@auth-gate/core 0.5.0 → 0.6.0

package/dist/index.cjs

@@ -39,6 +39,7 @@ var index_exports = {};
 __export(index_exports, {
   AuthGateClient: () => AuthGateClient,
   AuthGateError: () => AuthGateError,
+  ConfigurationError: () => ConfigurationError,
   DEFAULT_COOKIE_NAME: () => DEFAULT_COOKIE_NAME,
   InvalidStateError: () => InvalidStateError,
   NONCE_COOKIE_NAME: () => NONCE_COOKIE_NAME,
@@ -48,7 +49,9 @@ __export(index_exports, {
   SUPPORTED_PROVIDERS: () => SUPPORTED_PROVIDERS,
   SessionDecryptionError: () => SessionDecryptionError,
   TokenVerificationError: () => TokenVerificationError,
-  createAuthGateClient: () => createAuthGateClient
+  createAuthGateClient: () => createAuthGateClient,
+  hasFeature: () => hasFeature,
+  hasPlan: () => hasPlan
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -296,6 +299,12 @@ var InvalidStateError = class extends AuthGateError {
     this.name = "InvalidStateError";
   }
 };
+var ConfigurationError = class extends AuthGateError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigurationError";
+  }
+};
 
 // src/client.ts
 var AuthGateClient = class {
@@ -306,6 +315,28 @@ var AuthGateClient = class {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
+    if (!config.apiKey || typeof config.apiKey !== "string" || config.apiKey.trim() === "") {
+      throw new ConfigurationError(
+        "[AuthGate] Missing or empty `apiKey`. Get your API key from the AuthGate dashboard \u2192 Project \u2192 API Key."
+      );
+    }
+    if (!config.baseUrl || typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
+      throw new ConfigurationError(
+        '[AuthGate] Missing or empty `baseUrl`. Set this to your AuthGate service URL (e.g. "https://authgate.dev").'
+      );
+    }
+    try {
+      new URL(config.baseUrl);
+    } catch (e) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`baseUrl\`: "${config.baseUrl}". Must be a valid URL (e.g. "https://authgate.dev").`
+      );
+    }
+    if (config.callbackPath !== void 0 && !config.callbackPath.startsWith("/")) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`callbackPath\`: "${config.callbackPath}". Must start with "/" (e.g. "/api/auth/callback").`
+      );
+    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -927,7 +958,71 @@ var AuthGateClient = class {
       path: "/"
     };
   }
+  // ---------------------------------------------------------------------------
+  // Config validation (async, called by framework factories)
+  // ---------------------------------------------------------------------------
+  /**
+   * Validate the SDK configuration against the AuthGate server.
+   *
+   * Checks that the API key is valid and (optionally) that a callback URL
+   * is registered for the project. This is called automatically by framework
+   * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+   * console — it does NOT throw.
+   *
+   * @param callbackUrl - The full callback URL to check registration for.
+   * @internal
+   */
+  async validateConfig(callbackUrl) {
+    try {
+      const response = await fetch(
+        `${this.config.baseUrl}/api/v1/config/validate`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            callback_url: callbackUrl
+          })
+        }
+      );
+      if (response.status === 401) {
+        console.error(
+          "\n[AuthGate] \u2717 Invalid API key.\n  The API key you provided is not recognized or has been revoked.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 API Key to get a valid key.\n"
+        );
+        return;
+      }
+      if (!response.ok) {
+        console.warn(
+          "[AuthGate] Could not validate config (server returned " + response.status + "). Auth flows may fail."
+        );
+        return;
+      }
+      const data = await response.json();
+      if (callbackUrl && data.callback_url_registered === false) {
+        console.error(
+          "\n[AuthGate] \u2717 Callback URL not registered: " + callbackUrl + "\n  This URL must be added to your project's allowed callback URLs.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 Callback URLs \u2192 Add URL.\n"
+        );
+      }
+    } catch (e) {
+      console.warn(
+        "[AuthGate] Could not reach AuthGate server at " + this.config.baseUrl + " to validate config. Auth flows may fail if the URL is wrong."
+      );
+    }
+  }
 };
 function createAuthGateClient(config) {
   return new AuthGateClient(config);
 }
+
+// src/billing.ts
+function hasPlan(entitlements, plan) {
+  if (!(entitlements == null ? void 0 : entitlements.plan)) return false;
+  return entitlements.plan.toLowerCase() === plan.toLowerCase();
+}
+function hasFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.features)) return false;
+  const lower = feature.toLowerCase();
+  return entitlements.features.some((f) => f.toLowerCase() === lower);
+}

package/dist/index.d.cts

@@ -472,6 +472,18 @@ declare class AuthGateClient {
      * Short-lived (10 minutes) to match the state TTL.
      */
     getNonceCookieOptions(): CookieOptions;
+    /**
+     * Validate the SDK configuration against the AuthGate server.
+     *
+     * Checks that the API key is valid and (optionally) that a callback URL
+     * is registered for the project. This is called automatically by framework
+     * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+     * console — it does NOT throw.
+     *
+     * @param callbackUrl - The full callback URL to check registration for.
+     * @internal
+     */
+    validateConfig(callbackUrl?: string): Promise<void>;
 }
 /**
  * Create an {@link AuthGateClient} instance.
@@ -552,5 +564,79 @@ declare class SessionDecryptionError extends AuthGateError {
 declare class InvalidStateError extends AuthGateError {
     constructor(message?: string);
 }
+/**
+ * Thrown when the AuthGate SDK is initialized with invalid configuration.
+ *
+ * Check the error message for details on which config field is invalid
+ * and how to fix it.
+ */
+declare class ConfigurationError extends AuthGateError {
+    constructor(message: string);
+}
+
+/** A product/plan in the billing catalog. */
+interface BillingPlan {
+    id: string;
+    name: string;
+    description: string | null;
+    features: string[];
+    prices: BillingPrice[];
+}
+/** A price attached to a plan. */
+interface BillingPrice {
+    id: string;
+    type: "recurring" | "metered" | "tiered";
+    amount: number | null;
+    currency: string;
+    interval: "daily" | "weekly" | "monthly" | "yearly";
+    intervalCount: number;
+}
+/** An active subscription for an end user. */
+interface BillingSubscription {
+    id: string;
+    status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    plan: {
+        id: string;
+        name: string;
+    } | null;
+    price: BillingPrice | null;
+    currentPeriodStart: string;
+    currentPeriodEnd: string;
+    cancelAtPeriodEnd: boolean;
+    trialEnd: string | null;
+}
+/** Entitlement data for an end user — what plan they're on and what features they have. */
+interface BillingEntitlement {
+    plan: string | null;
+    features: string[];
+    status: string | null;
+    subscription: {
+        id: string;
+        currentPeriodEnd: string;
+    } | null;
+}
+/** A single usage event to report. */
+interface UsageEvent {
+    metric: string;
+    quantity: number;
+    idempotencyKey?: string;
+    timestamp?: string;
+}
+/**
+ * Check whether the user's entitlements include a specific plan.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param plan - The plan name to check (case-insensitive).
+ * @returns `true` if the user is on the given plan.
+ */
+declare function hasPlan(entitlements: BillingEntitlement | null | undefined, plan: string): boolean;
+/**
+ * Check whether the user's entitlements include a specific feature.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns `true` if the user has the given feature.
+ */
+declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, createAuthGateClient };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };

package/dist/index.d.ts

@@ -472,6 +472,18 @@ declare class AuthGateClient {
      * Short-lived (10 minutes) to match the state TTL.
      */
     getNonceCookieOptions(): CookieOptions;
+    /**
+     * Validate the SDK configuration against the AuthGate server.
+     *
+     * Checks that the API key is valid and (optionally) that a callback URL
+     * is registered for the project. This is called automatically by framework
+     * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+     * console — it does NOT throw.
+     *
+     * @param callbackUrl - The full callback URL to check registration for.
+     * @internal
+     */
+    validateConfig(callbackUrl?: string): Promise<void>;
 }
 /**
  * Create an {@link AuthGateClient} instance.
@@ -552,5 +564,79 @@ declare class SessionDecryptionError extends AuthGateError {
 declare class InvalidStateError extends AuthGateError {
     constructor(message?: string);
 }
+/**
+ * Thrown when the AuthGate SDK is initialized with invalid configuration.
+ *
+ * Check the error message for details on which config field is invalid
+ * and how to fix it.
+ */
+declare class ConfigurationError extends AuthGateError {
+    constructor(message: string);
+}
+
+/** A product/plan in the billing catalog. */
+interface BillingPlan {
+    id: string;
+    name: string;
+    description: string | null;
+    features: string[];
+    prices: BillingPrice[];
+}
+/** A price attached to a plan. */
+interface BillingPrice {
+    id: string;
+    type: "recurring" | "metered" | "tiered";
+    amount: number | null;
+    currency: string;
+    interval: "daily" | "weekly" | "monthly" | "yearly";
+    intervalCount: number;
+}
+/** An active subscription for an end user. */
+interface BillingSubscription {
+    id: string;
+    status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    plan: {
+        id: string;
+        name: string;
+    } | null;
+    price: BillingPrice | null;
+    currentPeriodStart: string;
+    currentPeriodEnd: string;
+    cancelAtPeriodEnd: boolean;
+    trialEnd: string | null;
+}
+/** Entitlement data for an end user — what plan they're on and what features they have. */
+interface BillingEntitlement {
+    plan: string | null;
+    features: string[];
+    status: string | null;
+    subscription: {
+        id: string;
+        currentPeriodEnd: string;
+    } | null;
+}
+/** A single usage event to report. */
+interface UsageEvent {
+    metric: string;
+    quantity: number;
+    idempotencyKey?: string;
+    timestamp?: string;
+}
+/**
+ * Check whether the user's entitlements include a specific plan.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param plan - The plan name to check (case-insensitive).
+ * @returns `true` if the user is on the given plan.
+ */
+declare function hasPlan(entitlements: BillingEntitlement | null | undefined, plan: string): boolean;
+/**
+ * Check whether the user's entitlements include a specific feature.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns `true` if the user has the given feature.
+ */
+declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, createAuthGateClient };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };

package/dist/index.mjs

@@ -262,6 +262,12 @@ var InvalidStateError = class extends AuthGateError {
     this.name = "InvalidStateError";
   }
 };
+var ConfigurationError = class extends AuthGateError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigurationError";
+  }
+};
 
 // src/client.ts
 var AuthGateClient = class {
@@ -272,6 +278,28 @@ var AuthGateClient = class {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
+    if (!config.apiKey || typeof config.apiKey !== "string" || config.apiKey.trim() === "") {
+      throw new ConfigurationError(
+        "[AuthGate] Missing or empty `apiKey`. Get your API key from the AuthGate dashboard \u2192 Project \u2192 API Key."
+      );
+    }
+    if (!config.baseUrl || typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
+      throw new ConfigurationError(
+        '[AuthGate] Missing or empty `baseUrl`. Set this to your AuthGate service URL (e.g. "https://authgate.dev").'
+      );
+    }
+    try {
+      new URL(config.baseUrl);
+    } catch (e) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`baseUrl\`: "${config.baseUrl}". Must be a valid URL (e.g. "https://authgate.dev").`
+      );
+    }
+    if (config.callbackPath !== void 0 && !config.callbackPath.startsWith("/")) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`callbackPath\`: "${config.callbackPath}". Must start with "/" (e.g. "/api/auth/callback").`
+      );
+    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -893,13 +921,78 @@ var AuthGateClient = class {
       path: "/"
     };
   }
+  // ---------------------------------------------------------------------------
+  // Config validation (async, called by framework factories)
+  // ---------------------------------------------------------------------------
+  /**
+   * Validate the SDK configuration against the AuthGate server.
+   *
+   * Checks that the API key is valid and (optionally) that a callback URL
+   * is registered for the project. This is called automatically by framework
+   * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+   * console — it does NOT throw.
+   *
+   * @param callbackUrl - The full callback URL to check registration for.
+   * @internal
+   */
+  async validateConfig(callbackUrl) {
+    try {
+      const response = await fetch(
+        `${this.config.baseUrl}/api/v1/config/validate`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            callback_url: callbackUrl
+          })
+        }
+      );
+      if (response.status === 401) {
+        console.error(
+          "\n[AuthGate] \u2717 Invalid API key.\n  The API key you provided is not recognized or has been revoked.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 API Key to get a valid key.\n"
+        );
+        return;
+      }
+      if (!response.ok) {
+        console.warn(
+          "[AuthGate] Could not validate config (server returned " + response.status + "). Auth flows may fail."
+        );
+        return;
+      }
+      const data = await response.json();
+      if (callbackUrl && data.callback_url_registered === false) {
+        console.error(
+          "\n[AuthGate] \u2717 Callback URL not registered: " + callbackUrl + "\n  This URL must be added to your project's allowed callback URLs.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 Callback URLs \u2192 Add URL.\n"
+        );
+      }
+    } catch (e) {
+      console.warn(
+        "[AuthGate] Could not reach AuthGate server at " + this.config.baseUrl + " to validate config. Auth flows may fail if the URL is wrong."
+      );
+    }
+  }
 };
 function createAuthGateClient(config) {
   return new AuthGateClient(config);
 }
+
+// src/billing.ts
+function hasPlan(entitlements, plan) {
+  if (!(entitlements == null ? void 0 : entitlements.plan)) return false;
+  return entitlements.plan.toLowerCase() === plan.toLowerCase();
+}
+function hasFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.features)) return false;
+  const lower = feature.toLowerCase();
+  return entitlements.features.some((f) => f.toLowerCase() === lower);
+}
 export {
   AuthGateClient,
   AuthGateError,
+  ConfigurationError,
   DEFAULT_COOKIE_NAME,
   InvalidStateError,
   NONCE_COOKIE_NAME,
@@ -909,5 +1002,7 @@ export {
   SUPPORTED_PROVIDERS,
   SessionDecryptionError,
   TokenVerificationError,
-  createAuthGateClient
+  createAuthGateClient,
+  hasFeature,
+  hasPlan
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/core",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "exports": {
     ".": {