@h-ai/api-client 0.1.0-alpha.72 → 0.1.0-alpha.74

package/dist/index.js

@@ -1,4 +1,4 @@
-import { apiContract } from '@h-ai/api-contract';
+import { apiContract, IamSessionErrorCodeSchema } from '@h-ai/api-contract';
 import { core, err, ok } from '@h-ai/core';
 import { TransportTimeError, TransportBodyTooLargeError } from '@h-ai/crypto';
 import { createORPCClient, ORPCError } from '@orpc/client';
@@ -63,6 +63,7 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
   let refreshPromise = null;
   let refreshController = null;
   let generation = 0;
+  let sessionInvalid = false;
   let storageMutation = Promise.resolve();
   function mutateStorage(operation) {
     const pending = storageMutation.then(operation);
@@ -83,8 +84,10 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
       if (refreshGeneration !== generation)
         return;
       await storage.clear();
-      if (refreshGeneration === generation)
+      if (refreshGeneration === generation) {
+        sessionInvalid = true;
         onRefreshFailed?.();
+      }
     });
   }
   async function refresh() {
@@ -111,7 +114,8 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
     if (refreshGeneration !== generation)
       return null;
     if (!refreshToken) {
-      logger.warn("Token refresh skipped, no refresh token available");
+      sessionInvalid = true;
+      logger.debug("Token refresh skipped, no refresh token available");
       onRefreshFailed?.();
       return null;
     }
@@ -171,7 +175,8 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
       });
       if (!committed || refreshGeneration !== generation)
         return null;
-      logger.info("Token refreshed successfully");
+      sessionInvalid = false;
+      logger.debug("Token refreshed successfully");
       for (const cb of callbacks) {
         if (refreshGeneration !== generation)
           return null;
@@ -189,9 +194,16 @@ function createTokenManager(storage, refreshEndpointUrl, fetchFn, onRefreshFaile
   }
   return {
     storage,
+    get generation() {
+      return generation;
+    },
+    get sessionInvalid() {
+      return sessionInvalid;
+    },
     refresh,
     async setTokens(tokens) {
       const previousController = invalidateRefresh();
+      sessionInvalid = false;
       const mutationGeneration = generation;
       const pending = mutateStorage(async () => {
         if (mutationGeneration !== generation)
@@ -286,8 +298,12 @@ var apiClientM = core.i18n.createMessageGetter({
   "en-US": en_US_default,
   "ja-JP": ja_JP_default
 });
-
-// src/api-client-iam.ts
+var pageExitBindings = /* @__PURE__ */ new WeakMap();
+function clearIamPageExitBindings(auth) {
+  for (const stop of pageExitBindings.get(auth) ?? [])
+    stop();
+  pageExitBindings.delete(auth);
+}
 function createIamAuthActions(client) {
   async function save(result) {
     if (result.success)
@@ -295,15 +311,45 @@ function createIamAuthActions(client) {
     return result;
   }
   return {
+    bindPageExit(options = {}) {
+      if (!options.enabled || typeof window === "undefined")
+        return () => {
+        };
+      const target = window;
+      let sent = false;
+      const onPageHide = (event) => {
+        if (event.persisted || sent)
+          return;
+        sent = true;
+        void client.iam.auth.closeSession({}, { context: { keepalive: true, autoRefresh: false } }).then((result) => {
+          if (!result.success)
+            core.logger.warn("Page exit session revocation failed", { errorCode: result.error.code });
+        }).catch(() => core.logger.warn("Page exit session request did not complete"));
+      };
+      target.addEventListener("pagehide", onPageHide);
+      const bindings = pageExitBindings.get(client.auth) ?? /* @__PURE__ */ new Set();
+      const stop = () => {
+        target.removeEventListener("pagehide", onPageHide);
+        bindings.delete(stop);
+        if (!bindings.size)
+          pageExitBindings.delete(client.auth);
+      };
+      bindings.add(stop);
+      pageExitBindings.set(client.auth, bindings);
+      return stop;
+    },
     publicConfig: () => client.iam.auth.publicConfig(),
+    createCaptcha: (input) => client.iam.auth.createCaptcha(input),
     login: async (input) => {
-      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "" }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password });
+      const result = input.method === "ldap" ? await client.iam.auth.loginWithLdap({ username: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId }) : input.method === "email" || input.method === "sms" ? await client.iam.auth.loginWithOtp({ identifier: input.identifier, code: input.code ?? "", captcha: input.captcha, expectedUserId: input.expectedUserId }) : await client.iam.auth.login({ identifier: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId });
       return save(result);
     },
     register: async (input) => save(await client.iam.auth.register(input)),
-    sendOtp: (identifier) => client.iam.auth.sendOtp({ identifier }),
-    requestPasswordReset: (identifier) => client.iam.auth.requestPasswordReset({ identifier }),
-    confirmPasswordReset: (token, newPassword) => client.iam.auth.confirmPasswordReset({ token, newPassword })
+    sendOtp: (identifier, options) => client.iam.auth.sendOtp({ identifier, ...options }),
+    requestPasswordReset: (identifier, options) => client.iam.auth.requestPasswordReset({ identifier, ...options }),
+    confirmPasswordReset: (token, newPassword) => client.iam.auth.confirmPasswordReset({ token, newPassword }),
+    renewPassword: (input) => client.iam.auth.renewPassword(input),
+    reauthenticate: (password, operation) => client.iam.auth.reauthenticate({ password, operation })
   };
 }
 var ApiClientErrorInfo = {
@@ -404,6 +450,7 @@ function createApiClient(contract) {
       }
     },
     async close() {
+      clearIamPageExitBindings(auth);
       state.observers.clear();
       state.transport?.destroy();
       state.config = null;
@@ -541,7 +588,7 @@ function buildTokenManager(config, transport) {
     new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
     return fetchFn(input, { ...init, headers });
   };
-  const manager = createTokenManager(storage, refreshUrl, refreshFetch, config.auth.onRefreshFailed, config.auth.refreshTimeoutMs);
+  const manager = createTokenManager(storage, refreshUrl, refreshFetch, config.auth.recoverSession ? void 0 : config.auth.onRefreshFailed, config.auth.refreshTimeoutMs);
   if (config.auth.onTokenRefreshed) {
     manager.onTokenRefreshed(config.auth.onTokenRefreshed);
   }
@@ -559,7 +606,12 @@ function buildTransportSession(config) {
 function buildRawClient(contract, config, tokenManager, transport) {
   const link = new OpenAPILink(contract, {
     url: config.baseUrl,
-    headers: async (options) => buildHeaders(config, tokenManager, getObservation(options.context)?.requestId),
+    headers: async (options) => {
+      const headers = await buildHeaders(config, tokenManager, getObservation(options.context)?.requestId);
+      if (typeof options.context.reauthentication === "string")
+        headers["x-hai-reauthentication"] = options.context.reauthentication;
+      return headers;
+    },
     fetch: async (request, init, options) => {
       const record = getObservation(options.context);
       if (record) {
@@ -569,7 +621,8 @@ function buildRawClient(contract, config, tokenManager, transport) {
         url.hash = "";
         record.url = core.sanitize.sanitizeUrl(url.toString());
       }
-      const response = await fetchWithRefresh(request, init, config, tokenManager, transport, record);
+      const requestInit = options.context.keepalive === true ? { ...init, keepalive: true } : init;
+      const response = await fetchWithRefresh(request, requestInit, config, options.context.autoRefresh === false ? void 0 : tokenManager, transport, record);
       if (record) {
         record.status = response.status;
         const traceId = response.headers.get("x-trace-id") ?? response.headers.get("x-request-id");
@@ -588,6 +641,7 @@ function getObservation(context) {
 async function buildHeaders(config, tokenManager, requestId) {
   const configured = typeof config.headers === "function" ? await config.headers() : config.headers ?? {};
   const headers = new Headers(configured);
+  headers.set("x-hai-terminal", config.auth?.terminalType ?? "web");
   if (!headers.has("accept-language"))
     headers.set("accept-language", core.i18n.getGlobalLocale());
   const accessToken = await tokenManager?.storage.getAccessToken();
@@ -600,6 +654,7 @@ async function buildHeaders(config, tokenManager, requestId) {
 }
 async function fetchWithRefresh(request, init, config, tokenManager, transport, observation) {
   const retryRequest = tokenManager ? request.clone() : void 0;
+  const identityGeneration = tokenManager?.generation;
   if (observation)
     observation.attempts++;
   const response = await fetchWithTimeout(request, init, config, transport);
@@ -612,11 +667,28 @@ async function fetchWithRefresh(request, init, config, tokenManager, transport,
     return response;
   if (response.status !== 401 && !await isUnauthorizedResult(response))
     return response;
+  const failure = await response.clone().json().catch(() => void 0);
+  if (failure && typeof failure === "object" && "error" in failure && failure.error && typeof failure.error === "object" && "code" in failure.error && typeof failure.error.code === "string" && failure.error.code.startsWith("hai:iam:") && !IamSessionErrorCodeSchema.safeParse(failure.error.code).success) {
+    return response;
+  }
+  if (tokenManager.generation !== identityGeneration)
+    return response;
   const tokens = await tokenManager.refresh();
-  if (!tokens)
+  if (tokenManager.generation !== identityGeneration)
+    return response;
+  let accessToken = tokens?.accessToken;
+  if (!accessToken && config.auth?.recoverSession && tokenManager.sessionInvalid) {
+    if (await config.auth.recoverSession()) {
+      const restoredGeneration = tokenManager.generation;
+      accessToken = await tokenManager.storage.getAccessToken() ?? void 0;
+      if (tokenManager.generation !== restoredGeneration)
+        return response;
+    }
+  }
+  if (!accessToken)
     return response;
   const headers = new Headers(retryRequest.headers);
-  headers.set("authorization", `Bearer ${tokens.accessToken}`);
+  headers.set("authorization", `Bearer ${accessToken}`);
   if (observation)
     observation.attempts++;
   return fetchWithTimeout(new Request(retryRequest, { headers }), init, config, transport);