@happyvertical/smrt-users 0.38.9 → 0.38.11

package/dist/sveltekit.js

@@ -1,8 +1,184 @@
-import { _ as resolveOidcProviderConfig, a as TerminalAuthRateLimitError, f as OidcLoginError, g as getUsersOidcConfig, h as encodeOidcTransaction, i as TerminalAuthError, l as withSessionPermissionContext, m as decodeOidcTransaction, o as TerminalAuthService, p as OidcLoginService, u as SessionService } from "./chunks/TerminalAuthService-BgwNOEPM.js";
+import { C as encodeOidcTransaction, S as decodeOidcTransaction, T as resolveOidcProviderConfig, _ as validateMobileRedirectUri, a as TerminalAuthRateLimitError, b as OidcLoginError, g as readMobileBearerToken, h as MobileAuthService, i as TerminalAuthError, m as MobileAuthError, o as TerminalAuthService, p as withSessionPermissionContext, s as OperationPermissionError, v as SessionService, w as getUsersOidcConfig, x as OidcLoginService } from "./chunks/TerminalAuthService-DGp_Wsil.js";
 import { ObjectRegistry } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";
 import { classnameToTablename } from "@happyvertical/smrt-core/utils";
 import { methodNameToKebab, resolveApiActionSet } from "@happyvertical/smrt-core/vite-plugin";
+//#region src/sveltekit/mobile-handlers.ts
+var logger$1 = createLogger({ level: "info" });
+var NO_STORE_HEADERS$1 = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache"
+};
+function jsonResponse$2(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			...NO_STORE_HEADERS$1
+		}
+	});
+}
+function withNoStoreDefault(response) {
+	if (response.headers.has("cache-control")) return response;
+	const headers = new Headers(response.headers);
+	for (const [name, value] of Object.entries(NO_STORE_HEADERS$1)) headers.set(name, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function errorResponse(error) {
+	if (error instanceof MobileAuthError) {
+		if (error.status >= 500) logger$1.error("Mobile handler server error", {
+			code: error.code,
+			message: error.message
+		});
+		return jsonResponse$2({
+			error: error.message,
+			code: error.code
+		}, error.status);
+	}
+	if (error instanceof OperationPermissionError) return jsonResponse$2({
+		error: error.message,
+		code: "permission_denied",
+		reason: error.decision.reason,
+		permission: error.permission
+	}, error.status);
+	logger$1.error("Unexpected mobile handler error", { error });
+	return jsonResponse$2({
+		error: "Internal server error",
+		code: "internal_error"
+	}, 500);
+}
+async function readJsonBody(event) {
+	try {
+		const body = await event.request.json();
+		if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("not an object");
+		return body;
+	} catch {
+		throw new MobileAuthError(400, "invalid_request", "Request body must be a JSON object.");
+	}
+}
+function optionalString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function parseStartRequest(body) {
+	return {
+		providerId: optionalString(body.providerId),
+		redirectUri: optionalString(body.redirectUri) ?? "",
+		scopes: Array.isArray(body.scopes) ? body.scopes.filter((scope) => typeof scope === "string") : void 0,
+		state: optionalString(body.state),
+		loginHint: optionalString(body.loginHint)
+	};
+}
+function parseCompleteRequest(body) {
+	return {
+		providerId: optionalString(body.providerId),
+		code: optionalString(body.code) ?? "",
+		state: optionalString(body.state),
+		codeVerifier: optionalString(body.codeVerifier),
+		redirectUri: optionalString(body.redirectUri) ?? ""
+	};
+}
+function clientAddress(event) {
+	try {
+		return event.getClientAddress?.();
+	} catch {
+		return;
+	}
+}
+function populateLocals(event, context) {
+	if (!event.locals) return;
+	event.locals.user = context.user;
+	event.locals.membership = context.membership ?? null;
+	event.locals.permissions = context.permissions;
+	event.locals.tenantId = context.tenantId;
+	event.locals.sessionId = context.sessionId;
+}
+function createMobileAuthHandlers(options) {
+	let servicePromise = null;
+	const getService = () => {
+		servicePromise ??= MobileAuthService.create(options).catch((error) => {
+			servicePromise = null;
+			throw error;
+		});
+		return servicePromise;
+	};
+	const authStart = async (event) => {
+		try {
+			const service = await getService();
+			const body = await readJsonBody(event);
+			return jsonResponse$2(await service.start(parseStartRequest(body)));
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const authComplete = async (event) => {
+		try {
+			const service = await getService();
+			const body = await readJsonBody(event);
+			return jsonResponse$2(await service.complete(parseCompleteRequest(body), {
+				userAgent: event.request.headers.get("user-agent") ?? void 0,
+				ipAddress: clientAddress(event)
+			}));
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const sessionGet = async (event) => {
+		try {
+			return jsonResponse$2(await (await getService()).bootstrap(event.request.headers.get("authorization")));
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const sessionDelete = async (event) => {
+		try {
+			return jsonResponse$2(await (await getService()).logout(event.request.headers.get("authorization")));
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const withSession = async (event, fn) => {
+		try {
+			const service = await getService();
+			const token = readMobileBearerToken(event.request.headers.get("authorization"));
+			if (!token) throw new MobileAuthError(401, "missing_bearer_token", "Missing mobile bearer token.");
+			return await withSessionPermissionContext({
+				...options,
+				sessionId: token,
+				sessionService: service.getSessionService(),
+				enterTenantContext: options.enterTenantContext ?? true,
+				postgresRls: options.postgresRls
+			}, async (context) => {
+				if (!context.session) throw new MobileAuthError(401, "invalid_bearer_token", "Invalid or expired mobile bearer token.");
+				populateLocals(event, context);
+				return withNoStoreDefault(await fn(event, context));
+			});
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	return {
+		authStart,
+		authComplete,
+		session: {
+			GET: sessionGet,
+			DELETE: sessionDelete
+		},
+		withSession,
+		guard: (fn) => (event) => withSession(event, fn),
+		getService
+	};
+}
+function resolveMobileUploadDedupKey(formData, headers, fieldName = "clientCaptureId") {
+	const field = formData?.get(fieldName);
+	if (typeof field === "string" && field.trim().length > 0) return field.trim();
+	const header = headers.get("idempotency-key")?.trim();
+	return header && header.length > 0 ? header : null;
+}
+//#endregion
 //#region src/sveltekit/resource-list-handler.ts
 var STANDARD_API_ACTIONS = [
 	"list",
@@ -805,6 +981,6 @@ var NO_STORE_HEADERS = {
 	pragma: "no-cache"
 };
 //#endregion
-export { InvalidBearerError, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, completeOidcLogin, createBearerSessionDeleteHandler, createOidcCallbackHandler, createOidcLoginHandler, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, switchSessionTenant };
+export { InvalidBearerError, MobileAuthError, MobileAuthService, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, completeOidcLogin, createBearerSessionDeleteHandler, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateMobileRedirectUri };
 
 //# sourceMappingURL=sveltekit.js.map