@coinlist-co/react 0.12.2-rc.eea3be6 → 0.12.2

package/dist/server/index.js

@@ -1,19 +1,20 @@
 import {
+  API_VERSION,
   AuthenticatedApiClient,
-  NABU_BASE_URL,
   PINO_LEVEL,
   SDK_LOGGER_NAME,
+  baseUrls,
+  createNabuApiClient,
   loggerOverPino,
   notifySessionExpired,
   publicClients,
   systemTime
-} from "../chunk-IUAGXUJY.js";
+} from "../chunk-OQ2ANYUF.js";
 import {
   ClientCredentialsOAuth,
   OAuthSession
-} from "../chunk-MJ6YXZWH.js";
+} from "../chunk-IWQ6A52U.js";
 import {
-  API_VERSION,
   Attributes,
   CentrifugeNamespaceImpl,
   CoinListTokenSaleNamespaceImpl,
@@ -22,8 +23,8 @@ import {
   HttpError,
   Millis,
   NotAuthenticatedError,
+  OffersNamespaceImpl,
   OndoNamespaceImpl,
-  PUBLIC_API_BASE_URL,
   RequirementsNamespaceImpl,
   Seconds,
   SuperstateSwapNamespaceImpl,
@@ -37,24 +38,84 @@ import {
   internalLogger,
   isExpired,
   isRejectedToken
-} from "../chunk-335G7ZM5.js";
+} from "../chunk-2FZAXGVH.js";
 
-// src/server/core/api/api-client.ts
-var ApiClient = class {
-  constructor(config, fetchAccessToken, logger = null) {
-    this.client = new AuthenticatedApiClient(
-      config,
-      fetchAccessToken,
-      [],
-      logger
-    );
-  }
-  async send(request) {
-    return this.client.send(request);
+// src/server/core/auth/errors.ts
+var WritableSessionStoreRequiredError = class extends Error {
+  constructor(message = "This operation requires a writable SessionStore. Provide a `setSession` implementation in your SessionStore to persist or clear OAuth sessions.") {
+    super(message);
+    this.name = "WritableSessionStoreRequiredError";
   }
 };
 
-// src/server/core/session-refresh.ts
+// src/server/core/auth/server-access-token.ts
+function classifyAccessToken({
+  session,
+  store,
+  trigger,
+  now,
+  buffer
+}) {
+  if (session === null) {
+    return { type: "no-session" };
+  }
+  const token = session.accessToken;
+  const stale = isExpired({
+    expiresAt: EpochMillis.fromDate(token.expiresAt),
+    now,
+    buffer
+  });
+  switch (store.type) {
+    case "read-only":
+      return classifyReadOnly(token, trigger, stale);
+    case "writable": {
+      if (!needsRefresh(token, trigger, stale)) {
+        return { type: "serve", token };
+      }
+      const fallback = fallbackToken(token, trigger, now);
+      return session.refreshToken === void 0 && fallback !== null ? { type: "serve", token: fallback } : {
+        type: "refresh",
+        session,
+        setSession: store.setSession,
+        fallback
+      };
+    }
+  }
+}
+function classifyReadOnly(token, trigger, stale) {
+  switch (trigger.type) {
+    case "after-401":
+      return isRejectedToken(token, trigger.rejected) ? { type: "refuse" } : { type: "serve", token };
+    case "before-request":
+      return stale ? { type: "serve-stale", token } : { type: "serve", token };
+  }
+}
+function sessionStoreAccess(sessionStore) {
+  const setSession = sessionStore.setSession?.bind(sessionStore);
+  return setSession === void 0 ? { type: "read-only" } : { type: "writable", setSession };
+}
+function needsRefresh(token, trigger, stale) {
+  switch (trigger.type) {
+    case "before-request":
+      return stale;
+    case "after-401":
+      return trigger.rejected.type === "no-user-token" || isRejectedToken(token, trigger.rejected) || stale;
+  }
+}
+function fallbackToken(token, trigger, now) {
+  const unexpired = !isExpired({
+    expiresAt: EpochMillis.fromDate(token.expiresAt),
+    now
+  });
+  switch (trigger.type) {
+    case "after-401":
+      return unexpired && !isRejectedToken(token, trigger.rejected) ? token : null;
+    case "before-request":
+      return unexpired ? token : null;
+  }
+}
+
+// src/server/core/auth/session-refresh.ts
 var VERDICT_MIN_GAP = Millis.of(5e3);
 var REJECTION_MEMORY = Millis.of(6e4);
 var RefreshKey = {
@@ -155,38 +216,91 @@ function rejectedAt(rejection) {
 }
 var processRefreshCoordinator = new RefreshCoordinator();
 
-// src/server/shared/errors.ts
-var WritableSessionStoreRequiredError = class extends Error {
-  constructor(message = "This operation requires a writable SessionStore. Provide a `setSession` implementation in your SessionStore to persist or clear OAuth sessions.") {
-    super(message);
-    this.name = "WritableSessionStoreRequiredError";
+// src/universal/api/frontline/oauth.ts
+async function exchangeAuthorizationCode(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/oauth/token",
+    body: {
+      grant_type: "authorization_code",
+      code: params.code,
+      redirect_uri: params.redirectUri,
+      client_id: params.clientId,
+      client_secret: params.clientSecret,
+      code_verifier: params.codeVerifier
+    },
+    attributes: Attributes.notRetryable()
+  });
+  return OAuthSession.fromDto(dto);
+}
+async function refreshOAuthSession(api, params) {
+  try {
+    const dto = await api.send({
+      method: "POST",
+      url: "/oauth/token",
+      body: {
+        grant_type: "refresh_token",
+        refresh_token: params.refreshToken,
+        client_id: params.clientId,
+        client_secret: params.clientSecret
+      },
+      attributes: Attributes.notRetryable()
+    });
+    return { type: "renewed", session: OAuthSession.fromDto(dto) };
+  } catch (error) {
+    if (isInvalidGrant(error)) {
+      return { type: "invalid-grant" };
+    }
+    throw error;
   }
-};
+}
+async function requestClientCredentials(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/oauth/token",
+    body: {
+      grant_type: "client_credentials",
+      client_id: params.clientId,
+      client_secret: params.clientSecret
+    }
+  });
+  return ClientCredentialsOAuth(OAuthSession.fromDto(dto).accessToken);
+}
+async function revokeOAuthToken(api, params) {
+  await api.send({
+    method: "POST",
+    url: "/oauth/revoke",
+    body: {
+      token: params.token.value,
+      client_id: params.clientId,
+      client_secret: params.clientSecret
+    }
+  });
+}
+function isInvalidGrant(error) {
+  if (!(error instanceof HttpError) || error.response.status !== 400) {
+    return false;
+  }
+  const body = error.response.body;
+  return typeof body === "object" && body !== null && "error" in body && body.error === "invalid_grant";
+}
 
-// src/server/core/server-auth-namespace-impl.ts
+// src/server/core/auth/auth-namespace.ts
 var ServerAuthNamespaceImpl = class {
   constructor(api, config) {
     this.api = api;
     this.config = config;
     this.log = internalLogger(config.logger ?? null, "AUTH");
   }
-  async completeOAuth(params) {
+  async completeOAuth(grant) {
     return this.log.wrap("completeOAuth", void 0, async () => {
       const setSession = this.writableSessionStore();
-      const sessionDto = await this.api.send({
-        method: "POST",
-        url: `/oauth/token`,
-        body: {
-          grant_type: "authorization_code",
-          code: params.code,
-          redirect_uri: this.config.redirectUri,
-          client_id: this.config.clientId,
-          client_secret: this.config.clientSecret,
-          code_verifier: params.codeVerifier
-        },
-        attributes: Attributes.notRetryable()
+      const session = await exchangeAuthorizationCode(this.api, {
+        ...this.oauthClient(),
+        code: grant.code,
+        codeVerifier: grant.codeVerifier,
+        redirectUri: this.config.redirectUri
       });
-      const session = OAuthSession.fromDto(sessionDto);
       await setSession(session);
       return session;
     });
@@ -294,48 +408,34 @@ var ServerAuthNamespaceImpl = class {
     }
   }
   /**
-   * One `POST /oauth/token`, total: every failure comes back as a value, so
+   * One refresh-token grant, total: every failure comes back as a value, so
    * the coordinator can judge it once for everyone who joined.
-   *
-   * Never retried. The refresh token is single-use, so a retry of an attempt
-   * that reached the server would present a token already rotated away, and
-   * its `invalid_grant` would be judged as a rejection of the session.
    */
   async exchange(refreshToken) {
     if (refreshToken === void 0) {
       return { type: "unrenewable" };
     }
     try {
-      const sessionDto = await this.api.send({
-        method: "POST",
-        url: `/oauth/token`,
-        body: {
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          client_id: this.config.clientId,
-          client_secret: this.config.clientSecret
-        },
-        attributes: Attributes.notRetryable()
+      const grant = await refreshOAuthSession(this.api, {
+        ...this.oauthClient(),
+        refreshToken
       });
-      return { type: "renewed", session: OAuthSession.fromDto(sessionDto) };
+      switch (grant.type) {
+        case "renewed":
+          return { type: "renewed", session: grant.session };
+        case "invalid-grant":
+          return { type: "rejected" };
+      }
     } catch (error) {
-      return isInvalidGrant(error) ? { type: "rejected" } : { type: "unknown", error };
+      return { type: "unknown", error };
     }
   }
   async clientCredentials() {
-    return this.log.wrap("clientCredentials", void 0, async () => {
-      const sessionDto = await this.api.send({
-        method: "POST",
-        url: `/oauth/token`,
-        body: {
-          grant_type: "client_credentials",
-          client_id: this.config.clientId,
-          client_secret: this.config.clientSecret
-        }
-      });
-      const session = OAuthSession.fromDto(sessionDto);
-      return ClientCredentialsOAuth(session.accessToken);
-    });
+    return this.log.wrap(
+      "clientCredentials",
+      void 0,
+      () => requestClientCredentials(this.api, this.oauthClient())
+    );
   }
   async logout() {
     return this.log.wrap("logout", void 0, () => this.revokeAndClear());
@@ -345,14 +445,9 @@ var ServerAuthNamespaceImpl = class {
     const session = await this.config.sessionStore.getSession();
     if (session == null) return;
     try {
-      await this.api.send({
-        method: "POST",
-        url: `/oauth/revoke`,
-        body: {
-          token: session.accessToken.value,
-          client_id: this.config.clientId,
-          client_secret: this.config.clientSecret
-        }
+      await revokeOAuthToken(this.api, {
+        ...this.oauthClient(),
+        token: session.accessToken
       });
     } catch (err) {
       if (this.config.strict) {
@@ -365,6 +460,12 @@ var ServerAuthNamespaceImpl = class {
     }
     await setSession(null);
   }
+  oauthClient() {
+    return {
+      clientId: this.config.clientId,
+      clientSecret: this.config.clientSecret
+    };
+  }
   /**
    * Returns the store's `setSession`, or throws - the guard every
    * session-writing operation shares.
@@ -379,85 +480,29 @@ var ServerAuthNamespaceImpl = class {
     }
   }
 };
-function classifyAccessToken({
-  session,
-  store,
-  trigger,
-  now,
-  buffer
-}) {
-  if (session === null) {
-    return { type: "no-session" };
-  }
-  const token = session.accessToken;
-  const stale = isExpired({
-    expiresAt: EpochMillis.fromDate(token.expiresAt),
-    now,
-    buffer
-  });
-  switch (store.type) {
-    case "read-only":
-      return classifyReadOnly(token, trigger, stale);
-    case "writable": {
-      if (!needsRefresh(token, trigger, stale)) {
-        return { type: "serve", token };
-      }
-      const fallback = fallbackToken(token, trigger, now);
-      return session.refreshToken === void 0 && fallback !== null ? { type: "serve", token: fallback } : {
-        type: "refresh",
-        session,
-        setSession: store.setSession,
-        fallback
-      };
-    }
-  }
-}
-function classifyReadOnly(token, trigger, stale) {
-  switch (trigger.type) {
-    case "after-401":
-      return isRejectedToken(token, trigger.rejected) ? { type: "refuse" } : { type: "serve", token };
-    case "before-request":
-      return stale ? { type: "serve-stale", token } : { type: "serve", token };
-  }
-}
-function sessionStoreAccess(sessionStore) {
-  const setSession = sessionStore.setSession?.bind(sessionStore);
-  return setSession === void 0 ? { type: "read-only" } : { type: "writable", setSession };
-}
-function needsRefresh(token, trigger, stale) {
-  switch (trigger.type) {
-    case "before-request":
-      return stale;
-    case "after-401":
-      return trigger.rejected.type === "no-user-token" || isRejectedToken(token, trigger.rejected) || stale;
-  }
+
+// src/server/core/auth/session-store.ts
+function emptySessionStore() {
+  return { getSession: async () => null };
 }
-function fallbackToken(token, trigger, now) {
-  const unexpired = !isExpired({
-    expiresAt: EpochMillis.fromDate(token.expiresAt),
-    now
-  });
-  switch (trigger.type) {
-    case "after-401":
-      return unexpired && !isRejectedToken(token, trigger.rejected) ? token : null;
-    case "before-request":
-      return unexpired ? token : null;
+
+// src/server/core/api/api-client.ts
+var ApiClient = class {
+  constructor(config, fetchAccessToken, logger = null) {
+    this.client = new AuthenticatedApiClient(
+      config,
+      fetchAccessToken,
+      [],
+      logger
+    );
   }
-}
-function isInvalidGrant(error) {
-  if (!(error instanceof HttpError) || error.response.status !== 400) {
-    return false;
+  async send(request) {
+    return this.client.send(request);
   }
-  const body = error.response.body;
-  return typeof body === "object" && body !== null && "error" in body && body.error === "invalid_grant";
-}
+};
 
-// src/server/core/server-offers-namespace.ts
-var ServerOffersNamespaceImpl = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-    this.log = internalLogger(ctx.logger, "OFFERS");
-  }
+// src/server/core/offers/server-offers-namespace.ts
+var ServerOffersNamespaceImpl = class extends OffersNamespaceImpl {
   async list(clientCreds) {
     return this.log.wrap("list", clientCreds, async () => {
       await this.ctx.ensureAuthenticated(clientCreds);
@@ -478,17 +523,13 @@ var ServerOffersNamespaceImpl = class {
   }
 };
 
-// src/server/core/server-requirements-namespace.ts
+// src/server/core/requirements/server-requirements-namespace.ts
 var ServerRequirementsNamespaceImpl = class extends RequirementsNamespaceImpl {
-  constructor(serverCtx) {
-    super(serverCtx);
-    this.serverCtx = serverCtx;
-  }
   async forOffer(offerId, clientCreds) {
     return this.log.wrap("forOffer", { offerId, clientCreds }, async () => {
-      await this.serverCtx.ensureAuthenticated(clientCreds);
+      await this.ctx.ensureAuthenticated(clientCreds);
       return fetchOfferRequirements(
-        this.serverCtx.api,
+        this.ctx.api,
         offerId,
         clientCreds
       );
@@ -501,9 +542,10 @@ var ACCESS_TOKEN_EXPIRY_BUFFER = Seconds.of(60);
 var CoinListServerImpl = class {
   constructor(_config) {
     const logger = _config.logger ?? null;
+    const urls = baseUrls(_config);
     this.api = new ApiClient(
       {
-        baseUrl: _config.baseUrl ?? PUBLIC_API_BASE_URL,
+        baseUrl: urls.api,
         xApiVersion: API_VERSION
       },
       (trigger) => auth.tokenFor(trigger),
@@ -532,10 +574,10 @@ var CoinListServerImpl = class {
     this.superstate = new SuperstateSwapNamespaceImpl(ctx);
     this.ondo = new OndoNamespaceImpl(ctx);
     this.centrifuge = new CentrifugeNamespaceImpl(ctx);
-    this.tokens = new TokensNamespaceImpl(
-      _config.tokensBaseUrl ?? NABU_BASE_URL,
+    this.tokens = new TokensNamespaceImpl({
+      nabu: createNabuApiClient(urls.tokens, logger),
       logger
-    );
+    });
   }
   /**
    * An app-level token authenticates a request on its own; without one the
@@ -553,7 +595,7 @@ function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
 
-// src/server/core/observability/pino-server-logger.ts
+// src/server/core/shared/observability/pino-server-logger.ts
 import { pino } from "pino";
 function pinoServerLogger(options) {
   return loggerOverPino(
@@ -567,12 +609,8 @@ function pinoServerLogger(options) {
     options.level
   );
 }
-
-// src/server/core/server-auth-namespace.ts
-function emptySessionStore() {
-  return { getSession: async () => null };
-}
 export {
+  ServerAuthNamespaceImpl,
   ServerOffersNamespaceImpl,
   ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError,