@ecomiq/storefront 2.1.4 → 3.0.1

package/src/auth/create-storefront-auth.ts

@@ -1,94 +0,0 @@
-import { betterAuth } from 'better-auth'
-import type { BetterAuthPlugin } from 'better-auth'
-import { createCookieGetter, getCookies } from 'better-auth/cookies'
-import { tanstackStartCookies } from 'better-auth/tanstack-start'
-import { getStorefrontClient } from '../client'
-import { ecomiqOAuthPassword } from './ecomiq-oauth-password-plugin'
-import { readProcessEnv } from './env'
-import { shouldUseSecureCookies } from './secure-cookies'
-import {
-  mergeSettingsHostsIntoBaseURL,
-  resolveStorefrontAuthBaseURL,
-  type StorefrontDynamicBaseURLConfig,
-} from './storefront-auth-base-url'
-
-export type CreateStorefrontAuthOptions = {
-  secret?: string
-  /** Opciones adicionales pasadas a `betterAuth` (p. ej. `database`). */
-  [key: string]: unknown
-}
-
-/**
- * Instancia Better Auth del storefront (servidor).
- *
- * allowedHosts = `BETTER_AUTH_TRUSTED_HOSTS` (defaults) + dominio(s) de settings.
- * Cookies `Secure` se recalculan por request (HTTP vs HTTPS).
- */
-export function createStorefrontAuth(options: CreateStorefrontAuthOptions = {}) {
-  const { secret, advanced, ...rest } = options
-
-  const resolvedBaseURL: StorefrontDynamicBaseURLConfig = resolveStorefrontAuthBaseURL()
-
-  const auth = betterAuth({
-    ...rest,
-    secret: (secret as string | undefined) ?? readProcessEnv('BETTER_AUTH_SECRET'),
-    baseURL: resolvedBaseURL,
-    advanced: {
-      disableCSRFCheck: true,
-      useSecureCookies: false,
-      ...(typeof advanced === 'object' && advanced !== null ? advanced : {}),
-    },
-    plugins: [
-      ecomiqOAuthPassword() as BetterAuthPlugin,
-      tanstackStartCookies(),
-    ],
-  })
-
-  const originalHandler = auth.handler.bind(auth)
-
-  return Object.assign(auth, {
-    handler: async (request: Request) => {
-      await syncAllowedHostsFromSettings(resolvedBaseURL)
-      await rehydrateAuthCookiesForRequest(auth, request)
-      return originalHandler(request)
-    },
-  })
-}
-
-async function syncAllowedHostsFromSettings(
-  baseURL: StorefrontDynamicBaseURLConfig,
-): Promise<void> {
-  try {
-    const settings = await getStorefrontClient().getSettings()
-    mergeSettingsHostsIntoBaseURL(baseURL, settings)
-  } catch {
-    mergeSettingsHostsIntoBaseURL(baseURL, null)
-  }
-}
-
-/**
- * Better Auth crea cookies al init; con `protocol: 'auto'` cae en `isProduction`
- * y marca Secure. En cada request las regeneramos según el protocolo real.
- */
-async function rehydrateAuthCookiesForRequest(
-  auth: { $context: Promise<Record<string, unknown>> | Record<string, unknown> },
-  request: Request,
-): Promise<void> {
-  const ctx = await auth.$context
-  const useSecure = shouldUseSecureCookies(request.url)
-  const origin = new URL(request.url).origin
-  const options = (ctx.options ?? {}) as Record<string, unknown>
-  const advanced = {
-    ...((options.advanced as object | undefined) ?? {}),
-    useSecureCookies: useSecure,
-  }
-  const cookieOptions = {
-    ...options,
-    baseURL: origin,
-    advanced,
-  }
-
-  ctx.authCookies = getCookies(cookieOptions as never)
-  ctx.createAuthCookie = createCookieGetter(cookieOptions as never)
-  options.advanced = advanced
-}

package/src/auth/ecomiq-oauth-password-client.ts

@@ -1,26 +0,0 @@
-import type { BetterAuthClientPlugin } from 'better-auth/client'
-import { PLUGIN_ID } from './ecomiq-oauth-password-constants'
-
-/**
- * Cliente Better Auth para el plugin `ecomiqOAuthPassword` (login `/v1/customer/login`).
- * Tras añadirlo a `createAuthClient`, refresca la sesión al llamar al sign-in.
- *
- * Ejemplo:
- * `authClient.$fetch("/ecomiq-oauth/sign-in", { method: "POST", headers, body: { email, password } })`
- *
- * Importante: no anotar el retorno como `BetterAuthClientPlugin` (rompe la inferencia de sesión).
- */
-export function ecomiqOAuthPasswordClient() {
-  return {
-    id: PLUGIN_ID,
-    pathMethods: {
-      '/ecomiq-oauth/sign-in': 'POST',
-    },
-    atomListeners: [
-      {
-        matcher: (path: string) => path === '/ecomiq-oauth/sign-in',
-        signal: '$sessionSignal' as const,
-      },
-    ],
-  } satisfies BetterAuthClientPlugin
-}

package/src/auth/ecomiq-oauth-password-constants.ts

@@ -1,24 +0,0 @@
-import { DEFAULT_API_BASE_URL, DEFAULT_API_VERSION } from '@ecomiq/core'
-
-/** Id del plugin servidor/cliente Better Auth (debe coincidir en ambos lados). */
-export const PLUGIN_ID = 'ecomiq-oauth-password'
-
-/** Base storefront (override con `STOREFRONT_API_URL`). */
-export const DEFAULT_STOREFRONT_API_URL = DEFAULT_API_BASE_URL
-
-/** Prefijo de versión en storefront API (`/v1/...`). */
-export const STOREFRONT_API_PATH_PREFIX = DEFAULT_API_VERSION
-
-/**
- * Cookie HttpOnly con el bearer de customer login.
- * Debe coincidir con el nombre que lee el proxy BFF (`api-proxy`).
- */
-export const STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME = 'ecomiq_sf_oauth_at'
-
-/** Path de la cookie (debe llegar a `/api/*` del proxy). */
-export const STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH = '/api'
-
-/** Header de identidad para login storefront (`POST /v1/customer/login`). */
-export const STOREFRONT_HEADERS = {
-  storeId: 'x-Store-Id',
-} as const

package/src/auth/ecomiq-oauth-password-plugin.ts

@@ -1,294 +0,0 @@
-import {
-  createAuthEndpoint,
-  createAuthMiddleware,
-  formCsrfMiddleware,
-} from "better-auth/api";
-import { APIError, type BetterAuthPlugin } from "better-auth";
-import { setSessionCookie } from "better-auth/cookies";
-import { parseUserOutput } from "better-auth/db";
-
-import { readProcessEnv } from "./env";
-import {
-  DEFAULT_STOREFRONT_API_URL,
-  PLUGIN_ID,
-  STOREFRONT_API_PATH_PREFIX,
-  STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME,
-  STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH,
-  STOREFRONT_HEADERS,
-} from "./ecomiq-oauth-password-constants";
-import {
-  customerLoginResponseSchema,
-  signInBody,
-} from "./ecomiq-oauth-password-types";
-import { shouldUseSecureCookiesFromBaseURL } from "./secure-cookies";
-
-type StoreIdentityContext = {
-  storeId?: string | null
-};
-
-/**
- * Inicia sesión contra `POST /v1/customer/login` del storefront Ecomiq,
- * crea/actualiza el usuario en Better Auth y guarda el bearer en cookie HttpOnly
- * acotada a `/api` (proxy BFF).
- */
-export function ecomiqOAuthPassword(): BetterAuthPlugin {
-  const clearStorefrontOAuthCookieMiddleware = createAuthMiddleware(async (ctx) => {
-    ctx.setCookie(STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME, "", {
-      path: STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH,
-      httpOnly: true,
-      sameSite: "lax",
-      secure: shouldUseSecureCookiesFromBaseURL(
-        ctx.context.baseURL,
-        ctx.request?.url,
-      ),
-      maxAge: 0,
-    });
-  });
-
-  return {
-    id: PLUGIN_ID,
-    schema: {
-      user: {
-        fields: {
-          firstName: { type: "string", required: false },
-          lastName: { type: "string", required: false },
-          phone: { type: "string", required: false },
-        },
-      },
-    },
-    hooks: {
-      after: [
-        {
-          matcher: (hookCtx) => hookCtx.path === "/sign-out",
-          handler: clearStorefrontOAuthCookieMiddleware,
-        },
-      ],
-    },
-    endpoints: {
-      signIn: createAuthEndpoint(
-        "/ecomiq-oauth/sign-in",
-        {
-          method: "POST",
-          use: [formCsrfMiddleware],
-          body: signInBody,
-        },
-        async (ctx) => {
-          const { email: loginEmail, password, callbackURL, rememberMe } = ctx.body;
-
-          const login = await customerPasswordLogin(loginEmail, password, {
-            storeId: ctx.getHeader(STOREFRONT_HEADERS.storeId),
-          });
-
-          const canonicalEmail = loginEmail.toLowerCase().trim();
-          const displayName = canonicalEmail.split("@")[0] || "Cliente";
-
-          const existing = await ctx.context.internalAdapter.findUserByEmail(canonicalEmail);
-          let user = existing?.user;
-          if (!user) {
-            user = await ctx.context.internalAdapter.createUser({
-              email: canonicalEmail,
-              name: displayName,
-              emailVerified: login.customer.isVerified,
-            });
-          } else if (user.name !== displayName) {
-            await ctx.context.internalAdapter.updateUser(user.id, { name: displayName });
-            user = { ...user, name: displayName };
-          }
-
-          const oauthSessionExpires =
-            login.expiresIn !== undefined && login.expiresIn > 0
-              ? new Date(Date.now() + login.expiresIn * 1000)
-              : undefined;
-
-          const session = await ctx.context.internalAdapter.createSession(
-            user.id,
-            rememberMe === false,
-            oauthSessionExpires ? { expiresAt: oauthSessionExpires } : {},
-            Boolean(oauthSessionExpires),
-          );
-
-          if (!session) {
-            throw APIError.from("INTERNAL_SERVER_ERROR", {
-              code: "ECOMIQ_SESSION_FAILED",
-              message: "No se pudo crear la sesión",
-            });
-          }
-
-          await setSessionCookie(ctx, { session, user }, rememberMe === false);
-
-          const oauthMaxAgeSec =
-            oauthSessionExpires !== undefined
-              ? Math.max(60, Math.ceil((oauthSessionExpires.getTime() - Date.now()) / 1000))
-              : login.expiresIn !== undefined && login.expiresIn > 0
-                ? login.expiresIn
-                : 60 * 60 * 24;
-
-          const secureCookie = shouldUseSecureCookiesFromBaseURL(
-            ctx.context.baseURL,
-            ctx.request?.url,
-          );
-
-          await ctx.setCookie(STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME, login.accessToken, {
-            path: STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH,
-            httpOnly: true,
-            sameSite: "lax",
-            secure: secureCookie,
-            maxAge: oauthMaxAgeSec,
-          });
-
-          if (callbackURL) ctx.setHeader("Location", callbackURL);
-
-          return ctx.json({
-            redirect: !!callbackURL,
-            token: session.token,
-            url: callbackURL,
-            user: parseUserOutput(ctx.context.options, user),
-          });
-        },
-      ),
-    },
-  } satisfies BetterAuthPlugin;
-}
-
-function resolveCustomerLoginUrl(): string {
-  const base = (readProcessEnv("STOREFRONT_API_URL") ?? DEFAULT_STOREFRONT_API_URL).replace(
-    /\/$/,
-    "",
-  );
-  return `${base}/${STOREFRONT_API_PATH_PREFIX}/customer/login`;
-}
-
-type ApiErrorBody = {
-  error?: string;
-  message?: string;
-  title?: string;
-  detail?: string;
-};
-
-async function customerPasswordLogin(
-  email: string,
-  password: string,
-  context: StoreIdentityContext,
-): Promise<ReturnType<typeof customerLoginResponseSchema.parse>> {
-  const headers = new Headers({
-    "content-type": "application/json",
-    accept: "application/json",
-  });
-
-  const storeId = context.storeId?.trim();
-  if (storeId) {
-    headers.set(STOREFRONT_HEADERS.storeId, storeId);
-  }
-
-  let res: Response;
-  let text: string;
-  try {
-    res = await fetch(resolveCustomerLoginUrl(), {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ email, password }),
-    });
-    text = await res.text();
-  } catch (e) {
-    throw mapCustomerLoginFetchFailure(e);
-  }
-
-  const json = safeParseJson(text);
-  if (!res.ok) {
-    throwBadRequestFromLoginApi(json, res.statusText || text || `HTTP ${res.status}`);
-  }
-
-  const parsed = customerLoginResponseSchema.safeParse(json);
-  if (!parsed.success) {
-    throw APIError.from("UNAUTHORIZED", {
-      code: "ECOMIQ_LOGIN_SHAPE",
-      message: "Respuesta de login con formato inválido",
-    });
-  }
-
-  if (parsed.data.customer.status !== "active") {
-    throw APIError.from("UNAUTHORIZED", {
-      code: "ECOMIQ_CUSTOMER_INACTIVE",
-      message: "La cuenta del cliente no está activa",
-    });
-  }
-
-  return parsed.data;
-}
-
-function safeParseJson(text: string): unknown {
-  try {
-    return text ? JSON.parse(text) : {};
-  } catch {
-    return {};
-  }
-}
-
-function throwBadRequestFromLoginApi(payload: unknown, fallbackMessage: string): never {
-  const err = payload as ApiErrorBody;
-  const errorCode =
-    typeof err.error === "string" && err.error.trim() ? err.error.trim() : "invalid_credentials";
-  const errorMessage =
-    (typeof err.message === "string" && err.message.trim()) ||
-    (typeof err.detail === "string" && err.detail.trim()) ||
-    (typeof err.title === "string" && err.title.trim()) ||
-    (typeof err.error === "string" && err.error.trim()) ||
-    fallbackMessage.trim() ||
-    "Credenciales inválidas.";
-  throw APIError.from("BAD_REQUEST", {
-    code: errorCode,
-    message: errorMessage.slice(0, 500),
-  });
-}
-
-function mapCustomerLoginFetchFailure(e: unknown): never {
-  const codes = collectNetworkErrorCodes(e);
-  const msg = e instanceof Error ? e.message : String(e);
-
-  const isDnsError = codes.some((c) => c === "ENOTFOUND" || c === "EAI_AGAIN");
-  if (isDnsError) {
-    throw APIError.from("BAD_GATEWAY", {
-      code: "ECOMIQ_LOGIN_DNS",
-      message: "No se pudo resolver el servidor de la tienda.",
-    });
-  }
-
-  const isConnectionRefused = codes.includes("ECONNREFUSED");
-  if (isConnectionRefused) {
-    throw APIError.from("BAD_GATEWAY", {
-      code: "ECOMIQ_LOGIN_REFUSED",
-      message: "Conexión rechazada al servidor de la tienda.",
-    });
-  }
-
-  const looksLikeAbortOrSocketClose =
-    codes.some((c) =>
-      ["UND_ERR_SOCKET", "ECONNRESET", "EPIPE", "ECONNABORTED"].includes(c),
-    ) || /terminated|abort|closed|FIN|socket/i.test(msg);
-
-  if (looksLikeAbortOrSocketClose) {
-    throwBadRequestFromLoginApi({}, "Credenciales inválidas o conexión cerrada por el servidor.");
-  }
-
-  throw APIError.from("INTERNAL_SERVER_ERROR", {
-    code: "ECOMIQ_LOGIN_REQUEST_FAILED",
-    message: msg.slice(0, 280) || "Error al contactar el servidor de la tienda.",
-  });
-}
-
-function collectNetworkErrorCodes(e: unknown): string[] {
-  const out: string[] = [];
-  const visit = (x: unknown): void => {
-    if (!x || typeof x !== "object") return;
-    const code =
-      "code" in x && typeof (x as { code?: unknown }).code === "string"
-        ? (x as { code: string }).code
-        : undefined;
-    if (code) out.push(code);
-    if ("cause" in x && (x as { cause?: unknown }).cause) {
-      visit((x as { cause: unknown }).cause);
-    }
-  };
-  visit(e);
-  return out;
-}

package/src/auth/ecomiq-oauth-password-types.ts

@@ -1,24 +0,0 @@
-import { z } from "zod";
-
-export const customerLoginCustomerSchema = z.object({
-  id: z.coerce.number(),
-  status: z.string(),
-  isVerified: z.boolean(),
-});
-
-/** Respuesta de `POST /v1/customer/login`. */
-export const customerLoginResponseSchema = z.object({
-  accessToken: z.string().min(1),
-  refreshToken: z.string().optional(),
-  /** Segundos hasta expiración (ej. `86399`). Sincroniza la sesión Better Auth con el bearer. */
-  expiresIn: z.coerce.number().int().positive().optional(),
-  tokenType: z.string().optional(),
-  customer: customerLoginCustomerSchema,
-});
-
-export const signInBody = z.object({
-  email: z.string().email(),
-  password: z.string().min(1),
-  callbackURL: z.string().optional(),
-  rememberMe: z.boolean().optional().default(true),
-});

package/src/auth/ecomiq-storefront-sign-in.ts

@@ -1,44 +0,0 @@
-import type { StorefrontSettings } from '@ecomiq/core'
-import { STOREFRONT_HEADERS } from './ecomiq-oauth-password-constants'
-
-export type EcomiqSignInCredentials = {
-  email: string
-  password: string
-}
-
-/** Cliente Better Auth con `$fetch` (p. ej. resultado de `createStorefrontAuthClient`). */
-export type StorefrontAuthFetchClient = {
-  $fetch: (
-    path: string,
-    init: {
-      method: string
-      headers: Record<string, string | undefined>
-      body: EcomiqSignInCredentials
-    },
-  ) => Promise<{ error?: { message?: string } | null }>
-}
-
-/**
- * Inicia sesión con email/contraseña vía plugin `ecomiqOAuthPassword`
- * (Better Auth → `/v1/customer/login`).
- */
-export async function signInWithEcomiqCredentials(
-  authClient: StorefrontAuthFetchClient,
-  settings: StorefrontSettings | null | undefined,
-  credentials: EcomiqSignInCredentials,
-) {
-  const response = await authClient.$fetch('/ecomiq-oauth/sign-in', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      [STOREFRONT_HEADERS.storeId]: settings?.store.id,
-    },
-    body: credentials,
-  })
-
-  if (response.error) {
-    throw new Error(response.error.message ?? 'Error al iniciar sesión')
-  }
-
-  return response
-}

package/src/auth/env.ts

@@ -1,7 +0,0 @@
-/** Lee una variable de entorno sin depender de `@types/node`. */
-export function readProcessEnv(name: string): string | undefined {
-  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })
-    .process?.env
-  const value = env?.[name]
-  return typeof value === 'string' && value.length > 0 ? value : undefined
-}

package/src/auth/secure-cookies.ts

@@ -1,23 +0,0 @@
-/**
- * Secure cookies solo en HTTPS. En localhost HTTP el browser las descarta.
- */
-export function shouldUseSecureCookies(requestUrl: string | URL): boolean {
-  try {
-    const url = typeof requestUrl === 'string' ? new URL(requestUrl) : requestUrl
-    return url.protocol === 'https:'
-  } catch {
-    return false
-  }
-}
-
-export function shouldUseSecureCookiesFromBaseURL(
-  baseURL: string | undefined,
-  fallbackRequestUrl?: string,
-): boolean {
-  if (typeof baseURL === 'string' && baseURL.length > 0) {
-    if (baseURL.startsWith('https://')) return true
-    if (baseURL.startsWith('http://')) return false
-  }
-  if (fallbackRequestUrl) return shouldUseSecureCookies(fallbackRequestUrl)
-  return false
-}

package/src/auth/storefront-auth-base-url.ts

@@ -1,117 +0,0 @@
-import { readProcessEnv } from './env'
-
-/** Config dinámica de Better Auth (`baseURL: { allowedHosts }`). */
-export type StorefrontDynamicBaseURLConfig = {
-  allowedHosts: string[]
-  fallback?: string
-  protocol?: 'http' | 'https' | 'auto'
-}
-
-/** Env CSV con hosts por defecto (antes de settings). */
-export const BETTER_AUTH_TRUSTED_HOSTS_ENV = 'BETTER_AUTH_TRUSTED_HOSTS'
-
-/**
- * Defaults si `BETTER_AUTH_TRUSTED_HOSTS` no está definido.
- * Incluye host sin puerto (`localhost`) y con puerto (`localhost:*`).
- */
-export const DEFAULT_STOREFRONT_AUTH_ALLOWED_HOSTS = [
-  'localhost',
-  'localhost:*',
-  '127.0.0.1',
-  '127.0.0.1:*',
-  '*.ecomiq.app',
-  'ecomiq.app',
-] as const
-
-export type StoreSettingsHostsSource = {
-  store: {
-    domain: string | null
-    domains: string[]
-  }
-}
-
-/** Hosts por defecto: env CSV o fallback hardcodeado. */
-export function defaultAllowedHostsFromEnv(): string[] {
-  const fromEnv = splitCsv(readProcessEnv(BETTER_AUTH_TRUSTED_HOSTS_ENV))
-  return uniqueHosts(
-    fromEnv.length > 0 ? fromEnv : [...DEFAULT_STOREFRONT_AUTH_ALLOWED_HOSTS],
-  )
-}
-
-/**
- * Extrae hosts desde settings API (`store.domain` + `store.domains`).
- */
-export function hostsFromStoreSettings(
-  settings: StoreSettingsHostsSource | null | undefined,
-): string[] {
-  if (!settings?.store) return []
-  const raw = [settings.store.domain, ...settings.store.domains]
-  return uniqueHosts(
-    raw.flatMap((value) => {
-      const host = normalizeHost(value)
-      return host ? [host] : []
-    }),
-  )
-}
-
-/**
- * `baseURL` dinámico: solo hosts del env (defaults).
- * El dominio final se fusiona luego desde settings API.
- */
-export function resolveStorefrontAuthBaseURL(): StorefrontDynamicBaseURLConfig {
-  return {
-    protocol: 'auto',
-    allowedHosts: defaultAllowedHostsFromEnv(),
-  }
-}
-
-/**
- * allowedHosts = defaults (env) + dominio(s) de settings.
- */
-export function mergeSettingsHostsIntoBaseURL(
-  baseURL: StorefrontDynamicBaseURLConfig,
-  settings: StoreSettingsHostsSource | null | undefined,
-): void {
-  baseURL.allowedHosts = uniqueHosts([
-    ...defaultAllowedHostsFromEnv(),
-    ...hostsFromStoreSettings(settings),
-  ])
-}
-
-function splitCsv(value: string | undefined): string[] {
-  if (!value) return []
-  return value
-    .split(',')
-    .map((part) => part.trim())
-    .filter(Boolean)
-}
-
-function normalizeHost(value: string | null | undefined): string | null {
-  if (!value) return null
-  const trimmed = value.trim()
-  if (!trimmed) return null
-
-  try {
-    if (trimmed.includes('://')) {
-      const host = new URL(trimmed).host
-      return host || null
-    }
-  } catch {
-    return null
-  }
-
-  const withoutPath = trimmed.split('/')[0]?.trim()
-  return withoutPath || null
-}
-
-function uniqueHosts(hosts: readonly string[]): string[] {
-  const seen = new Set<string>()
-  const result: string[] = []
-  for (const host of hosts) {
-    const normalized = host.trim().toLowerCase()
-    if (!normalized || seen.has(normalized)) continue
-    seen.add(normalized)
-    result.push(host.trim())
-  }
-  return result
-}

package/src/auth/storefront-auth.ts

@@ -1,7 +0,0 @@
-/**
- * Instancia Better Auth del storefront (servidor).
- * Singleton usado por la ruta cerrada `/api/auth/$`.
- */
-import { createStorefrontAuth } from './create-storefront-auth'
-
-export const storefrontAuth = createStorefrontAuth()