@corespec/vite-plugin-api-auto-login 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,273 @@
-# Temporary Holding Version
+# @corespec/vite-plugin-api-auto-login
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm version](https://img.shields.io/npm/v/@corespec/vite-plugin-api-auto-login)](https://www.npmjs.com/package/@corespec/vite-plugin-api-auto-login)
+[![CI](https://github.com/core-spec-tech/vite-plugin-api-auto-login/actions/workflows/ci.yml/badge.svg?branch=main&event=push)](https://github.com/core-spec-tech/vite-plugin-api-auto-login/actions/workflows/ci.yml)
+[![Security checks](https://github.com/core-spec-tech/vite-plugin-api-auto-login/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/core-spec-tech/vite-plugin-api-auto-login/actions/workflows/security.yml)
+[![License](https://img.shields.io/npm/l/@corespec/vite-plugin-api-auto-login)](https://www.npmjs.com/package/@corespec/vite-plugin-api-auto-login)
+[![Vite compatibility](https://registry.vite.dev/api/badges?package=%40corespec%2Fvite-plugin-api-auto-login&tool=vite)](https://registry.vite.dev/)
+[![Rollup compatibility](https://registry.vite.dev/api/badges?package=%40corespec%2Fvite-plugin-api-auto-login&tool=rollup)](https://registry.vite.dev/)
+
+A reusable Vite plugin that automatically logs in to an API from the Node.js development server.
+
+## Installation
+
+```bash
+npm install -D @corespec/vite-plugin-api-auto-login
+```
+
+## Usage
+
+Add the plugin to your Vite configuration:
+
+```ts
+import { defineConfig } from 'vite'
+import { viteAPIAutoLogin } from '@corespec/vite-plugin-api-auto-login'
+
+export default defineConfig({
+  plugins: [viteAPIAutoLogin()],
+})
+```
+
+The plugin runs only in Vite's development server. It reads environment variables prefixed with `API_AUTO_LOGIN_` and injects an authentication cookie into responses to matching HTML document requests.
+
+## Customizing form field names
+
+Use `formFields` to rename either credential field without writing a strategy:
+
+```ts
+viteAPIAutoLogin({
+  formFields: { username: 'email' },
+})
+```
+
+The default names are `username` and `password`. For example,
+`formFields: { username: 'login', password: 'passcode' }` changes both.
+Values still come from `API_AUTO_LOGIN_USERNAME` and `API_AUTO_LOGIN_PASSWORD`;
+only the outgoing form field names change. Names must be non-empty and distinct.
+The `User-Agent` header is unaffected.
+
+Use `formFields` only with the default request; it cannot be combined with a custom
+`request`. The exported `createFormDataRequest(config, fields)` function returns
+a request callback for consumers who want to compose the default behavior.
+
+## Customizing the login request
+
+Pass a function that receives the parsed configuration and returns the URL and
+Undici fetch options. It can return a promise. Create a fresh request body each
+time the callback runs:
+
+```ts
+import { defineConfig } from 'vite'
+import { viteAPIAutoLogin } from '@corespec/vite-plugin-api-auto-login'
+
+export default defineConfig({
+  plugins: [
+    viteAPIAutoLogin({
+      request: (config) => {
+        if (!config.loginUrl || !config.username || !config.password) {
+          throw new Error('JSON login requires an endpoint, username, and password')
+        }
+        return {
+          url: config.loginUrl,
+          init: {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              email: config.username,
+              password: config.password,
+            }),
+          },
+        }
+      },
+    }),
+  ],
+})
+```
+
+The callback runs lazily when a login is needed. Concurrent requests share one
+login through RxJS, and each Vite server has its own token cache. JWTs are reused
+until their `exp` timestamp; opaque tokens and tokens without readable expiry are
+not cached between completed logins. Errors are logged and requests continue;
+the next request can attempt authentication again. There are no automatic retries.
+
+Custom callbacks validate their own requirements and may omit the default login
+variables. Without a callback, the default sends a multipart POST with the mapped
+username/password fields and a `User-Agent` header.
+
+`init` supports Undici options including `signal` and `redirect`. The plugin
+combines your signal with its lifecycle cancellation and manages `dispatcher`
+through the TLS configuration. The response must be successful JSON containing
+a non-empty `token` string.
+
+## Cookie options
+
+```ts
+viteAPIAutoLogin({
+  cookie: {
+    path: '/api',
+    sameSite: 'strict',
+    secure: false,
+    httpOnly: true,
+  },
+})
+```
+
+Defaults preserve the original behavior: `path: '/'`, `sameSite: 'lax'`,
+`secure: false`, and `httpOnly: false`. `sameSite` accepts `lax`, `strict`, or
+`none`; `none` requires `secure: true`. Enable `httpOnly` when your frontend does
+not need JavaScript access to the cookie. `secure` cookies require HTTPS in the
+normal browser cookie model.
+
+The name still comes from `API_AUTO_LOGIN_COOKIE_NAME`. Cookie `path` controls
+where the browser sends the cookie, not which page requests trigger login.
+Cookies are serialized with `cookie` and appended without replacing existing
+`Set-Cookie` headers. Disconnected responses unsubscribe without continuing the
+middleware chain. When the last waiting response disconnects, the login is aborted;
+a later request starts a fresh login. Vite shutdown also cancels pending authentication.
+
+## Migrating from the class-based API
+
+Version `0.2.0` changes the public API under the project's pre-1.0 versioning policy:
+
+- Replace `request: instance` with `request: (config) => instance.create(config)`,
+  or inline the request construction as shown above.
+- Replace `createAuthRequest` with a `request(config)` callback. The callback runs
+  per login, rather than once during server configuration.
+- Replace `PluginConfig.fromEnv(env)` with `loadPluginConfig(env)`.
+- Replace `new FormDataAuthRequest(config, fields)` with
+  `createFormDataRequest(config, fields)`. Call the returned function with `config`.
+- `AuthRequest` is now a function type; `AuthRequestFactory` is removed.
+- `AuthCookieOptions` is exported for reusable cookie configuration.
+
+## Environment variables
+
+Define these variables in your Vite environment files, such as `.env.local`, `.env.development`, or another file in `envDir` that Vite loads for the current mode.
+
+Required by the default form-data request only:
+
+| Variable                   | Description                                                                                  |
+| -------------------------- | -------------------------------------------------------------------------------------------- |
+| `API_AUTO_LOGIN_LOGIN_URL` | Login endpoint URL used to request an authentication token.                                  |
+| `API_AUTO_LOGIN_USERNAME`  | Account username sent to the login endpoint; may be an email address if the API supports it. |
+| `API_AUTO_LOGIN_PASSWORD`  | Account password sent to the login endpoint.                                                 |
+
+Optional variables:
+
+| Variable                            | Default           | Description                                                                   |
+| ----------------------------------- | ----------------- | ----------------------------------------------------------------------------- |
+| `API_AUTO_LOGIN_COOKIE_NAME`        | `your_token_name` | Name of the cookie added to the response with the authentication token.       |
+| `API_AUTO_LOGIN_USER_AGENT`         | `vite`            | Value sent in the login request's `User-Agent` HTTP header.                   |
+| `API_AUTO_LOGIN_ALLOW_INSECURE_TLS` | `false`           | Set to `true` to disable TLS certificate verification for the login endpoint. |
+
+## Configuration parsing
+
+`loadPluginConfig(env)` converts the environment values returned by Vite's
+`loadEnv` into a frozen configuration object. It applies shared defaults and
+parses the TLS flag.
+
+Login URL, username, and password are optional in the shared configuration.
+`createFormDataRequest` validates them when constructing the default callback.
+Custom request callbacks validate their own requirements.
+
+## Vue + MSW example
+
+Run `npm ci` and `npm run example` from this repository, then open
+[http://127.0.0.1:5173](http://127.0.0.1:5173).
+
+The [example guide](examples/vue-msw/README.md) explains the mock API, cookie
+flow, and `formFields: { username: 'email' }` mapping. No external API or real
+credentials are needed.
+
+## Development
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for code conventions, design guidelines,
+and the required checks.
+
+Use the Node.js version pinned in `.nvmrc`. GitHub CI and publishing use the same
+file. With nvm installed:
+
+```bash
+nvm install
+nvm use
+npm ci
+npm run check
+npm run build
+```
+
+`npm run check` runs formatting checks, linting, the full project type check, and all tests once.
+Use `npm test` for watch mode or `npm run coverage` for a coverage report.
+The build produces ESM, CommonJS, and TypeScript declarations.
+Use `npm run format` to format files with Prettier (100-character print width).
+
+Tests are grouped under `tests/auth`, `tests/config`, and `tests/http`.
+`tests/plugin.spec.ts` covers plugin integration, with shared HTTP fixtures in
+`tests/helpers`. Editor formatting defaults are defined in `.editorconfig`.
+Local environment overrides (`.env.local` and `.env.*.local`) are ignored by Git.
+
+### Source imports
+
+Use `@/` for imports from `src/`, including imports in tests:
+
+```ts
+import { loadPluginConfig } from '@/config/loadPluginConfig'
+```
+
+TypeScript and Vite/Vitest resolve this alias locally. The declaration build
+uses `tsc-alias` to replace aliases with relative paths in published types;
+consumers do not need to configure `@/`. Imports between test helpers stay relative.
+
+## Local linking
+
+When developing this package alongside a consuming Vite application, run the linking commands from each repository's root directory:
+
+```bash
+cd vite-plugin-api-auto-login
+npm link
+
+cd ../your-app
+npm link @corespec/vite-plugin-api-auto-login
+```
+
+## Security scanning
+
+GitHub Actions runs CodeQL for TypeScript and workflow code, dependency review
+on pull requests, and scheduled npm audits. Run `npm run security:audit` locally;
+high and critical dependency findings also block publishing.
+See [security setup](CONTRIBUTING.md#security-checks) for thresholds and the GitHub
+settings needed for secret scanning and merge protection.
+
+## Publishing
+
+The `.github/workflows/publish.yml` workflow stages releases for approval when a version tag (`v*`) or package-specific tag (`@corespec/vite-plugin-api-auto-login@*`) is pushed. The tag must match the version in `package.json`. The workflow runs linting, type checking, tests, and the build before staging the package on npm. A maintainer approves the staged version with 2FA to publish it.
+
+The initial version is `0.1.0`. Releases use Semantic Versioning and Conventional
+Commits; see [CONTRIBUTING.md](CONTRIBUTING.md#versioning-and-releases) for the
+release commands and the `0.x` versioning policy.
+
+Release setup:
+
+1. Store a granular npm publishing token with access to the `@corespec` scope
+   as the repository Actions secret `NPM_TOKEN`. Use a stage-only token; CI does
+   not need to bypass 2FA. Keep local tokens in an ignored `.env` file.
+2. Run `npm ci`, `npm run check`, and `npm run example:build`.
+3. Use `npm run release` or an explicit bump command described in CONTRIBUTING.md.
+   Releases use version tags such as `v0.2.0`. Historical release tags were removed
+   during the repository history reset; published npm versions remain available.
+4. Push the release commit and tag with `git push --follow-tags`. The Publish
+   workflow checks, builds, and stages the package with provenance. The npm
+   token is available only to its staging step.
+5. Review the version in npm's Staged Packages tab and approve it with 2FA,
+   or run `npm stage approve <stage-id>` while logged in as a maintainer.
+   A successful staging workflow does not mean the version is publicly available.
+
+To retry an existing tag, manually run the Publish workflow and supply that tag
+(for example `v0.2.0`). It checks out the tagged source and verifies the version.
+
+Trusted publishing can replace the token after configuring owner `core-spec-tech`,
+repository `vite-plugin-api-auto-login`, and workflow `publish.yml` in npm's package
+settings. Then remove `NODE_AUTH_TOKEN` from the staging step and delete
+the repository secret.
+
+GitHub CI runs on pushes and pull requests. You can configure Renovate through its GitHub app using `renovate.json`.
+
+See [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers/) for details.

package/dist/auth/AuthRequest.d.ts

@@ -0,0 +1,8 @@
+import type { RequestInit } from 'undici';
+import type { PluginEnv } from '../config/types.js';
+export type AuthRequestOptions = {
+    url: string | URL;
+    init: Omit<RequestInit, 'dispatcher'>;
+};
+export type AuthRequest = (config: Readonly<PluginEnv>) => AuthRequestOptions | Promise<AuthRequestOptions>;
+//# sourceMappingURL=AuthRequest.d.ts.map

package/dist/auth/AuthRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRequest.d.ts","sourceRoot":"","sources":["../../src/auth/AuthRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IACjB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KACxB,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/auth/createFormDataRequest.d.ts

@@ -0,0 +1,4 @@
+import type { FormFieldNames, PluginEnv } from '../config/types.js';
+import type { AuthRequest } from './AuthRequest.js';
+export declare function createFormDataRequest(config: Readonly<PluginEnv>, fields?: Readonly<FormFieldNames>): AuthRequest;
+//# sourceMappingURL=createFormDataRequest.d.ts.map

package/dist/auth/createFormDataRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createFormDataRequest.d.ts","sourceRoot":"","sources":["../../src/auth/createFormDataRequest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,MAAM,GAAE,QAAQ,CAAC,cAAc,CAAM,GACpC,WAAW,CAkBb"}

package/dist/auth/createTokenStream.d.ts

@@ -0,0 +1,14 @@
+import type { Observable } from 'rxjs';
+import { fetch as undiciFetch } from 'undici';
+import type { Dispatcher } from 'undici';
+import type { PluginEnv } from '../config/types.js';
+import type { AuthRequest } from './AuthRequest.js';
+type TokenStreamDependencies = {
+    request?: AuthRequest;
+    fetch?: typeof undiciFetch;
+    createDispatcher?: () => Dispatcher;
+    signal?: AbortSignal;
+};
+export declare function createTokenStream(config: Readonly<PluginEnv>, dependencies?: TokenStreamDependencies): Observable<string>;
+export {};
+//# sourceMappingURL=createTokenStream.d.ts.map

package/dist/auth/createTokenStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createTokenStream.d.ts","sourceRoot":"","sources":["../../src/auth/createTokenStream.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AACtC,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIrD,KAAK,uBAAuB,GAAG;IAC7B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,KAAK,CAAC,EAAE,OAAO,WAAW,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,UAAU,CAAA;IACnC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,YAAY,GAAE,uBAA4B,GACzC,UAAU,CAAC,MAAM,CAAC,CAoDpB"}

package/dist/config/loadPluginConfig.d.ts

@@ -0,0 +1,5 @@
+import type { PluginEnv, PluginEnvInput } from './types.js';
+export declare const DEFAULT_COOKIE_NAME = "your_token_name";
+export declare const DEFAULT_USER_AGENT = "vite";
+export declare function loadPluginConfig(env: PluginEnvInput): Readonly<PluginEnv>;
+//# sourceMappingURL=loadPluginConfig.d.ts.map

package/dist/config/loadPluginConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadPluginConfig.d.ts","sourceRoot":"","sources":["../../src/config/loadPluginConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/D,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,kBAAkB,SAAS,CAAA;AAExC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,CASzE"}

package/dist/config/types.d.ts

@@ -0,0 +1,30 @@
+import type { AuthRequest } from '../auth/AuthRequest.js';
+export type PluginEnv = {
+    allowInsecureTls: boolean;
+    cookieName: string;
+    username?: string;
+    loginUrl?: string;
+    password?: string;
+    userAgent: string;
+};
+export type PluginEnvInput = Readonly<Record<string, string | undefined>>;
+export type FormFieldNames = {
+    username?: string;
+    password?: string;
+};
+export type AuthCookieOptions = {
+    path?: string;
+    sameSite?: 'lax' | 'strict' | 'none';
+    secure?: boolean;
+    httpOnly?: boolean;
+};
+export type AutoLoginOptions = {
+    cookie?: AuthCookieOptions;
+} & ({
+    formFields?: FormFieldNames;
+    request?: never;
+} | {
+    formFields?: never;
+    request: AuthRequest;
+});
+//# sourceMappingURL=types.d.ts.map

package/dist/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,MAAM,SAAS,GAAG;IACtB,gBAAgB,EAAE,OAAO,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AAEzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAAG,CAC9D;IAAE,UAAU,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,UAAU,CAAC,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAChG,CAAA"}

package/dist/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const PLUGIN_NAME = "vite-plugin-api-auto-login";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,+BAA+B,CAAA"}

package/dist/http/isHtmlDocumentRequest.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+export declare function isHtmlDocumentRequest(req: IncomingMessage): boolean;
+//# sourceMappingURL=isHtmlDocumentRequest.d.ts.map

package/dist/http/isHtmlDocumentRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isHtmlDocumentRequest.d.ts","sourceRoot":"","sources":["../../src/http/isHtmlDocumentRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAKnE"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { viteAPIAutoLogin } from './plugin.js';
+export { createFormDataRequest } from './auth/createFormDataRequest.js';
+export { loadPluginConfig } from './config/loadPluginConfig.js';
+export type { AuthRequest, AuthRequestOptions } from './auth/AuthRequest.js';
+export type { AutoLoginOptions, PluginEnv, FormFieldNames, AuthCookieOptions } from './config/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/middleware/createAutoLoginMiddleware.d.ts

@@ -0,0 +1,5 @@
+import type { Observable } from 'rxjs';
+import type { Connect, Logger } from 'vite';
+import type { AuthCookieOptions, PluginEnv } from '../config/types.js';
+export declare function createAutoLoginMiddleware(config: Readonly<PluginEnv>, cookie: Required<AuthCookieOptions>, token$: Observable<string>, logger: Pick<Logger, 'error'>, signal: AbortSignal): Connect.NextHandleFunction;
+//# sourceMappingURL=createAutoLoginMiddleware.d.ts.map

package/dist/middleware/createAutoLoginMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAutoLoginMiddleware.d.ts","sourceRoot":"","sources":["../../src/middleware/createAutoLoginMiddleware.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAIlE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACnC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,CA0C5B"}

package/dist/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { Plugin } from 'vite';
+import type { AutoLoginOptions } from './config/types.js';
+export declare function viteAPIAutoLogin(options?: AutoLoginOptions): Plugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAOlC,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGzE,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,gBAAqB,GAAG,MAAM,CAoDvE"}

package/dist/vite-plugin-api-auto-login.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("cookie"),t=require("vite"),n=require("undici"),r=require("jose"),i=require("rxjs");function a(e,t={}){let r=t.username??`username`,i=t.password??`password`;if(!r.trim()||!i.trim()||r===i)throw Error(`Form field names must be non-empty and distinct`);return o(e),e=>{let{loginUrl:t,username:a,password:s}=o(e),c=new n.FormData;return c.set(r,a),c.set(i,s),{url:t,init:{method:`POST`,headers:{"User-Agent":e.userAgent},body:c}}}}function o(e){let{loginUrl:t,username:n,password:r}=e;if(!t||!n||!r)throw Error(`Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD`);return{loginUrl:t,username:n,password:r}}function s(e,t={}){let r=t.request??a(e),o=t.fetch??n.fetch,s;return(0,i.defer)(()=>{if(t.signal?.aborted)return i.EMPTY;if(s?.expiresAt!==void 0&&s.expiresAt>Date.now())return(0,i.of)(s.value);let a=new AbortController,l;return e.allowInsecureTls&&(l=t.createDispatcher?.()??new n.Agent({connect:{rejectUnauthorized:!1}})),(0,i.defer)(()=>(0,i.from)(Promise.resolve(r(e)))).pipe((0,i.switchMap)(({url:e,init:n})=>{let r=[a.signal];return n.signal&&r.push(n.signal),t.signal&&r.push(t.signal),(0,i.from)(o(e,{...n,dispatcher:l,signal:AbortSignal.any(r)}))}),(0,i.switchMap)(e=>{if(!e.ok)throw Error(`Login request failed with status ${e.status}`);return(0,i.from)(e.json())}),(0,i.map)(c),(0,i.tap)(e=>{s=e}),(0,i.map)(e=>e.value),(0,i.takeUntil)(t.signal?(0,i.fromEvent)(t.signal,`abort`):i.EMPTY),(0,i.finalize)(()=>{a.abort(),l&&l.destroy().catch(()=>{})}))}).pipe((0,i.share)({connector:()=>new i.ReplaySubject(1),resetOnError:!0,resetOnComplete:!0,resetOnRefCountZero:!0}))}function c(e){if(!e||typeof e!=`object`||!(`token`in e)||typeof e.token!=`string`||e.token.length===0)throw Error(`Login response did not include a token`);let t=e.token;try{let{exp:e}=(0,r.decodeJwt)(t);return{value:t,expiresAt:typeof e==`number`?e*1e3:void 0}}catch{return{value:t}}}var l=`vite-plugin-api-auto-login`;function u(e){return Object.freeze({allowInsecureTls:e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS===`true`,cookieName:e.API_AUTO_LOGIN_COOKIE_NAME??`your_token_name`,username:e.API_AUTO_LOGIN_USERNAME,loginUrl:e.API_AUTO_LOGIN_LOGIN_URL,password:e.API_AUTO_LOGIN_PASSWORD,userAgent:e.API_AUTO_LOGIN_USER_AGENT??`vite`})}function d(e){let t=e.method===`GET`||e.method===`HEAD`,n=e.headers.accept?.includes(`text/html`)??!1,r=e.headers.upgrade?.toLowerCase()===`websocket`;return t&&n&&!r}function f(t,n,r,a,o){return(s,c,u)=>{if(o.aborted||c.destroyed||c.writableEnded)return;let f=new i.Subscription,p=()=>f.unsubscribe(),m=()=>{o.aborted||c.destroyed||c.writableEnded||f.closed||u()};c.once(`close`,p),o.addEventListener(`abort`,p,{once:!0}),f.add(()=>{c.off(`close`,p),o.removeEventListener(`abort`,p)}),f.add((0,i.of)(s).pipe((0,i.filter)(d),(0,i.switchMap)(()=>r),(0,i.take)(1),(0,i.map)(r=>(0,e.stringifySetCookie)({...n,name:t.cookieName,value:r})),(0,i.tap)(e=>{c.headersSent||c.destroyed||c.writableEnded||c.appendHeader(`Set-Cookie`,e)})).subscribe({error:e=>{let n=e instanceof Error?e.message:String(e),r=t.loginUrl?` (${t.loginUrl})`:``;a.error(`[${l}] ${n}${r}`),m(),f.unsubscribe()},complete:()=>{m(),f.unsubscribe()}}))}}function p(n={}){if(`createAuthRequest`in n)throw Error(`createAuthRequest was removed; use request(config) instead`);if(n.request!==void 0&&typeof n.request!=`function`)throw Error(`request must be a function: request(config)`);if(n.formFields!==void 0&&n.request!==void 0)throw Error(`Use formFields only with the default request`);let r={path:n.cookie?.path??`/`,sameSite:n.cookie?.sameSite??`lax`,secure:n.cookie?.secure??!1,httpOnly:n.cookie?.httpOnly??!1};if(r.sameSite===`none`&&!r.secure)throw Error(`cookie.sameSite "none" requires cookie.secure to be true`);(0,e.stringifySetCookie)({...r,name:`validation`,value:``});let i=new Set;return{name:l,apply:`serve`,configureServer(o){let{mode:c,envDir:d,logger:p}=o.config;try{let l=u((0,t.loadEnv)(c,d,`API_AUTO_LOGIN_`));(0,e.stringifySetCookie)({...r,name:l.cookieName,value:``});let m=n.request??a(l,n.formFields),h=new AbortController,g=()=>{h.abort(),o.httpServer?.off(`close`,g),i.delete(g)};i.add(g),o.httpServer?.once(`close`,g);let _=s(l,{request:m,signal:h.signal});o.middlewares.use(f(l,r,_,p,h.signal))}catch(e){p.error(`[${l}] ${e instanceof Error?e.message:String(e)}`)}},closeBundle(){for(let e of i)e()}}}exports.createFormDataRequest=a,exports.loadPluginConfig=u,exports.viteAPIAutoLogin=p;

package/dist/vite-plugin-api-auto-login.js

@@ -0,0 +1,164 @@
+import { stringifySetCookie as e } from "cookie";
+import { loadEnv as t } from "vite";
+import { Agent as n, FormData as r, fetch as i } from "undici";
+import { decodeJwt as a } from "jose";
+import { EMPTY as o, ReplaySubject as s, Subscription as c, defer as l, filter as u, finalize as d, from as f, fromEvent as p, map as m, of as h, share as g, switchMap as _, take as v, takeUntil as y, tap as b } from "rxjs";
+// src/auth/createFormDataRequest.ts
+function x(e, t = {}) {
+	let n = t.username ?? "username", i = t.password ?? "password";
+	if (!n.trim() || !i.trim() || n === i) throw Error("Form field names must be non-empty and distinct");
+	return S(e), (e) => {
+		let { loginUrl: t, username: a, password: o } = S(e), s = new r();
+		return s.set(n, a), s.set(i, o), {
+			url: t,
+			init: {
+				method: "POST",
+				headers: { "User-Agent": e.userAgent },
+				body: s
+			}
+		};
+	};
+}
+function S(e) {
+	let { loginUrl: t, username: n, password: r } = e;
+	if (!t || !n || !r) throw Error("Missing required env vars: API_AUTO_LOGIN_LOGIN_URL, API_AUTO_LOGIN_USERNAME, API_AUTO_LOGIN_PASSWORD");
+	return {
+		loginUrl: t,
+		username: n,
+		password: r
+	};
+}
+// src/auth/createTokenStream.ts
+function C(e, t = {}) {
+	let r = t.request ?? x(e), a = t.fetch ?? i, c;
+	return l(() => {
+		if (t.signal?.aborted) return o;
+		if (c?.expiresAt !== void 0 && c.expiresAt > Date.now()) return h(c.value);
+		let i = new AbortController(), s;
+		return e.allowInsecureTls && (s = t.createDispatcher?.() ?? new n({ connect: { rejectUnauthorized: !1 } })), l(() => f(Promise.resolve(r(e)))).pipe(_(({ url: e, init: n }) => {
+			let r = [i.signal];
+			return n.signal && r.push(n.signal), t.signal && r.push(t.signal), f(a(e, {
+				...n,
+				dispatcher: s,
+				signal: AbortSignal.any(r)
+			}));
+		}), _((e) => {
+			if (!e.ok) throw Error(`Login request failed with status ${e.status}`);
+			return f(e.json());
+		}), m(w), b((e) => {
+			c = e;
+		}), m((e) => e.value), y(t.signal ? p(t.signal, "abort") : o), d(() => {
+			i.abort(), s && s.destroy().catch(() => {});
+		}));
+	}).pipe(g({
+		connector: () => new s(1),
+		resetOnError: !0,
+		resetOnComplete: !0,
+		resetOnRefCountZero: !0
+	}));
+}
+function w(e) {
+	if (!e || typeof e != "object" || !("token" in e) || typeof e.token != "string" || e.token.length === 0) throw Error("Login response did not include a token");
+	let t = e.token;
+	try {
+		let { exp: e } = a(t);
+		return {
+			value: t,
+			expiresAt: typeof e == "number" ? e * 1e3 : void 0
+		};
+	} catch {
+		return { value: t };
+	}
+}
+// src/constants.ts
+var T = "vite-plugin-api-auto-login";
+function E(e) {
+	return Object.freeze({
+		allowInsecureTls: e.API_AUTO_LOGIN_ALLOW_INSECURE_TLS === "true",
+		cookieName: e.API_AUTO_LOGIN_COOKIE_NAME ?? "your_token_name",
+		username: e.API_AUTO_LOGIN_USERNAME,
+		loginUrl: e.API_AUTO_LOGIN_LOGIN_URL,
+		password: e.API_AUTO_LOGIN_PASSWORD,
+		userAgent: e.API_AUTO_LOGIN_USER_AGENT ?? "vite"
+	});
+}
+// src/http/isHtmlDocumentRequest.ts
+function D(e) {
+	let t = e.method === "GET" || e.method === "HEAD", n = e.headers.accept?.includes("text/html") ?? !1, r = e.headers.upgrade?.toLowerCase() === "websocket";
+	return t && n && !r;
+}
+// src/middleware/createAutoLoginMiddleware.ts
+function O(t, n, r, i, a) {
+	return (o, s, l) => {
+		if (a.aborted || s.destroyed || s.writableEnded) return;
+		let d = new c(), f = () => d.unsubscribe(), p = () => {
+			a.aborted || s.destroyed || s.writableEnded || d.closed || l();
+		};
+		s.once("close", f), a.addEventListener("abort", f, { once: !0 }), d.add(() => {
+			s.off("close", f), a.removeEventListener("abort", f);
+		}), d.add(h(o).pipe(u(D), _(() => r), v(1), m((r) => e({
+			...n,
+			name: t.cookieName,
+			value: r
+		})), b((e) => {
+			s.headersSent || s.destroyed || s.writableEnded || s.appendHeader("Set-Cookie", e);
+		})).subscribe({
+			error: (e) => {
+				let n = e instanceof Error ? e.message : String(e), r = t.loginUrl ? ` (${t.loginUrl})` : "";
+				i.error(`[${T}] ${n}${r}`), p(), d.unsubscribe();
+			},
+			complete: () => {
+				p(), d.unsubscribe();
+			}
+		}));
+	};
+}
+// src/plugin.ts
+function k(n = {}) {
+	if ("createAuthRequest" in n) throw Error("createAuthRequest was removed; use request(config) instead");
+	if (n.request !== void 0 && typeof n.request != "function") throw Error("request must be a function: request(config)");
+	if (n.formFields !== void 0 && n.request !== void 0) throw Error("Use formFields only with the default request");
+	let r = {
+		path: n.cookie?.path ?? "/",
+		sameSite: n.cookie?.sameSite ?? "lax",
+		secure: n.cookie?.secure ?? !1,
+		httpOnly: n.cookie?.httpOnly ?? !1
+	};
+	if (r.sameSite === "none" && !r.secure) throw Error("cookie.sameSite \"none\" requires cookie.secure to be true");
+	e({
+		...r,
+		name: "validation",
+		value: ""
+	});
+	let i = /* @__PURE__ */ new Set();
+	return {
+		name: T,
+		apply: "serve",
+		configureServer(a) {
+			let { mode: o, envDir: s, logger: c } = a.config;
+			try {
+				let l = E(t(o, s, "API_AUTO_LOGIN_"));
+				e({
+					...r,
+					name: l.cookieName,
+					value: ""
+				});
+				let u = n.request ?? x(l, n.formFields), d = new AbortController(), f = () => {
+					d.abort(), a.httpServer?.off("close", f), i.delete(f);
+				};
+				i.add(f), a.httpServer?.once("close", f);
+				let p = C(l, {
+					request: u,
+					signal: d.signal
+				});
+				a.middlewares.use(O(l, r, p, c, d.signal));
+			} catch (e) {
+				c.error(`[${T}] ${e instanceof Error ? e.message : String(e)}`);
+			}
+		},
+		closeBundle() {
+			for (let e of i) e();
+		}
+	};
+}
+export { x as createFormDataRequest, E as loadPluginConfig, k as viteAPIAutoLogin };

package/package.json

@@ -1,6 +1,115 @@
 {
   "name": "@corespec/vite-plugin-api-auto-login",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Reusable Vite plugin for API auto login during local development",
+  "type": "module",
+  "main": "./dist/vite-plugin-api-auto-login.cjs",
+  "module": "./dist/vite-plugin-api-auto-login.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/vite-plugin-api-auto-login.js",
+      "require": "./dist/vite-plugin-api-auto-login.cjs"
+    }
+  },
+  "scripts": {
+    "build": "vite build && npm run build:types",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly && tsc-alias -p tsconfig.build.json",
+    "test": "vitest",
+    "coverage": "vitest run --coverage",
+    "release": "commit-and-tag-version",
+    "lint:file:fix": "npm-run-all \"eslint -- {1} --fix\" --",
+    "lint:file": "npm-run-all \"eslint -- {1}\" --",
+    "eslint": "eslint",
+    "lint:fix": "eslint . --fix",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit && vue-tsc --noEmit -p examples/vue-msw/tsconfig.json",
+    "check": "npm run format:check && npm run lint && npm run typecheck && npm test -- --run",
+    "format": "prettier . --write",
+    "format:check": "prettier . --check",
+    "example": "npm run build && node examples/vue-msw/dev.ts",
+    "example:build": "npm run build && vue-tsc --noEmit -p examples/vue-msw/tsconfig.json && vite build --config examples/vue-msw/vite.config.ts",
+    "release:first": "npm run release -- --first-release",
+    "release:patch": "npm run release -- --release-as patch",
+    "release:minor": "npm run release -- --release-as minor",
+    "release:major": "npm run release -- --release-as major",
+    "security:audit": "npm audit --package-lock-only --include=dev --audit-level=high"
+  },
+  "license": "ISC",
+  "engines": {
+    "node": ">=22.23.4"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@msw/serve": "^0.11.0",
+    "@stylistic/eslint-plugin": "^5.10.0",
+    "@types/node": "^22.20.5",
+    "@vitejs/plugin-vue": "^6.0.10",
+    "@vitest/coverage-v8": "^5.0.5",
+    "@vitest/eslint-plugin": "^1.6.28",
+    "commit-and-tag-version": "^13.3.0",
+    "eslint": "^10.14.0",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-vue": "^10.12.0",
+    "globals": "^17.14.0",
+    "msw": "^3.0.4",
+    "npm-run-all2": "^9.0.4",
+    "prettier": "3.9.10",
+    "tsc-alias": "^1.9.10",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.72.1",
+    "vite": "^8.3.5",
+    "vitest": "^5.0.5",
+    "vue": "^3.5.45",
+    "vue-tsc": "^3.3.14"
+  },
+  "dependencies": {
+    "cookie": "^2.0.2",
+    "jose": "^6.2.15",
+    "rxjs": "^7.8.2",
+    "undici": "^8.12.3"
+  },
+  "peerDependencies": {
+    "vite": "^7.0.0 || ^8.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "keywords": [
+    "vite-plugin",
+    "authentication",
+    "auto-login"
+  ],
+  "compatiblePackages": {
+    "schemaVersion": 1,
+    "vite": {
+      "type": "compatible",
+      "versions": "^7.0.0 || ^8.0.0",
+      "note": "Development server only; requires Vite configureServer and middleware APIs."
+    },
+    "rollup": {
+      "type": "incompatible",
+      "reason": "Requires the Vite development server and its configureServer hook."
+    },
+    "rolldown": {
+      "type": "incompatible",
+      "reason": "Requires the Vite development server and its configureServer hook."
+    }
+  },
+  "overrides": {
+    "minimatch@^10.0.0": "^11.0.5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/core-spec-tech/vite-plugin-api-auto-login.git"
+  },
+  "homepage": "https://github.com/core-spec-tech/vite-plugin-api-auto-login#readme",
+  "bugs": {
+    "url": "https://github.com/core-spec-tech/vite-plugin-api-auto-login/issues"
+  }
+}