@cesar-richard/git-connector-sdk 1.48.5 → 1.49.0

package/README.md

@@ -58,6 +58,21 @@ curl -X POST https://git-connector.example.com/admin/api-keys \
 # → { "token": "gck_…", "id": 12, "name": "my-integration", "createdAt": "…" }
 ```
 
+### Cookie auth (same-origin web UIs)
+
+When the server has `WEB_UI_COOKIE_AUTH=1` and you're calling from the same origin as the git-connector deployment (e.g. its own SPA), you can omit `token` entirely — the server accepts the `gck_session` httpOnly cookie set on first proxy-authenticated request:
+
+```ts
+const client = createGitConnectorClient({
+  baseUrl: window.location.origin,
+  // Custom fetch so the browser attaches the gck_session cookie.
+  fetch: (input, init) =>
+    globalThis.fetch(input, { ...init, credentials: "include" }),
+});
+```
+
+External SDK consumers (cross-origin scripts, CI integrations) should keep passing a Bearer `token`.
+
 Tokens with the `gck_` prefix are immutable once minted; revoke and reissue via the same endpoint.
 
 ---

package/dist/index.d.ts

@@ -3,8 +3,14 @@ export type { paths, components } from "./schema";
 export interface GitConnectorClientOptions {
     /** Base URL of the git-connector server, e.g. `https://git-connector.example.com`. */
     baseUrl: string;
-    /** API token issued via `POST /admin/api-keys` (format: `gck_*`). */
-    token: string;
+    /**
+     * API token issued via `POST /admin/api-keys` (format: `gck_*`).
+     * Optional: when omitted, the client does NOT set an `Authorization`
+     * header — useful for same-origin web UIs that authenticate via the
+     * `gck_session` httpOnly cookie (CR-541). External SDK consumers SHOULD
+     * still pass a token.
+     */
+    token?: string;
     /** Optional custom fetch implementation (default: `globalThis.fetch`). */
     fetch?: typeof fetch;
 }

package/dist/index.js

@@ -6,19 +6,18 @@ export function createGitConnectorClient(opts) {
     // Trim whitespace + strip an accidental "Bearer " prefix that users sometimes
     // paste in along with the token value.
     const token = opts.token?.trim().replace(/^Bearer\s+/i, "") ?? "";
-    if (!token) {
-        throw new Error("createGitConnectorClient: token is required (mint via POST /admin/api-keys)");
-    }
     const client = createClient({
         baseUrl: opts.baseUrl.replace(/\/$/, ""),
         fetch: opts.fetch,
     });
-    const auth = {
-        onRequest({ request }) {
-            request.headers.set("Authorization", `Bearer ${token}`);
-            return request;
-        },
-    };
-    client.use(auth);
+    if (token) {
+        const auth = {
+            onRequest({ request }) {
+                request.headers.set("Authorization", `Bearer ${token}`);
+                return request;
+            },
+        };
+        client.use(auth);
+    }
     return client;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cesar-richard/git-connector-sdk",
-  "version": "1.48.5",
+  "version": "1.49.0",
   "description": "TypeScript SDK for the git-connector v1 API (work items + iterations aggregated from GitHub/GitLab). Version published on npm tracks server releases.",
   "license": "MIT",
   "repository": {