@every-app/sdk 0.0.6 → 0.0.7

package/dist/client/session-manager.d.ts

@@ -1,27 +1,33 @@
 export interface SessionManagerConfig {
-  appId: string;
+    appId: string;
 }
+/**
+ * Detects whether the current window is running inside an iframe.
+ * Returns true if in an iframe, false if running as top-level window.
+ */
+export declare function isRunningInIframe(): boolean;
 export declare class SessionManager {
-  readonly parentOrigin: string;
-  readonly appId: string;
-  private token;
-  private refreshPromise;
-  constructor(config: SessionManagerConfig);
-  private isTokenExpiringSoon;
-  private postMessageWithResponse;
-  requestNewToken(): Promise<string>;
-  getToken(): Promise<string>;
-  getTokenState(): {
-    status: "NO_TOKEN" | "VALID" | "EXPIRED" | "REFRESHING";
-    token: string | null;
-  };
-  /**
-   * Extracts user information from the current JWT token.
-   * Returns null if no valid token is available.
-   */
-  getUser(): {
-    userId: string;
-    email: string;
-  } | null;
+    readonly parentOrigin: string;
+    readonly appId: string;
+    readonly isInIframe: boolean;
+    private token;
+    private refreshPromise;
+    constructor(config: SessionManagerConfig);
+    private isTokenExpiringSoon;
+    private postMessageWithResponse;
+    requestNewToken(): Promise<string>;
+    getToken(): Promise<string>;
+    getTokenState(): {
+        status: "NO_TOKEN" | "VALID" | "EXPIRED" | "REFRESHING";
+        token: string | null;
+    };
+    /**
+     * Extracts user information from the current JWT token.
+     * Returns null if no valid token is available.
+     */
+    getUser(): {
+        userId: string;
+        email: string;
+    } | null;
 }
-//# sourceMappingURL=session-manager.d.ts.map
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/client/session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/client/session-manager.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,qBAAa,cAAc;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,cAAc,CAAgC;gBAE1C,MAAM,EAAE,oBAAoB;IAoBxC,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,uBAAuB;IAuCzB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IA8ClC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,aAAa,IAAI;QACf,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;QACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;IAgBD;;;OAGG;IACH,OAAO,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAwBpD"}
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/client/session-manager.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAQ3C;AAED,qBAAa,cAAc;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,cAAc,CAAgC;gBAE1C,MAAM,EAAE,oBAAoB;IAqBxC,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,uBAAuB;IAuCzB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IA8ClC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,aAAa,IAAI;QACf,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;QACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;IAgBD;;;OAGG;IACH,OAAO,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAwBpD"}

package/dist/client/session-manager.js

@@ -1,141 +1,158 @@
 const MESSAGE_TIMEOUT_MS = 5000;
 const TOKEN_EXPIRY_BUFFER_MS = 10000;
 const DEFAULT_TOKEN_LIFETIME_MS = 60000;
-export class SessionManager {
-  parentOrigin;
-  appId;
-  token = null;
-  refreshPromise = null;
-  constructor(config) {
-    if (!config.appId) {
-      throw new Error("[SessionManager] appId is required.");
-    }
-    const gatewayUrl = import.meta.env.VITE_GATEWAY_URL;
-    if (!gatewayUrl) {
-      throw new Error("[SessionManager] VITE_GATEWAY_URL env var is required.");
-    }
+/**
+ * Detects whether the current window is running inside an iframe.
+ * Returns true if in an iframe, false if running as top-level window.
+ */
+export function isRunningInIframe() {
     try {
-      new URL(gatewayUrl);
-    } catch {
-      throw new Error(`[SessionManager] Invalid gateway URL: ${gatewayUrl}`);
+        return window.self !== window.top;
     }
-    this.appId = config.appId;
-    this.parentOrigin = gatewayUrl;
-  }
-  isTokenExpiringSoon(bufferMs = TOKEN_EXPIRY_BUFFER_MS) {
-    if (!this.token) return true;
-    return Date.now() >= this.token.expiresAt - bufferMs;
-  }
-  postMessageWithResponse(request, responseType, requestId) {
-    return new Promise((resolve, reject) => {
-      const cleanup = () => {
-        clearTimeout(timeout);
-        window.removeEventListener("message", handler);
-      };
-      const handler = (event) => {
-        // Security: reject messages from wrong origin (including null from sandboxed iframes)
-        if (event.origin !== this.parentOrigin) return;
-        // Safety: ignore malformed messages that could crash the handler
-        if (!event.data || typeof event.data !== "object") return;
-        if (
-          event.data.type === responseType &&
-          event.data.requestId === requestId
-        ) {
-          cleanup();
-          if (event.data.error) {
-            reject(new Error(event.data.error));
-          } else {
-            resolve(event.data);
-          }
-        }
-      };
-      const timeout = setTimeout(() => {
-        cleanup();
-        reject(new Error("Token request timeout - parent did not respond"));
-      }, MESSAGE_TIMEOUT_MS);
-      window.addEventListener("message", handler);
-      window.parent.postMessage(request, this.parentOrigin);
-    });
-  }
-  async requestNewToken() {
-    if (this.refreshPromise) {
-      return this.refreshPromise;
+    catch {
+        // If we can't access window.top due to cross-origin restrictions,
+        // we're definitely in an iframe
+        return true;
     }
-    this.refreshPromise = (async () => {
-      const requestId = crypto.randomUUID();
-      const response = await this.postMessageWithResponse(
-        {
-          type: "SESSION_TOKEN_REQUEST",
-          requestId,
-          appId: this.appId,
-        },
-        "SESSION_TOKEN_RESPONSE",
-        requestId,
-      );
-      if (!response.token) {
-        throw new Error("No token in response");
-      }
-      // Parse expiresAt, falling back to default lifetime if invalid
-      let expiresAt = Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
-      if (response.expiresAt) {
-        const parsed = new Date(response.expiresAt).getTime();
-        if (!Number.isNaN(parsed)) {
-          expiresAt = parsed;
+}
+export class SessionManager {
+    parentOrigin;
+    appId;
+    isInIframe;
+    token = null;
+    refreshPromise = null;
+    constructor(config) {
+        if (!config.appId) {
+            throw new Error("[SessionManager] appId is required.");
         }
-      }
-      this.token = {
-        token: response.token,
-        expiresAt,
-      };
-      return this.token.token;
-    })();
-    try {
-      return await this.refreshPromise;
-    } finally {
-      this.refreshPromise = null;
+        const gatewayUrl = import.meta.env.VITE_GATEWAY_URL;
+        if (!gatewayUrl) {
+            throw new Error("[SessionManager] VITE_GATEWAY_URL env var is required.");
+        }
+        try {
+            new URL(gatewayUrl);
+        }
+        catch {
+            throw new Error(`[SessionManager] Invalid gateway URL: ${gatewayUrl}`);
+        }
+        this.appId = config.appId;
+        this.parentOrigin = gatewayUrl;
+        this.isInIframe = isRunningInIframe();
     }
-  }
-  async getToken() {
-    if (this.isTokenExpiringSoon()) {
-      return this.requestNewToken();
+    isTokenExpiringSoon(bufferMs = TOKEN_EXPIRY_BUFFER_MS) {
+        if (!this.token)
+            return true;
+        return Date.now() >= this.token.expiresAt - bufferMs;
     }
-    return this.token.token;
-  }
-  getTokenState() {
-    if (this.refreshPromise) {
-      return { status: "REFRESHING", token: null };
+    postMessageWithResponse(request, responseType, requestId) {
+        return new Promise((resolve, reject) => {
+            const cleanup = () => {
+                clearTimeout(timeout);
+                window.removeEventListener("message", handler);
+            };
+            const handler = (event) => {
+                // Security: reject messages from wrong origin (including null from sandboxed iframes)
+                if (event.origin !== this.parentOrigin)
+                    return;
+                // Safety: ignore malformed messages that could crash the handler
+                if (!event.data || typeof event.data !== "object")
+                    return;
+                if (event.data.type === responseType &&
+                    event.data.requestId === requestId) {
+                    cleanup();
+                    if (event.data.error) {
+                        reject(new Error(event.data.error));
+                    }
+                    else {
+                        resolve(event.data);
+                    }
+                }
+            };
+            const timeout = setTimeout(() => {
+                cleanup();
+                reject(new Error("Token request timeout - parent did not respond"));
+            }, MESSAGE_TIMEOUT_MS);
+            window.addEventListener("message", handler);
+            window.parent.postMessage(request, this.parentOrigin);
+        });
     }
-    if (!this.token) {
-      return { status: "NO_TOKEN", token: null };
+    async requestNewToken() {
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = (async () => {
+            const requestId = crypto.randomUUID();
+            const response = await this.postMessageWithResponse({
+                type: "SESSION_TOKEN_REQUEST",
+                requestId,
+                appId: this.appId,
+            }, "SESSION_TOKEN_RESPONSE", requestId);
+            if (!response.token) {
+                throw new Error("No token in response");
+            }
+            // Parse expiresAt, falling back to default lifetime if invalid
+            let expiresAt = Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
+            if (response.expiresAt) {
+                const parsed = new Date(response.expiresAt).getTime();
+                if (!Number.isNaN(parsed)) {
+                    expiresAt = parsed;
+                }
+            }
+            this.token = {
+                token: response.token,
+                expiresAt,
+            };
+            return this.token.token;
+        })();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
     }
-    if (this.isTokenExpiringSoon(0)) {
-      return { status: "EXPIRED", token: this.token.token };
+    async getToken() {
+        if (this.isTokenExpiringSoon()) {
+            return this.requestNewToken();
+        }
+        return this.token.token;
     }
-    return { status: "VALID", token: this.token.token };
-  }
-  /**
-   * Extracts user information from the current JWT token.
-   * Returns null if no valid token is available.
-   */
-  getUser() {
-    if (!this.token) {
-      return null;
+    getTokenState() {
+        if (this.refreshPromise) {
+            return { status: "REFRESHING", token: null };
+        }
+        if (!this.token) {
+            return { status: "NO_TOKEN", token: null };
+        }
+        if (this.isTokenExpiringSoon(0)) {
+            return { status: "EXPIRED", token: this.token.token };
+        }
+        return { status: "VALID", token: this.token.token };
     }
-    try {
-      const parts = this.token.token.split(".");
-      if (parts.length !== 3) {
-        return null;
-      }
-      const payload = JSON.parse(atob(parts[1]));
-      if (!payload.sub) {
-        return null;
-      }
-      return {
-        userId: payload.sub,
-        email: payload.email ?? "",
-      };
-    } catch {
-      return null;
+    /**
+     * Extracts user information from the current JWT token.
+     * Returns null if no valid token is available.
+     */
+    getUser() {
+        if (!this.token) {
+            return null;
+        }
+        try {
+            const parts = this.token.token.split(".");
+            if (parts.length !== 3) {
+                return null;
+            }
+            const payload = JSON.parse(atob(parts[1]));
+            if (!payload.sub) {
+                return null;
+            }
+            return {
+                userId: payload.sub,
+                email: payload.email ?? "",
+            };
+        }
+        catch {
+            return null;
+        }
     }
-  }
 }

package/dist/client/useSessionTokenClientMiddleware.d.ts

@@ -1,8 +1,2 @@
-export declare const useSessionTokenClientMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterClient<
-  {},
-  unknown,
-  undefined,
-  undefined,
-  undefined
->;
-//# sourceMappingURL=useSessionTokenClientMiddleware.d.ts.map
+export declare const useSessionTokenClientMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterClient<{}, unknown, undefined, undefined, undefined>;
+//# sourceMappingURL=useSessionTokenClientMiddleware.d.ts.map

package/dist/client/useSessionTokenClientMiddleware.js

@@ -1,24 +1,21 @@
 import { createMiddleware } from "@tanstack/react-start";
 export const useSessionTokenClientMiddleware = createMiddleware({
-  type: "function",
+    type: "function",
 }).client(async ({ next }) => {
-  // Get the global sessionManager - this MUST be available for embedded apps
-  const sessionManager = window.__embeddedSessionManager;
-  if (!sessionManager) {
-    throw new Error(
-      "[AuthMiddleware] SessionManager not available - embedded provider not initialized",
-    );
-  }
-  // INVARIANT: This is just an extra check and should never be the case if the sessionManager exists.
-  if (typeof sessionManager.getToken !== "function") {
-    throw new Error(
-      "[AuthMiddleware] SessionManager.getToken is not a function",
-    );
-  }
-  const token = await sessionManager.getToken();
-  return next({
-    headers: {
-      Authorization: `Bearer ${token}`,
-    },
-  });
+    // Get the global sessionManager - this MUST be available for embedded apps
+    const sessionManager = window
+        .__embeddedSessionManager;
+    if (!sessionManager) {
+        throw new Error("[AuthMiddleware] SessionManager not available - embedded provider not initialized");
+    }
+    // INVARIANT: This is just an extra check and should never be the case if the sessionManager exists.
+    if (typeof sessionManager.getToken !== "function") {
+        throw new Error("[AuthMiddleware] SessionManager.getToken is not a function");
+    }
+    const token = await sessionManager.getToken();
+    return next({
+        headers: {
+            Authorization: `Bearer ${token}`,
+        },
+    });
 });

package/dist/server/auth-config.d.ts

@@ -1,3 +1,3 @@
 import type { AuthConfig } from "./types";
 export declare function getAuthConfig(): AuthConfig;
-//# sourceMappingURL=auth-config.d.ts.map
+//# sourceMappingURL=auth-config.d.ts.map

package/dist/server/auth-config.js

@@ -1,7 +1,7 @@
 import { env } from "cloudflare:workers";
 export function getAuthConfig() {
-  return {
-    issuer: env.GATEWAY_URL,
-    audience: import.meta.env.VITE_APP_ID,
-  };
+    return {
+        issuer: env.GATEWAY_URL,
+        audience: import.meta.env.VITE_APP_ID,
+    };
 }

package/dist/server/authenticateRequest.d.ts

@@ -1,26 +1,21 @@
 import type { AuthConfig } from "./types";
 interface SessionTokenPayload {
-  sub: string;
-  iss: string;
-  aud: string;
-  exp: number;
-  iat: number;
-  appId?: string;
-  permissions?: string[];
-  email?: string;
+    sub: string;
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    appId?: string;
+    permissions?: string[];
+    email?: string;
 }
-export declare function authenticateRequest(
-  authConfig: AuthConfig,
-  providedRequest?: Request,
-): Promise<SessionTokenPayload | null>;
+export declare function authenticateRequest(authConfig: AuthConfig, providedRequest?: Request): Promise<SessionTokenPayload | null>;
 /**
  * Extracts the bearer token from an Authorization header.
  *
  * @param authHeader - The Authorization header value (e.g., "Bearer eyJ...")
  * @returns The token string if valid, null otherwise
  */
-export declare function extractBearerToken(
-  authHeader: string | null,
-): string | null;
+export declare function extractBearerToken(authHeader: string | null): string | null;
 export {};
-//# sourceMappingURL=authenticateRequest.d.ts.map
+//# sourceMappingURL=authenticateRequest.d.ts.map

package/dist/server/authenticateRequest.js

@@ -1,61 +1,57 @@
 import { getRequest } from "@tanstack/react-start/server";
-import { createLocalJWKSet, jwtVerify } from "jose";
+import { createLocalJWKSet, jwtVerify, } from "jose";
 import { env } from "cloudflare:workers";
 export async function authenticateRequest(authConfig, providedRequest) {
-  const request = providedRequest || getRequest();
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader) {
-    console.log("No auth header found");
-    return null;
-  }
-  const token = extractBearerToken(authHeader);
-  if (!token) {
-    return null;
-  }
-  try {
-    const session = await verifySessionToken(token, authConfig);
-    return session;
-  } catch (error) {
-    console.error(
-      JSON.stringify({
-        message: "Error verifying session token",
-        error: error instanceof Error ? error.message : String(error),
-        stack: error instanceof Error ? error.stack : undefined,
-        errorType: error instanceof Error ? error.constructor.name : "Unknown",
-        issuer: authConfig.issuer,
-        audience: authConfig.audience,
-      }),
-    );
-    return null;
-  }
+    const request = providedRequest || getRequest();
+    const authHeader = request.headers.get("authorization");
+    if (!authHeader) {
+        console.log("No auth header found");
+        return null;
+    }
+    const token = extractBearerToken(authHeader);
+    if (!token) {
+        return null;
+    }
+    try {
+        const session = await verifySessionToken(token, authConfig);
+        return session;
+    }
+    catch (error) {
+        console.error(JSON.stringify({
+            message: "Error verifying session token",
+            error: error instanceof Error ? error.message : String(error),
+            stack: error instanceof Error ? error.stack : undefined,
+            errorType: error instanceof Error ? error.constructor.name : "Unknown",
+            issuer: authConfig.issuer,
+            audience: authConfig.audience,
+        }));
+        return null;
+    }
 }
 async function verifySessionToken(token, config) {
-  const { issuer, audience } = config;
-  if (!issuer) {
-    throw new Error("Issuer must be provided for token verification");
-  }
-  if (!audience) {
-    throw new Error("Audience must be provided for token verification");
-  }
-  // Fetch JWKS - use service binding in production, direct fetch in development
-  const jwksResponse =
-    import.meta.env.PROD && env.EVERY_APP_GATEWAY
-      ? await env.EVERY_APP_GATEWAY.fetch("http://localhost/api/embedded/jwks")
-      : await fetch(`${env.GATEWAY_URL}/api/embedded/jwks`);
-  if (!jwksResponse.ok) {
-    throw new Error(
-      `Failed to fetch JWKS: ${jwksResponse.status} ${jwksResponse.statusText}`,
-    );
-  }
-  const jwks = await jwksResponse.json();
-  const localJWKS = createLocalJWKSet(jwks);
-  const options = {
-    issuer,
-    audience,
-    algorithms: ["RS256"],
-  };
-  const { payload } = await jwtVerify(token, localJWKS, options);
-  return payload;
+    const { issuer, audience } = config;
+    if (!issuer) {
+        throw new Error("Issuer must be provided for token verification");
+    }
+    if (!audience) {
+        throw new Error("Audience must be provided for token verification");
+    }
+    // Fetch JWKS - use service binding in production, direct fetch in development
+    const jwksResponse = import.meta.env.PROD && env.EVERY_APP_GATEWAY
+        ? await env.EVERY_APP_GATEWAY.fetch("http://localhost/api/embedded/jwks")
+        : await fetch(`${env.GATEWAY_URL}/api/embedded/jwks`);
+    if (!jwksResponse.ok) {
+        throw new Error(`Failed to fetch JWKS: ${jwksResponse.status} ${jwksResponse.statusText}`);
+    }
+    const jwks = (await jwksResponse.json());
+    const localJWKS = createLocalJWKSet(jwks);
+    const options = {
+        issuer,
+        audience,
+        algorithms: ["RS256"],
+    };
+    const { payload } = await jwtVerify(token, localJWKS, options);
+    return payload;
 }
 /**
  * Extracts the bearer token from an Authorization header.
@@ -64,8 +60,8 @@ async function verifySessionToken(token, config) {
  * @returns The token string if valid, null otherwise
  */
 export function extractBearerToken(authHeader) {
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
-  }
-  return authHeader.substring(7);
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return null;
+    }
+    return authHeader.substring(7);
 }

package/dist/server/getLocalD1Url.d.ts

@@ -1,2 +1,2 @@
 export declare function getLocalD1Url(): string | null;
-//# sourceMappingURL=getLocalD1Url.d.ts.map
+//# sourceMappingURL=getLocalD1Url.d.ts.map