@econneq/gql-auth 1.2.10 → 2.0.1

package/README.md

@@ -1,22 +1,304 @@
-# @econneq/gql-auth
-![NPM Version](https://img.shields.io/npm/v/@econneq/gql-auth)
-
-A high-performance, multi-tenant GraphQL abstraction layer designed for **Next.js (App Router)** and **Apollo Client**. 
-
-This package standardizes how frontend projects interact with a Django GraphQL backend, handling tenant detection, SSR cookie forwarding, and multipart file uploads.
-
----
-
-## ✨ Features
-
-* 🌍 **Automatic Tenant Injection**: Detects subdomains and injects `X-Tenant-ID`, `X-Process-ID`, and `X-Widget-ID` headers.
-* 🔐 **SSR Ready**: Built-in support for `next/headers` to forward authentication cookies during Server-Side Rendering.
-* 📁 **Smart File Uploads**: Simplifies `multipart/form-data` logic for GraphQL mutations.
-* 🚀 **Lightweight**: Optimized to use peer dependencies, keeping your bundle size minimal.
-
----
-
-## 📦 Installation
-
-```bash
-npm install @econneq/gql-auth
+# @econneq/gql-auth
+
+GraphQL + Auth utilities for **multi-tenant** and **single-tenant** Next.js apps.
+
+Handles:
+- Server-side (internal Docker network) and client-side (browser proxy) GraphQL
+- Multi-tenant header injection (`X-Tenant-ID`, `X-Process-ID`, `X-Widget-ID`)
+- JWT auth on both server and client
+- File uploads (GraphQL multipart spec)
+- Batch mutations with per-item error reporting
+
+---
+
+## Installation
+
+```bash
+npm install @econneq/gql-auth
+```
+
+### Peer dependencies
+
+```bash
+npm install @apollo/client graphql next react
+```
+
+---
+
+## Environment Variables
+
+| Variable | Side | Description |
+|---|---|---|
+| `DOMAIN_URL` | server | Base domain, e.g. `e-conneq.com` |
+| `PROTOCOL` | server | e.g. `https://` |
+| `BACKEND_URL_INT` | server | Internal Docker URL, e.g. `api:8000` |
+| `BACKEND_URL_EXT` | server | External backend host, e.g. `admin.e-conneq.com` |
+| `NEXT_PUBLIC_DOMAIN_URL` | both | Same as DOMAIN_URL (client-accessible) |
+| `NEXT_PUBLIC_PROTOCOL` | both | Same as PROTOCOL (client-accessible) |
+| `NEXT_PUBLIC_BACKEND_URL_EXT` | both | Same as BACKEND_URL_EXT (client-accessible) |
+| `API_KEY` | server | Optional service-to-service key |
+
+> The internal URL (`BACKEND_URL_INT`) is **never** exposed to the browser.
+> Client-side mutations route through Next.js `/api/graphql` proxy.
+
+---
+
+## Config Object
+
+Every function accepts a `config` object describing your tenants.
+
+```ts
+// config.ts  (shared across your project)
+import type { ConfigType } from "@econneq/gql-auth";
+
+export const config: ConfigType = {
+  Subdomains: [
+    { id: 1, subdomain: "acme",  processId: "proc-1", widgetID: "wgt-1" },
+    { id: 2, subdomain: "globex", processId: "proc-2" },
+  ],
+};
+```
+
+**Single-tenant**: put one entry in `Subdomains`. The library will always use it
+without requiring a `domain` parameter.
+
+---
+
+## Quick start
+
+### 1. Register the cookie helper (Next.js app)
+
+In your root layout (`app/layout.tsx`) or instrumentation file:
+
+```ts
+import { cookies } from "next/headers";
+import { registerCookiesFn } from "@econneq/gql-auth";
+
+registerCookiesFn(cookies);
+```
+
+This lets the Apollo client forward cookies server-side without a hard
+`next/headers` import inside the package.
+
+---
+
+### 2. Server-side query (Server Component / Route Handler)
+
+```ts
+import { queryServerGraphQL } from "@econneq/gql-auth";
+import { config } from "@/config";
+import { GET_USERS } from "@/graphql/queries";
+
+// Multi-tenant
+const data = await queryServerGraphQL({
+  query: GET_USERS,
+  variables: { active: true },
+  domain: "acme",      // ← matches Subdomains[].subdomain
+  config,
+});
+
+// Single-tenant (omit domain)
+const data = await queryServerGraphQL({
+  query: GET_USERS,
+  config,
+});
+```
+
+### 3. Server-side mutation (Server Action)
+
+```ts
+"use server";
+import { mutateServerGraphQL } from "@econneq/gql-auth";
+
+const result = await mutateServerGraphQL({
+  query: CREATE_USER_MUTATION,
+  variables: { input: formData },
+  domain: params.domain,
+  config,
+});
+```
+
+---
+
+### 4. Client-side mutation with ApiFactory
+
+```tsx
+"use client";
+import { ApiFactory, getToken } from "@econneq/gql-auth";
+import { useRouter } from "next/navigation";
+import { config } from "@/config";
+
+export function MyForm({ params }: { params: { domain: string } }) {
+  const router = useRouter();
+
+  const handleSubmit = async (formData: any) => {
+    await ApiFactory({
+      newData: formData,
+      mutationName: "createUser",
+      modelName: "user",
+      successField: "username",
+      query: CREATE_USER_MUTATION,
+      params: { domain: params.domain },  // omit for single-tenant
+      config,
+      router,
+      token: getToken() ?? undefined,
+      onAlert: ({ title, status }) => {
+        // Connect to your toast/alert system
+        console.log(title, status);
+      },
+      redirect: true,
+      redirectPath: "/dashboard",
+    });
+  };
+
+  return <form onSubmit={...}>...</form>;
+}
+```
+
+#### Batch mutations
+
+Pass an array to `newData`:
+
+```ts
+await ApiFactory({
+  newData: [item1, item2, item3],
+  mutationName: "createProduct",
+  modelName: "product",
+  // ...
+});
+```
+
+#### File uploads
+
+```ts
+await ApiFactory({
+  newData: formData,
+  getFileMap: (item) => ({ avatar: item.avatarFile }),
+  // ...
+});
+```
+
+#### Return data instead of alert
+
+```ts
+const user = await ApiFactory<{ id: string; username: string }>({
+  returnResponseObject: true,
+  // ...
+});
+```
+
+---
+
+### 5. Direct upload mutation
+
+For full control over multipart uploads:
+
+```ts
+import { uploadGraphQLMutation } from "@econneq/gql-auth";
+
+const response = await uploadGraphQLMutation({
+  query: UPLOAD_DOCUMENT_MUTATION.loc!.source.body,
+  variables: { title: "Report", file: null },
+  fileMap: { file: selectedFile },
+  params: { domain: "acme" },
+  config,
+  token: userToken,
+});
+```
+
+---
+
+### 6. Auth utilities
+
+#### Client-side
+
+```ts
+import { getToken, getUser, logout } from "@econneq/gql-auth";
+
+const token = getToken();          // cookie → localStorage
+const user  = getUser();           // decoded JwtPayload
+logout();                          // clears cookies + localStorage
+```
+
+#### Server-side
+
+```ts
+import {
+  getServerToken,
+  getServerUser,
+  getPermissions,
+} from "@econneq/gql-auth";
+
+const token = await getServerToken();
+const user  = await getServerUser();
+
+// Does the user have any access to module 42?
+const canRead = getPermissions(user?.permissions ?? [], 42);
+
+// Does the user have CREATE access to module 42?
+const canCreate = getPermissions(user?.permissions ?? [], 42, "C");
+```
+
+---
+
+### 7. Apollo client (advanced)
+
+Direct access when you need a custom query/mutation outside ApiFactory:
+
+```ts
+import { getApolloClient } from "@econneq/gql-auth";
+
+const client = await getApolloClient({
+  domain: "acme",   // omit for single-tenant
+  config,
+});
+
+const { data } = await client.query({ query: MY_QUERY });
+```
+
+---
+
+## Architecture
+
+```
+Browser                     Next.js Server              Backend (Docker)
+─────────                   ──────────────              ────────────────
+uploadGraphQLMutation  ──►  /api/graphql  (proxy) ──►  api:8000/graphql/
+ApiFactory             ──►  /api/graphql  (proxy) ──►  api:8000/graphql/
+
+queryServerGraphQL     ────────────────────────────►  http://api:8000/graphql/
+mutateServerGraphQL    ────────────────────────────►  http://api:8000/graphql/
+getApolloClient        ────────────────────────────►  http://api:8000/graphql/
+```
+
+Server-side calls skip the proxy entirely and hit the backend directly
+through Docker's internal network — faster and no public exposure.
+
+---
+
+## Permissions format
+
+Permission strings encode resource + action:
+
+```
+"42"   → access resource 42 (any action)
+"42C"  → create on resource 42
+"42R"  → read on resource 42
+"42U"  → update on resource 42
+"42D"  → delete on resource 42
+```
+
+---
+
+## Changelog
+
+### 2.0.0
+- Centralised env resolution (`env.ts`)
+- Tenant resolution separated into `tenant.ts` — single-tenant fallback
+- `mutateServerGraphQL` added (server-side mutations)
+- `ApiFactory` typed generics, batch partial-error reporting
+- `registerCookiesFn` removes hard `next/headers` dependency
+- `getServerCookieString` helper exported
+- `parseGraphQLErrors` exported for custom use
+- Subdomains[0] fallback for single-tenant setups
+- `uploadGraphQLMutation` no longer throws on missing tenant in single-tenant mode

package/dist/api-factory.d.ts

@@ -1,30 +1,12 @@
-type SubmitOptions = {
-    newData: any;
-    editData?: any;
-    mutationName: string;
-    modelName: string;
-    successField?: string;
-    query: any;
-    params: any;
-    router: any;
-    token?: string;
-    config: {
-        protocol: string;
-        RootApi: string;
-        Subdomains: any[];
-    };
-    onAlert: (options: {
-        title: string;
-        status: boolean;
-        duration: number;
-    }) => void;
-    redirect?: boolean;
-    redirectPath?: string;
-    returnResponseField?: boolean;
-    returnResponseObject?: boolean;
-    reload?: boolean;
-    getFileMap?: (item: any) => Record<string, File>;
-};
-export declare const ApiFactory: (options: SubmitOptions) => Promise<any>;
-export {};
+import type { ApiFactoryOptions } from "./types";
+/**
+ * Run one or more GraphQL mutations and handle the full
+ * response → alert / redirect / reload lifecycle.
+ *
+ * @returns
+ *   - `returnResponseObject = true`  → the raw mutation response object
+ *   - `returnResponseField = true`   → the value of `successField` from result
+ *   - Otherwise                      → `void` (triggers alert + reload/redirect)
+ */
+export declare function ApiFactory<T = any>(options: ApiFactoryOptions): Promise<T | void>;
 //# sourceMappingURL=api-factory.d.ts.map

package/dist/api-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-factory.d.ts","sourceRoot":"","sources":["../src/api-factory.ts"],"names":[],"mappings":"AAIA,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,GAAG,CAAC;IACb,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,GAAG,CAAC;IACX,MAAM,EAAE,GAAG,CAAC;IACZ,MAAM,EAAE,GAAG,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,GAAG,EAAE,CAAC;KACnB,CAAC;IACF,OAAO,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAClD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAU,SAAS,aAAa,iBA0DtD,CAAC"}
+{"version":3,"file":"api-factory.d.ts","sourceRoot":"","sources":["../src/api-factory.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAiBjD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,CAAC,GAAG,GAAG,EACtC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA8GnB"}

package/dist/api-factory.js

@@ -1,68 +1,119 @@
-import { uploadGraphQLMutation } from "./upload-gql.js";
-import { removeEmptyFields } from "./utilsGeneral.js";
-export const ApiFactory = async (options) => {
-    const { newData, editData, mutationName, modelName, successField = "title", query, router, params, reload = true, redirect, redirectPath, returnResponseField = false, returnResponseObject = false, getFileMap, token, config, onAlert } = options;
-    const items = Array.isArray(newData || editData) ? (newData || editData) : [(newData || editData)];
+// ============================================================
+// @econneq/gql-auth — ApiFactory
+// ============================================================
+//
+// Client-side orchestrator for GraphQL mutations.
+//
+// Features
+// ─────────
+// • Single item or batch (array) mutations in one call
+// • File uploads via multipart (getFileMap)
+// • Multi-tenant and single-tenant support
+// • Typed overloads for returnResponseField / returnResponseObject
+// • Granular alert feedback for partial batch failures
+// • Automatic token resolution (prop → cookie → localStorage)
+// ─────────────────────────────────────────────────────────────
+import { uploadGraphQLMutation } from "./upload-gql";
+import { parseGraphQLErrors } from "./errors";
+import { removeEmptyFields, getToken } from "./functions";
+// ─── Internal helpers ────────────────────────────────────────
+function resolveToken(token) {
+    if (token)
+        return token;
+    if (typeof window !== "undefined") {
+        return getToken() ?? undefined;
+    }
+    return undefined;
+}
+// ─── Main ────────────────────────────────────────────────────
+/**
+ * Run one or more GraphQL mutations and handle the full
+ * response → alert / redirect / reload lifecycle.
+ *
+ * @returns
+ *   - `returnResponseObject = true`  → the raw mutation response object
+ *   - `returnResponseField = true`   → the value of `successField` from result
+ *   - Otherwise                      → `void` (triggers alert + reload/redirect)
+ */
+export async function ApiFactory(options) {
+    const { newData, editData, mutationName, modelName, successField = "title", query, router, params, reload = true, redirect, redirectPath, returnResponseField = false, returnResponseObject = false, getFileMap, config, onAlert, } = options;
+    const token = resolveToken(options.token);
+    // Support single item or batch array
+    const source = newData ?? editData;
+    const items = Array.isArray(source) ? source : [source];
     const successMessages = [];
     const errorMessages = [];
     let responseFieldData = null;
-    for (const res of items) {
+    // ── Batch loop ─────────────────────────────────────────
+    for (const item of items) {
         try {
-            console.log("launching e-conneq/auth-gql ......");
+            const cleanVariables = removeEmptyFields(item);
             const response = await uploadGraphQLMutation({
-                query: query.loc?.source.body || "",
-                variables: removeEmptyFields(res),
-                fileMap: getFileMap ? getFileMap(res) : {},
-                params, // Pass domain params for multi-tenancy
+                query: query?.loc?.source?.body ?? query,
+                variables: cleanVariables,
+                fileMap: getFileMap ? getFileMap(item) : {},
+                params,
                 token,
-                config, // Pass global URLs and Subdomain list
+                config,
             });
-            console.log("response e-conneq/auth-gql ......");
-            const result = response?.data?.[mutationName]?.[modelName];
-            if (response?.data?.[mutationName]) {
-                successMessages.push(result?.[successField] || "operation successful ✅");
-                if (returnResponseObject)
-                    responseFieldData = response.data[mutationName];
-                if (result?.id && returnResponseField)
+            // ── Parse success ──────────────────────────────────
+            const mutationPayload = response?.data?.[mutationName];
+            if (mutationPayload !== undefined) {
+                const result = mutationPayload?.[modelName];
+                const label = result?.[successField] ?? "Operation successful ✅";
+                successMessages.push(label);
+                if (returnResponseObject) {
+                    responseFieldData = mutationPayload;
+                }
+                else if (returnResponseField && result?.id) {
                     responseFieldData = result[successField];
-                if (result?.id || result?.token || result === null) {
                 }
             }
-            // Error Handling
-            if (response?.errors) {
-                handleGraphQLErrors(response.errors, errorMessages);
+            // ── Parse GraphQL errors ───────────────────────────
+            if (response?.errors?.length) {
+                errorMessages.push(...parseGraphQLErrors(response.errors));
             }
         }
         catch (err) {
-            errorMessages.push(`Error: ${err.message}`);
+            errorMessages.push(`Network error: ${err?.message ?? "Unknown"}`);
         }
     }
-    // Handle Response/UI Logic
-    if (successMessages.length > 0 && errorMessages.length === 0) {
-        if (returnResponseObject || returnResponseField)
-            return responseFieldData;
-        onAlert({ title: "successfully submitted ✅", status: true, duration: 3000 });
-        if (redirect && redirectPath)
-            router.push(redirectPath);
-        else if (reload)
-            window.location.reload();
+    // ── Response / UI logic ────────────────────────────────
+    const hasSuccess = successMessages.length > 0;
+    const hasErrors = errorMessages.length > 0;
+    // Partial batch: some succeeded, some failed
+    if (hasSuccess && hasErrors) {
+        onAlert({
+            title: `⚠️ Partial success:\n${successMessages.join(", ")}\n\nErrors:\n${errorMessages.join("\n")}`,
+            status: false,
+            duration: 6000,
+        });
+        return;
     }
-    else if (errorMessages.length > 0) {
+    if (hasErrors) {
         onAlert({
             title: `❌ Errors:\n${errorMessages.join("\n")}`,
             status: false,
-            duration: 5000
+            duration: 5000,
         });
+        return;
+    }
+    if (hasSuccess) {
+        // Return data when caller wants it
+        if (returnResponseObject || returnResponseField) {
+            return responseFieldData;
+        }
+        onAlert({
+            title: `Successfully submitted ✅`,
+            status: true,
+            duration: 3000,
+        });
+        if (redirect && redirectPath && router) {
+            router.push(redirectPath);
+        }
+        else if (reload && typeof window !== "undefined") {
+            window.location.reload();
+        }
     }
-};
-// Internal Helper for Error Parsing
-const handleGraphQLErrors = (errors, errorList) => {
-    errors.forEach(error => {
-        if (error.message.includes("duplicate"))
-            errorList.push("Record Already Exists ❌");
-        else if (error.message.includes("Authentication"))
-            errorList.push("Login Required ❌");
-        else
-            errorList.push(error.message);
-    });
-};
+}
+//# sourceMappingURL=api-factory.js.map

package/dist/api-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-factory.js","sourceRoot":"","sources":["../src/api-factory.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iCAAiC;AACjC,+DAA+D;AAC/D,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,WAAW;AACX,YAAY;AACZ,uDAAuD;AACvD,4CAA4C;AAC5C,2CAA2C;AAC3C,mEAAmE;AACnE,uDAAuD;AACvD,8DAA8D;AAC9D,gEAAgE;AAGhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE1D,gEAAgE;AAEhE,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,QAAQ,EAAE,IAAI,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gEAAgE;AAEhE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B;IAE1B,MAAM,EACJ,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,YAAY,GAAG,OAAO,EACtB,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,GAAG,IAAI,EACb,QAAQ,EACR,YAAY,EACZ,mBAAmB,GAAG,KAAK,EAC3B,oBAAoB,GAAG,KAAK,EAC5B,UAAU,EACV,MAAM,EACN,OAAO,GACR,GAAG,OAAO,CAAC;IAEZ,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE1C,qCAAqC;IACrC,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC;IACnC,MAAM,KAAK,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,iBAAiB,GAAa,IAAI,CAAC;IAEvC,0DAA0D;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;gBAC3C,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK;gBACxC,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3C,MAAM;gBACN,KAAK;gBACL,MAAM;aACP,CAAC,CAAC;YAEH,sDAAsD;YACtD,MAAM,eAAe,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC;YAEvD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,wBAAwB,CAAC;gBACjE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAE5B,IAAI,oBAAoB,EAAE,CAAC;oBACzB,iBAAiB,GAAG,eAAoB,CAAC;gBAC3C,CAAC;qBAAM,IAAI,mBAAmB,IAAI,MAAM,EAAE,EAAE,EAAE,CAAC;oBAC7C,iBAAiB,GAAG,MAAM,CAAC,YAAY,CAAM,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,sDAAsD;YACtD,IAAI,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7B,aAAa,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,0DAA0D;IAE1D,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAE3C,6CAA6C;IAC7C,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC;YACN,KAAK,EAAE,wBAAwB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACnG,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC;YACN,KAAK,EAAE,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,mCAAmC;QACnC,IAAI,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;YAChD,OAAO,iBAAsB,CAAC;QAChC,CAAC;QAED,OAAO,CAAC;YACN,KAAK,EAAE,0BAA0B;YACjC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,IAAI,QAAQ,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACnD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/authServer.d.ts

@@ -0,0 +1,32 @@
+import type { JwtPayload } from "./types";
+/**
+ * Read the JWT from the incoming request cookies.
+ * Returns null when no token cookie is present.
+ */
+export declare const getServerToken: () => Promise<string | null>;
+/**
+ * Decode the server-side JWT and return the payload.
+ * Returns null when no token is present or decoding fails.
+ */
+export declare const getServerUser: () => Promise<JwtPayload | null>;
+/**
+ * Check whether a permission list grants access to a resource.
+ *
+ * @param list   - Array of permission strings (from JwtPayload.permissions)
+ * @param access - Numeric resource/module identifier
+ * @param action - Optional action suffix (e.g. "C", "R", "U", "D")
+ *
+ * @example
+ * // Does the user have ANY access to module 42?
+ * getPermissions(user.permissions, 42);
+ *
+ * // Does the user have CREATE access to module 42?
+ * getPermissions(user.permissions, 42, "C");
+ */
+export declare const getPermissions: (list: string[], access: number, action?: string) => boolean;
+/**
+ * Return the full cookie header string for forwarding to the
+ * backend (Django session / CSRF pass-through).
+ */
+export declare const getServerCookieString: () => Promise<string>;
+//# sourceMappingURL=authServer.d.ts.map

package/dist/authServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authServer.d.ts","sourceRoot":"","sources":["../src/authServer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,MAAM,GAAG,IAAI,CAS5D,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,UAAU,GAAG,IAAI,CAU/D,CAAC;AAIF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EAAE,EACd,QAAQ,MAAM,EACd,SAAS,MAAM,KACd,OAoBF,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,MAAM,CAQ5D,CAAC"}

package/dist/authServer.js

@@ -0,0 +1,93 @@
+// ============================================================
+// @econneq/gql-auth — Server-side auth helpers
+// ============================================================
+//
+// These helpers are Next.js-specific (they use next/headers).
+// Import them only in Server Components, Server Actions, or
+// Route Handlers.
+// ─────────────────────────────────────────────────────────────
+"use server";
+// ─── Token ───────────────────────────────────────────────────
+/**
+ * Read the JWT from the incoming request cookies.
+ * Returns null when no token cookie is present.
+ */
+export const getServerToken = async () => {
+    try {
+        const { cookies } = await import("next/headers");
+        const cookieStore = await cookies();
+        return cookieStore.get("token")?.value ?? null;
+    }
+    catch {
+        // next/headers not available outside of a Next.js context
+        return null;
+    }
+};
+// ─── User ─────────────────────────────────────────────────────
+/**
+ * Decode the server-side JWT and return the payload.
+ * Returns null when no token is present or decoding fails.
+ */
+export const getServerUser = async () => {
+    const token = await getServerToken();
+    if (!token)
+        return null;
+    try {
+        const { jwtDecode } = await import("jwt-decode");
+        return jwtDecode(token);
+    }
+    catch {
+        return null;
+    }
+};
+// ─── Permissions ─────────────────────────────────────────────
+/**
+ * Check whether a permission list grants access to a resource.
+ *
+ * @param list   - Array of permission strings (from JwtPayload.permissions)
+ * @param access - Numeric resource/module identifier
+ * @param action - Optional action suffix (e.g. "C", "R", "U", "D")
+ *
+ * @example
+ * // Does the user have ANY access to module 42?
+ * getPermissions(user.permissions, 42);
+ *
+ * // Does the user have CREATE access to module 42?
+ * getPermissions(user.permissions, 42, "C");
+ */
+export const getPermissions = (list, access, action) => {
+    if (!list?.length)
+        return false;
+    try {
+        return list.some((entry) => {
+            if (access && !action) {
+                // Match "42", "42C", "42R", etc. — but NOT "420"
+                const regex = new RegExp(`^${access}(?!\\d)`);
+                return regex.test(entry);
+            }
+            if (access && action) {
+                return entry === `${access}${action}`;
+            }
+            return false;
+        });
+    }
+    catch {
+        return false;
+    }
+};
+// ─── Cookie string ────────────────────────────────────────────
+/**
+ * Return the full cookie header string for forwarding to the
+ * backend (Django session / CSRF pass-through).
+ */
+export const getServerCookieString = async () => {
+    try {
+        const { cookies } = await import("next/headers");
+        const cookieStore = await cookies();
+        return cookieStore.toString();
+    }
+    catch {
+        return "";
+    }
+};
+//# sourceMappingURL=authServer.js.map