@h-ai/api-client 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/index.js

@@ -7,29 +7,6 @@ import { z } from 'zod';
 // src/api-client-main.ts
 var logger = core.logger.child({ module: "api-client", scope: "auth" });
 var HTTPONLY_COOKIE_SENTINEL = "__httponly_cookie__";
-var LS_ACCESS_KEY = "hai_access_token";
-var LS_REFRESH_KEY = "hai_refresh_token";
-function createLocalStorageTokenStorage() {
-  logger.warn("apiClient.tokenStorage.localStorage: storing tokens in localStorage exposes them to XSS. Prefer httpOnly cookies for production.");
-  return {
-    async getAccessToken() {
-      return globalThis.localStorage?.getItem(LS_ACCESS_KEY) ?? null;
-    },
-    async setAccessToken(token) {
-      globalThis.localStorage?.setItem(LS_ACCESS_KEY, token);
-    },
-    async getRefreshToken() {
-      return globalThis.localStorage?.getItem(LS_REFRESH_KEY) ?? null;
-    },
-    async setRefreshToken(token) {
-      globalThis.localStorage?.setItem(LS_REFRESH_KEY, token);
-    },
-    async clear() {
-      globalThis.localStorage?.removeItem(LS_ACCESS_KEY);
-      globalThis.localStorage?.removeItem(LS_REFRESH_KEY);
-    }
-  };
-}
 function createMemoryTokenStorage() {
   let accessToken = null;
   let refreshToken = null;
@@ -83,25 +60,61 @@ var RefreshTokenPayloadSchema = z.object({
 function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFailed, refreshTimeoutMs = 1e4) {
   const callbacks = [];
   let refreshPromise = null;
+  let refreshController = null;
+  let generation = 0;
+  let storageMutation = Promise.resolve();
+  function mutateStorage(operation) {
+    const pending = storageMutation.then(operation);
+    storageMutation = pending.then(() => {
+    }, () => {
+    });
+    return pending;
+  }
+  function invalidateRefresh() {
+    const previousController = refreshController;
+    generation++;
+    refreshController = null;
+    refreshPromise = null;
+    return previousController;
+  }
+  async function failRefresh(refreshGeneration) {
+    await mutateStorage(async () => {
+      if (refreshGeneration !== generation)
+        return;
+      await storage.clear();
+      if (refreshGeneration === generation)
+        onRefreshFailed?.();
+    });
+  }
   async function refresh() {
     if (refreshPromise)
       return refreshPromise;
-    refreshPromise = doRefresh();
+    const controller = new AbortController();
+    const pending = doRefresh(generation, controller);
+    refreshController = controller;
+    refreshPromise = pending;
     try {
-      return await refreshPromise;
+      return await pending;
     } finally {
-      refreshPromise = null;
+      if (refreshPromise === pending) {
+        refreshPromise = null;
+        refreshController = null;
+      }
     }
   }
-  async function doRefresh() {
+  async function doRefresh(refreshGeneration, controller) {
+    await storageMutation;
+    if (refreshGeneration !== generation)
+      return null;
     const refreshToken = await storage.getRefreshToken();
+    if (refreshGeneration !== generation)
+      return null;
     if (!refreshToken) {
       logger.warn("Token refresh skipped, no refresh token available");
       onRefreshFailed?.();
       return null;
     }
     logger.debug("Refreshing token");
-    const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), refreshTimeoutMs);
     try {
       const useHttpOnlyCookie = refreshToken === HTTPONLY_COOKIE_SENTINEL;
@@ -115,27 +128,28 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
         requestInit.headers = { "Content-Type": "application/json" };
       }
       const response = await fetchFn(refreshEndpointUrl, requestInit);
+      if (refreshGeneration !== generation)
+        return null;
       if (!response.ok) {
         if (response.status >= 400 && response.status < 500) {
-          await storage.clear();
-          onRefreshFailed?.();
+          await failRefresh(refreshGeneration);
         } else {
           logger.warn("Token refresh transient failure, keeping tokens", { status: response.status });
         }
         return null;
       }
       const body = await response.json();
+      if (refreshGeneration !== generation)
+        return null;
       const parsed = RefreshTokenPayloadSchema.safeParse(readTokenPayload(body.data));
       if (!parsed.success) {
         logger.warn("Token refresh returned invalid data", { issues: parsed.error.issues });
-        await storage.clear();
-        onRefreshFailed?.();
+        await failRefresh(refreshGeneration);
         return null;
       }
       if (!useHttpOnlyCookie && !parsed.data.refreshToken) {
         logger.warn("Token refresh returned invalid data", { issues: [{ path: ["refreshToken"], message: "Required" }] });
-        await storage.clear();
-        onRefreshFailed?.();
+        await failRefresh(refreshGeneration);
         return null;
       }
       const refreshTokenForStorage = parsed.data.refreshToken ?? HTTPONLY_COOKIE_SENTINEL;
@@ -145,12 +159,27 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
         expiresIn: parsed.data.expiresIn ?? 3600,
         tokenType: "Bearer"
       };
-      await storage.setAccessToken(tokens.accessToken);
-      await storage.setRefreshToken(refreshTokenForStorage);
+      const committed = await mutateStorage(async () => {
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setAccessToken(tokens.accessToken);
+        if (refreshGeneration !== generation)
+          return false;
+        await storage.setRefreshToken(refreshTokenForStorage);
+        return refreshGeneration === generation;
+      });
+      if (!committed || refreshGeneration !== generation)
+        return null;
       logger.info("Token refreshed successfully");
-      for (const cb of callbacks) cb(tokens);
-      return tokens;
+      for (const cb of callbacks) {
+        if (refreshGeneration !== generation)
+          return null;
+        cb(tokens);
+      }
+      return refreshGeneration === generation ? tokens : null;
     } catch (error) {
+      if (refreshGeneration !== generation)
+        return null;
       logger.error("Token refresh failed (transient)", { error });
       return null;
     } finally {
@@ -161,12 +190,26 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
     storage,
     refresh,
     async setTokens(tokens) {
-      await storage.setAccessToken(tokens.accessToken);
-      if (tokens.refreshToken)
-        await storage.setRefreshToken(tokens.refreshToken);
+      const previousController = invalidateRefresh();
+      const mutationGeneration = generation;
+      const pending = mutateStorage(async () => {
+        if (mutationGeneration !== generation)
+          return;
+        await storage.clear();
+        if (mutationGeneration !== generation)
+          return;
+        await storage.setAccessToken(tokens.accessToken);
+        if (tokens.refreshToken && mutationGeneration === generation)
+          await storage.setRefreshToken(tokens.refreshToken);
+      });
+      previousController?.abort();
+      await pending;
     },
     async clear() {
-      await storage.clear();
+      const previousController = invalidateRefresh();
+      const pending = mutateStorage(() => storage.clear());
+      previousController?.abort();
+      await pending;
     },
     onTokenRefreshed(callback) {
       callbacks.push(callback);
@@ -202,6 +245,23 @@ var en_US_default = {
   apiClient_unknown: "Unknown error"
 };
 
+// messages/ja-JP.json
+var ja_JP_default = {
+  apiClient_networkError: "\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_timeout: "\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F",
+  apiClient_serverError: "\u30B5\u30FC\u30D0\u30FC\u30A8\u30E9\u30FC\uFF08{status}\uFF09",
+  apiClient_unauthorized: "\u8A8D\u8A3C\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_forbidden: "\u30A2\u30AF\u30BB\u30B9\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",
+  apiClient_notFound: "\u30EA\u30BD\u30FC\u30B9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093",
+  apiClient_validationFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_tokenRefreshFailed: "\u30C8\u30FC\u30AF\u30F3\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_notInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306BapiClient.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_alreadyInitialized: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306F\u521D\u671F\u5316\u6E08\u307F\u3067\u3059\u3002init()\u306E\u524D\u306BapiClient.close()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  apiClient_configError: "API\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u306E\u8A2D\u5B9A\u30A8\u30E9\u30FC: {error}",
+  apiClient_responseValidationFailed: "\u30EC\u30B9\u30DD\u30F3\u30B9\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  apiClient_unknown: "\u4E0D\u660E\u306A\u30A8\u30E9\u30FC"
+};
+
 // messages/zh-CN.json
 var zh_CN_default = {
   apiClient_networkError: "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25",
@@ -222,7 +282,8 @@ var zh_CN_default = {
 // src/api-client-i18n.ts
 var apiClientM = core.i18n.createMessageGetter({
   "zh-CN": zh_CN_default,
-  "en-US": en_US_default
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
 });
 
 // src/api-client-iam.ts
@@ -235,7 +296,7 @@ function createIamAuthActions(client) {
   return {
     publicConfig: () => client.iam.auth.publicConfig(),
     login: async (input) => {
-      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "" }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password, rememberMe: input.rememberMe });
+      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "" }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password });
       return save(result);
     },
     register: async (input) => save(await client.iam.auth.register(input)),
@@ -275,8 +336,6 @@ var TRAILING_SLASHES_REGEX = /\/+$/;
 var tokenStorage = {
   /** 内存存储——SSR / Node 测试或一次性会话使用。 */
   memory: createMemoryTokenStorage,
-  /** 浏览器 `localStorage` 存储——单页应用便捷选项；注意 XSS 风险。 */
-  localStorage: createLocalStorageTokenStorage,
   /** httpOnly Cookie 存储——浏览器场景推荐方案。 */
   httpOnlyCookie: createHttpOnlyCookieTokenStorage
 };
@@ -425,6 +484,8 @@ function buildTokenManager(config, transport) {
   const refreshFetch = async (input, init) => {
     const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
     const headers = new Headers(configured);
+    if (!headers.has("accept-language"))
+      headers.set("accept-language", core.i18n.getGlobalLocale());
     headers.set("x-request-client", config.clientName ?? DEFAULT_CLIENT_NAME);
     new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
     return fetchFn(input, { ...init, headers });
@@ -454,9 +515,12 @@ function buildRawClient(contract, config, tokenManager, transport) {
 }
 async function buildHeaders(config, tokenManager) {
   const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
+  const headers = new Headers(configured);
+  if (!headers.has("accept-language"))
+    headers.set("accept-language", core.i18n.getGlobalLocale());
   const accessToken = await tokenManager?.storage.getAccessToken();
   return {
-    ...configured,
+    ...Object.fromEntries(headers),
     "x-request-client": config.clientName ?? DEFAULT_CLIENT_NAME,
     ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
   };
@@ -515,6 +579,8 @@ async function fetchWithTimeout(request, init, config, transport) {
 function mapClientError(error) {
   if (error instanceof ORPCError) {
     const detail = { orpcCode: error.code, status: error.status, data: error.data };
+    if (error.status === 400 || error.status === 422)
+      return err(HaiApiClientError.VALIDATION_FAILED, error.message, detail);
     if (error.status === 401)
       return err(HaiApiClientError.UNAUTHORIZED, error.message, detail);
     if (error.status === 403)