@insforge/sdk 1.4.1 → 1.4.3

package/dist/ssr.js

@@ -34,6 +34,7 @@ __export(ssr_exports, {
   DEFAULT_REFRESH_TOKEN_COOKIE: () => DEFAULT_REFRESH_TOKEN_COOKIE,
   accessTokenCookieOptions: () => accessTokenCookieOptions,
   clearAuthCookies: () => clearAuthCookies,
+  createAuthActions: () => createAuthActions,
   createBrowserClient: () => createBrowserClient,
   createRefreshAuthRouter: () => createRefreshAuthRouter,
   createServerClient: () => createServerClient,
@@ -881,19 +882,32 @@ var HttpClient = class {
 
 // src/modules/auth/helpers.ts
 var PKCE_VERIFIER_KEY = "insforge_pkce_verifier";
+async function getWebCrypto() {
+  const webCrypto = globalThis.crypto;
+  if (typeof webCrypto?.getRandomValues === "function" && webCrypto.subtle) {
+    return webCrypto;
+  }
+  if (typeof process !== "undefined" && process.versions?.node) {
+    const { webcrypto } = await import("crypto");
+    return webcrypto;
+  }
+  throw new Error("Web Crypto API is not available in this environment");
+}
 function base64UrlEncode(buffer) {
   const base64 = btoa(String.fromCharCode(...buffer));
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function generateCodeVerifier() {
+async function generateCodeVerifier() {
+  const webCrypto = await getWebCrypto();
   const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
+  webCrypto.getRandomValues(array);
   return base64UrlEncode(array);
 }
 async function generateCodeChallenge(verifier) {
+  const webCrypto = await getWebCrypto();
   const encoder = new TextEncoder();
   const data = encoder.encode(verifier);
-  const hash = await crypto.subtle.digest("SHA-256", data);
+  const hash = await webCrypto.subtle.digest("SHA-256", data);
   return base64UrlEncode(new Uint8Array(hash));
 }
 function storePkceVerifier(verifier) {
@@ -940,7 +954,7 @@ var Auth = class {
     this.http = http;
     this.tokenManager = tokenManager;
     this.options = options;
-    this.authCallbackHandled = this.detectAuthCallback();
+    this.authCallbackHandled = options.detectOAuthCallback === false ? Promise.resolve() : this.detectAuthCallback();
   }
   isServerMode() {
     return !!this.options.isServerMode;
@@ -1037,10 +1051,16 @@ var Auth = class {
   async signOut() {
     try {
       try {
+        const serverMode = this.isServerMode();
+        const csrfToken = !serverMode ? getCsrfToken() : null;
         await this.http.post(
-          this.isServerMode() ? "/api/auth/logout?client_type=mobile" : "/api/auth/logout",
+          serverMode ? "/api/auth/logout?client_type=mobile" : "/api/auth/logout",
           void 0,
-          { credentials: "include", skipAuthRefresh: true }
+          {
+            credentials: "include",
+            skipAuthRefresh: true,
+            ...csrfToken ? { headers: { "X-CSRF-Token": csrfToken } } : {}
+          }
         );
       } catch {
       }
@@ -1086,7 +1106,7 @@ var Auth = class {
       }
       const { provider } = signInOptions;
       const providerKey = encodeURIComponent(provider.toLowerCase());
-      const codeVerifier = generateCodeVerifier();
+      const codeVerifier = await generateCodeVerifier();
       const codeChallenge = await generateCodeChallenge(codeVerifier);
       storePkceVerifier(codeVerifier);
       const params = {
@@ -1446,12 +1466,30 @@ function createInsForgePostgrestFetch(httpClient) {
   };
 }
 var Database = class {
-  constructor(httpClient) {
+  constructor(httpClient, defaultSchema) {
     this.postgrest = new import_postgrest_js.PostgrestClient("http://dummy", {
       fetch: createInsForgePostgrestFetch(httpClient),
-      headers: {}
+      headers: {},
+      ...defaultSchema ? { schema: defaultSchema } : {}
     });
   }
+  /**
+   * Select a non-default Postgres schema for the chained query. Maps to
+   * PostgREST's `Accept-Profile` (reads) / `Content-Profile` (writes) header.
+   * The schema must be exposed by the backend.
+   *
+   * @example
+   * const { data } = await client.database
+   *   .schema('analytics')
+   *   .from('events')
+   *   .select('*');
+   *
+   * @example
+   * await client.database.schema('analytics').rpc('rollup', { day: '2026-01-01' });
+   */
+  schema(schemaName) {
+    return this.postgrest.schema(schemaName);
+  }
   /**
    * Create a query builder for a table
    *
@@ -2808,9 +2846,10 @@ var InsForgeClient = class {
       this.tokenManager.setAccessToken(accessToken);
     }
     this.auth = new Auth(this.http, this.tokenManager, {
-      isServerMode: config.isServerMode ?? !!accessToken
+      isServerMode: config.isServerMode ?? !!accessToken,
+      detectOAuthCallback: config.auth?.detectOAuthCallback
     });
-    this.database = new Database(this.http);
+    this.database = new Database(this.http, config.db?.schema);
     this.storage = new Storage(this.http);
     this.ai = new AI(this.http);
     this.functions = new Functions(this.http, config.functionsUrl);
@@ -3217,7 +3256,10 @@ function createBrowserClient(options = {}) {
     fetch: ssrFetch,
     // Browser clients manage tokens via the refresh route, not a static
     // config token; shadow any untyped accessToken in the options spread.
-    accessToken: void 0
+    accessToken: void 0,
+    auth: {
+      detectOAuthCallback: false
+    }
   });
   const setAccessToken = client.setAccessToken.bind(client);
   client.setAccessToken = (token) => {
@@ -3422,6 +3464,109 @@ function createRefreshAuthRouter(options = {}) {
   };
 }
 
+// src/ssr/auth-actions.ts
+function persistSessionCookies(cookies, data, settings) {
+  if (!data?.accessToken) return;
+  setAuthCookies(
+    cookies,
+    {
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken
+    },
+    settings
+  );
+}
+function sanitizeAuthData(data) {
+  if (!data) return null;
+  const {
+    accessToken: _accessToken,
+    refreshToken: _refreshToken,
+    csrfToken: _csrfToken,
+    ...safeData
+  } = data;
+  return safeData;
+}
+function toSafeAuthResult(result) {
+  return {
+    data: sanitizeAuthData(result.data),
+    error: result.error
+  };
+}
+function createAuthActions(options = {}) {
+  const {
+    cookies,
+    requestCookies,
+    responseCookies,
+    names,
+    options: cookieOptions,
+    ...clientOptions
+  } = options;
+  const readCookies = requestCookies ?? cookies;
+  const writeCookies = responseCookies ?? cookies;
+  if (!writeCookies?.set) {
+    throw new Error(
+      "createAuthActions() requires a writable cookie store. Pass cookies in Server Actions or responseCookies in Route Handlers."
+    );
+  }
+  const cookieSettings = {
+    names,
+    options: cookieOptions
+  };
+  const createClient = () => createServerClient({
+    ...clientOptions,
+    names,
+    options: cookieOptions,
+    cookies: readCookies
+  });
+  return {
+    signUp: async (request) => {
+      const result = await createClient().auth.signUp(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(result);
+    },
+    signInWithPassword: async (request) => {
+      const result = await createClient().auth.signInWithPassword(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    signInWithOAuth: async (providerOrOptions, signInOptions) => {
+      return createClient().auth.signInWithOAuth(
+        providerOrOptions,
+        signInOptions
+      );
+    },
+    signInWithIdToken: async (credentials) => {
+      const result = await createClient().auth.signInWithIdToken(credentials);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    exchangeOAuthCode: async (code, codeVerifier) => {
+      const result = await createClient().auth.exchangeOAuthCode(
+        code,
+        codeVerifier
+      );
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(
+        result
+      );
+    },
+    verifyEmail: async (request) => {
+      const result = await createClient().auth.verifyEmail(request);
+      persistSessionCookies(writeCookies, result.data, cookieSettings);
+      return toSafeAuthResult(result);
+    },
+    signOut: async () => {
+      const result = await createClient().auth.signOut();
+      clearAuthCookies(writeCookies, cookieSettings);
+      return result;
+    }
+  };
+}
+
 // src/ssr/update-session.ts
 async function updateSession(options) {
   const accessCookieName = getAccessTokenCookieName(options.names);
@@ -3483,6 +3628,7 @@ async function updateSession(options) {
   DEFAULT_REFRESH_TOKEN_COOKIE,
   accessTokenCookieOptions,
   clearAuthCookies,
+  createAuthActions,
   createBrowserClient,
   createRefreshAuthRouter,
   createServerClient,