@camstack/sdk 1.2.127 → 1.2.129

package/dist/index.js

@@ -666,6 +666,9 @@ SuperJSON.allowErrorProps;
 * ui-library Provider can seed React Query with the same WS connection
 * — a future phase will narrow the surface further.
 */
+function refreshFlag(options) {
+	return options.refreshable === true ? { refreshable: true } : {};
+}
 var WS_KEEP_ALIVE_INTERVAL_MS = 1e4;
 var WS_KEEP_ALIVE_PONG_TIMEOUT_MS = 6e3;
 var WS_RECONNECT_RETRY_DELAY_MS = 2e3;
@@ -945,10 +948,11 @@ var System = class {
 		this.mirror = null;
 		this.mirrorInit = null;
 	}
-	async login(username, password) {
+	async login(username, password, options = {}) {
 		const result = await this._trpcClient.auth.login.mutate({
 			username,
-			password
+			password,
+			...refreshFlag(options)
 		});
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const r = result;
@@ -965,10 +969,11 @@ var System = class {
 	* server mints the real session JWT, which we set as the active
 	* token on this client.
 	*/
-	async loginVerifyTotp(challengeToken, code) {
+	async loginVerifyTotp(challengeToken, code, options = {}) {
 		const result = await this._trpcClient.auth.loginVerifyTotp.mutate({
 			challengeToken,
-			code
+			code,
+			...refreshFlag(options)
 		});
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const token = result.token;
@@ -989,10 +994,11 @@ var System = class {
 	* success the server mints the real session JWT, which we set as the
 	* active token on this client.
 	*/
-	async loginVerifyPasskey(challengeToken, response) {
+	async loginVerifyPasskey(challengeToken, response, options = {}) {
 		const result = await this._trpcClient.auth.loginVerifyPasskey.mutate({
 			challengeToken,
-			response
+			response,
+			...refreshFlag(options)
 		});
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const token = result.token;
@@ -1021,8 +1027,11 @@ var System = class {
 	* `secondFactors`. That token is NOT persisted as the active session
 	* — the caller completes the remaining factor via `loginVerifyTotp`.
 	*/
-	async passkeyLoginFinish(response) {
-		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({ response });
+	async passkeyLoginFinish(response, options = {}) {
+		const result = await this._trpcClient.auth.passkeyLoginFinish.mutate({
+			response,
+			...refreshFlag(options)
+		});
 		if (typeof result === "object" && result !== null && "token" in result) {
 			const r = result;
 			const requiresSecondFactor = r.requiresTotp === true || Array.isArray(r.secondFactors) && r.secondFactors.length > 0;
@@ -1030,8 +1039,22 @@ var System = class {
 		}
 		return result;
 	}
-	async logout() {
-		await this._trpcClient.auth.logout.mutate();
+	/**
+	* Swap a refresh token for a new access token and a ROTATED refresh token
+	* (the old one stops working). Sets the new access token on this client.
+	* Throws a tRPC UNAUTHORIZED when the session is over — sign in again.
+	*/
+	async refreshSession(refreshToken) {
+		const result = await this._trpcClient.auth.refreshSession.mutate({ refreshToken });
+		this.setToken(result.token);
+		return result;
+	}
+	/**
+	* End this session on the hub (its tokens stop working at once);
+	* `everywhere: true` ends every session of the user.
+	*/
+	async logout(options = {}) {
+		await this._trpcClient.auth.logout.mutate(options.everywhere === true ? { everywhere: true } : void 0);
 	}
 	async getMe() {
 		return await this._trpcClient.auth.me.query();
@@ -1045,8 +1068,25 @@ var System = class {
 	async confirmOwnTotp(input) {
 		return await this._trpcClient.auth.confirmOwnTotp.mutate(input);
 	}
-	async disableOwnTotp() {
-		return await this._trpcClient.auth.disableOwnTotp.mutate();
+	/** Needs a fresh `reauthToken` from {@link reauthenticate}. */
+	async disableOwnTotp(input) {
+		return await this._trpcClient.auth.disableOwnTotp.mutate(input);
+	}
+	/**
+	* Re-authentication, passkey path step 1: assertion options for the
+	* caller's own passkeys. Feed `optionsJSON` to `startAuthentication`, then
+	* pass the result to {@link reauthenticate} as `passkeyResponse`.
+	*/
+	async reauthBeginPasskey() {
+		return await this._trpcClient.auth.reauthBeginPasskey.mutate();
+	}
+	/**
+	* Prove it is you — the current password or a passkey assertion — for a
+	* 5-minute `reauthToken`, required by `disableOwnTotp`, `removeOwnPasskey`
+	* and `auth.beginExternalLink` (valid only in this session).
+	*/
+	async reauthenticate(input) {
+		return await this._trpcClient.auth.reauthenticate.mutate(input);
 	}
 	async getOwnTotpStatus() {
 		return await this._trpcClient.auth.getOwnTotpStatus.query();
@@ -1060,6 +1100,7 @@ var System = class {
 	async listOwnPasskeys() {
 		return await this._trpcClient.auth.listOwnPasskeys.query();
 	}
+	/** Needs a fresh `reauthToken` from {@link reauthenticate}. */
 	async removeOwnPasskey(input) {
 		return await this._trpcClient.auth.removeOwnPasskey.mutate(input);
 	}
@@ -1409,6 +1450,119 @@ async function raceFastestEndpoint(candidates, timeoutMs) {
 	}
 }
 //#endregion
+//#region src/session-keeper.ts
+var DEFAULT_MARGIN_MS = 5 * 6e4;
+var RETRY_MS = 3e4;
+var MIN_DELAY_MS = 1e3;
+/** Decode a JWT's `exp` (seconds) to epoch ms, or `null`. Never throws. */
+function jwtExpiresAt(token) {
+	const part = token.split(".")[1];
+	if (part === void 0) return null;
+	try {
+		const base64 = part.replace(/-/g, "+").replace(/_/g, "/");
+		const json = typeof atob === "function" ? atob(base64) : Buffer.from(base64, "base64").toString("utf8");
+		const payload = JSON.parse(json);
+		if (payload === null || typeof payload !== "object") return null;
+		const exp = Reflect.get(payload, "exp");
+		return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
+	} catch {
+		return null;
+	}
+}
+/** Is `error` the hub saying the session is over (as opposed to a transport failure)? */
+function isSessionRefusal(error) {
+	if (error === null || typeof error !== "object") return false;
+	const data = Reflect.get(error, "data");
+	const code = data !== null && typeof data === "object" ? Reflect.get(data, "code") : void 0;
+	return code === "UNAUTHORIZED" || code === "FORBIDDEN";
+}
+var SessionKeeper = class {
+	options;
+	current = null;
+	cancel = null;
+	inflight = null;
+	now;
+	setTimer;
+	constructor(options) {
+		this.options = options;
+		this.now = options.now ?? Date.now;
+		this.setTimer = options.setTimer ?? ((fn, ms) => {
+			const handle = setTimeout(fn, ms);
+			return () => clearTimeout(handle);
+		});
+	}
+	/** Take over `tokens` (a login, a restore from storage) and schedule its refresh. */
+	adopt(tokens) {
+		this.current = tokens;
+		this.schedule();
+	}
+	/** The tokens the keeper holds now. */
+	tokens() {
+		return this.current;
+	}
+	/**
+	* Refresh now if the access token expires within `marginMs` (default: the
+	* keeper's margin) — call it before reconnecting after the app was in the
+	* background. Resolves when done; concurrent callers share one refresh.
+	*/
+	async ensureFresh(marginMs = this.margin()) {
+		const current = this.current;
+		if (current?.refreshToken === void 0) return;
+		const expiresAt = this.expiresAtOf(current);
+		if (expiresAt !== null && expiresAt - this.now() > marginMs) return;
+		await this.refreshNow();
+	}
+	/** Refresh immediately. `null` when there is nothing to refresh or it failed. */
+	refreshNow() {
+		if (this.inflight !== null) return this.inflight;
+		const refreshToken = this.current?.refreshToken;
+		if (refreshToken === void 0) return Promise.resolve(null);
+		this.inflight = this.options.refresh(refreshToken).then((next) => {
+			this.current = next;
+			this.options.onTokens(next);
+			this.schedule();
+			return next;
+		}).catch((error) => {
+			if (isSessionRefusal(error)) {
+				this.stop();
+				this.current = null;
+				this.options.onExpired();
+			} else this.arm(RETRY_MS);
+			return null;
+		}).finally(() => {
+			this.inflight = null;
+		});
+		return this.inflight;
+	}
+	stop() {
+		this.cancel?.();
+		this.cancel = null;
+	}
+	margin() {
+		return this.options.marginMs ?? DEFAULT_MARGIN_MS;
+	}
+	expiresAtOf(tokens) {
+		return tokens.expiresAt ?? jwtExpiresAt(tokens.token);
+	}
+	schedule() {
+		this.stop();
+		const current = this.current;
+		if (current?.refreshToken === void 0) return;
+		const expiresAt = this.expiresAtOf(current);
+		if (expiresAt === null) return;
+		const remaining = expiresAt - this.now();
+		const margin = Math.min(this.margin(), Math.max(0, remaining / 2));
+		this.arm(Math.max(MIN_DELAY_MS, remaining - margin));
+	}
+	arm(ms) {
+		this.stop();
+		this.cancel = this.setTimer(() => {
+			this.cancel = null;
+			this.refreshNow();
+		}, ms);
+	}
+};
+//#endregion
 //#region src/detection.ts
 /**
 * Detection classes — shared between CamStack app and proxy.
@@ -1622,6 +1776,9 @@ var sensorLabelClasses = [
 	"flooded",
 	"entry_open"
 ];
+function listIncludes(list, value) {
+	return list.includes(value);
+}
 var detectionClassesDefaultMap = {
 	...animalClasses.reduce((tot, curr) => ({
 		...tot,
@@ -1668,16 +1825,16 @@ var detectionClassesDefaultMap = {
 		[curr]: "sensor"
 	}), {})
 };
-var isFaceClassname = (c) => faceClasses.includes(c);
-var isPlateClassname = (c) => licensePlateClasses.includes(c);
-var isAnimalClassname = (c) => animalClasses.includes(c);
-var isPersonClassname = (c) => personClasses.includes(c);
-var isVehicleClassname = (c) => vehicleClasses.includes(c);
-var isMotionClassname = (c) => motionClasses.includes(c);
-var isDoorbellClassname = (c) => doorbellClasses.includes(c);
-var isPackageClassname = (c) => packageClasses.includes(c);
-var isAudioClassname = (c) => audioClasses.includes(c) || audioLabelClasses.includes(c);
-var isSensorLabelClassname = (c) => sensorLabelClasses.includes(c);
+var isFaceClassname = (c) => listIncludes(faceClasses, c);
+var isPlateClassname = (c) => listIncludes(licensePlateClasses, c);
+var isAnimalClassname = (c) => listIncludes(animalClasses, c);
+var isPersonClassname = (c) => listIncludes(personClasses, c);
+var isVehicleClassname = (c) => listIncludes(vehicleClasses, c);
+var isMotionClassname = (c) => listIncludes(motionClasses, c);
+var isDoorbellClassname = (c) => listIncludes(doorbellClasses, c);
+var isPackageClassname = (c) => listIncludes(packageClasses, c);
+var isAudioClassname = (c) => listIncludes(audioClasses, c) || listIncludes(audioLabelClasses, c);
+var isSensorLabelClassname = (c) => listIncludes(sensorLabelClasses, c);
 var isLabelDetection = (c) => isFaceClassname(c) || isPlateClassname(c);
 var getParentClass = (className) => detectionClassesDefaultMap[className];
 var getParentDetectionClass = (det) => {
@@ -1721,4 +1878,4 @@ function getClassesForTimelinePreset(preset, customClasses) {
 	}
 }
 //#endregion
-export { DEFAULT_ENABLED_CLASSES, DetectionClass, System, TIMELINE_PRESET_ALL, TIMELINE_PRESET_CRITICAL, TIMELINE_PRESET_IMPORTANT, animalClasses, audioClasses, audioLabelClasses, createSystem, defaultDetectionClasses, detectionClassesDefaultMap, doorbellClasses, faceClasses, getClassesForTimelinePreset, getParentClass, getParentDetectionClass, isAnimalClassname, isAudioClassname, isDoorbellClassname, isFaceClassname, isLabelDetection, isMotionClassname, isPackageClassname, isPersonClassname, isPlateClassname, isSensorLabelClassname, isVehicleClassname, licensePlateClasses, motionClasses, packageClasses, personClasses, raceFastestEndpoint, sensorLabelClasses, vehicleClasses };
+export { DEFAULT_ENABLED_CLASSES, DetectionClass, SessionKeeper, System, TIMELINE_PRESET_ALL, TIMELINE_PRESET_CRITICAL, TIMELINE_PRESET_IMPORTANT, animalClasses, audioClasses, audioLabelClasses, createSystem, defaultDetectionClasses, detectionClassesDefaultMap, doorbellClasses, faceClasses, getClassesForTimelinePreset, getParentClass, getParentDetectionClass, isAnimalClassname, isAudioClassname, isDoorbellClassname, isFaceClassname, isLabelDetection, isMotionClassname, isPackageClassname, isPersonClassname, isPlateClassname, isSensorLabelClassname, isSessionRefusal, isVehicleClassname, jwtExpiresAt, licensePlateClasses, motionClasses, packageClasses, personClasses, raceFastestEndpoint, sensorLabelClasses, vehicleClasses };