@flexkit/studio 0.1.0 → 0.1.1

package/dist/astro.js

@@ -1,6 +1,6 @@
 import {
   handleFlexkitRequest
-} from "./chunk-C2BPRGGQ.js";
+} from "./chunk-TXK4OFAG.js";
 
 // src/auth/astro-api.ts
 function resultToResponse(result) {

package/dist/{chunk-C2BPRGGQ.js → chunk-TXK4OFAG.js}

@@ -1,3 +1,23 @@
+// src/auth/bff-session.ts
+var API_TOKEN_PREFIX = "flk-";
+function getBearerToken(authorizationHeader) {
+  if (!authorizationHeader) {
+    return "";
+  }
+  const [scheme, token, ...rest] = authorizationHeader.trim().split(/\s+/);
+  if (rest.length > 0 || !scheme || !token || scheme.toLowerCase() !== "bearer") {
+    return "";
+  }
+  return token;
+}
+function resolveBffSession(sessionCookie, authorizationHeader) {
+  const bearerToken = getBearerToken(authorizationHeader);
+  if (bearerToken.startsWith(API_TOKEN_PREFIX)) {
+    return { error: "API tokens are not accepted here. Call the project API directly with the token." };
+  }
+  return { token: sessionCookie || bearerToken };
+}
+
 // src/core/domains.ts
 var defaultFlexkitDomain = "flexkit.io";
 var allowedFlexkitDomains = {
@@ -86,22 +106,6 @@ var hopByHopHeaders = /* @__PURE__ */ new Set([
   "transfer-encoding",
   "upgrade"
 ]);
-function getBearerToken(authorizationHeader) {
-  if (!authorizationHeader) {
-    return "";
-  }
-  const [scheme, token, ...rest] = authorizationHeader.trim().split(/\s+/);
-  if (rest.length > 0) {
-    return "";
-  }
-  if (!scheme || !token) {
-    return "";
-  }
-  if (scheme.toLowerCase() !== "bearer") {
-    return "";
-  }
-  return token;
-}
 function sanitizeForwardHeaders(headers) {
   const sanitized = new Headers();
   headers.forEach((value, key) => {
@@ -200,9 +204,12 @@ async function handleFlexkitRequest(ctx) {
       body = void 0;
     }
   }
+  const session = resolveBffSession(sessionToken, request.headers.get("authorization"));
+  if (session.error) {
+    return { type: "json", status: 401, body: { error: session.error } };
+  }
   const forwardHeaders = sanitizeForwardHeaders(request.headers);
-  const bearerToken = getBearerToken(request.headers.get("authorization"));
-  const effectiveSessionToken = sessionToken || bearerToken;
+  const effectiveSessionToken = session.token;
   forwardHeaders.delete("Authorization");
   forwardHeaders.delete("Cookie");
   if (effectiveSessionToken) {

package/dist/nextjs.js

@@ -1,6 +1,6 @@
 import {
   handleFlexkitRequest
-} from "./chunk-C2BPRGGQ.js";
+} from "./chunk-TXK4OFAG.js";
 
 // src/auth/nextjs-api.ts
 function resultToNextResponse(result, NextResponse) {

package/dist/tanstack-start.js

@@ -1,6 +1,6 @@
 import {
   handleFlexkitRequest
-} from "./chunk-C2BPRGGQ.js";
+} from "./chunk-TXK4OFAG.js";
 
 // src/auth/tanstack-start-api.ts
 function getCookieValue(cookieHeader, name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flexkit/studio",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Flexkit Studio - Build custom internal tools like PIMs, CRMs, and ERPs with a flexible React UI and a graph-backed API",
   "keywords": [
     "flexkit",
@@ -157,8 +157,8 @@
     "uuid": "^9.0.1",
     "vaul": "1.1.2",
     "zod": "4.4.3",
-    "@flexkit/agent-protocol": "^0.2.0",
-    "@flexkit/schema": "0.1.0"
+    "@flexkit/schema": "0.1.1",
+    "@flexkit/agent-protocol": "^0.2.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
@@ -185,7 +185,7 @@
     "test:performance": "tsup --config tests/performance.config.ts && node --test build/tests/list-performance.test.js build/tests/editor-preview.test.js",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",
     "ui:add": "pnpm dlx shadcn@latest add",
-    "test:core": "tsup --config tests/core.config.ts && node --test build/tests/json-schema-to-zod.test.js build/tests/icon-name.test.js build/tests/project-schemas.test.js build/tests/rating-preview.test.js build/tests/last-project.test.js build/tests/proxy-target.test.js build/tests/project-label.test.js build/tests/hosted-session.test.js",
+    "test:core": "tsup --config tests/core.config.ts && node --test build/tests/json-schema-to-zod.test.js build/tests/icon-name.test.js build/tests/project-schemas.test.js build/tests/rating-preview.test.js build/tests/last-project.test.js build/tests/proxy-target.test.js build/tests/project-label.test.js build/tests/hosted-session.test.js build/tests/bff-session.test.js",
     "test:ai": "tsup --config tests/ai.config.ts && node --test build/tests/ai/*.test.js",
     "test": "pnpm run test:core && pnpm run test:ai && pnpm run test:performance"
   }