@cloudsignal/pwa-sdk 1.1.1 → 1.2.0

package/dist/index.js

@@ -1,3 +1,6 @@
+import { isValidUUID } from './chunk-IMM7VF4N.js';
+export { generateAuthHeaders, generateHMACSignature, isValidUUID, makeAuthenticatedRequest } from './chunk-IMM7VF4N.js';
+
 /**
  * CloudSignal PWA SDK v1.0.0
  * https://cloudsignal.io
@@ -889,80 +892,17 @@ var InstallationManager = class {
   }
 };
 
-// src/utils/hmac.ts
-function toHex(buffer) {
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-function toBase64(buffer) {
-  return btoa(String.fromCharCode(...new Uint8Array(buffer)));
-}
-async function generateHMACSignature(secret, organizationId, timestamp, method, url, body = "") {
-  const encoder = new TextEncoder();
-  let path;
-  let query;
-  try {
-    const urlObj = url.startsWith("http") ? new URL(url) : new URL(url, "https://pwa.cloudsignal.app");
-    path = urlObj.pathname;
-    query = urlObj.search ? urlObj.search.slice(1) : "";
-  } catch {
-    const queryIndex = url.indexOf("?");
-    if (queryIndex > -1) {
-      path = url.slice(0, queryIndex);
-      query = url.slice(queryIndex + 1);
-    } else {
-      path = url;
-      query = "";
-    }
-  }
-  const canonicalParts = [
-    method.toUpperCase(),
-    path,
-    query,
-    organizationId,
-    timestamp
-  ];
-  if (body && body.length > 0) {
-    const bodyHashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(body));
-    const bodyHashHex = toHex(bodyHashBuffer);
-    canonicalParts.push(bodyHashHex);
-  }
-  const canonicalString = canonicalParts.join("\n");
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(canonicalString));
-  return toBase64(signature);
-}
-async function generateAuthHeaders(organizationId, organizationSecret, method, url, body) {
-  const timestamp = Math.floor(Date.now() / 1e3).toString();
-  const signature = await generateHMACSignature(
-    organizationSecret,
-    organizationId,
-    timestamp,
-    method,
-    url,
-    body || ""
-  );
+// src/utils/jwt-auth.ts
+function generateJWTHeaders(token, organizationId) {
   return {
+    "Authorization": `Bearer ${token}`,
     "X-CloudSignal-Organization-ID": organizationId,
-    "X-CloudSignal-Timestamp": timestamp,
-    "X-CloudSignal-Signature": signature,
     "Content-Type": "application/json"
   };
 }
-async function makeAuthenticatedRequest(organizationId, organizationSecret, method, url, body) {
+async function makeJWTAuthenticatedRequest(config, method, url, body) {
   const bodyStr = body ? JSON.stringify(body) : void 0;
-  const headers = await generateAuthHeaders(
-    organizationId,
-    organizationSecret,
-    method,
-    url,
-    bodyStr
-  );
+  let headers = generateJWTHeaders(config.token, config.organizationId);
   const options = {
     method,
     headers
@@ -970,11 +910,81 @@ async function makeAuthenticatedRequest(organizationId, organizationSecret, meth
   if (bodyStr) {
     options.body = bodyStr;
   }
-  return fetch(url, options);
+  let response = await fetch(url, options);
+  if (response.status === 401 && config.onTokenExpired) {
+    try {
+      const newToken = await config.onTokenExpired();
+      if (newToken) {
+        headers = generateJWTHeaders(newToken, config.organizationId);
+        options.headers = headers;
+        response = await fetch(url, options);
+      }
+    } catch (refreshError) {
+      console.warn("[CloudSignal PWA] Token refresh failed:", refreshError);
+    }
+  }
+  return response;
 }
-function isValidUUID(value) {
-  if (!value || typeof value !== "string") return false;
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+function createAuthContext(config) {
+  if (config.userToken) {
+    return {
+      mode: "jwt",
+      organizationId: config.organizationId,
+      userToken: config.userToken,
+      onTokenExpired: config.onTokenExpired
+    };
+  }
+  if (!config.organizationSecret) {
+    throw new Error("Either userToken or organizationSecret is required");
+  }
+  return {
+    mode: "hmac",
+    organizationId: config.organizationId,
+    organizationSecret: config.organizationSecret
+  };
+}
+async function makeAuthenticatedRequestWithContext(authContext, method, url, body, onTokenExpired) {
+  if (authContext.mode === "jwt") {
+    if (!authContext.userToken) {
+      throw new Error("userToken required for JWT auth mode");
+    }
+    return makeJWTAuthenticatedRequest(
+      {
+        token: authContext.userToken,
+        organizationId: authContext.organizationId,
+        // Allow override of token expired callback
+        onTokenExpired: onTokenExpired || authContext.onTokenExpired
+      },
+      method,
+      url,
+      body
+    );
+  }
+  const { makeAuthenticatedRequest: makeAuthenticatedRequest4 } = await import('./hmac-LWLR6F7Z.js');
+  if (!authContext.organizationSecret) {
+    throw new Error("organizationSecret required for HMAC auth mode");
+  }
+  return makeAuthenticatedRequest4(
+    authContext.organizationId,
+    authContext.organizationSecret,
+    method,
+    url,
+    body
+  );
+}
+function updateAuthToken(authContext, newToken) {
+  if (authContext.mode !== "jwt") {
+    return {
+      mode: "jwt",
+      organizationId: authContext.organizationId,
+      userToken: newToken,
+      onTokenExpired: authContext.onTokenExpired
+    };
+  }
+  return {
+    ...authContext,
+    userToken: newToken
+  };
 }
 
 // src/utils/storage.ts
@@ -1220,14 +1230,19 @@ var PushNotificationManager = class {
     this.vapidPublicKey = null;
     this.serviceUrl = options.serviceUrl;
     this.organizationId = options.organizationId;
-    this.organizationSecret = options.organizationSecret;
     this.serviceId = options.serviceId;
     this.debug = options.debug ?? false;
     this.deviceDetector = new DeviceDetector();
+    this.authContext = createAuthContext({
+      organizationId: options.organizationId,
+      organizationSecret: options.organizationSecret,
+      userToken: options.userToken
+    });
     this.onRegistered = options.onRegistered;
     this.onUnregistered = options.onUnregistered;
     this.onError = options.onError;
     this.onPermissionDenied = options.onPermissionDenied;
+    this.onTokenExpired = options.onTokenExpired;
     this.registrationId = getRegistrationId(this.organizationId, this.serviceId);
   }
   /**
@@ -1254,6 +1269,19 @@ var PushNotificationManager = class {
   isRegistered() {
     return this.registrationId !== null;
   }
+  /**
+   * Get current authentication mode
+   */
+  getAuthMode() {
+    return this.authContext.mode;
+  }
+  /**
+   * Update JWT token (for token refresh or upgrading from HMAC to JWT)
+   */
+  updateToken(token) {
+    this.authContext = updateAuthToken(this.authContext, token);
+    this.log(`Auth mode: ${this.authContext.mode}`);
+  }
   /**
    * Register for push notifications
    */
@@ -1303,12 +1331,12 @@ var PushNotificationManager = class {
         language: options.language || navigator.language || "en-US"
       };
       const url = `${this.serviceUrl}/api/v1/registration/register`;
-      const response = await makeAuthenticatedRequest(
-        this.organizationId,
-        this.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "POST",
         url,
-        registrationData
+        registrationData,
+        this.onTokenExpired
       );
       if (!response.ok) {
         const errorText = await response.text();
@@ -1347,12 +1375,12 @@ var PushNotificationManager = class {
         this.pushSubscription = null;
       }
       const url = `${this.serviceUrl}/api/v1/registration/unregister`;
-      const response = await makeAuthenticatedRequest(
-        this.organizationId,
-        this.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "POST",
         url,
-        { registration_id: this.registrationId }
+        { registration_id: this.registrationId },
+        this.onTokenExpired
       );
       if (!response.ok) {
         this.log(`Backend unregistration failed: ${response.status}`, "warn");
@@ -1378,9 +1406,8 @@ var PushNotificationManager = class {
         throw new Error("Not registered for push notifications");
       }
       const url = `${this.serviceUrl}/api/v1/registration/update`;
-      const response = await makeAuthenticatedRequest(
-        this.organizationId,
-        this.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "POST",
         url,
         {
@@ -1389,7 +1416,8 @@ var PushNotificationManager = class {
           timezone: preferences.timezone,
           language: preferences.language,
           is_active: preferences.isActive
-        }
+        },
+        this.onTokenExpired
       );
       if (!response.ok) {
         throw new Error(`Update failed: ${response.status}`);
@@ -1412,11 +1440,12 @@ var PushNotificationManager = class {
         return null;
       }
       const url = `${this.serviceUrl}/api/v1/registration/status/${this.registrationId}`;
-      const response = await makeAuthenticatedRequest(
-        this.organizationId,
-        this.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "GET",
-        url
+        url,
+        void 0,
+        this.onTokenExpired
       );
       if (!response.ok) {
         if (response.status === 404) {
@@ -1529,13 +1558,18 @@ var HeartbeatManager = class {
     this.batteryManager = null;
     this.serviceUrl = options.serviceUrl;
     this.organizationId = options.organizationId;
-    this.organizationSecret = options.organizationSecret;
     this.debug = options.debug ?? false;
     this.onHeartbeatSent = options.onHeartbeatSent;
     this.onHeartbeatError = options.onHeartbeatError;
     this.onIntervalChanged = options.onIntervalChanged;
     this.onPausedForBattery = options.onPausedForBattery;
     this.onResumedFromBattery = options.onResumedFromBattery;
+    this.onTokenExpired = options.onTokenExpired;
+    this.authContext = createAuthContext({
+      organizationId: options.organizationId,
+      organizationSecret: options.organizationSecret,
+      userToken: options.userToken
+    });
     this.config = {
       enabled: options.config?.enabled ?? true,
       interval: options.config?.interval ?? 3e4,
@@ -1626,6 +1660,19 @@ var HeartbeatManager = class {
   isHeartbeatRunning() {
     return this.isRunning;
   }
+  /**
+   * Get current authentication mode
+   */
+  getAuthMode() {
+    return this.authContext.mode;
+  }
+  /**
+   * Update JWT token (for token refresh or upgrading from HMAC to JWT)
+   */
+  updateToken(token) {
+    this.authContext = updateAuthToken(this.authContext, token);
+    this.log(`Auth mode: ${this.authContext.mode}`);
+  }
   /**
    * Send a single heartbeat
    */
@@ -1636,11 +1683,12 @@ var HeartbeatManager = class {
     }
     try {
       const url = `${this.serviceUrl}/api/v1/registration/heartbeat/${this.registrationId}`;
-      const response = await makeAuthenticatedRequest(
-        this.organizationId,
-        this.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "POST",
-        url
+        url,
+        void 0,
+        this.onTokenExpired
       );
       if (!response.ok) {
         throw new Error(`Heartbeat failed: ${response.status}`);
@@ -2956,7 +3004,7 @@ var IOSInstallBanner = class {
 
 // src/CloudSignalPWA.ts
 var DEFAULT_SERVICE_URL = "https://pwa.cloudsignal.app";
-var SDK_VERSION = "1.1.0";
+var SDK_VERSION = "1.2.0";
 var CloudSignalPWA = class {
   constructor(config) {
     this.initialized = false;
@@ -2970,6 +3018,14 @@ var CloudSignalPWA = class {
     this.config = config;
     this.serviceUrl = config.serviceUrl || DEFAULT_SERVICE_URL;
     this.debug = config.debug ?? false;
+    if (!config.organizationSecret && !config.userToken) {
+      throw new Error("Either organizationSecret or userToken must be provided");
+    }
+    this.authContext = createAuthContext({
+      organizationId: config.organizationId,
+      organizationSecret: config.organizationSecret,
+      userToken: config.userToken
+    });
     this.deviceDetector = new DeviceDetector();
     this.serviceWorkerManager = new ServiceWorkerManager({
       config: config.serviceWorker,
@@ -2989,6 +3045,8 @@ var CloudSignalPWA = class {
       serviceUrl: this.serviceUrl,
       organizationId: config.organizationId,
       organizationSecret: config.organizationSecret,
+      userToken: config.userToken,
+      onTokenExpired: config.onTokenExpired,
       serviceId: config.serviceId,
       debug: this.debug,
       onRegistered: (reg) => {
@@ -3006,6 +3064,8 @@ var CloudSignalPWA = class {
       serviceUrl: this.serviceUrl,
       organizationId: config.organizationId,
       organizationSecret: config.organizationSecret,
+      userToken: config.userToken,
+      onTokenExpired: config.onTokenExpired,
       config: config.heartbeat,
       debug: this.debug,
       onHeartbeatSent: () => this.emit("heartbeat:sent", { timestamp: Date.now() }),
@@ -3114,12 +3174,12 @@ var CloudSignalPWA = class {
   async downloadConfig() {
     try {
       const url = `${this.serviceUrl}/api/v1/config/download`;
-      const response = await makeAuthenticatedRequest(
-        this.config.organizationId,
-        this.config.organizationSecret,
+      const response = await makeAuthenticatedRequestWithContext(
+        this.authContext,
         "POST",
         url,
-        { organization_id: this.config.organizationId }
+        { organization_id: this.config.organizationId },
+        this.config.onTokenExpired
       );
       if (!response.ok) {
         throw new Error(`Config download failed: ${response.status}`);
@@ -3221,6 +3281,27 @@ var CloudSignalPWA = class {
     return this.pushNotificationManager.requestPermission();
   }
   // ============================================
+  // Authentication
+  // ============================================
+  /**
+   * Get current authentication mode
+   */
+  getAuthMode() {
+    return this.authContext.mode;
+  }
+  /**
+   * Set JWT user token (for upgrading anonymous to authenticated, or token refresh)
+   * After calling this, you should call registerForPush() again to re-register with user context
+   * @param token - JWT token from identity provider
+   */
+  setUserToken(token) {
+    this.authContext = updateAuthToken(this.authContext, token);
+    this.pushNotificationManager.updateToken(token);
+    this.heartbeatManager.updateToken(token);
+    this.emit("auth:tokenUpdated", { mode: this.authContext.mode });
+    this.log(`Auth mode updated to: ${this.authContext.mode}`);
+  }
+  // ============================================
   // Device Information
   // ============================================
   /**
@@ -3940,8 +4021,8 @@ var NotificationPermissionPrompt = class {
 };
 
 // src/index.ts
-var VERSION = "1.1.0";
+var VERSION = "1.2.0";
 
-export { CloudSignalPWA, DeviceDetector, HeartbeatManager, IOSInstallBanner, IOS_BANNER_TRANSLATIONS, IndexedDBStorage, InstallationManager, NOTIFICATION_PROMPT_TRANSLATIONS, NotificationPermissionPrompt, OfflineQueueManager, PushNotificationManager, ServiceWorkerManager, VERSION, WakeLockManager, CloudSignalPWA_default as default, detectBrowserLanguage, deviceDetector, generateAuthHeaders, generateBrowserFingerprint, generateHMACSignature, generateTrackingId, getRegistrationId, getStorageItem, isValidUUID, makeAuthenticatedRequest, removeRegistrationId, removeStorageItem, setRegistrationId, setStorageItem };
+export { CloudSignalPWA, DeviceDetector, HeartbeatManager, IOSInstallBanner, IOS_BANNER_TRANSLATIONS, IndexedDBStorage, InstallationManager, NOTIFICATION_PROMPT_TRANSLATIONS, NotificationPermissionPrompt, OfflineQueueManager, PushNotificationManager, ServiceWorkerManager, VERSION, WakeLockManager, createAuthContext, CloudSignalPWA_default as default, detectBrowserLanguage, deviceDetector, generateBrowserFingerprint, generateJWTHeaders, generateTrackingId, getRegistrationId, getStorageItem, makeAuthenticatedRequestWithContext, makeJWTAuthenticatedRequest, removeRegistrationId, removeStorageItem, setRegistrationId, setStorageItem, updateAuthToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map