@foir/sdk 0.27.1 → 0.29.0

package/dist/server.js

@@ -144,6 +144,7 @@ var GRANT_TABLE = [
   ["apikeys:write", "none", [], []],
   ["organizations:read", "none", [], []],
   ["organizations:write", "none", [], []],
+  ["orgsettings:write", "none", [], []],
   ["organizations:create", "none", [], []],
   ["organizations:delete", "none", [], []],
   ["organizations:reach", "none", [], []],
@@ -154,7 +155,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "orgsettings:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -185,7 +186,6 @@ var GRANT_TABLE = [
   ["usersecrets:list", "none", [], []],
   ["usersecrets:put", "none", [], []],
   ["usersecrets:delete", "none", [], []],
-  ["auth:login_with_foir", "none", [], []],
   ["signinproviders:read", "none", [], []],
   ["signinproviders:write", "none", [], []]
 ];
@@ -1107,8 +1107,18 @@ async function resolveFoirAuth(config) {
     key: { apiKey: config.apiKey, bearerToken }
   };
 }
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewBearerOnce(refresh) {
+  const running = renewing.get(refresh);
+  if (running) return running;
+  const next = refresh().finally(() => renewing.delete(refresh));
+  renewing.set(refresh, next);
+  return next;
+}
 
 // src/data/ws-transport.ts
+var CLOSE_CREDENTIAL_ENDED = 4402;
+var CLOSE_FORBIDDEN = 4403;
 var GQL = {
   connectionInit: "connection_init",
   connectionAck: "connection_ack",
@@ -1143,6 +1153,9 @@ var FoirSocketTransport = class {
   disposed = false;
   keepAlive = null;
   retryTimer = null;
+  // A bearer renewed after the socket's lapsed (4402), presented from the next
+  // connect on in place of the client's own.
+  renewedBearer = null;
   constructor(config) {
     if (config.dispatch !== void 0) {
       throw new FoirRequestError(
@@ -1215,12 +1228,14 @@ var FoirSocketTransport = class {
     socket.onmessage = (event) => this.receive(event.data);
     socket.onerror = () => {
     };
-    socket.onclose = () => this.handleClose();
+    socket.onclose = (event) => this.handleClose(event);
   }
   async sendConnectionInit(socket) {
     this.connecting = false;
     try {
-      const { headers } = await resolveFoirAuth(this.config);
+      const { headers } = await resolveFoirAuth(
+        this.renewedBearer ? { ...this.config, bearerToken: this.renewedBearer } : this.config
+      );
       const { "Content-Type": _contentType, ...params } = headers;
       const extra = await this.config.connectionParams?.() ?? {};
       this.send(socket, {
@@ -1234,19 +1249,53 @@ var FoirSocketTransport = class {
       this.teardownSocket(true);
     }
   }
-  handleClose() {
+  handleClose(event) {
+    const code = event?.code;
     const wasAcknowledged = this.acknowledged;
     this.teardownSocket(false);
     if (this.disposed || this.registrations.size === 0) return;
     for (const registration of this.registrations.values()) {
       registration.sent = false;
     }
+    if (code === CLOSE_FORBIDDEN) {
+      this.failAll(
+        new FoirRequestError(
+          "[foir] the subscription socket was refused where it asked to stand: the signed-in user is no member of the organization this client names"
+        )
+      );
+      return;
+    }
+    if (code === CLOSE_CREDENTIAL_ENDED) {
+      void this.reconnectWithARenewedBearer();
+      return;
+    }
     this.scheduleReconnect(
       new FoirRequestError(
         wasAcknowledged ? "[foir] the subscription socket closed and could not be re-established" : "[foir] the subscription socket closed before the credential was accepted"
       )
     );
   }
+  /**
+   * Reconnect after the socket's credential lapsed: with the bearer renewed
+   * through the client's `refreshBearer` where it has one, failing every
+   * subscription with `FoirSessionExpiredError` when the session is over. A
+   * client without one reconnects at once, presenting what its bearer
+   * provider gives now.
+   */
+  async reconnectWithARenewedBearer() {
+    const refresh = this.config.refreshBearer;
+    if (refresh) {
+      const token = await renewBearerOnce(refresh).catch(() => null);
+      if (this.disposed) return;
+      if (!token) {
+        this.failAll(new FoirSessionExpiredError());
+        return;
+      }
+      this.renewedBearer = token;
+    }
+    this.attempt = 0;
+    this.ensureConnected();
+  }
   scheduleReconnect(error) {
     if (this.disposed || this.registrations.size === 0) return;
     if (this.attempt >= this.policy.maxAttempts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -173,7 +173,7 @@
     "react-dom": "^19.2.0",
     "tsup": "^8.5.1",
     "typescript": "5.9.2",
-    "vitest": "^3.2.4",
+    "vitest": "^5.0.5",
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
     "yjs": "^13.6.30",