedOut: false,
+      message: err instanceof Error ? err.message : "read failed"
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var inflightRefreshes = /* @__PURE__ */ new WeakMap();
 async function doRefresh(client) {
   const store = client.authStore;
@@ -242,32 +357,68 @@ async function doRefresh(client) {
   if (!rt) {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "no_session", message: "No refresh token available" } })
+      error: new AuraError(0, {
+        error: { code: "no_session", message: "No refresh token available" }
+      })
     };
   }
   const epoch = store.removalEpoch;
   const headers = { "Content-Type": "application/json" };
   if (client.apiKey) headers["apikey"] = client.apiKey;
+  const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  let refreshTimer;
+  let refreshSignal;
+  if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+    const ctrl = new AbortController();
+    refreshTimer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    refreshTimer.unref?.();
+    refreshSignal = ctrl.signal;
+  }
+  const clearRefreshTimer = () => {
+    if (refreshTimer) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+  };
   let res;
   try {
-    res = await client.fetchFn(`${client.baseUrl}/v1/auth/${client.projectId}/refresh`, {
+    res = await client.fetchFn(`${client.baseUrl}/v1/auth/refresh`, {
       method: "POST",
       headers,
-      body: serializeBody({ refresh_token: rt })
+      body: serializeBody({ refresh_token: rt }),
+      signal: refreshSignal
     });
   } catch (err) {
+    clearRefreshTimer();
+    if (timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/refresh`
+      });
+    }
     return {
       data: null,
       error: new AuraError(0, {
-        error: { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
+          code: "network_error",
+          message: err instanceof Error ? err.message : "Network request failed"
+        }
       })
     };
   }
+  clearRefreshTimer();
   if (!res.ok) {
     let body2 = null;
-    try {
-      body2 = await res.json();
-    } catch {
+    const errRead = await readTextBounded(res, timeoutMs);
+    if (errRead.ok && errRead.text.trim() !== "") {
+      try {
+        body2 = JSON.parse(errRead.text);
+      } catch {
+      }
     }
     const code = typeof body2?.error?.code === "string" ? body2.error.code : null;
     const definitivelyRejected = res.status === 403 || res.status === 401 && code === "REFRESH_TOKEN_REJECTED";
@@ -279,12 +430,29 @@ async function doRefresh(client) {
     return { data: null, error: new AuraError(res.status, body2) };
   }
   let body;
+  const okRead = await readTextBounded(res, timeoutMs);
+  if (!okRead.ok) {
+    if (okRead.timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/refresh`
+      });
+    }
+    return {
+      data: null,
+      error: new AuraError(0, {
+        error: okRead.timedOut ? { code: "timeout", message: `Refresh body not received within ${timeoutMs}ms` } : { code: "invalid_response", message: `Invalid refresh response (${okRead.message})` }
+      })
+    };
+  }
   try {
-    body = await res.json();
+    body = JSON.parse(okRead.text);
   } catch {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" } })
+      error: new AuraError(0, {
+        error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" }
+      })
     };
   }
   const data = unwrapEnvelope(body);
@@ -296,7 +464,9 @@ async function doRefresh(client) {
       });
       return {
         data: null,
-        error: new AuraError(409, { error: { code: "refresh_discarded", message: "Session changed during refresh" } })
+        error: new AuraError(409, {
+          error: { code: "refresh_discarded", message: "Session changed during refresh" }
+        })
       };
     }
     store.save(data.access_token, data.refresh_token, data.user);
@@ -305,7 +475,9 @@ async function doRefresh(client) {
   }
   return {
     data: null,
-    error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response" } })
+    error: new AuraError(0, {
+      error: { code: "invalid_response", message: "Invalid refresh response" }
+    })
   };
 }
 function withRefreshLock(client, fn) {
@@ -316,7 +488,7 @@ function withRefreshLock(client, fn) {
     return fn();
   }
   const request = locks.request;
-  const lockName = `aura-refresh-${client.projectId}`;
+  const lockName = `aura-refresh-${clientScope(client.baseUrl)}`;
   const timeoutMs = (client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS) || DEFAULT_REQUEST_TIMEOUT_MS;
   let timer;
   const options = {};
@@ -373,6 +545,7 @@ async function fetchWithAuth(url, init, client) {
   const isFormData = typeof FormData !== "undefined" && init.body instanceof FormData;
   const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const applyTimeout = timeoutMs > 0 && init.signal === void 0 && !isFormData;
+  const bodyTimeoutMs = init.signal === void 0 ? timeoutMs : 0;
   let attempt = 0;
   for (; ; ) {
     const headers = { ...init.headers };
@@ -431,7 +604,10 @@ async function fetchWithAuth(url, init, client) {
       return {
         data: null,
         error: new AuraError(0, {
-          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
+            code: "network_error",
+            message: err instanceof Error ? err.message : "Network request failed"
+          }
         })
       };
     }
@@ -444,7 +620,12 @@ async function fetchWithAuth(url, init, client) {
       await res.body?.cancel().catch(() => {
       });
       const nextAttempt = attempt + 1;
-      emitAuraEvent(client.onEvent, client.debug, { kind: "retry", attempt: nextAttempt, status: res.status, url });
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "retry",
+        attempt: nextAttempt,
+        status: res.status,
+        url
+      });
       await abortableSleep(delay, init.signal);
       attempt = nextAttempt;
       continue;
@@ -462,26 +643,42 @@ async function fetchWithAuth(url, init, client) {
     }
     if (!res.ok) {
       let body2 = null;
-      try {
-        body2 = await res.json();
-      } catch {
+      const errRead = await readTextBounded(res, bodyTimeoutMs);
+      if (errRead.ok && errRead.text.trim() !== "") {
+        try {
+          body2 = JSON.parse(errRead.text);
+        } catch {
+        }
+      } else if (!errRead.ok && errRead.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
       return { data: null, error: new AuraError(res.status, body2) };
     }
-    let raw;
-    try {
-      raw = await res.text();
-    } catch (err) {
+    const read = await readTextBounded(res, bodyTimeoutMs);
+    if (!read.ok) {
+      if (read.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "timeout",
+              message: `Response body not fully received within ${bodyTimeoutMs}ms (HTTP ${res.status})`
+            }
+          })
+        };
+      }
       return {
         data: null,
         error: new AuraError(0, {
           error: {
             code: "invalid_response",
-            message: `Unreadable response body (HTTP ${res.status}): ${err instanceof Error ? err.message : "read failed"}`
+            message: `Unreadable response body (HTTP ${res.status}): ${read.message}`
           }
         })
       };
     }
+    const raw = read.text;
     if (raw.trim() === "") {
       return { data: null, error: null };
     }
@@ -534,12 +731,40 @@ var BaseService = class {
   }
 };
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
   key;
-  constructor(key = "aurabase_auth") {
+  /**
+   * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
+   *            `aura-${clientScope(baseUrl)}-auth`.
+   */
+  constructor(key) {
     super();
     this.key = key;
     this._loadFromStorage();
@@ -556,11 +781,12 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
   /**
    * Supprime de localStorage tous les artefacts d'auth éphémères sur disque :
-   *  - `code_verifier` PKCE (`aura-<projectId>-pkce-code-verifier`),
-   *  - marqueur d'initiation OAuth implicit (`aura-<projectId>-oauth-implicit-initiated`,
+   *  - `code_verifier` PKCE (`aura-<portée>-pkce-code-verifier`),
+   *  - marqueur d'initiation OAuth implicit (`aura-<portée>-oauth-implicit-initiated`,
    *    SEC-F3). Un `signOut`/`clear()` ne doit laisser aucun résidu réutilisable (parité
    * `@supabase/ssr` : ces artefacts sont éphémères). On itère les clés préfixées pour
-   * couvrir un store partagé entre plusieurs projets, sans dépendre du `projectId` courant.
+   * couvrir un store partagé entre plusieurs projets, sans dépendre de la portée courante
+   * (`clientScope`, dérivée de l'URL du projet).
    */
   _removePkceVerifiers() {
     if (typeof localStorage === "undefined") return;
@@ -681,38 +907,17 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
+exports.AUTH_SETTINGS_WRITABLE_FIELDS = AUTH_SETTINGS_WRITABLE_FIELDS;
 exports.AuraError = AuraError;
 exports.BaseAuthStore = BaseAuthStore;
 exports.BaseService = BaseService;
 exports.DEFAULT_MAX_RETRIES = DEFAULT_MAX_RETRIES;
+exports.DEFAULT_REQUEST_TIMEOUT_MS = DEFAULT_REQUEST_TIMEOUT_MS;
 exports.LocalAuthStore = LocalAuthStore;
 exports.RETRYABLE_METHODS = RETRYABLE_METHODS;
 exports.RETRYABLE_STATUS = RETRYABLE_STATUS;
 exports.abortableSleep = abortableSleep;
+exports.clientScope = clientScope;
 exports.computeBackoff = computeBackoff;
 exports.emitAuraEvent = emitAuraEvent;
 exports.fetchWithAuth = fetchWithAuth;