@aurabase/core 0.4.0 → 0.5.0

package/dist/index.js

@@ -31,6 +31,70 @@ function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
 
+// src/retry.ts
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
+var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var DEFAULT_MAX_RETRIES = 3;
+var BASE_MS = 500;
+var CAP_MS = 1e4;
+function isRetryableStatus(status) {
+  return RETRYABLE_STATUS.has(status);
+}
+function isRetryableMethod(method) {
+  return RETRYABLE_METHODS.has(method.toUpperCase());
+}
+function computeBackoff(attempt, rand = Math.random) {
+  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
+  return Math.floor(rand() * bound);
+}
+function parseRetryAfter(header, now = Date.now()) {
+  if (header === null) return null;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
+  const dateMs = Date.parse(trimmed);
+  if (Number.isNaN(dateMs)) return null;
+  return Math.max(0, dateMs - now);
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isAbortError(err) {
+  return typeof err === "object" && err !== null && err.name === "AbortError";
+}
+
+// src/scope.ts
+function clientScope(baseUrl) {
+  let host;
+  try {
+    host = new URL(baseUrl).host;
+  } catch {
+    host = baseUrl;
+  }
+  return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "default";
+}
+
+// src/serialize.ts
+function serializeBody(body) {
+  return JSON.stringify(
+    body,
+    (_key, value) => typeof value === "bigint" ? value.toString() : value
+  );
+}
+
 // src/types.ts
 function redactUrl(u) {
   const cut = u.search(/[?#]/);
@@ -50,6 +114,60 @@ function emitAuraEvent(onEvent, debug, event) {
   } catch {
   }
 }
+var AUTH_SETTINGS_WRITABLE_FIELDS = [
+  "allow_signup",
+  "email_confirmation_required",
+  "password_min_length",
+  "mfa_enabled",
+  "allow_anonymous_users",
+  "jwt_expiry_seconds",
+  "refresh_token_expiry_days",
+  "site_url",
+  "oauth_providers",
+  "new_device_alerts_enabled",
+  "webhook_url",
+  "webhook_secret",
+  "smtp_host",
+  "smtp_port",
+  "smtp_username",
+  "smtp_password",
+  "smtp_from_email",
+  "smtp_from_name",
+  "smtp_clear",
+  "oauth_credentials",
+  "oauth_credentials_clear",
+  "captcha_enabled",
+  "captcha_provider",
+  "captcha_site_key",
+  "captcha_secret_key",
+  "password_check_hibp",
+  "sms_provider",
+  "sms_api_key",
+  "sms_api_secret",
+  "sms_from_number",
+  "sms_clear",
+  "redirect_urls",
+  "session_inactivity_timeout_seconds",
+  "hook_send_sms_url",
+  "hook_send_email_url",
+  "hook_mfa_verification_url",
+  "hook_password_verification_url",
+  "auto_link_by_email",
+  "rate_limit_login_per_hour",
+  "rate_limit_emails_per_hour",
+  "rate_limit_signup_per_hour",
+  "revoke_on_new_device",
+  "enforce_ip_binding",
+  "allowed_email_domains",
+  "blocked_email_domains",
+  "password_require_uppercase",
+  "password_require_number",
+  "password_require_special",
+  "hook_before_signup_url",
+  "hook_after_signup_url",
+  "hook_custom_access_token_url",
+  "hook_secret"
+];
 
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
@@ -170,59 +288,6 @@ var BaseAuthStore = class {
   }
 };
 
-// src/retry.ts
-var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
-var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-var DEFAULT_MAX_RETRIES = 3;
-var BASE_MS = 500;
-var CAP_MS = 1e4;
-function isRetryableStatus(status) {
-  return RETRYABLE_STATUS.has(status);
-}
-function isRetryableMethod(method) {
-  return RETRYABLE_METHODS.has(method.toUpperCase());
-}
-function computeBackoff(attempt, rand = Math.random) {
-  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
-  return Math.floor(rand() * bound);
-}
-function parseRetryAfter(header, now = Date.now()) {
-  if (header === null) return null;
-  const trimmed = header.trim();
-  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
-  const dateMs = Date.parse(trimmed);
-  if (Number.isNaN(dateMs)) return null;
-  return Math.max(0, dateMs - now);
-}
-function abortableSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) {
-      resolve();
-      return;
-    }
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function isAbortError(err) {
-  return typeof err === "object" && err !== null && err.name === "AbortError";
-}
-
-// src/serialize.ts
-function serializeBody(body) {
-  return JSON.stringify(
-    body,
-    (_key, value) => typeof value === "bigint" ? value.toString() : value
-  );
-}
-
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
@@ -233,6 +298,56 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+async function readTextBounded(res, timeoutMs) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
+    try {
+      return { ok: true, text: await res.text() };
+    } catch (err) {
+      return {
+        ok: false,
+        timedOut: false,
+        message: err instanceof Error ? err.message : "read failed"
+      };
+    }
+  }
+  let timer;
+  const TIMED_OUT = /* @__PURE__ */ Symbol("body-timeout");
+  try {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      timer.unref?.();
+    });
+    for (; ; ) {
+      const step = await Promise.race([reader.read(), deadline]);
+      if (step === TIMED_OUT) {
+        await reader.cancel().catch(() => {
+        });
+        return {
+          ok: false,
+          timedOut: true,
+          message: `Response body not fully received within ${timeoutMs}ms`
+        };
+      }
+      if (step.done) {
+        out += decoder.decode();
+        return { ok: true, text: out };
+      }
+      if (step.value) out += decoder.decode(step.value, { stream: true });
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      timedOut: false,
+      message: err instanceof Error ? err.message : "read failed"
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var inflightRefreshes = /* @__PURE__ */ new WeakMap();
 async function doRefresh(client) {
   const store = client.authStore;
@@ -240,32 +355,68 @@ async function doRefresh(client) {
   if (!rt) {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "no_session", message: "No refresh token available" } })
+      error: new AuraError(0, {
+        error: { code: "no_session", message: "No refresh token available" }
+      })
     };
   }
   const epoch = store.removalEpoch;
   const headers = { "Content-Type": "application/json" };
   if (client.apiKey) headers["apikey"] = client.apiKey;
+  const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  let refreshTimer;
+  let refreshSignal;
+  if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+    const ctrl = new AbortController();
+    refreshTimer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    refreshTimer.unref?.();
+    refreshSignal = ctrl.signal;
+  }
+  const clearRefreshTimer = () => {
+    if (refreshTimer) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+  };
   let res;
   try {
-    res = await client.fetchFn(`${client.baseUrl}/v1/auth/${client.projectId}/refresh`, {
+    res = await client.fetchFn(`${client.baseUrl}/v1/auth/refresh`, {
       method: "POST",
       headers,
-      body: serializeBody({ refresh_token: rt })
+      body: serializeBody({ refresh_token: rt }),
+      signal: refreshSignal
     });
   } catch (err) {
+    clearRefreshTimer();
+    if (timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/refresh`
+      });
+    }
     return {
       data: null,
       error: new AuraError(0, {
-        error: { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
+          code: "network_error",
+          message: err instanceof Error ? err.message : "Network request failed"
+        }
       })
     };
   }
+  clearRefreshTimer();
   if (!res.ok) {
     let body2 = null;
-    try {
-      body2 = await res.json();
-    } catch {
+    const errRead = await readTextBounded(res, timeoutMs);
+    if (errRead.ok && errRead.text.trim() !== "") {
+      try {
+        body2 = JSON.parse(errRead.text);
+      } catch {
+      }
     }
     const code = typeof body2?.error?.code === "string" ? body2.error.code : null;
     const definitivelyRejected = res.status === 403 || res.status === 401 && code === "REFRESH_TOKEN_REJECTED";
@@ -277,12 +428,29 @@ async function doRefresh(client) {
     return { data: null, error: new AuraError(res.status, body2) };
   }
   let body;
+  const okRead = await readTextBounded(res, timeoutMs);
+  if (!okRead.ok) {
+    if (okRead.timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/refresh`
+      });
+    }
+    return {
+      data: null,
+      error: new AuraError(0, {
+        error: okRead.timedOut ? { code: "timeout", message: `Refresh body not received within ${timeoutMs}ms` } : { code: "invalid_response", message: `Invalid refresh response (${okRead.message})` }
+      })
+    };
+  }
   try {
-    body = await res.json();
+    body = JSON.parse(okRead.text);
   } catch {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" } })
+      error: new AuraError(0, {
+        error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" }
+      })
     };
   }
   const data = unwrapEnvelope(body);
@@ -294,7 +462,9 @@ async function doRefresh(client) {
       });
       return {
         data: null,
-        error: new AuraError(409, { error: { code: "refresh_discarded", message: "Session changed during refresh" } })
+        error: new AuraError(409, {
+          error: { code: "refresh_discarded", message: "Session changed during refresh" }
+        })
       };
     }
     store.save(data.access_token, data.refresh_token, data.user);
@@ -303,7 +473,9 @@ async function doRefresh(client) {
   }
   return {
     data: null,
-    error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response" } })
+    error: new AuraError(0, {
+      error: { code: "invalid_response", message: "Invalid refresh response" }
+    })
   };
 }
 function withRefreshLock(client, fn) {
@@ -314,7 +486,7 @@ function withRefreshLock(client, fn) {
     return fn();
   }
   const request = locks.request;
-  const lockName = `aura-refresh-${client.projectId}`;
+  const lockName = `aura-refresh-${clientScope(client.baseUrl)}`;
   const timeoutMs = (client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS) || DEFAULT_REQUEST_TIMEOUT_MS;
   let timer;
   const options = {};
@@ -371,6 +543,7 @@ async function fetchWithAuth(url, init, client) {
   const isFormData = typeof FormData !== "undefined" && init.body instanceof FormData;
   const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const applyTimeout = timeoutMs > 0 && init.signal === void 0 && !isFormData;
+  const bodyTimeoutMs = init.signal === void 0 ? timeoutMs : 0;
   let attempt = 0;
   for (; ; ) {
     const headers = { ...init.headers };
@@ -429,7 +602,10 @@ async function fetchWithAuth(url, init, client) {
       return {
         data: null,
         error: new AuraError(0, {
-          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
+            code: "network_error",
+            message: err instanceof Error ? err.message : "Network request failed"
+          }
         })
       };
     }
@@ -442,7 +618,12 @@ async function fetchWithAuth(url, init, client) {
       await res.body?.cancel().catch(() => {
       });
       const nextAttempt = attempt + 1;
-      emitAuraEvent(client.onEvent, client.debug, { kind: "retry", attempt: nextAttempt, status: res.status, url });
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "retry",
+        attempt: nextAttempt,
+        status: res.status,
+        url
+      });
       await abortableSleep(delay, init.signal);
       attempt = nextAttempt;
       continue;
@@ -460,26 +641,42 @@ async function fetchWithAuth(url, init, client) {
     }
     if (!res.ok) {
       let body2 = null;
-      try {
-        body2 = await res.json();
-      } catch {
+      const errRead = await readTextBounded(res, bodyTimeoutMs);
+      if (errRead.ok && errRead.text.trim() !== "") {
+        try {
+          body2 = JSON.parse(errRead.text);
+        } catch {
+        }
+      } else if (!errRead.ok && errRead.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
       return { data: null, error: new AuraError(res.status, body2) };
     }
-    let raw;
-    try {
-      raw = await res.text();
-    } catch (err) {
+    const read = await readTextBounded(res, bodyTimeoutMs);
+    if (!read.ok) {
+      if (read.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "timeout",
+              message: `Response body not fully received within ${bodyTimeoutMs}ms (HTTP ${res.status})`
+            }
+          })
+        };
+      }
       return {
         data: null,
         error: new AuraError(0, {
           error: {
             code: "invalid_response",
-            message: `Unreadable response body (HTTP ${res.status}): ${err instanceof Error ? err.message : "read failed"}`
+            message: `Unreadable response body (HTTP ${res.status}): ${read.message}`
           }
         })
       };
     }
+    const raw = read.text;
     if (raw.trim() === "") {
       return { data: null, error: null };
     }
@@ -532,12 +729,40 @@ var BaseService = class {
   }
 };
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
   key;
-  constructor(key = "aurabase_auth") {
+  /**
+   * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
+   *            `aura-${clientScope(baseUrl)}-auth`.
+   */
+  constructor(key) {
     super();
     this.key = key;
     this._loadFromStorage();
@@ -554,11 +779,12 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
   /**
    * Supprime de localStorage tous les artefacts d'auth éphémères sur disque :
-   *  - `code_verifier` PKCE (`aura-<projectId>-pkce-code-verifier`),
-   *  - marqueur d'initiation OAuth implicit (`aura-<projectId>-oauth-implicit-initiated`,
+   *  - `code_verifier` PKCE (`aura-<portée>-pkce-code-verifier`),
+   *  - marqueur d'initiation OAuth implicit (`aura-<portée>-oauth-implicit-initiated`,
    *    SEC-F3). Un `signOut`/`clear()` ne doit laisser aucun résidu réutilisable (parité
    * `@supabase/ssr` : ces artefacts sont éphémères). On itère les clés préfixées pour
-   * couvrir un store partagé entre plusieurs projets, sans dépendre du `projectId` courant.
+   * couvrir un store partagé entre plusieurs projets, sans dépendre de la portée courante
+   * (`clientScope`, dérivée de l'URL du projet).
    */
   _removePkceVerifiers() {
     if (typeof localStorage === "undefined") return;
@@ -679,28 +905,4 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
-export { AuraError, BaseAuthStore, BaseService, DEFAULT_MAX_RETRIES, LocalAuthStore, RETRYABLE_METHODS, RETRYABLE_STATUS, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, AuraError, BaseAuthStore, BaseService, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, LocalAuthStore, RETRYABLE_METHODS, RETRYABLE_STATUS, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -45,6 +45,7 @@
     "core"
   ],
   "devDependencies": {
+    "@types/node": "20.14.15",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.1.6"
@@ -53,6 +54,7 @@
     "build": "tsup",
     "test": "vitest run && tsc --noEmit -p tsconfig.test-d.json",
     "test:types": "tsc --noEmit -p tsconfig.test-d.json",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json"
   }
 }