@insforge/sdk 1.3.0-ssr.0 → 1.3.0-ssr.2

package/dist/ssr.mjs

@@ -2621,26 +2621,6 @@ function isJwtExpiredOrExpiring(token, leewaySeconds = 60) {
   return expires.getTime() <= Date.now() + leewaySeconds * 1e3;
 }
 
-// src/ssr/config.ts
-function env(name) {
-  if (typeof process === "undefined") return void 0;
-  return process.env[name];
-}
-function resolveBrowserConfig(config = {}) {
-  return {
-    ...config,
-    baseUrl: config.baseUrl ?? env("NEXT_PUBLIC_INSFORGE_URL"),
-    anonKey: config.anonKey ?? env("NEXT_PUBLIC_INSFORGE_ANON_KEY")
-  };
-}
-function resolveServerConfig(config = {}) {
-  return {
-    ...config,
-    baseUrl: config.baseUrl ?? env("INSFORGE_URL") ?? env("NEXT_PUBLIC_INSFORGE_URL"),
-    anonKey: config.anonKey ?? env("INSFORGE_ANON_KEY") ?? env("NEXT_PUBLIC_INSFORGE_ANON_KEY")
-  };
-}
-
 // src/ssr/browser-client.ts
 import { ERROR_CODES as ERROR_CODES2 } from "@insforge/shared-schemas";
 
@@ -2717,11 +2697,11 @@ function setCookie(cookies, name, value, options) {
 }
 function deleteCookie(cookies, name, options) {
   if (!cookies) return;
-  if (cookies.delete) {
-    cookies.delete(name, options);
+  if (cookies.set) {
+    cookies.set(name, "", expiredCookieOptions(options));
     return;
   }
-  cookies.set?.(name, "", expiredCookieOptions(options));
+  cookies.delete?.(name);
 }
 function serializeCookie(name, value, options = {}) {
   const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
@@ -2740,32 +2720,17 @@ function serializeCookie(name, value, options = {}) {
 function appendSetCookie(headers, name, value, options) {
   headers.append("Set-Cookie", serializeCookie(name, value, options));
 }
-function setAuthCookies(target, tokens, settings = {}) {
+function setAuthCookies(cookies, tokens, settings = {}) {
   const accessName = getAccessTokenCookieName(settings.names);
   const refreshName = getRefreshTokenCookieName(settings.names);
   const accessOptions = accessTokenCookieOptions(
     tokens.accessToken,
     settings.options?.accessToken
   );
-  if (target instanceof Headers) {
-    appendSetCookie(target, accessName, tokens.accessToken, accessOptions);
-    if (tokens.refreshToken) {
-      appendSetCookie(
-        target,
-        refreshName,
-        tokens.refreshToken,
-        refreshTokenCookieOptions(
-          tokens.refreshToken,
-          settings.options?.refreshToken
-        )
-      );
-    }
-    return;
-  }
-  setCookie(target, accessName, tokens.accessToken, accessOptions);
+  setCookie(cookies, accessName, tokens.accessToken, accessOptions);
   if (tokens.refreshToken) {
     setCookie(
-      target,
+      cookies,
       refreshName,
       tokens.refreshToken,
       refreshTokenCookieOptions(
@@ -2775,18 +2740,48 @@ function setAuthCookies(target, tokens, settings = {}) {
     );
   }
 }
-function clearAuthCookies(target, settings = {}) {
+function clearAuthCookies(cookies, settings = {}) {
   const accessName = getAccessTokenCookieName(settings.names);
   const refreshName = getRefreshTokenCookieName(settings.names);
   const accessOptions = expiredCookieOptions(settings.options?.accessToken);
   const refreshOptions = expiredCookieOptions(settings.options?.refreshToken);
-  if (target instanceof Headers) {
-    appendSetCookie(target, accessName, "", accessOptions);
-    appendSetCookie(target, refreshName, "", refreshOptions);
-    return;
+  deleteCookie(cookies, accessName, accessOptions);
+  deleteCookie(cookies, refreshName, refreshOptions);
+}
+function setAuthCookieHeaders(headers, tokens, settings = {}) {
+  const accessName = getAccessTokenCookieName(settings.names);
+  const refreshName = getRefreshTokenCookieName(settings.names);
+  appendSetCookie(
+    headers,
+    accessName,
+    tokens.accessToken,
+    accessTokenCookieOptions(tokens.accessToken, settings.options?.accessToken)
+  );
+  if (tokens.refreshToken) {
+    appendSetCookie(
+      headers,
+      refreshName,
+      tokens.refreshToken,
+      refreshTokenCookieOptions(
+        tokens.refreshToken,
+        settings.options?.refreshToken
+      )
+    );
   }
-  deleteCookie(target, accessName, accessOptions);
-  deleteCookie(target, refreshName, refreshOptions);
+}
+function clearAuthCookieHeaders(headers, settings = {}) {
+  appendSetCookie(
+    headers,
+    getAccessTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.accessToken)
+  );
+  appendSetCookie(
+    headers,
+    getRefreshTokenCookieName(settings.names),
+    "",
+    expiredCookieOptions(settings.options?.refreshToken)
+  );
 }
 
 // src/ssr/browser-client.ts
@@ -2835,6 +2830,17 @@ function withAuthHeader(init, token) {
   };
 }
 function createBrowserClient(options = {}) {
+  let { baseUrl, anonKey } = options;
+  try {
+    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
+    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
+  } catch {
+  }
+  if (!baseUrl || !anonKey) {
+    throw new Error(
+      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to createBrowserClient() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
+    );
+  }
   let accessToken = getBrowserCookie(
     getAccessTokenCookieName(options.names)
   );
@@ -2911,7 +2917,9 @@ function createBrowserClient(options = {}) {
     return fetchImpl(input, withAuthHeader(init, refreshed.accessToken));
   };
   client = new InsForgeClient({
-    ...resolveBrowserConfig(options),
+    ...options,
+    baseUrl,
+    anonKey,
     fetch: ssrFetch
   });
   const setAccessToken = client.setAccessToken.bind(client);
@@ -2930,12 +2938,25 @@ function createBrowserClient(options = {}) {
 
 // src/ssr/server-client.ts
 function createServerClient(options = {}) {
+  let { baseUrl, anonKey } = options;
+  try {
+    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
+    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
+  } catch {
+  }
+  if (!baseUrl || !anonKey) {
+    throw new Error(
+      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to createServerClient() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
+    );
+  }
   const accessToken = options.accessToken ?? getCookieValue(
     options.cookies,
     getAccessTokenCookieName(options.names)
   );
   return new InsForgeClient({
-    ...resolveServerConfig(options),
+    ...options,
+    baseUrl,
+    anonKey,
     isServerMode: true,
     edgeFunctionToken: accessToken ?? void 0
   });
@@ -2952,12 +2973,25 @@ function jsonResponse(body, init = {}, headers = new Headers(init.headers)) {
 }
 function normalizeError(error) {
   if (error instanceof InsForgeError) return error;
+  if (error && typeof error === "object") {
+    const body = error;
+    return new InsForgeError(
+      typeof body.message === "string" ? body.message : "Failed to refresh auth session",
+      typeof body.statusCode === "number" ? body.statusCode : 500,
+      typeof body.error === "string" ? body.error : ERROR_CODES3.UNKNOWN_ERROR
+    );
+  }
   return new InsForgeError(
     error instanceof Error ? error.message : "Failed to refresh auth session",
     500,
     ERROR_CODES3.UNKNOWN_ERROR
   );
 }
+async function readJson(response) {
+  const contentType = response.headers.get("content-type");
+  if (!contentType?.includes("json")) return null;
+  return response.json();
+}
 function readRefreshToken(options) {
   if (options.refreshToken) return options.refreshToken;
   const refreshCookieName = getRefreshTokenCookieName(options.names);
@@ -2972,7 +3006,7 @@ async function refreshAuth(options = {}) {
   const headers = new Headers();
   const refreshToken = readRefreshToken(options);
   if (!refreshToken) {
-    clearAuthCookies(headers, options);
+    clearAuthCookieHeaders(headers, options);
     const error2 = new InsForgeError(
       "Refresh token cookie is missing",
       401,
@@ -2994,13 +3028,55 @@ async function refreshAuth(options = {}) {
       error: error2
     };
   }
-  const client = new InsForgeClient({
-    ...resolveServerConfig(options),
-    isServerMode: true
-  });
-  const { data, error } = await client.auth.refreshSession({ refreshToken });
+  let { baseUrl, anonKey } = options;
+  try {
+    baseUrl || (baseUrl = process.env.NEXT_PUBLIC_INSFORGE_URL);
+    anonKey || (anonKey = process.env.NEXT_PUBLIC_INSFORGE_ANON_KEY);
+  } catch {
+  }
+  if (!baseUrl || !anonKey) {
+    throw new Error(
+      "Missing InsForge baseUrl or anonKey. Pass baseUrl and anonKey to refreshAuth() or set NEXT_PUBLIC_INSFORGE_URL and NEXT_PUBLIC_INSFORGE_ANON_KEY."
+    );
+  }
+  const fetchImpl = options.fetch ?? (globalThis.fetch ? globalThis.fetch.bind(globalThis) : void 0);
+  if (!fetchImpl) {
+    throw new Error(
+      "Fetch is not available. Please provide a fetch implementation."
+    );
+  }
+  const requestHeaders = new Headers(options.headers);
+  requestHeaders.set("Authorization", `Bearer ${anonKey}`);
+  requestHeaders.set("Content-Type", "application/json");
+  requestHeaders.set("Accept", "application/json");
+  let data = null;
+  let error = null;
+  try {
+    const response = await fetchImpl(
+      new URL("/api/auth/refresh?client_type=mobile", baseUrl).toString(),
+      {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify({ refresh_token: refreshToken })
+      }
+    );
+    const body = await readJson(response);
+    if (!response.ok) {
+      error = normalizeError(
+        body ?? {
+          message: "Failed to refresh auth session",
+          statusCode: response.status,
+          error: ERROR_CODES3.UNKNOWN_ERROR
+        }
+      );
+    } else {
+      data = body;
+    }
+  } catch (caught) {
+    error = normalizeError(caught);
+  }
   if (error || !data?.accessToken) {
-    clearAuthCookies(headers, options);
+    clearAuthCookieHeaders(headers, options);
     const normalized = normalizeError(error);
     return {
       response: jsonResponse(
@@ -3019,7 +3095,7 @@ async function refreshAuth(options = {}) {
     };
   }
   const nextRefreshToken = data.refreshToken ?? refreshToken;
-  setAuthCookies(
+  setAuthCookieHeaders(
     headers,
     {
       accessToken: data.accessToken,