@dotbots-boutique/auth-sdk 0.1.0

package/dist/esm/index.js

@@ -0,0 +1,388 @@
+class DotBotsAuthError extends Error {
+    constructor(code, message, originalError) {
+        super(message);
+        this.code = code;
+        this.originalError = originalError;
+        this.name = 'DotBotsAuthError';
+    }
+}
+
+class TokenManager {
+    constructor(config, environment, onRefreshed, onSessionExpired) {
+        this.accessToken = null;
+        this.refreshToken = null;
+        this.expiresAt = 0;
+        this.refreshTimer = null;
+        this.config = config;
+        this.environment = environment;
+        this.onRefreshed = onRefreshed;
+        this.onSessionExpired = onSessionExpired;
+    }
+    setTokens(tokens) {
+        this.accessToken = tokens.accessToken;
+        this.refreshToken = tokens.refreshToken;
+        this.expiresAt = Date.now() + tokens.expiresIn * 1000;
+        this.scheduleRefresh(tokens.expiresIn * 1000);
+    }
+    getAccessToken() {
+        return this.accessToken;
+    }
+    isAuthenticated() {
+        return this.accessToken !== null && Date.now() < this.expiresAt;
+    }
+    async exchangeCode(code) {
+        const response = await this.apiRequest('/api/auth/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ code, appId: this.config.appId }),
+        });
+        if (!response.ok) {
+            if (response.status === 401 || response.status === 400) {
+                throw new DotBotsAuthError('CODE_EXPIRED', 'Auth code is expired or invalid');
+            }
+            throw new DotBotsAuthError('NETWORK_ERROR', `Token exchange failed: ${response.status}`);
+        }
+        const tokens = await response.json();
+        this.setTokens(tokens);
+    }
+    async refresh() {
+        if (!this.refreshToken) {
+            throw new DotBotsAuthError('REFRESH_FAILED', 'No refresh token available');
+        }
+        let response;
+        try {
+            response = await this.apiRequest('/api/auth/refresh', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    refreshToken: this.refreshToken,
+                    appId: this.config.appId,
+                }),
+            });
+        }
+        catch (err) {
+            throw new DotBotsAuthError('REFRESH_FAILED', 'Token refresh request failed', err instanceof Error ? err : undefined);
+        }
+        if (!response.ok) {
+            throw new DotBotsAuthError('REFRESH_FAILED', `Token refresh failed: ${response.status}`);
+        }
+        const tokens = await response.json();
+        this.setTokens(tokens);
+    }
+    async revoke() {
+        if (this.accessToken && this.refreshToken) {
+            try {
+                await this.apiRequest('/api/auth/revoke', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        Authorization: `Bearer ${this.accessToken}`,
+                    },
+                    body: JSON.stringify({ refreshToken: this.refreshToken }),
+                });
+            }
+            catch {
+                // Best effort — continue with local cleanup regardless
+            }
+        }
+        this.clear();
+    }
+    clear() {
+        this.accessToken = null;
+        this.refreshToken = null;
+        this.expiresAt = 0;
+        if (this.refreshTimer !== null) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        }
+    }
+    scheduleRefresh(expiresInMs) {
+        if (this.refreshTimer !== null) {
+            clearTimeout(this.refreshTimer);
+        }
+        const buffer = this.config.tokenRefreshBuffer ?? 60000;
+        const delay = Math.max(expiresInMs - buffer, 0);
+        this.refreshTimer = setTimeout(async () => {
+            try {
+                await this.refresh();
+                this.onRefreshed();
+            }
+            catch {
+                this.onSessionExpired();
+                this.config.onTokenRefreshFailed?.();
+            }
+        }, delay);
+    }
+    apiRequest(path, init) {
+        const headers = new Headers(init.headers);
+        headers.set('X-App-Id', this.config.appId);
+        headers.set('X-Environment', this.environment);
+        return fetch(`${this.config.apiUrl}${path}`, { ...init, headers });
+    }
+}
+
+class PostMessageHandler {
+    constructor(marketplaceOrigin) {
+        this.marketplaceOrigin = marketplaceOrigin;
+    }
+    /**
+     * Detect if the current window is running inside an iframe.
+     * Also performs a security check: if window.frameElement is accessible
+     * in a cross-origin context, something is wrong.
+     */
+    isInIframe() {
+        try {
+            if (window.self === window.top)
+                return false;
+        }
+        catch {
+            // Cross-origin restriction — we are in an iframe
+            return true;
+        }
+        // Security check: frameElement should NOT be accessible cross-origin
+        try {
+            if (window.frameElement) {
+                throw new DotBotsAuthError('UNAUTHORIZED', 'Security violation: window.frameElement is accessible in cross-origin iframe');
+            }
+        }
+        catch (err) {
+            if (err instanceof DotBotsAuthError)
+                throw err;
+            // SecurityError is expected — this is the normal case
+        }
+        return true;
+    }
+    /**
+     * Send a ready signal to the parent window and wait for the auth code.
+     */
+    requestAuthCode(appId, timeout) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                window.removeEventListener('message', handler);
+                reject(new DotBotsAuthError('IFRAME_TIMEOUT', `Parent did not respond within ${timeout}ms`));
+            }, timeout);
+            const handler = (event) => {
+                if (event.origin !== this.marketplaceOrigin)
+                    return;
+                if (event.data?.type !== 'DOTBOTS_AUTH_CODE')
+                    return;
+                clearTimeout(timer);
+                window.removeEventListener('message', handler);
+                resolve(event.data.code);
+            };
+            window.addEventListener('message', handler);
+            window.parent.postMessage({ type: 'DOTBOTS_READY', appId }, this.marketplaceOrigin);
+        });
+    }
+    /**
+     * Notify the parent that the user has logged out.
+     */
+    sendLogout() {
+        if (this.isInIframe()) {
+            window.parent.postMessage({ type: 'DOTBOTS_LOGOUT' }, this.marketplaceOrigin);
+        }
+    }
+}
+
+class ProxyConfigManager {
+    constructor(apiUrl, appId, environment) {
+        this.config = null;
+        this.apiUrl = apiUrl;
+        this.appId = appId;
+        this.environment = environment;
+    }
+    async fetchConfig() {
+        try {
+            const response = await fetch(`${this.apiUrl}/api/proxy/config`, {
+                headers: {
+                    'X-App-Id': this.appId,
+                    'X-Environment': this.environment,
+                },
+            });
+            if (!response.ok) {
+                throw new Error(`Proxy config request failed: ${response.status}`);
+            }
+            this.config = await response.json();
+        }
+        catch (err) {
+            // Non-fatal: log warning, SDK falls back to direct apiUrl
+            console.warn('[DotBotsAuth] Could not fetch proxy config, falling back to direct API:', err instanceof Error ? err.message : err);
+            this.config = null;
+        }
+    }
+    getProxyUrl() {
+        return this.config?.proxyUrl ?? null;
+    }
+    getConfig() {
+        return this.config;
+    }
+    /**
+     * Returns the base URL to use for API calls.
+     * Uses the proxy if available, otherwise falls back to apiUrl.
+     */
+    getBaseUrl() {
+        return this.config?.proxyUrl ?? this.apiUrl;
+    }
+}
+
+class DotBotsAuth {
+    constructor(config) {
+        this.listeners = new Map();
+        this.cachedUser = null;
+        this.initialized = false;
+        this.config = config;
+        this.environment = this.detectEnvironment();
+        const marketplaceOrigin = config.marketplaceOrigin ?? 'https://dotbots.boutique';
+        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'));
+        this.postMessageHandler = new PostMessageHandler(marketplaceOrigin);
+        this.proxyConfigManager = new ProxyConfigManager(config.apiUrl, config.appId, this.environment);
+    }
+    async initialize() {
+        // Step 1 — Fetch proxy config
+        await this.proxyConfigManager.fetchConfig();
+        // Step 2 — Authenticate
+        if (this.postMessageHandler.isInIframe()) {
+            await this.initializeIframe();
+        }
+        else {
+            await this.initializeStandalone();
+        }
+        this.initialized = true;
+    }
+    async getUser() {
+        this.assertInitialized();
+        if (this.cachedUser)
+            return this.cachedUser;
+        const response = await this.buildRequest(`${this.config.apiUrl}/api/auth/me`);
+        if (!response.ok) {
+            if (response.status === 401) {
+                throw new DotBotsAuthError('UNAUTHORIZED', 'Not authorized to access this app');
+            }
+            throw new DotBotsAuthError('NETWORK_ERROR', `Failed to fetch user: ${response.status}`);
+        }
+        this.cachedUser = await response.json();
+        this.emit('userLoaded');
+        return this.cachedUser;
+    }
+    can(permission) {
+        if (!this.cachedUser) {
+            throw new DotBotsAuthError('NOT_INITIALIZED', 'User data not loaded. Call getUser() first.');
+        }
+        return this.cachedUser.permissions.includes(permission);
+    }
+    canAll(permissions) {
+        return permissions.every((p) => this.can(p));
+    }
+    canAny(permissions) {
+        return permissions.some((p) => this.can(p));
+    }
+    hasRole(role) {
+        if (!this.cachedUser) {
+            throw new DotBotsAuthError('NOT_INITIALIZED', 'User data not loaded. Call getUser() first.');
+        }
+        return this.cachedUser.roles.includes(role);
+    }
+    async fetch(url, options) {
+        this.assertInitialized();
+        const baseUrl = this.proxyConfigManager.getBaseUrl();
+        const fullUrl = `${baseUrl}${url.startsWith('/') ? url : `/${url}`}`;
+        let response = await this.buildRequest(fullUrl, options);
+        // On 401, try one refresh then retry
+        if (response.status === 401) {
+            try {
+                await this.tokenManager.refresh();
+                this.emit('tokenRefreshed');
+                response = await this.buildRequest(fullUrl, options);
+            }
+            catch {
+                throw new DotBotsAuthError('UNAUTHORIZED', 'Request unauthorized and token refresh failed');
+            }
+        }
+        return response;
+    }
+    async logout() {
+        this.assertInitialized();
+        await this.tokenManager.revoke();
+        this.cachedUser = null;
+        this.emit('loggedOut');
+        if (this.postMessageHandler.isInIframe()) {
+            this.postMessageHandler.sendLogout();
+        }
+        else {
+            const redirectUri = encodeURIComponent(window.location.origin);
+            window.location.href = `${this.config.apiUrl}/api/auth/logout?redirectUri=${redirectUri}`;
+        }
+    }
+    on(event, handler) {
+        if (!this.listeners.has(event)) {
+            this.listeners.set(event, new Set());
+        }
+        this.listeners.get(event).add(handler);
+    }
+    off(event, handler) {
+        this.listeners.get(event)?.delete(handler);
+    }
+    /**
+     * Returns the proxy config if available. Useful for advanced use cases.
+     */
+    getProxyConfig() {
+        return this.proxyConfigManager.getConfig();
+    }
+    // --- Private ---
+    detectEnvironment() {
+        const hostname = window.location.hostname;
+        if (hostname.includes('test-apps'))
+            return 'test';
+        return 'prod';
+    }
+    async initializeIframe() {
+        const timeout = this.config.iframeTimeout ?? 5000;
+        const code = await this.postMessageHandler.requestAuthCode(this.config.appId, timeout);
+        await this.tokenManager.exchangeCode(code);
+    }
+    async initializeStandalone() {
+        const url = new URL(window.location.href);
+        const code = url.searchParams.get('code');
+        if (code) {
+            // Remove code from URL immediately
+            url.searchParams.delete('code');
+            window.history.replaceState({}, '', url.toString());
+            await this.tokenManager.exchangeCode(code);
+        }
+        else if (!this.tokenManager.isAuthenticated()) {
+            // Redirect to auth
+            const redirectUri = encodeURIComponent(window.location.href);
+            window.location.href = `${this.config.apiUrl}/api/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
+        }
+    }
+    async buildRequest(url, options) {
+        const headers = new Headers(options?.headers);
+        const accessToken = this.tokenManager.getAccessToken();
+        if (accessToken) {
+            headers.set('Authorization', `Bearer ${accessToken}`);
+        }
+        headers.set('X-App-Id', this.config.appId);
+        headers.set('X-Environment', this.environment);
+        return globalThis.fetch(url, { ...options, headers });
+    }
+    assertInitialized() {
+        if (!this.initialized) {
+            throw new DotBotsAuthError('NOT_INITIALIZED', 'Call initialize() before using the SDK');
+        }
+    }
+    emit(event) {
+        const handlers = this.listeners.get(event);
+        if (handlers) {
+            for (const handler of handlers) {
+                try {
+                    handler();
+                }
+                catch {
+                    // Don't let listener errors break the SDK
+                }
+            }
+        }
+    }
+}
+
+export { DotBotsAuth, DotBotsAuthError };

package/dist/esm/react/index.js

@@ -0,0 +1,63 @@
+import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
+import { createContext, useState, useEffect, useContext } from 'react';
+
+const DotBotsAuthContext = createContext(null);
+function DotBotsAuthProvider({ auth, children, loadingComponent, errorComponent, }) {
+    const [user, setUser] = useState(null);
+    const [isLoading, setIsLoading] = useState(true);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        let cancelled = false;
+        async function init() {
+            try {
+                await auth.initialize();
+                const userData = await auth.getUser();
+                if (!cancelled) {
+                    setUser(userData);
+                    setIsLoading(false);
+                }
+            }
+            catch (err) {
+                if (!cancelled) {
+                    setError(err);
+                    setIsLoading(false);
+                }
+            }
+        }
+        init();
+        return () => {
+            cancelled = true;
+        };
+    }, [auth]);
+    if (isLoading) {
+        return jsx(Fragment, { children: loadingComponent ?? jsx("div", { children: "Loading..." }) });
+    }
+    if (error) {
+        if (errorComponent) {
+            return jsx(Fragment, { children: errorComponent(error) });
+        }
+        return jsxs("div", { children: ["Authentication error: ", error.message] });
+    }
+    const value = {
+        user,
+        isLoading,
+        error,
+        can: (permission) => auth.can(permission),
+        canAll: (permissions) => auth.canAll(permissions),
+        canAny: (permissions) => auth.canAny(permissions),
+        hasRole: (role) => auth.hasRole(role),
+        fetch: (url, options) => auth.fetch(url, options),
+        logout: () => auth.logout(),
+    };
+    return (jsx(DotBotsAuthContext.Provider, { value: value, children: children }));
+}
+
+function useDotBotsAuth() {
+    const context = useContext(DotBotsAuthContext);
+    if (!context) {
+        throw new Error('useDotBotsAuth must be used within a DotBotsAuthProvider');
+    }
+    return context;
+}
+
+export { DotBotsAuthProvider, useDotBotsAuth };

package/dist/types/DotBotsAuth.d.ts

@@ -0,0 +1,32 @@
+import type { DotBotsConfig, DotBotsUser, DotBotsAuthEvent, DotBotsProxyConfig } from './types.js';
+export declare class DotBotsAuth {
+    private readonly config;
+    private readonly environment;
+    private readonly tokenManager;
+    private readonly postMessageHandler;
+    private readonly proxyConfigManager;
+    private readonly listeners;
+    private cachedUser;
+    private initialized;
+    constructor(config: DotBotsConfig);
+    initialize(): Promise<void>;
+    getUser(): Promise<DotBotsUser>;
+    can(permission: string): boolean;
+    canAll(permissions: string[]): boolean;
+    canAny(permissions: string[]): boolean;
+    hasRole(role: string): boolean;
+    fetch(url: string, options?: RequestInit): Promise<Response>;
+    logout(): Promise<void>;
+    on(event: DotBotsAuthEvent, handler: Function): void;
+    off(event: DotBotsAuthEvent, handler: Function): void;
+    /**
+     * Returns the proxy config if available. Useful for advanced use cases.
+     */
+    getProxyConfig(): DotBotsProxyConfig | null;
+    private detectEnvironment;
+    private initializeIframe;
+    private initializeStandalone;
+    private buildRequest;
+    private assertInitialized;
+    private emit;
+}

package/dist/types/DotBotsAuthError.d.ts

@@ -0,0 +1,6 @@
+import type { DotBotsAuthErrorCode } from './types.js';
+export declare class DotBotsAuthError extends Error {
+    code: DotBotsAuthErrorCode;
+    originalError?: Error | undefined;
+    constructor(code: DotBotsAuthErrorCode, message: string, originalError?: Error | undefined);
+}

package/dist/types/PostMessageHandler.d.ts

@@ -0,0 +1,18 @@
+export declare class PostMessageHandler {
+    private readonly marketplaceOrigin;
+    constructor(marketplaceOrigin: string);
+    /**
+     * Detect if the current window is running inside an iframe.
+     * Also performs a security check: if window.frameElement is accessible
+     * in a cross-origin context, something is wrong.
+     */
+    isInIframe(): boolean;
+    /**
+     * Send a ready signal to the parent window and wait for the auth code.
+     */
+    requestAuthCode(appId: string, timeout: number): Promise<string>;
+    /**
+     * Notify the parent that the user has logged out.
+     */
+    sendLogout(): void;
+}

package/dist/types/ProxyConfigManager.d.ts

@@ -0,0 +1,16 @@
+import type { DotBotsProxyConfig, DotBotsEnvironment } from './types.js';
+export declare class ProxyConfigManager {
+    private config;
+    private readonly apiUrl;
+    private readonly appId;
+    private readonly environment;
+    constructor(apiUrl: string, appId: string, environment: DotBotsEnvironment);
+    fetchConfig(): Promise<void>;
+    getProxyUrl(): string | null;
+    getConfig(): DotBotsProxyConfig | null;
+    /**
+     * Returns the base URL to use for API calls.
+     * Uses the proxy if available, otherwise falls back to apiUrl.
+     */
+    getBaseUrl(): string;
+}

package/dist/types/TokenManager.d.ts

@@ -0,0 +1,21 @@
+import type { DotBotsConfig, TokenPair, DotBotsEnvironment } from './types.js';
+export declare class TokenManager {
+    private accessToken;
+    private refreshToken;
+    private expiresAt;
+    private refreshTimer;
+    private readonly config;
+    private readonly environment;
+    private readonly onRefreshed;
+    private readonly onSessionExpired;
+    constructor(config: DotBotsConfig, environment: DotBotsEnvironment, onRefreshed: () => void, onSessionExpired: () => void);
+    setTokens(tokens: TokenPair): void;
+    getAccessToken(): string | null;
+    isAuthenticated(): boolean;
+    exchangeCode(code: string): Promise<void>;
+    refresh(): Promise<void>;
+    revoke(): Promise<void>;
+    clear(): void;
+    private scheduleRefresh;
+    private apiRequest;
+}

package/dist/types/index.d.ts

@@ -0,0 +1,3 @@
+export { DotBotsAuth } from './DotBotsAuth.js';
+export { DotBotsAuthError } from './DotBotsAuthError.js';
+export type { DotBotsConfig, DotBotsUser, DotBotsAuthEvent, DotBotsAuthErrorCode, DotBotsProxyConfig, ProxyFeature, DotBotsEnvironment, } from './types.js';