@econneq/gql-auth 1.2.11 → 2.0.1

package/dist/authServer.js

@@ -1,40 +1,93 @@
-// utils/authServer.ts
-import { cookies } from 'next/headers';
-import { jwtDecode } from "jwt-decode";
+// ============================================================
+// @econneq/gql-auth — Server-side auth helpers
+// ============================================================
+//
+// These helpers are Next.js-specific (they use next/headers).
+// Import them only in Server Components, Server Actions, or
+// Route Handlers.
+// ─────────────────────────────────────────────────────────────
+"use server";
+// ─── Token ───────────────────────────────────────────────────
+/**
+ * Read the JWT from the incoming request cookies.
+ * Returns null when no token cookie is present.
+ */
 export const getServerToken = async () => {
-    const cookieStore = await cookies();
-    return cookieStore.get("token")?.value || null;
+    try {
+        const { cookies } = await import("next/headers");
+        const cookieStore = await cookies();
+        return cookieStore.get("token")?.value ?? null;
+    }
+    catch {
+        // next/headers not available outside of a Next.js context
+        return null;
+    }
 };
+// ─── User ─────────────────────────────────────────────────────
+/**
+ * Decode the server-side JWT and return the payload.
+ * Returns null when no token is present or decoding fails.
+ */
 export const getServerUser = async () => {
     const token = await getServerToken();
     if (!token)
         return null;
     try {
-        const user = jwtDecode(token);
-        return user;
+        const { jwtDecode } = await import("jwt-decode");
+        return jwtDecode(token);
     }
-    catch (error) {
+    catch {
         return null;
     }
 };
+// ─── Permissions ─────────────────────────────────────────────
+/**
+ * Check whether a permission list grants access to a resource.
+ *
+ * @param list   - Array of permission strings (from JwtPayload.permissions)
+ * @param access - Numeric resource/module identifier
+ * @param action - Optional action suffix (e.g. "C", "R", "U", "D")
+ *
+ * @example
+ * // Does the user have ANY access to module 42?
+ * getPermissions(user.permissions, 42);
+ *
+ * // Does the user have CREATE access to module 42?
+ * getPermissions(user.permissions, 42, "C");
+ */
 export const getPermissions = (list, access, action) => {
-    if (!list || list.length < 1)
+    if (!list?.length)
         return false;
     try {
-        return list.some(entry => {
-            // If only num is provided, check if entry starts with that number followed by non-digits
+        return list.some((entry) => {
             if (access && !action) {
+                // Match "42", "42C", "42R", etc. — but NOT "420"
                 const regex = new RegExp(`^${access}(?!\\d)`);
                 return regex.test(entry);
             }
-            // If both are provided, check for the exact combination
             if (access && action) {
                 return entry === `${access}${action}`;
             }
             return false;
         });
     }
-    catch (error) {
+    catch {
         return false;
     }
 };
+// ─── Cookie string ────────────────────────────────────────────
+/**
+ * Return the full cookie header string for forwarding to the
+ * backend (Django session / CSRF pass-through).
+ */
+export const getServerCookieString = async () => {
+    try {
+        const { cookies } = await import("next/headers");
+        const cookieStore = await cookies();
+        return cookieStore.toString();
+    }
+    catch {
+        return "";
+    }
+};
+//# sourceMappingURL=authServer.js.map

package/dist/authServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authServer.js","sourceRoot":"","sources":["../src/authServer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+CAA+C;AAC/C,+DAA+D;AAC/D,EAAE;AACF,8DAA8D;AAC9D,4DAA4D;AAC5D,kBAAkB;AAClB,gEAAgE;AAEhE,YAAY,CAAC;AAIb,gEAAgE;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,iEAAiE;AAEjE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,IAAgC,EAAE;IAClE,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,OAAO,SAAS,CAAa,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,gEAAgE;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAc,EACd,MAAc,EACd,MAAe,EACN,EAAE;IACX,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAEhC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,iDAAiD;gBACjD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YAED,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACrB,OAAO,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;YACxC,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,iEAAiE;AAEjE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,IAAqB,EAAE;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC"}

package/dist/client.d.ts

@@ -1,12 +1,29 @@
-import { ApolloClient } from '@apollo/client';
-export default function getApolloClient(options?: {
-    csrfToken?: string;
-    cookie?: string;
-}, domain?: string | null, config?: {
-    Subdomains: {
-        subdomain: string;
-        processId?: string;
-        widgetID?: string;
-    }[];
-}): Promise<ApolloClient | null>;
+import { ApolloClient } from "@apollo/client";
+import type { ApolloOptions, ConfigType } from "./types";
+/**
+ * Inject Next.js `cookies` at app startup to keep this module
+ * free of a hard `next/headers` import (which breaks non-Next projects).
+ *
+ * Call once in your app layout or instrumentation file:
+ *
+ * ```ts
+ * import { cookies } from "next/headers";
+ * import { registerCookiesFn } from "@econneq/gql-auth";
+ * registerCookiesFn(cookies);
+ * ```
+ */
+export declare function registerCookiesFn(fn: () => Promise<{
+    get: (k: string) => {
+        value: string;
+    } | undefined;
+    toString: () => string;
+}>): void;
+type ClientOptions = {
+    options?: ApolloOptions;
+    /** Tenant subdomain. Omit for single-tenant. */
+    domain?: string | null;
+    config: ConfigType;
+};
+export declare function getApolloClient({ options, domain, config, }: ClientOptions): Promise<ApolloClient>;
+export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA2B,MAAM,gBAAgB,CAAC;AAGvE,wBAA8B,eAAe,CAC3C,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACjD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,MAAM,CAAC,EAAE;IACP,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5E,GACA,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgE9B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAA2B,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAazD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,OAAO,CAAC;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,MAAM,CAAA;CAAE,CAAC,GAC/F,IAAI,CAEN;AAID,KAAK,aAAa,GAAG;IACnB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,MAAM,EACN,MAAM,GACP,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA4DvC"}

package/dist/client.js

@@ -1,65 +1,85 @@
-// src/client.ts
-import { ApolloClient, InMemoryCache, HttpLink } from '@apollo/client';
-import Cookies from "js-cookie";
-export default async function getApolloClient(options, domain, config) {
-    if (!config)
-        throw new Error("Configuration is required for getApolloClient");
-    const isServer = typeof window === "undefined";
-    const { Subdomains } = config;
-    // const apiKey = process.env.API_KEY || "";
-    const urlDomain = process.env.NEXT_PUBLIC_DOMAIN_URL || process.env.DOMAIN_URL; // e.g e-conneq.com
-    const protocol = process.env.NEXT_PUBLIC_PROTOCOL || process.env.PROTOCOL; // e.g https:// or e.g http://
-    const urlBackEndInt = process.env.NEXT_PUBLIC_BACKEND_URL_INT || process.env.BACKEND_URL_INT; // e.g api:8000 (docker) or 127.0.0.1:8100 (VPS host) or localhost:8001 (local host)
-    const urlBackEndExt = process.env.NEXT_PUBLIC_BACKEND_URL_EXT || process.env.BACKEND_URL_EXT; // e.g https://admin.e-conneq.com
-    if (!urlDomain)
-        throw new Error("Env (DOMAIN_URL) is required");
-    if (!protocol)
-        throw new Error("Env (PROTOCOL) is required");
-    if (!urlBackEndInt)
-        throw new Error("Env (BACKEND_URL_INT) is required");
-    if (!urlBackEndExt)
-        throw new Error("Env (BACKEND_URL_EXT) is required");
-    const tenant = domain
-        ? Subdomains.find((s) => s.subdomain.toLowerCase() === domain.toLowerCase())
-        : null;
-    let uri;
-    let destUrl;
-    const sourceHost = `${protocol}${tenant?.subdomain || "public"}.${urlDomain}`;
-    if (isServer) {
-        destUrl = `http://${urlBackEndInt}`;
-        uri = `${destUrl}/graphql/`;
+// ============================================================
+// @econneq/gql-auth — Apollo Client factory
+// ============================================================
+//
+// • Server-side  → uses internal Docker URL + cookie forwarding
+// • Client-side  → uses /api/graphql proxy + CSRF token
+// • Multi-tenant → injects X-Tenant-ID / X-Process-ID headers
+// • Single-tenant → falls back to Subdomains[0]
+// ─────────────────────────────────────────────────────────────
+import { ApolloClient, InMemoryCache, HttpLink } from "@apollo/client";
+import { Env, assertServerEnv, externalBaseUrl, externalGraphQLUrl, internalGraphQLUrl, isServer, } from "./env";
+import { buildTenantHeaders, resolveTenant } from "./tenant";
+let _cookiesFn = null;
+/**
+ * Inject Next.js `cookies` at app startup to keep this module
+ * free of a hard `next/headers` import (which breaks non-Next projects).
+ *
+ * Call once in your app layout or instrumentation file:
+ *
+ * ```ts
+ * import { cookies } from "next/headers";
+ * import { registerCookiesFn } from "@econneq/gql-auth";
+ * registerCookiesFn(cookies);
+ * ```
+ */
+export function registerCookiesFn(fn) {
+    _cookiesFn = fn;
+}
+export async function getApolloClient({ options, domain, config, }) {
+    const server = isServer();
+    if (server)
+        assertServerEnv();
+    // ── Tenant resolution ────────────────────────────────────
+    const tenant = resolveTenant(config, domain ? { domain } : undefined);
+    const tenantHeaders = buildTenantHeaders(tenant, Env.apiKey);
+    // ── URI ─────────────────────────────────────────────────
+    const uri = server ? internalGraphQLUrl() : externalGraphQLUrl();
+    const destUrl = server
+        ? `http://${Env.backendInt}`
+        : externalBaseUrl();
+    // ── Source host (Referer / Host) ─────────────────────────
+    const sourceSubdomain = tenant?.subdomain ?? "public";
+    const sourceHost = `${Env.protocol}${sourceSubdomain}.${Env.domainUrl}`;
+    // ── CSRF ─────────────────────────────────────────────────
+    let csrfToken = options?.csrfToken ?? "";
+    if (!csrfToken && !server) {
+        try {
+            // Lazy import so SSR never executes this branch
+            const Cookies = (await import("js-cookie")).default;
+            csrfToken = Cookies.get("csrftoken") ?? "";
+        }
+        catch {
+            // js-cookie not available in some environments
+        }
     }
-    else {
-        uri = "/api/graphql";
-        destUrl = `${protocol}${urlBackEndExt}`;
+    // ── Cookie forwarding (server → backend) ─────────────────
+    let cookieHeader = options?.cookie ?? "";
+    if (!cookieHeader && server && _cookiesFn) {
+        try {
+            const store = await _cookiesFn();
+            cookieHeader = store.toString();
+        }
+        catch {
+            // cookies() may throw outside a request context
+        }
     }
-    console.log("g-auth uri ==============", uri);
-    console.log("g-auth sourceHost =======", sourceHost);
-    console.log("g-auth destinationHost ==========", destUrl);
-    const csrfToken = options?.csrfToken || (!isServer ? Cookies.get("csrftoken") : "");
+    // ── Assemble headers ─────────────────────────────────────
     const headers = {
-        'Content-Type': 'application/json',
-        // 'X-API-KEY': apiKey,
-        ...(options?.cookie && { 'Cookie': options.cookie }),
-        ...(csrfToken && { 'X-CSRFToken': csrfToken }),
-        ...(tenant && {
-            'X-Tenant-ID': tenant.subdomain,
-            'X-Process-ID': tenant?.processId || "",
-            'X-Widget-ID': tenant?.widgetID || "",
-        }),
-        'Referer': destUrl,
-        'Host': isServer ? sourceHost : window.location.host,
+        "Content-Type": "application/json",
+        ...tenantHeaders,
+        ...(cookieHeader ? { Cookie: cookieHeader } : {}),
+        ...(csrfToken ? { "X-CSRFToken": csrfToken } : {}),
+        Referer: destUrl,
+        Host: server ? sourceHost : (typeof window !== "undefined" ? window.location.host : sourceHost),
     };
     return new ApolloClient({
-        link: new HttpLink({
-            uri,
-            fetch,
-            headers,
-        }),
+        link: new HttpLink({ uri, fetch, headers }),
         cache: new InMemoryCache(),
         defaultOptions: {
-            mutate: { fetchPolicy: 'no-cache' },
-            query: { fetchPolicy: 'no-cache' },
+            mutate: { fetchPolicy: "no-cache" },
+            query: { fetchPolicy: "no-cache" },
         },
     });
 }
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,4CAA4C;AAC5C,+DAA+D;AAC/D,EAAE;AACF,gEAAgE;AAChE,wDAAwD;AACxD,8DAA8D;AAC9D,gDAAgD;AAChD,gEAAgE;AAEhE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,GAAG,EACH,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,GACT,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE7D,IAAI,UAAU,GAA0G,IAAI,CAAC;AAE7H;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAgG;IAEhG,UAAU,GAAG,EAAE,CAAC;AAClB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,OAAO,EACP,MAAM,EACN,MAAM,GACQ;IACd,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAE1B,IAAI,MAAM;QAAE,eAAe,EAAE,CAAC;IAE9B,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7D,2DAA2D;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,UAAU,GAAG,CAAC,UAAU,EAAE;QAC5B,CAAC,CAAC,eAAe,EAAE,CAAC;IAEtB,4DAA4D;IAC5D,MAAM,eAAe,GAAG,MAAM,EAAE,SAAS,IAAI,QAAQ,CAAC;IACtD,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,eAAe,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;IAExE,4DAA4D;IAC5D,IAAI,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,YAAY,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,YAAY,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;YACjC,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,aAAa;QAChB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAChG,CAAC;IAEF,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3C,KAAK,EAAE,IAAI,aAAa,EAAE;QAC1B,cAAc,EAAE;YACd,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;YACnC,KAAK,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;SACnC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,35 @@
+export declare const Env: {
+    /** e.g. "e-conneq.com" */
+    readonly domainUrl: string;
+    /** e.g. "https://" */
+    readonly protocol: string;
+    /**
+     * Internal backend used from within the Docker network (server-side).
+     * e.g. "api:8000"
+     */
+    readonly backendInt: string;
+    /**
+     * External backend reachable from the browser.
+     * e.g. "admin.e-conneq.com"
+     */
+    readonly backendExt: string;
+    /** Optional service-to-service API key. */
+    readonly apiKey: string;
+};
+export declare function assertServerEnv(): void;
+export declare const isServer: () => boolean;
+/**
+ * GraphQL endpoint used by server-side code (internal Docker network).
+ * e.g. http://api:8000/graphql/
+ */
+export declare const internalGraphQLUrl: () => string;
+/**
+ * GraphQL endpoint used by browser code (proxied Next.js API route).
+ */
+export declare const externalGraphQLUrl: () => string;
+/**
+ * Full external base URL.
+ * e.g. https://admin.e-conneq.com
+ */
+export declare const externalBaseUrl: () => string;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,GAAG;IACd,0BAA0B;;IAG1B,sBAAsB;;IAGtB;;;OAGG;;IAGH;;;OAGG;;IAGH,2CAA2C;;CAEnC,CAAC;AAIX,wBAAgB,eAAe,IAAI,IAAI,CAWtC;AAID,eAAO,MAAM,QAAQ,QAAO,OAAwC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAO,MACD,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAAO,MAAwB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,MACC,CAAC"}

package/dist/env.js

@@ -0,0 +1,65 @@
+// ============================================================
+// @econneq/gql-auth — Environment resolver
+// ============================================================
+//
+// All env variables are consumed here so the rest of the
+// codebase never touches process.env directly.
+// ─────────────────────────────────────────────────────────────
+const get = (keys) => {
+    for (const key of keys) {
+        const val = typeof process !== "undefined" ? process.env[key] : undefined;
+        if (val)
+            return val;
+    }
+    return "";
+};
+export const Env = {
+    /** e.g. "e-conneq.com" */
+    domainUrl: get(["NEXT_PUBLIC_DOMAIN_URL", "DOMAIN_URL"]),
+    /** e.g. "https://" */
+    protocol: get(["NEXT_PUBLIC_PROTOCOL", "PROTOCOL"]),
+    /**
+     * Internal backend used from within the Docker network (server-side).
+     * e.g. "api:8000"
+     */
+    backendInt: get(["BACKEND_URL_INT", "NEXT_PUBLIC_BACKEND_URL_INT"]),
+    /**
+     * External backend reachable from the browser.
+     * e.g. "admin.e-conneq.com"
+     */
+    backendExt: get(["NEXT_PUBLIC_BACKEND_URL_EXT", "BACKEND_URL_EXT"]),
+    /** Optional service-to-service API key. */
+    apiKey: get(["API_KEY", "NEXT_PUBLIC_API_KEY"]),
+};
+// ─── Runtime validators ───────────────────────────────────────
+export function assertServerEnv() {
+    const missing = [];
+    if (!Env.domainUrl)
+        missing.push("DOMAIN_URL");
+    if (!Env.protocol)
+        missing.push("PROTOCOL");
+    if (!Env.backendInt)
+        missing.push("BACKEND_URL_INT");
+    if (!Env.backendExt)
+        missing.push("BACKEND_URL_EXT");
+    if (missing.length) {
+        throw new Error(`[@econneq/gql-auth] Missing required env variables: ${missing.join(", ")}`);
+    }
+}
+// ─── URL builders ─────────────────────────────────────────────
+export const isServer = () => typeof window === "undefined";
+/**
+ * GraphQL endpoint used by server-side code (internal Docker network).
+ * e.g. http://api:8000/graphql/
+ */
+export const internalGraphQLUrl = () => `http://${Env.backendInt}/graphql/`;
+/**
+ * GraphQL endpoint used by browser code (proxied Next.js API route).
+ */
+export const externalGraphQLUrl = () => `/api/graphql`;
+/**
+ * Full external base URL.
+ * e.g. https://admin.e-conneq.com
+ */
+export const externalBaseUrl = () => `${Env.protocol}${Env.backendExt}`;
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,2CAA2C;AAC3C,+DAA+D;AAC/D,EAAE;AACF,yDAAyD;AACzD,+CAA+C;AAC/C,gEAAgE;AAEhE,MAAM,GAAG,GAAG,CAAC,IAAc,EAAU,EAAE;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GACP,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAE,OAAO,CAAC,GAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,0BAA0B;IAC1B,SAAS,EAAE,GAAG,CAAC,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;IAExD,sBAAsB;IACtB,QAAQ,EAAE,GAAG,CAAC,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;IAEnD;;;OAGG;IACH,UAAU,EAAE,GAAG,CAAC,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IAEnE;;;OAGG;IACH,UAAU,EAAE,GAAG,CAAC,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,CAAC;IAEnE,2CAA2C;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;CACvC,CAAC;AAEX,iEAAiE;AAEjE,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iEAAiE;AAEjE,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAY,EAAE,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAC7C,UAAU,GAAG,CAAC,UAAU,WAAW,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAAC,cAAc,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE,CAC1C,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+export type ParsedError = {
+    message: string;
+    code?: string;
+};
+/**
+ * Convert raw GraphQL errors into user-friendly strings.
+ * Extend the switch/map here to handle more backend error codes.
+ */
+export declare function parseGraphQLErrors(errors: any[]): string[];
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAY1D"}

package/dist/errors.js

@@ -0,0 +1,24 @@
+// ============================================================
+// @econneq/gql-auth — GraphQL error parser
+// ============================================================
+/**
+ * Convert raw GraphQL errors into user-friendly strings.
+ * Extend the switch/map here to handle more backend error codes.
+ */
+export function parseGraphQLErrors(errors) {
+    return errors.map((err) => {
+        const msg = err?.message ?? "Unknown error";
+        if (/duplicate/i.test(msg))
+            return "Record already exists ❌";
+        if (/authentication/i.test(msg))
+            return "Login required ❌";
+        if (/permission/i.test(msg))
+            return "Permission denied ❌";
+        if (/not found/i.test(msg))
+            return "Record not found ❌";
+        if (/unique constraint/i.test(msg))
+            return "Duplicate value ❌";
+        return msg;
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,2CAA2C;AAC3C,+DAA+D;AAO/D;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAa;IAC9C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAU,EAAE;QAChC,MAAM,GAAG,GAAW,GAAG,EAAE,OAAO,IAAI,eAAe,CAAC;QAEpD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAC7D,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAC3D,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,oBAAoB,CAAC;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,mBAAmB,CAAC;QAE/D,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/functions.d.ts

@@ -1,6 +1,24 @@
-import { JwtPayload } from "./index.js";
-export declare const logout: () => void;
+import type { JwtPayload } from "./types";
+/**
+ * Read the JWT from cookies first, then localStorage.
+ * Returns null on the server (window is undefined).
+ */
 export declare const getToken: () => string | null;
+/**
+ * Decode the JWT and return the payload.
+ * Returns null when no token is present or decoding fails.
+ */
 export declare const getUser: () => JwtPayload | null;
-export declare const removeEmptyFields: (obj: any) => any;
+/**
+ * Clear all session state client-side.
+ * Does NOT call any server endpoint — combine with a Server Action
+ * or API route if you need to invalidate the session server-side.
+ */
+export declare const logout: () => void;
+/**
+ * Strip null / undefined / empty-string fields from an object
+ * before sending it as GraphQL variables.
+ * File objects are always preserved.
+ */
+export declare const removeEmptyFields: <T extends Record<string, any>>(obj: T) => Partial<T>;
 //# sourceMappingURL=functions.d.ts.map

package/dist/functions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../src/functions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,eAAO,MAAM,MAAM,YAclB,CAAC;AAEF,eAAO,MAAM,QAAQ,qBAKpB,CAAC;AAEF,eAAO,MAAM,OAAO,yBAInB,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,KAAK,GAAG,QAUzC,CAAC"}
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../src/functions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C;;;GAGG;AACH,eAAO,MAAM,QAAQ,QAAO,MAAM,GAAG,IAgBpC,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,OAAO,QAAO,UAAU,GAAG,IAavC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,MAAM,QAAO,IAezB,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7D,KAAK,CAAC,KACL,OAAO,CAAC,CAAC,CAuBX,CAAC"}

package/dist/functions.js

@@ -1,38 +1,86 @@
-import Cookies from "js-cookie";
-import { jwtDecode } from "jwt-decode";
-export const logout = () => {
-    // 1. Clear Local Storage
-    localStorage.removeItem("token");
-    const tokenDeleteString = "token=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;";
-    document.cookie = tokenDeleteString;
-    // 3. Fallback: Clear ALL cookies (your original loop)
-    const cookies = document.cookie.split(";");
-    for (let i = 0; i < cookies.length; i++) {
-        const cookie = cookies[i];
-        const eqPos = cookie.indexOf("=");
-        const name = eqPos > -1 ? cookie.substr(0, eqPos).trim() : cookie.trim();
-        document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;`;
-    }
-};
+// ============================================================
+// @econneq/gql-auth — Client utilities
+// ============================================================
+// ─── Token ───────────────────────────────────────────────────
+/**
+ * Read the JWT from cookies first, then localStorage.
+ * Returns null on the server (window is undefined).
+ */
 export const getToken = () => {
-    if (typeof window === "undefined") {
+    if (typeof window === "undefined")
         return null;
+    try {
+        // Prefer cookie (set by server on login)
+        const fromCookie = document.cookie
+            .split("; ")
+            .find((row) => row.startsWith("token="))
+            ?.split("=")?.[1];
+        if (fromCookie)
+            return fromCookie;
     }
-    return Cookies.get("token") || localStorage.getItem("token");
+    catch {
+        // Cookies blocked (e.g. incognito with strict settings)
+    }
+    return localStorage.getItem("token");
 };
+// ─── User ────────────────────────────────────────────────────
+/**
+ * Decode the JWT and return the payload.
+ * Returns null when no token is present or decoding fails.
+ */
 export const getUser = () => {
     const token = getToken();
-    const user = token ? jwtDecode(token) : null;
-    return user;
+    if (!token)
+        return null;
+    try {
+        // jwtDecode is a peer dependency — lazy-required to keep SSR safe
+        const { jwtDecode } = require("jwt-decode");
+        return jwtDecode(token);
+    }
+    catch {
+        return null;
+    }
+};
+// ─── Logout ──────────────────────────────────────────────────
+/**
+ * Clear all session state client-side.
+ * Does NOT call any server endpoint — combine with a Server Action
+ * or API route if you need to invalidate the session server-side.
+ */
+export const logout = () => {
+    if (typeof window === "undefined")
+        return;
+    localStorage.removeItem("token");
+    // Expire the token cookie
+    document.cookie = "token=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;";
+    // Expire every other cookie for this origin
+    document.cookie.split(";").forEach((c) => {
+        const name = c.trim().split("=")?.[0];
+        if (name) {
+            document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/;`;
+        }
+    });
 };
+// ─── Data helpers ─────────────────────────────────────────────
+/**
+ * Strip null / undefined / empty-string fields from an object
+ * before sending it as GraphQL variables.
+ * File objects are always preserved.
+ */
 export const removeEmptyFields = (obj) => {
-    const newObj = {};
+    const result = {};
     for (const key in obj) {
-        // Keep File objects and non-empty values
-        if (obj[key] instanceof File ||
-            (obj[key] !== null && obj[key] !== undefined && obj[key] !== '')) {
-            newObj[key] = obj[key];
+        const value = obj[key];
+        const v = value;
+        const isFile = typeof File !== "undefined" &&
+            typeof v === "object" &&
+            v !== null &&
+            v instanceof File;
+        if (isFile ||
+            (value !== null && value !== undefined && value !== "")) {
+            result[key] = value;
         }
     }
-    return newObj;
+    return result;
 };
+//# sourceMappingURL=functions.js.map

package/dist/functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.js","sourceRoot":"","sources":["../src/functions.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,uCAAuC;AACvC,+DAA+D;AAI/D,gEAAgE;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAkB,EAAE;IAC1C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAE/C,IAAI,CAAC;QACH,yCAAyC;QACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpB,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,gEAAgE;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAsB,EAAE;IAC7C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,kEAAkE;QAClE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,YAAY,CAEzC,CAAC;QACF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,gEAAgE;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,GAAS,EAAE;IAC/B,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAE1C,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,GAAG,wDAAwD,CAAC;IAE3E,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,mDAAmD,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,iEAAiE;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EACM,EAAE;IACd,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAExB,MAAM,CAAC,GAAG,KAAgB,CAAC;QAE9B,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,WAAW;YAC3B,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACV,CAAC,YAAY,IAAI,CAAC;QAEhB,IACE,MAAM;YACN,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,EACvD,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}