@aurabase/core 0.4.1 → 0.5.0

package/README.md

@@ -113,7 +113,7 @@ class WidgetsService extends BaseService {
   }
 
   private get prefix(): string {
-    return `/v1/widgets/${this.client.projectId}`
+    return '/v1/widgets'
   }
 
   async list(): Promise<AuraResponse<Widget[]>> {
@@ -132,16 +132,21 @@ class WidgetsService extends BaseService {
 
 `BaseAuthStore` est en mémoire (event-emitter `onChange`, stockage clé/valeur générique pour le PKCE `code_verifier`). `LocalAuthStore` l'étend avec persistance `localStorage` et des helpers cookie pour le rendu serveur.
 
+Son argument `key` est **obligatoire** et doit être SCOPÉ par projet : deux clients pointant sur deux projets dans la même page partagent un seul `localStorage` (celui de la page), et une clé constante les ferait s'écraser. Le nom canonique est `aura-${clientScope(baseUrl)}-auth` — celui que posent déjà `AuraClient` et `createServerClient`.
+
 ```ts
-import { LocalAuthStore } from '@aurabase/core'
+import { LocalAuthStore, clientScope } from '@aurabase/core'
+
+const PROJET = 'https://mon-projet.aurabase.cloud'
+const CLE = `aura-${clientScope(PROJET)}-auth`
 
 function hydrateFromCookieHeader(cookieHeader: string) {
-  const store = new LocalAuthStore('aurabase_auth')
+  const store = new LocalAuthStore(CLE)
   store.loadFromCookie(cookieHeader) // hydrate depuis l'en-tête Cookie de la requête entrante
   return store
 }
 
-const store = hydrateFromCookieHeader('aurabase_auth=%7B%22token%22%3Anull%7D')
+const store = hydrateFromCookieHeader(`${CLE}=%7B%22token%22%3Anull%7D`)
 
 // Après une mutation de session, sérialiser l'état courant en Set-Cookie.
 const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'Lax', httpOnly: true })
@@ -163,7 +168,7 @@ Cette couche (`fetchWithAuth`, `refreshOnce`) est exportée mais reste un détai
 
 - Package d'infrastructure : pas d'API « produit ». Pour construire une application, utilisez le méta-package [`aurabase`](../aurabase), qui assemble tous les services derrière un seul client.
 - `BaseAuthStore` est en mémoire — l'état est perdu au reload ; `LocalAuthStore` nécessite un `localStorage` disponible (sinon retombe silencieusement sur le comportement en mémoire, sauf via les helpers cookie explicites).
-- `AuraClientLike` est un contrat minimal (`baseUrl`, `projectId`, `apiKey`, `fetchFn`, `authStore`, `auth.refreshSession`, `retryConfig?`, `requestTimeoutMs?`) : un client maison doit l'implémenter intégralement pour rester compatible avec `BaseService`.
+- `AuraClientLike` est un contrat minimal (`baseUrl`, `apiKey`, `fetchFn`, `authStore`, `auth.refreshSession`, `retryConfig?`, `requestTimeoutMs?`) : un client maison doit l'implémenter intégralement pour rester compatible avec `BaseService`.
 - La couche fetch bas niveau (`fetchWithAuth`/`refreshOnce`) est un détail d'implémentation interne, pas une API publique stabilisée.
 
 ## Documentation

package/dist/index.cjs

@@ -33,6 +33,70 @@ function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
 
+// src/retry.ts
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
+var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var DEFAULT_MAX_RETRIES = 3;
+var BASE_MS = 500;
+var CAP_MS = 1e4;
+function isRetryableStatus(status) {
+  return RETRYABLE_STATUS.has(status);
+}
+function isRetryableMethod(method) {
+  return RETRYABLE_METHODS.has(method.toUpperCase());
+}
+function computeBackoff(attempt, rand = Math.random) {
+  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
+  return Math.floor(rand() * bound);
+}
+function parseRetryAfter(header, now = Date.now()) {
+  if (header === null) return null;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
+  const dateMs = Date.parse(trimmed);
+  if (Number.isNaN(dateMs)) return null;
+  return Math.max(0, dateMs - now);
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function isAbortError(err) {
+  return typeof err === "object" && err !== null && err.name === "AbortError";
+}
+
+// src/scope.ts
+function clientScope(baseUrl) {
+  let host;
+  try {
+    host = new URL(baseUrl).host;
+  } catch {
+    host = baseUrl;
+  }
+  return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "default";
+}
+
+// src/serialize.ts
+function serializeBody(body) {
+  return JSON.stringify(
+    body,
+    (_key, value) => typeof value === "bigint" ? value.toString() : value
+  );
+}
+
 // src/types.ts
 function redactUrl(u) {
   const cut = u.search(/[?#]/);
@@ -52,6 +116,60 @@ function emitAuraEvent(onEvent, debug, event) {
   } catch {
   }
 }
+var AUTH_SETTINGS_WRITABLE_FIELDS = [
+  "allow_signup",
+  "email_confirmation_required",
+  "password_min_length",
+  "mfa_enabled",
+  "allow_anonymous_users",
+  "jwt_expiry_seconds",
+  "refresh_token_expiry_days",
+  "site_url",
+  "oauth_providers",
+  "new_device_alerts_enabled",
+  "webhook_url",
+  "webhook_secret",
+  "smtp_host",
+  "smtp_port",
+  "smtp_username",
+  "smtp_password",
+  "smtp_from_email",
+  "smtp_from_name",
+  "smtp_clear",
+  "oauth_credentials",
+  "oauth_credentials_clear",
+  "captcha_enabled",
+  "captcha_provider",
+  "captcha_site_key",
+  "captcha_secret_key",
+  "password_check_hibp",
+  "sms_provider",
+  "sms_api_key",
+  "sms_api_secret",
+  "sms_from_number",
+  "sms_clear",
+  "redirect_urls",
+  "session_inactivity_timeout_seconds",
+  "hook_send_sms_url",
+  "hook_send_email_url",
+  "hook_mfa_verification_url",
+  "hook_password_verification_url",
+  "auto_link_by_email",
+  "rate_limit_login_per_hour",
+  "rate_limit_emails_per_hour",
+  "rate_limit_signup_per_hour",
+  "revoke_on_new_device",
+  "enforce_ip_binding",
+  "allowed_email_domains",
+  "blocked_email_domains",
+  "password_require_uppercase",
+  "password_require_number",
+  "password_require_special",
+  "hook_before_signup_url",
+  "hook_after_signup_url",
+  "hook_custom_access_token_url",
+  "hook_secret"
+];
 
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
@@ -172,59 +290,6 @@ var BaseAuthStore = class {
   }
 };
 
-// src/retry.ts
-var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 502, 503, 504]);
-var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-var DEFAULT_MAX_RETRIES = 3;
-var BASE_MS = 500;
-var CAP_MS = 1e4;
-function isRetryableStatus(status) {
-  return RETRYABLE_STATUS.has(status);
-}
-function isRetryableMethod(method) {
-  return RETRYABLE_METHODS.has(method.toUpperCase());
-}
-function computeBackoff(attempt, rand = Math.random) {
-  const bound = Math.min(BASE_MS * 2 ** attempt, CAP_MS);
-  return Math.floor(rand() * bound);
-}
-function parseRetryAfter(header, now = Date.now()) {
-  if (header === null) return null;
-  const trimmed = header.trim();
-  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10) * 1e3;
-  const dateMs = Date.parse(trimmed);
-  if (Number.isNaN(dateMs)) return null;
-  return Math.max(0, dateMs - now);
-}
-function abortableSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) {
-      resolve();
-      return;
-    }
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function isAbortError(err) {
-  return typeof err === "object" && err !== null && err.name === "AbortError";
-}
-
-// src/serialize.ts
-function serializeBody(body) {
-  return JSON.stringify(
-    body,
-    (_key, value) => typeof value === "bigint" ? value.toString() : value
-  );
-}
-
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
@@ -292,7 +357,9 @@ async function doRefresh(client) {
   if (!rt) {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "no_session", message: "No refresh token available" } })
+      error: new AuraError(0, {
+        error: { code: "no_session", message: "No refresh token available" }
+      })
     };
   }
   const epoch = store.removalEpoch;
@@ -319,7 +386,7 @@ async function doRefresh(client) {
   };
   let res;
   try {
-    res = await client.fetchFn(`${client.baseUrl}/v1/auth/${client.projectId}/refresh`, {
+    res = await client.fetchFn(`${client.baseUrl}/v1/auth/refresh`, {
       method: "POST",
       headers,
       body: serializeBody({ refresh_token: rt }),
@@ -330,13 +397,16 @@ async function doRefresh(client) {
     if (timedOut) {
       emitAuraEvent(client.onEvent, client.debug, {
         kind: "timeout",
-        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+        url: `${client.baseUrl}/v1/auth/refresh`
       });
     }
     return {
       data: null,
       error: new AuraError(0, {
-        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
+          code: "network_error",
+          message: err instanceof Error ? err.message : "Network request failed"
+        }
       })
     };
   }
@@ -365,7 +435,7 @@ async function doRefresh(client) {
     if (okRead.timedOut) {
       emitAuraEvent(client.onEvent, client.debug, {
         kind: "timeout",
-        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+        url: `${client.baseUrl}/v1/auth/refresh`
       });
     }
     return {
@@ -380,7 +450,9 @@ async function doRefresh(client) {
   } catch {
     return {
       data: null,
-      error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" } })
+      error: new AuraError(0, {
+        error: { code: "invalid_response", message: "Invalid refresh response (non-JSON body)" }
+      })
     };
   }
   const data = unwrapEnvelope(body);
@@ -392,7 +464,9 @@ async function doRefresh(client) {
       });
       return {
         data: null,
-        error: new AuraError(409, { error: { code: "refresh_discarded", message: "Session changed during refresh" } })
+        error: new AuraError(409, {
+          error: { code: "refresh_discarded", message: "Session changed during refresh" }
+        })
       };
     }
     store.save(data.access_token, data.refresh_token, data.user);
@@ -401,7 +475,9 @@ async function doRefresh(client) {
   }
   return {
     data: null,
-    error: new AuraError(0, { error: { code: "invalid_response", message: "Invalid refresh response" } })
+    error: new AuraError(0, {
+      error: { code: "invalid_response", message: "Invalid refresh response" }
+    })
   };
 }
 function withRefreshLock(client, fn) {
@@ -412,7 +488,7 @@ function withRefreshLock(client, fn) {
     return fn();
   }
   const request = locks.request;
-  const lockName = `aura-refresh-${client.projectId}`;
+  const lockName = `aura-refresh-${clientScope(client.baseUrl)}`;
   const timeoutMs = (client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS) || DEFAULT_REQUEST_TIMEOUT_MS;
   let timer;
   const options = {};
@@ -528,7 +604,10 @@ async function fetchWithAuth(url, init, client) {
       return {
         data: null,
         error: new AuraError(0, {
-          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+          error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
+            code: "network_error",
+            message: err instanceof Error ? err.message : "Network request failed"
+          }
         })
       };
     }
@@ -541,7 +620,12 @@ async function fetchWithAuth(url, init, client) {
       await res.body?.cancel().catch(() => {
       });
       const nextAttempt = attempt + 1;
-      emitAuraEvent(client.onEvent, client.debug, { kind: "retry", attempt: nextAttempt, status: res.status, url });
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "retry",
+        attempt: nextAttempt,
+        status: res.status,
+        url
+      });
       await abortableSleep(delay, init.signal);
       attempt = nextAttempt;
       continue;
@@ -647,12 +731,40 @@ var BaseService = class {
   }
 };
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
   key;
-  constructor(key = "aurabase_auth") {
+  /**
+   * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
+   *            `aura-${clientScope(baseUrl)}-auth`.
+   */
+  constructor(key) {
     super();
     this.key = key;
     this._loadFromStorage();
@@ -669,11 +781,12 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
   /**
    * Supprime de localStorage tous les artefacts d'auth éphémères sur disque :
-   *  - `code_verifier` PKCE (`aura-<projectId>-pkce-code-verifier`),
-   *  - marqueur d'initiation OAuth implicit (`aura-<projectId>-oauth-implicit-initiated`,
+   *  - `code_verifier` PKCE (`aura-<portée>-pkce-code-verifier`),
+   *  - marqueur d'initiation OAuth implicit (`aura-<portée>-oauth-implicit-initiated`,
    *    SEC-F3). Un `signOut`/`clear()` ne doit laisser aucun résidu réutilisable (parité
    * `@supabase/ssr` : ces artefacts sont éphémères). On itère les clés préfixées pour
-   * couvrir un store partagé entre plusieurs projets, sans dépendre du `projectId` courant.
+   * couvrir un store partagé entre plusieurs projets, sans dépendre de la portée courante
+   * (`clientScope`, dérivée de l'URL du projet).
    */
   _removePkceVerifiers() {
     if (typeof localStorage === "undefined") return;
@@ -794,30 +907,7 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
+exports.AUTH_SETTINGS_WRITABLE_FIELDS = AUTH_SETTINGS_WRITABLE_FIELDS;
 exports.AuraError = AuraError;
 exports.BaseAuthStore = BaseAuthStore;
 exports.BaseService = BaseService;
@@ -827,6 +917,7 @@ exports.LocalAuthStore = LocalAuthStore;
 exports.RETRYABLE_METHODS = RETRYABLE_METHODS;
 exports.RETRYABLE_STATUS = RETRYABLE_STATUS;
 exports.abortableSleep = abortableSleep;
+exports.clientScope = clientScope;
 exports.computeBackoff = computeBackoff;
 exports.emitAuraEvent = emitAuraEvent;
 exports.fetchWithAuth = fetchWithAuth;