@beeuni/sdk 0.1.0

package/dist/core/auth/beeuni-member.js

@@ -0,0 +1,168 @@
+import { safeEnv } from '../http/env.js';
+export class BeeuniMemberError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'BeeuniMemberError';
+        this.code = code;
+    }
+}
+const text = (value) => (typeof value === 'string' && value.length > 0 ? value : null);
+function list(value) {
+    let parsed = value;
+    if (typeof value === 'string') {
+        try {
+            parsed = JSON.parse(value);
+        }
+        catch {
+            return [];
+        }
+    }
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === 'string') : [];
+}
+export function readBeeuniMember(claims) {
+    if (!claims || typeof claims !== 'object')
+        return null;
+    const c = claims;
+    const userId = text(c.sub) ?? text(c.subject) ?? text(c.user_id) ?? text(c.userId);
+    if (!userId)
+        return null;
+    return {
+        userId,
+        email: text(c.email),
+        name: text(c.name),
+        picture: text(c.picture) ?? text(c.pictureUrl),
+        groups: list(c.groups),
+        groupIds: list(c.group_ids ?? c.groupIds),
+        role: text(c.role),
+        accountId: text(c.account_id) ?? text(c.accountId),
+        projectId: text(c.project_id) ?? text(c.projectId),
+    };
+}
+export function requireBeeuniMember(claims, requirement = {}) {
+    const member = readBeeuniMember(claims);
+    if (!member)
+        throw new BeeuniMemberError('unauthenticated', 'Sign in with Beeuni to continue.');
+    const { groups, roles } = requirement;
+    if (groups && !groups.some((group) => member.groups.includes(group) || member.groupIds.includes(group))) {
+        throw new BeeuniMemberError('forbidden', `Only members of ${groups.join(' or ') || 'no group'} may do this.`);
+    }
+    if (roles && !roles.some((role) => member.role === role)) {
+        throw new BeeuniMemberError('forbidden', `Only ${roles.join(' or ') || 'no role'} members may do this.`);
+    }
+    return member;
+}
+const CLOCK_SKEW_SECONDS = 60;
+const remoteKeySets = new Map();
+function base64UrlBytes(value) {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function base64UrlJson(value) {
+    return JSON.parse(new TextDecoder().decode(base64UrlBytes(value)));
+}
+async function loadKeySet(source, fetchImpl) {
+    if (typeof source !== 'string')
+        return source;
+    if (source.startsWith('data:')) {
+        const comma = source.indexOf(',');
+        const meta = source.slice(5, comma);
+        const payload = source.slice(comma + 1);
+        const body = meta.endsWith(';base64')
+            ? new TextDecoder().decode(Uint8Array.from(atob(payload), (char) => char.charCodeAt(0)))
+            : decodeURIComponent(payload);
+        return JSON.parse(body);
+    }
+    if (/^https?:\/\//.test(source)) {
+        let cached = remoteKeySets.get(source);
+        if (!cached) {
+            cached = fetchImpl(source, { headers: { accept: 'application/json' } }).then(async (res) => {
+                if (!res.ok)
+                    throw new Error(`key set ${res.status}`);
+                return (await res.json());
+            });
+            cached.catch(() => remoteKeySets.delete(source));
+            remoteKeySets.set(source, cached);
+        }
+        return cached;
+    }
+    return JSON.parse(source);
+}
+export async function verifyBeeuniToken(token, options = {}) {
+    const refuse = (why) => {
+        throw new BeeuniMemberError('unauthenticated', `Beeuni sign-in token refused: ${why}.`);
+    };
+    const jwks = options.jwks ?? safeEnv('BEEUNI_AUTH_JWKS');
+    const issuer = options.issuer ?? safeEnv('BEEUNI_AUTH_ISSUER');
+    const audience = options.audience ?? safeEnv('BEEUNI_AUTH_AUDIENCE');
+    if (!jwks)
+        return refuse('no key set configured (BEEUNI_AUTH_JWKS)');
+    if (audience !== false && !audience) {
+        return refuse('no audience configured (BEEUNI_AUTH_AUDIENCE, or `audience: false` to accept any App)');
+    }
+    const parts = typeof token === 'string' ? token.split('.') : [];
+    if (parts.length !== 3)
+        return refuse('malformed');
+    const [head, body, signature] = parts;
+    let header;
+    let claims;
+    try {
+        header = base64UrlJson(head);
+        claims = base64UrlJson(body);
+    }
+    catch {
+        return refuse('malformed');
+    }
+    if (header.alg !== 'ES256')
+        return refuse('unsupported algorithm');
+    let keySet;
+    try {
+        keySet = await loadKeySet(jwks, options.fetch ?? ((input, init) => fetch(input, init)));
+    }
+    catch {
+        return refuse('key set unavailable');
+    }
+    const candidates = (keySet.keys ?? []).filter((key) => key.kty === 'EC' && (header.kid === undefined || key.kid === header.kid));
+    if (candidates.length === 0)
+        return refuse('unknown key');
+    const signed = new TextEncoder().encode(`${head}.${body}`);
+    let signatureBytes;
+    try {
+        signatureBytes = base64UrlBytes(signature);
+    }
+    catch {
+        return refuse('malformed');
+    }
+    let valid = false;
+    for (const jwk of candidates) {
+        try {
+            const { kid: _kid, alg: _alg, use: _use, key_ops: _ops, ...material } = jwk;
+            const key = await crypto.subtle.importKey('jwk', material, { name: 'ECDSA', namedCurve: 'P-256' }, false, [
+                'verify',
+            ]);
+            if (await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, signatureBytes, signed)) {
+                valid = true;
+                break;
+            }
+        }
+        catch {
+        }
+    }
+    if (!valid)
+        return refuse('bad signature');
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    if (typeof claims.exp !== 'number' || claims.exp + CLOCK_SKEW_SECONDS < nowSeconds)
+        return refuse('expired');
+    if (issuer && claims.iss !== issuer)
+        return refuse('wrong issuer');
+    if (audience) {
+        const aud = claims.aud;
+        if (!(aud === audience || (Array.isArray(aud) && aud.includes(audience))))
+            return refuse('wrong audience');
+    }
+    const member = readBeeuniMember(claims);
+    if (!member)
+        return refuse('no subject');
+    return member;
+}

package/dist/core/auth/session.d.ts

@@ -0,0 +1,24 @@
+import { type AuthRequestOptions, type AuthSession, type AuthUser } from '../rest/platform-client/auth.js';
+export interface BeeuniSessionStorage {
+    get(): Promise<string | null> | string | null;
+    set(value: string): Promise<void> | void;
+    remove(): Promise<void> | void;
+}
+export interface BeeuniSessionOptions {
+    storage?: BeeuniSessionStorage;
+    onChange?: (session: AuthSession | null) => void;
+    refreshSkewSeconds?: number;
+    request?: AuthRequestOptions;
+    now?: () => number;
+}
+export interface BeeuniSession {
+    current(): AuthSession | null;
+    set(session: AuthSession | null, user?: AuthUser | null): Promise<void>;
+    user(): AuthUser | null;
+    getToken(): Promise<string | null>;
+    refresh(): Promise<AuthSession | null>;
+    clear(): Promise<void>;
+    load(): Promise<AuthSession | null>;
+    subscribe(listener: (session: AuthSession | null) => void): () => void;
+}
+export declare function createBeeuniSession(options?: BeeuniSessionOptions): BeeuniSession;

package/dist/core/auth/session.js

@@ -0,0 +1,145 @@
+import { refreshSession } from '../rest/platform-client/auth.js';
+export function createBeeuniSession(options = {}) {
+    const skew = options.refreshSkewSeconds ?? 60;
+    const now = options.now ?? (() => Date.now());
+    let session = null;
+    let user = null;
+    let loaded = !options.storage;
+    let loading = null;
+    let inflight = null;
+    let generation = 0;
+    const listeners = new Set();
+    const expiresAt = (s) => (s.expires_at ?? 0) * 1000;
+    const needsRefresh = (s) => expiresAt(s) - skew * 1000 <= now();
+    async function persist() {
+        if (options.storage) {
+            if (session)
+                await options.storage.set(JSON.stringify({ session, user }));
+            else
+                await options.storage.remove();
+        }
+        for (const listener of [...listeners]) {
+            try {
+                listener(session);
+            }
+            catch {
+            }
+        }
+        try {
+            options.onChange?.(session);
+        }
+        catch {
+        }
+    }
+    async function load() {
+        if (loaded)
+            return session;
+        if (!loading) {
+            const startedAt = generation;
+            const pending = (async () => {
+                const raw = await options.storage.get();
+                if (startedAt === generation && raw) {
+                    try {
+                        const parsed = JSON.parse(raw);
+                        if (parsed.session?.access_token && parsed.session?.refresh_token) {
+                            session = parsed.session;
+                            user = parsed.user ?? null;
+                        }
+                    }
+                    catch {
+                        session = null;
+                    }
+                }
+                loaded = true;
+                return session;
+            })();
+            loading = pending;
+            pending.then(() => {
+                if (loading === pending)
+                    loading = null;
+            }, () => {
+                if (loading === pending)
+                    loading = null;
+            });
+        }
+        return loading;
+    }
+    async function refresh() {
+        await load();
+        if (!session)
+            return null;
+        if (!inflight) {
+            const token = session.refresh_token;
+            const startedAt = generation;
+            const request = refreshSession({ refresh_token: token }, options.request)
+                .then(async (result) => {
+                if (startedAt !== generation)
+                    return session;
+                session = result.session;
+                if (result.user)
+                    user = result.user;
+                await persist();
+                return session;
+            })
+                .catch(async (err) => {
+                if (startedAt !== generation)
+                    return session;
+                const status = err && typeof err === 'object' && 'status' in err ? err.status : 0;
+                if (status >= 400 && status < 500) {
+                    session = null;
+                    user = null;
+                    await persist();
+                    return null;
+                }
+                throw err;
+            })
+                .finally(() => {
+                if (inflight === request)
+                    inflight = null;
+            });
+            inflight = request;
+        }
+        return inflight;
+    }
+    return {
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        current: () => session,
+        user: () => user,
+        load,
+        async set(next, nextUser) {
+            await load();
+            generation += 1;
+            inflight = null;
+            session = next;
+            if (nextUser !== undefined)
+                user = nextUser;
+            if (!next)
+                user = null;
+            await persist();
+        },
+        async getToken() {
+            await load();
+            if (!session)
+                return null;
+            if (needsRefresh(session)) {
+                const refreshed = await refresh().catch(() => session);
+                return refreshed?.access_token ?? null;
+            }
+            return session.access_token;
+        },
+        refresh,
+        async clear() {
+            generation += 1;
+            inflight = null;
+            session = null;
+            user = null;
+            loaded = true;
+            await persist();
+        },
+    };
+}

package/dist/core/cache/persisted-query-cache.d.ts

@@ -0,0 +1,55 @@
+export interface KeyValueStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+export interface PersistableQuery {
+    queryKey: readonly unknown[];
+    state: {
+        data: unknown;
+        dataUpdatedAt: number;
+    };
+}
+export interface PersistableQueryClient {
+    getQueryCache(): {
+        getAll(): readonly PersistableQuery[];
+        subscribe(listener: (event: {
+            type: string;
+            query: PersistableQuery;
+        }) => void): () => void;
+    };
+    getQueryState(queryKey: readonly unknown[]): {
+        data?: unknown;
+        dataUpdatedAt: number;
+    } | undefined;
+    setQueryData(queryKey: readonly unknown[], data: unknown, options?: {
+        updatedAt?: number;
+    }): unknown;
+    invalidateQueries?(filters: {
+        queryKey: readonly unknown[];
+        exact?: boolean;
+        refetchType?: 'none';
+    }): unknown;
+}
+export interface PersistedQueryCacheOptions {
+    storage: KeyValueStorage;
+    userId: string;
+    shouldPersist: (queryKey: readonly unknown[]) => boolean;
+    version?: string;
+    maxAgeMs?: number;
+    maxBytes?: number;
+    throttleMs?: number;
+    namespace?: string;
+    now?: () => number;
+}
+export interface PersistedQueryCache {
+    readonly storageKey: string;
+    restore(client: PersistableQueryClient): number | Promise<number>;
+    persist(client: PersistableQueryClient): () => void;
+    flush(): Promise<void>;
+    clear(): Promise<void>;
+}
+export declare const PERSISTED_QUERY_CACHE_VERSION = "1";
+export declare function isPersistableQueryKey(queryKey: readonly unknown[]): boolean;
+export declare function createPersistedQueryCache(options: PersistedQueryCacheOptions): PersistedQueryCache;
+export declare function browserKeyValueStorage(): KeyValueStorage | null;

package/dist/core/cache/persisted-query-cache.js

@@ -0,0 +1,220 @@
+export const PERSISTED_QUERY_CACHE_VERSION = '1';
+const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const DEFAULT_MAX_BYTES = 1_000_000;
+const DEFAULT_THROTTLE_MS = 1_000;
+const DEFAULT_NAMESPACE = 'beeuni.query-cache';
+function isPromise(value) {
+    return !!value && typeof value.then === 'function';
+}
+function settle(value) {
+    return isPromise(value) ? value : Promise.resolve();
+}
+export function isPersistableQueryKey(queryKey) {
+    if (queryKey[0] !== 'kx')
+        return false;
+    const family = queryKey[1];
+    if (family === 'accounts') {
+        return queryKey.length === 3 && typeof queryKey[2] === 'string' && queryKey[2] !== 'anonymous';
+    }
+    if (family === 'projects')
+        return queryKey.length === 3;
+    if (family !== 'project' || typeof queryKey[2] !== 'string')
+        return false;
+    const segment = queryKey[3];
+    if (queryKey.length === 4)
+        return segment === 'summary' || segment === 'detail';
+    if (segment !== 'sessions')
+        return false;
+    if (queryKey.length === 6)
+        return queryKey[4] === 'list-paged';
+    if (queryKey.length === 7 && queryKey[4] === 'list-paged') {
+        const filters = queryKey[6];
+        return typeof filters === 'object' && filters !== null && !filters.q;
+    }
+    if (queryKey.length === 7 && queryKey[4] === 'list-children')
+        return queryKey[6] === '';
+    return queryKey.length === 5 && queryKey[4] !== 'list' && queryKey[4] !== 'list-paged';
+}
+export function createPersistedQueryCache(options) {
+    const { storage, userId, shouldPersist, version = PERSISTED_QUERY_CACHE_VERSION, maxAgeMs = DEFAULT_MAX_AGE_MS, maxBytes = DEFAULT_MAX_BYTES, throttleMs = DEFAULT_THROTTLE_MS, namespace = DEFAULT_NAMESPACE, now = () => Date.now(), } = options;
+    const storageKey = `${namespace}:${userId}`;
+    let attached = null;
+    let dirty = false;
+    let timer = null;
+    let writing = Promise.resolve();
+    const forget = () => {
+        try {
+            return settle(storage.removeItem(storageKey)).catch(() => undefined);
+        }
+        catch {
+            return Promise.resolve();
+        }
+    };
+    const apply = (client, raw) => {
+        if (!raw)
+            return 0;
+        let stored;
+        try {
+            stored = JSON.parse(raw);
+        }
+        catch {
+            void forget();
+            return 0;
+        }
+        if (!stored ||
+            stored.v !== version ||
+            stored.user !== userId ||
+            !Array.isArray(stored.queries) ||
+            now() - stored.at > maxAgeMs) {
+            void forget();
+            return 0;
+        }
+        let restored = 0;
+        for (const entry of stored.queries) {
+            if (!entry || !Array.isArray(entry.k) || entry.d === undefined)
+                continue;
+            if (typeof entry.t !== 'number' || now() - entry.t > maxAgeMs)
+                continue;
+            if (!shouldPersist(entry.k))
+                continue;
+            const current = client.getQueryState(entry.k);
+            if (current && current.data !== undefined && current.dataUpdatedAt >= entry.t)
+                continue;
+            client.setQueryData(entry.k, entry.d, { updatedAt: entry.t });
+            void client.invalidateQueries?.({ queryKey: entry.k, exact: true, refetchType: 'none' });
+            restored += 1;
+        }
+        return restored;
+    };
+    const snapshot = (client) => client
+        .getQueryCache()
+        .getAll()
+        .filter((query) => query.state.data !== undefined && shouldPersist(query.queryKey))
+        .map((query) => ({ k: query.queryKey, d: query.state.data, t: query.state.dataUpdatedAt }))
+        .sort((a, b) => b.t - a.t);
+    const fit = (entries, budget) => {
+        const kept = [];
+        let used = 0;
+        for (const entry of entries) {
+            const size = JSON.stringify(entry).length + 1;
+            if (used + size > budget)
+                continue;
+            kept.push(entry);
+            used += size;
+        }
+        return kept;
+    };
+    const write = async (client) => {
+        let entries = fit(snapshot(client), maxBytes);
+        while (true) {
+            const payload = { v: version, user: userId, at: now(), queries: entries };
+            try {
+                await settle(storage.setItem(storageKey, JSON.stringify(payload)));
+                return;
+            }
+            catch {
+                if (entries.length === 0)
+                    return;
+                entries = entries.slice(0, Math.floor(entries.length / 2));
+            }
+        }
+    };
+    const cancelTimer = () => {
+        if (timer === null)
+            return;
+        clearTimeout(timer);
+        timer = null;
+    };
+    const writeNow = () => {
+        cancelTimer();
+        const client = attached;
+        if (!client || !dirty)
+            return writing;
+        dirty = false;
+        writing = writing.then(() => write(client)).catch(() => undefined);
+        return writing;
+    };
+    const schedule = () => {
+        dirty = true;
+        if (timer !== null)
+            return;
+        timer = setTimeout(() => {
+            timer = null;
+            void writeNow();
+        }, throttleMs);
+    };
+    return {
+        storageKey,
+        restore(client) {
+            let raw;
+            try {
+                raw = storage.getItem(storageKey);
+            }
+            catch {
+                return 0;
+            }
+            if (isPromise(raw)) {
+                return raw.then((value) => apply(client, value)).catch(() => 0);
+            }
+            return apply(client, raw);
+        },
+        persist(client) {
+            attached = client;
+            dirty = true;
+            const unsubscribe = client.getQueryCache().subscribe((event) => {
+                if (event.type !== 'updated' && event.type !== 'removed' && event.type !== 'added')
+                    return;
+                if (!shouldPersist(event.query.queryKey))
+                    return;
+                schedule();
+            });
+            return () => {
+                unsubscribe();
+                if (attached !== client)
+                    return;
+                attached = null;
+                cancelTimer();
+            };
+        },
+        flush() {
+            return writeNow();
+        },
+        async clear() {
+            cancelTimer();
+            attached = null;
+            dirty = false;
+            await writing;
+            await forget();
+        },
+    };
+}
+export function browserKeyValueStorage() {
+    let found;
+    try {
+        found = globalThis.localStorage;
+    }
+    catch {
+        found = undefined;
+    }
+    if (!found)
+        return null;
+    const local = found;
+    return {
+        getItem: (key) => {
+            try {
+                return local.getItem(key);
+            }
+            catch {
+                return null;
+            }
+        },
+        setItem: (key, value) => local.setItem(key, value),
+        removeItem: (key) => {
+            try {
+                local.removeItem(key);
+            }
+            catch {
+            }
+        },
+    };
+}