@burdenoff/fluidgrids-fe-sdk 2026.1113.1 → 2026.1113.2

package/dist/token-refresh-link-BjN7H4qA.js

@@ -0,0 +1,291 @@
+"use client";
+import { c as setFluidGridsConfig, i as getFluidGridsTokenRevision, t as config } from "./config-X97zrIvn.js";
+import { a as operationErrorCode, i as isUnauthenticatedError, n as hasUnauthenticatedGraphQLError, t as describeOperationError } from "./errors-xPZ-IbQd.js";
+import { ApolloLink, Observable } from "@apollo/client/core";
+
+// src/graphql/live-tokens.ts
+/**
+* Token reader for an SDK-created Apollo client (BOFF-9961).
+*
+* The client starts with the tokens it was created with. Once a token is set
+* in the SDK config after that — a refresh through `auth.onTokenExpired`, or
+* a host calling `setFluidGridsConfig({ authToken })` — every later request
+* reads the configured value instead. Reading per request (never capturing
+* the token in a closure) is what lets a refreshed token reach in-flight
+* retries and websocket reconnects.
+*/
+function createLiveTokenReader(initial) {
+	const createdAt = getFluidGridsTokenRevision();
+	return () => {
+		if (getFluidGridsTokenRevision() === createdAt) return initial;
+		return {
+			authToken: config.authToken ?? initial.authToken,
+			workspaceToken: config.workspaceToken ?? initial.workspaceToken
+		};
+	};
+}
+
+// src/events/eventBus.ts
+/**
+* Host event bus for embedders (BOFF-9961).
+*
+* The SDK reports what happens inside the embedded builder to the host page
+* through one typed callback, `onEvent`, set on `FluidGridsConfig` (or the
+* `onEvent` prop of `FluidGridsProvider`). Hosts use it to sync their own UI,
+* analytics or backend: a workflow was saved or activated, a run started or
+* finished, the user selected a node, something failed.
+*
+* This bus is separate from the product-analytics emitters in
+* `analytics/fluidgridsEvents.ts`, which publish `fluidgrids.*` facts on the
+* fe-libs shell bus for Rybbit/OTel. Those stay as they are; this one is the
+* documented, versioned contract for third-party hosts.
+*
+* Versioning: {@link FLUIDGRIDS_EVENTS_VERSION} follows semver.
+*  - A new event name, or a new optional payload field, is a minor bump.
+*  - Removing or renaming an event, removing a payload field, or changing a
+*    field's type or meaning is a major bump (and a breaking SDK release).
+*
+* Delivery: events are synchronous and best effort. A handler that throws is
+* caught and logged with a warning; it never breaks the SDK action that
+* emitted the event.
+*
+* @module events/eventBus
+*/
+/** Version of the host event contract. See the module note for the rules. */
+const FLUIDGRIDS_EVENTS_VERSION = "1.1.0";
+/** Every host event name, in documentation order. */
+const FLUIDGRIDS_EVENT_NAMES = [
+	"workflow:saved",
+	"workflow:activated",
+	"run:started",
+	"run:completed",
+	"node:selected",
+	"error",
+	"auth:failed",
+	"builder:fullscreen"
+];
+/** Drop undefined keys so hosts see only the fields that are known. */
+function withoutUndefined(payload) {
+	return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== void 0));
+}
+/**
+* Deliver one host event. Never throws: a missing handler is a no-op and a
+* handler that throws is logged, so SDK code can call this anywhere.
+*/
+function emitFluidGridsEvent(name, payload) {
+	let handler;
+	try {
+		handler = config.onEvent;
+	} catch {
+		return;
+	}
+	if (typeof handler !== "function") return;
+	try {
+		const args = [name, withoutUndefined(payload)];
+		handler(...args);
+	} catch (error) {
+		console.warn(`[FluidGrids SDK] onEvent handler failed for ${name}`, error);
+	}
+}
+/**
+* Emit an `error` event for a failed SDK operation: the user-presentable
+* message and, when the gateway sent one, its error code.
+*/
+function emitOperationErrorEvent(source, error) {
+	emitFluidGridsEvent("error", {
+		source,
+		message: describeOperationError(error),
+		code: operationErrorCode(error)
+	});
+}
+const MAX_COMPLETED_RUNS = 500;
+const completedRuns = /* @__PURE__ */ new Set();
+/**
+* Emit `run:completed` once per run id. Later calls for the same run (a
+* second poll that sees the terminal status, a remounted builder following
+* the same run) are ignored.
+*/
+function emitRunCompletedOnce(payload) {
+	if (!payload.runId || completedRuns.has(payload.runId)) return;
+	completedRuns.add(payload.runId);
+	if (completedRuns.size > MAX_COMPLETED_RUNS) {
+		const oldest = completedRuns.values().next().value;
+		if (oldest !== void 0) completedRuns.delete(oldest);
+	}
+	emitFluidGridsEvent("run:completed", payload);
+}
+
+// src/graphql/token-refresh-link.ts
+/**
+* Token refresh on expiry (BOFF-9961).
+*
+* Workspace tokens are short-lived, so a builder left open outlives the token
+* it was mounted with. The gateway then answers 401 with a GraphQL
+* `UNAUTHENTICATED` error (category `CREDENTIAL_EXPIRED` / `_REVOKED`). This
+* link catches that, asks the host for a fresh token through
+* `auth.onTokenExpired`, stores it in the SDK config, and retries the failed
+* operation once with the new headers.
+*
+* Rules:
+*  - one refresh at a time: operations that fail while a refresh is running
+*    wait for the same promise instead of calling the host again, and an
+*    operation that was sent before a refresh finished retries with the
+*    token that refresh produced;
+*  - each operation is retried at most once, so a token the gateway keeps
+*    refusing can never loop;
+*  - when the host cannot refresh (the callback rejects or returns no token),
+*    `auth:failed` is emitted and the operation fails with its ORIGINAL error;
+*  - an operation sent before a refresh attempt that has since FAILED does
+*    not start a new one: its 401 is the same expired session that attempt
+*    already reported, so it fails with its original error and no second
+*    `auth:failed`. Only an operation sent after the failure (the host may
+*    have recovered, e.g. the user signed in again) may try a fresh refresh.
+*
+* @module graphql/token-refresh-link
+*/
+let inFlight = null;
+let refreshGeneration = 0;
+let lastRefreshed = null;
+let settledAttempts = 0;
+let lastFailedAttempt = 0;
+function normalizeTokens(value) {
+	if (typeof value === "string") return value.trim() ? { authToken: value } : null;
+	if (!value || typeof value !== "object") return null;
+	const tokens = {};
+	if (typeof value.authToken === "string" && value.authToken.trim()) tokens.authToken = value.authToken;
+	if (typeof value.workspaceToken === "string" && value.workspaceToken.trim()) tokens.workspaceToken = value.workspaceToken;
+	return tokens.authToken || tokens.workspaceToken ? tokens : null;
+}
+function storeInConfig(tokens) {
+	setFluidGridsConfig(tokens);
+}
+/**
+* Run the host refresh callback, sharing one call between concurrent
+* failures. Resolves with the fresh tokens, or null when the host could not
+* provide any (after emitting `auth:failed`).
+*/
+function refreshTokens(callback, store) {
+	if (inFlight) return inFlight;
+	const fail = (message) => {
+		settledAttempts += 1;
+		lastFailedAttempt = settledAttempts;
+		emitFluidGridsEvent("auth:failed", { message });
+		return null;
+	};
+	const run = (async () => {
+		try {
+			const tokens = normalizeTokens(await callback());
+			if (!tokens) return fail("onTokenExpired returned no token.");
+			store(tokens);
+			settledAttempts += 1;
+			refreshGeneration += 1;
+			lastRefreshed = tokens;
+			return tokens;
+		} catch (error) {
+			return fail(describeOperationError(error, "Token refresh failed."));
+		}
+	})();
+	inFlight = run;
+	run.finally(() => {
+		if (inFlight === run) inFlight = null;
+	});
+	return run;
+}
+function withTokenHeaders(headers, tokens) {
+	return {
+		...headers,
+		...tokens.authToken && { authorization: `Bearer ${tokens.authToken}` },
+		...tokens.workspaceToken && { "x-workspace-authorization": `Bearer ${tokens.workspaceToken}` }
+	};
+}
+function resultIsUnauthenticated(result) {
+	return hasUnauthenticatedGraphQLError(result.errors);
+}
+/**
+* Apollo link that refreshes an expired token and retries once.
+*
+* The SDK adds it to the clients it creates (`createFluidGridsClient`,
+* `createGlobalStoreClient`, `createFluidGridsClients`). Hosts that inject
+* their own Apollo client add it to their chain, BEFORE the link that sets the
+* `authorization` header, and either read the token from the SDK config in
+* that link or pass `onTokenRefreshed`:
+*
+* ```ts
+* const link = ApolloLink.from([
+*   createFluidGridsTokenRefreshLink(),
+*   authLink, // reads getFluidGridsConfig().authToken per request
+*   httpLink,
+* ]);
+* ```
+*
+* The retried operation also carries the new token in its own headers, so it
+* works when the host's auth link runs first, too — as long as that link
+* does not overwrite an `authorization` header it finds.
+*/
+function createFluidGridsTokenRefreshLink(options = {}) {
+	return new ApolloLink((operation, forward) => {
+		const store = options.onTokenRefreshed ?? storeInConfig;
+		return new Observable((observer) => {
+			const sentInGeneration = refreshGeneration;
+			const sentAfterAttempts = settledAttempts;
+			let retried = false;
+			let closed = false;
+			let current = null;
+			const pickRefresh = (callback) => {
+				if (refreshGeneration !== sentInGeneration && lastRefreshed) return Promise.resolve(lastRefreshed);
+				if (lastFailedAttempt > sentAfterAttempts) return Promise.resolve(null);
+				return refreshTokens(callback, store);
+			};
+			const retryOrFail = (fail) => {
+				const callback = options.onTokenExpired ?? config.auth?.onTokenExpired;
+				if (!callback) return false;
+				retried = true;
+				current?.unsubscribe();
+				current = null;
+				pickRefresh(callback).then((tokens) => {
+					if (closed) return;
+					if (!tokens) {
+						fail();
+						return;
+					}
+					const headers = operation.getContext().headers;
+					operation.setContext({ headers: withTokenHeaders(headers && typeof headers === "object" ? headers : void 0, tokens) });
+					subscribe();
+				});
+				return true;
+			};
+			const subscribe = () => {
+				let refreshing = false;
+				current = forward(operation).subscribe({
+					next: (result) => {
+						if (!retried && resultIsUnauthenticated(result) && retryOrFail(() => {
+							observer.next(result);
+							observer.complete();
+						})) {
+							refreshing = true;
+							return;
+						}
+						observer.next(result);
+					},
+					error: (error) => {
+						if (!retried && isUnauthenticatedError(error) && retryOrFail(() => observer.error(error))) {
+							refreshing = true;
+							return;
+						}
+						observer.error(error);
+					},
+					complete: () => {
+						if (!refreshing) observer.complete();
+					}
+				});
+			};
+			subscribe();
+			return () => {
+				closed = true;
+				current?.unsubscribe();
+			};
+		});
+	});
+}
+
+export { emitOperationErrorEvent as a, emitFluidGridsEvent as i, FLUIDGRIDS_EVENTS_VERSION as n, emitRunCompletedOnce as o, FLUIDGRIDS_EVENT_NAMES as r, createLiveTokenReader as s, createFluidGridsTokenRefreshLink as t };