@kasuvia/sdk 0.0.1

package/src/services/auth.service.ts

@@ -0,0 +1,332 @@
+/**
+ * Customer auth service — all API calls scoped to this storefront's business tenant.
+ * Every request automatically receives:
+ *  - Authorization: Bearer <accessToken>   (from interceptors)
+ *  - X-Storefront-Key: <storefrontApiKey>  (from interceptors)
+ *
+ * The `tenant_id` field in login/register payloads is the permanent business_id (B-XXXXXXXX).
+ */
+import { authAxios, refreshAxios } from '../client/httpClient'
+import { tokenStore } from '../client/authClient'
+import { resetGraphQLClient } from '../client/graphqlClient'
+import { getRuntimeConfig } from '../config'
+import { logger } from '../utils/logger'
+import { mergeGuestCartIfPresent } from './cart.service'
+import type {
+  CustomerAuthResponse,
+  CustomerLoginPayload,
+  CustomerRegisterPayload,
+  LogoutPayload,
+  RefreshTokenResponse,
+  CustomerUser,
+  AuthUserResponse,
+  UpdateProfilePayload,
+} from '../types/auth'
+
+// ── Auth API Calls ────────────────────────────────────────────────────────────
+
+/**
+ * POST /auth/login/customer/
+ * The `tenant_id` is automatically filled from config.api.storefrontBusinessId.
+ */
+export async function loginCustomer(payload: Omit<CustomerLoginPayload, 'tenant_id'>): Promise<CustomerAuthResponse> {
+  const config = getRuntimeConfig()
+  const { data } = await authAxios.post<CustomerAuthResponse>('/auth/login/customer/', {
+    ...payload,
+    tenant_id: config.businessId,
+  })
+
+  tokenStore.setAccessToken(data.access)
+  tokenStore.setRefreshToken(data.refresh)
+  resetGraphQLClient()
+
+  // Merge guest cart after successful login
+  await mergeGuestCartIfPresent()
+
+  return data
+}
+
+/**
+ * POST /auth/register/customer/
+ * The `tenant_id` is automatically filled from config.api.storefrontBusinessId.
+ */
+export async function registerCustomer(payload: Omit<CustomerRegisterPayload, 'tenant_id'>): Promise<CustomerAuthResponse> {
+  const config = getRuntimeConfig()
+  const { data } = await authAxios.post<CustomerAuthResponse>('/auth/register/customer/', {
+    ...payload,
+    tenant_id: config.businessId,
+  })
+
+  tokenStore.setAccessToken(data.access)
+  tokenStore.setRefreshToken(data.refresh)
+  resetGraphQLClient()
+
+  // Merge guest cart after successful registration
+  await mergeGuestCartIfPresent()
+
+  return data
+}
+
+/** POST /auth/token/refresh/
+ * CRITICAL: Uses refreshAxios (no interceptors) to prevent interceptor recursion.
+ */
+export async function refreshToken(refresh: string): Promise<RefreshTokenResponse> {
+  const { data } = await refreshAxios.post<RefreshTokenResponse>('/auth/token/refresh/', { refresh })
+  return data
+}
+
+/** POST /auth/logout/ — revokes the server-side session. Always clears local tokens. */
+export async function logout(): Promise<void> {
+  const refresh = tokenStore.getRefreshToken()
+  const payload: LogoutPayload = refresh ? { refresh } : {}
+  try {
+    await authAxios.post('/auth/logout/', payload)
+  } catch {
+    // Swallow server errors (401 = already expired, network = offline).
+    // Local token cleanup in `finally` is what actually logs the user out.
+  } finally {
+    tokenStore.clearAll()
+    resetGraphQLClient()
+  }
+}
+
+/**
+ * Verify a social provider id_token (or access_token for Facebook) with the backend.
+ * The backend validates the token with the provider and creates/finds the customer.
+ *
+ * Industry-standard "ID Token Exchange" pattern:
+ *   1. Customer completes Google/Facebook sign-in on the storefront
+ *   2. Storefront receives an id_token / access_token from the provider
+ *   3. This function sends it to the backend for server-side verification
+ *   4. Backend returns our JWT tokens
+ */
+export async function verifySocialToken(
+  provider: 'google' | 'facebook',
+  token: string
+): Promise<CustomerAuthResponse> {
+  const config = getRuntimeConfig()
+  const { data } = await authAxios.post<CustomerAuthResponse>(
+    `/auth/social/verify/${provider}/`,
+    {
+      id_token: token,
+      storefront_key: config.storefrontApiKey,
+    }
+  )
+  tokenStore.setAccessToken(data.access)
+  tokenStore.setRefreshToken(data.refresh)
+  resetGraphQLClient()
+  return data
+}
+
+/** Decode a JWT payload without verifying signature (client-side use only). */
+function parseJwtPayload(token: string): Record<string, unknown> {
+  try {
+    return JSON.parse(atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')))
+  } catch {
+    return {}
+  }
+}
+
+function resolveProvider(data: Pick<AuthUserResponse, 'is_google_auth_enabled' | 'is_facebook_auth_enabled'>): CustomerUser['provider'] {
+  if (data.is_google_auth_enabled) return 'google'
+  if (data.is_facebook_auth_enabled) return 'facebook'
+  return 'email'
+}
+
+function resolveAvatar(profilePicture: unknown): string | null {
+  if (!profilePicture) return null
+  if (typeof profilePicture === 'string') return profilePicture
+  if (typeof profilePicture === 'object' && profilePicture !== null && 'url' in profilePicture) {
+    const url = (profilePicture as { url?: string }).url
+    return typeof url === 'string' ? url : null
+  }
+  return null
+}
+
+/** Map luxe-auth UserSerializer response to storefront CustomerUser. */
+export function mapAuthUserToCustomer(data: AuthUserResponse, provider?: CustomerUser['provider']): CustomerUser {
+  const firstname = data.profile?.firstname?.trim() || undefined
+  const lastname = data.profile?.lastname?.trim() || undefined
+  const phone = data.profile?.phone?.trim() || undefined
+
+  return {
+    id: String(data.id),
+    email: data.email,
+    firstname,
+    lastname,
+    phone,
+    full_name: buildFullName(firstname, lastname),
+    avatar: resolveAvatar(data.profile?.profile_picture),
+    provider: provider ?? resolveProvider(data),
+  }
+}
+
+function buildCustomerFromClaims(claims: Record<string, unknown>): CustomerUser {
+  const provider: CustomerUser['provider'] = claims.is_google_auth_enabled
+    ? 'google'
+    : claims.is_facebook_auth_enabled
+      ? 'facebook'
+      : 'email'
+
+  const jwtFullName = String(claims.full_name ?? claims.name ?? '').trim() || undefined
+  const { firstname: splitFirst, lastname: splitLast } = splitFullName(jwtFullName)
+
+  return {
+    id: String(claims.user_id ?? claims.sub ?? ''),
+    email: String(claims.email ?? ''),
+    firstname: splitFirst || undefined,
+    lastname: splitLast || undefined,
+    phone: String(claims.phone ?? '').trim() || undefined,
+    full_name: jwtFullName,
+    avatar: claims.avatar as string | null,
+    provider,
+  }
+}
+
+/** GET /auth/profile/ */
+export async function getMe(): Promise<CustomerUser> {
+  const { data } = await authAxios.get<AuthUserResponse>('/auth/profile/')
+  return mapAuthUserToCustomer(data)
+}
+
+/** GET /auth/profile/ - alias for getMe for backward compatibility */
+export async function getAuthUser(): Promise<AuthUserResponse> {
+  const { data } = await authAxios.get<AuthUserResponse>('/auth/profile/')
+  return data
+}
+
+/** PUT /auth/profile/ — update firstname, lastname, phone */
+export async function updateProfile(payload: UpdateProfilePayload): Promise<CustomerUser> {
+  const { data } = await authAxios.put<AuthUserResponse>('/auth/profile/', payload)
+  return mapAuthUserToCustomer(data)
+}
+
+let refreshPromise: Promise<{ user: CustomerUser; provider: CustomerUser['provider'] } | null> | null = null;
+
+/**
+ * Helper to classify error types for proper handling.
+ */
+function classifyError(error: unknown): { isNetworkError: boolean; isAuthError: boolean; isBlacklistedError: boolean } {
+  const err = error as { response?: { status?: number; data?: { detail?: string } }; code?: string; message?: string }
+  const isNetworkError = !!(!err.response && (err.code === 'ECONNABORTED' || err.code === 'ERR_NETWORK' || err.message?.includes('Network Error')))
+  const isAuthError = !!(err.response?.status === 401 || err.response?.status === 403)
+  const isBlacklistedError = !!(err.response?.data?.detail === 'Token is blacklisted' || err.message === 'Token is blacklisted')
+  return { isNetworkError, isAuthError, isBlacklistedError }
+}
+
+/**
+ * Helper to retry with exponential backoff for transient network errors.
+ */
+async function retryWithBackoff<T>(
+  fn: () => Promise<T>,
+  maxRetries: number = 2,
+  baseDelay: number = 1000
+): Promise<T> {
+  let lastError: unknown
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await fn()
+    } catch (error) {
+      lastError = error
+      const { isNetworkError, isAuthError } = classifyError(error)
+
+      // Only retry on network errors, not auth errors
+      if (!isNetworkError || isAuthError) {
+        throw error
+      }
+
+      // Don't retry on the last attempt
+      if (attempt === maxRetries) {
+        throw error
+      }
+
+      // Exponential backoff: 1s, 2s, 4s, etc.
+      const delay = baseDelay * Math.pow(2, attempt)
+      await new Promise(resolve => setTimeout(resolve, delay))
+    }
+  }
+  throw lastError
+}
+
+/**
+ * Silently refresh the access token on app boot.
+ * Builds CustomerUser from JWT claims — no additional profile API call needed.
+ * Returns null if no refresh token exists or if the refresh fails.
+ * Includes a concurrent lock to prevent React Strict Mode from double-firing and blacklisting the token.
+ * 
+ * Network error resilience:
+ * - Classifies errors as network vs auth
+ * - Retries transient network errors with exponential backoff
+ * - Immediately fails on auth errors (401/403) to avoid infinite loops
+ * - Clears auth state on any failure to ensure consistent logout behavior
+ */
+export async function silentRefresh(): Promise<{ user: CustomerUser; provider: CustomerUser['provider'] } | null> {
+  const refresh = tokenStore.getRefreshToken()
+  if (!refresh) return null
+
+  if (refreshPromise) return refreshPromise;
+
+  refreshPromise = (async () => {
+    try {
+      // Use retry with backoff for network resilience
+      const tokens = await retryWithBackoff(() => refreshToken(refresh), 2, 1000)
+
+      tokenStore.setAccessToken(tokens.access)
+      if (tokens.refresh) tokenStore.setRefreshToken(tokens.refresh, tokenStore.isPersistent())
+
+      // Decode user identity from the new access token — avoids a fragile /profile/ round-trip
+      const claims = parseJwtPayload(tokens.access)
+      const user = buildCustomerFromClaims(claims)
+
+      return { user, provider: user.provider }
+    } catch (error: unknown) {
+      const { isNetworkError, isAuthError, isBlacklistedError } = classifyError(error)
+
+      if (isNetworkError) {
+        logger.warn('[silentRefresh] Network error during token refresh (offline/CORS), clearing session:', error)
+      } else if (isBlacklistedError) {
+        logger.log('[silentRefresh] Token was blacklisted (likely from logout), clearing session')
+      } else if (isAuthError) {
+        logger.log('[silentRefresh] Token refresh failed with auth error (expired/invalid), clearing session')
+      } else {
+        logger.error('[silentRefresh] Unexpected error during token refresh, clearing session:', error)
+      }
+
+      // CRITICAL: Clear auth state immediately on ANY refresh failure
+      // This prevents partial session state and ensures consistent logout behavior
+      tokenStore.clearAll()
+      return null
+    } finally {
+      refreshPromise = null;
+    }
+  })();
+
+  return refreshPromise;
+}
+
+/** Store tokens after OAuth callback or login/register response. */
+export function storeTokens(access: string, refresh: string, remember = true): void {
+  tokenStore.setAccessToken(access)
+  tokenStore.setRefreshToken(refresh, remember)
+}
+
+// ── Helper Functions ─────────────────────────────────────────────────────────
+
+function buildFullName(firstname?: string, lastname?: string): string {
+  if (firstname && lastname) return `${firstname} ${lastname}`
+  return firstname || lastname || ''
+}
+
+function splitFullName(fullName?: string): { firstname: string; lastname: string } {
+  if (!fullName) return { firstname: '', lastname: '' }
+
+  const parts = fullName.trim().split(/\s+/)
+  if (parts.length === 1) {
+    return { firstname: parts[0], lastname: '' }
+  }
+
+  return {
+    firstname: parts[0],
+    lastname: parts.slice(1).join(' ')
+  }
+}

package/src/services/bespoke.service.ts

@@ -0,0 +1,17 @@
+/**
+ * Bespoke Service
+ * 
+ * Handles bespoke product availability checks.
+ */
+import { storeManagementAxios } from '../client/httpClient'
+import type { BespokeAvailability } from '../types/consultations'
+
+export async function checkAvailability(product_id: string): Promise<BespokeAvailability> {
+  const { data } = await storeManagementAxios.get<BespokeAvailability>(`bespoke/availability/${product_id}`)
+  return data
+}
+
+// Service object export for backward compatibility
+export const bespokeService = {
+  checkAvailability,
+}

package/src/services/cart.service.ts

@@ -0,0 +1,245 @@
+/**
+ * Cart Service
+ * 
+ * Handles cart operations for both guest and authenticated users.
+ */
+import { storeManagementAxios, getOrCreateGuestSessionId, getGuestSessionId, clearGuestSessionId } from '../client/httpClient'
+import type { CartItem, CartResponse } from '../types/store'
+
+const GUEST_SESSION_COOKIE = "luxe_guest_sid"
+const GUEST_CART_TTL_DAYS = 7
+
+function parseItems(items: CartItem[]): CartItem[] {
+  return items.map((item) => ({
+    ...item,
+    variant_attributes:
+      item.variant_attributes && typeof item.variant_attributes === "string"
+        ? JSON.parse(item.variant_attributes)
+        : item.variant_attributes,
+  }));
+}
+
+/**
+ * Fetch guest cart from backend (Redis-backed).
+ */
+export async function getGuestCart(): Promise<CartItem[]> {
+  const sid = getGuestSessionId()
+  if (!sid) return []
+
+  try {
+    const { data } = await storeManagementAxios.get<CartResponse>("cart/", {
+      headers: { "X-Guest-Session": sid },
+    })
+    return parseItems(data.items || [])
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Add item to guest cart (Redis-backed).
+ */
+export async function addToGuestCart(item: CartItem): Promise<CartItem[]> {
+  const sid = getOrCreateGuestSessionId()
+  if (!sid) return []
+
+  const payload = {
+    product_id: item.product_id,
+    product_slug: item.product_slug,
+    product_name: item.product_name,
+    image: item.image,
+    variant_id: item.variant_id,
+    variant_attributes:
+      typeof item.variant_attributes === "string"
+        ? item.variant_attributes
+        : JSON.stringify(item.variant_attributes),
+    unit_price: item.unit_price,
+    quantity: item.quantity,
+    custom_measurements: item.custom_measurements,
+    is_bespoke: item.is_bespoke,
+  }
+
+  const { data } = await storeManagementAxios.post<CartResponse>("cart/", payload, {
+    headers: { "X-Guest-Session": sid },
+  })
+  return parseItems(data.items || [])
+}
+
+/**
+ * Update quantity of a guest cart item.
+ */
+export async function updateGuestCartItemQuantity(
+  itemId: string,
+  quantity: number
+): Promise<CartItem[]> {
+  const sid = getGuestSessionId()
+  if (!sid) return []
+
+  const { data } = await storeManagementAxios.patch<CartResponse>(
+    `cart/${itemId}`,
+    { quantity },
+    { headers: { "X-Guest-Session": sid } }
+  )
+  return parseItems(data.items || [])
+}
+
+/**
+ * Remove an item from the guest cart.
+ */
+export async function removeFromGuestCart(itemId: string): Promise<CartItem[]> {
+  const sid = getGuestSessionId()
+  if (!sid) return []
+
+  await storeManagementAxios.delete(`cart/${itemId}`, {
+    headers: { "X-Guest-Session": sid },
+  })
+
+  return getGuestCart()
+}
+
+/**
+ * Clear the entire guest cart.
+ */
+export async function clearGuestCart(): Promise<void> {
+  const sid = getGuestSessionId()
+  if (!sid) return
+
+  await storeManagementAxios.delete("cart/clear", {
+    headers: { "X-Guest-Session": sid },
+  })
+}
+
+/**
+ * Fetch authenticated user's cart from backend.
+ */
+export async function getCart(): Promise<CartResponse> {
+  const { data } = await storeManagementAxios.get<CartResponse>("cart/")
+  const parsedItems = parseItems(data.items || [])
+  return { ...data, items: parsedItems }
+}
+
+/**
+ * Add item to authenticated user's cart.
+ */
+export async function addToCart(item: {
+  product_id: string
+  product_slug: string
+  product_name: string
+  image?: string
+  variant_id?: string
+  variant_attributes?: string
+  unit_price: number
+  quantity: number
+  custom_measurements?: string
+  is_bespoke: boolean
+}): Promise<CartResponse> {
+  const { data } = await storeManagementAxios.post<CartResponse>("cart/", item)
+  const parsedItems = parseItems(data.items || [])
+  return { ...data, items: parsedItems }
+}
+
+/**
+ * Update item quantity in authenticated user's cart.
+ */
+export async function updateCartItem(
+  itemId: string,
+  quantity: number
+): Promise<CartResponse> {
+  const { data } = await storeManagementAxios.patch<CartResponse>(
+    `cart/${itemId}`,
+    { quantity }
+  )
+  const parsedItems = parseItems(data.items || [])
+  return { ...data, items: parsedItems }
+}
+
+/**
+ * Remove item from authenticated user's cart.
+ */
+export async function removeFromCart(itemId: string): Promise<CartResponse> {
+  await storeManagementAxios.delete(`cart/${itemId}`)
+  return getCart()
+}
+
+/**
+ * Clear authenticated user's cart.
+ */
+export async function clearCart(): Promise<void> {
+  await storeManagementAxios.delete("cart/clear")
+}
+
+/**
+ * Merge guest cart (from Redis) into authenticated user's DB cart.
+ */
+export async function mergeGuestCart(): Promise<CartResponse> {
+  const sid = getGuestSessionId()
+  const guestItems = sid ? await getGuestCart() : []
+  
+  if (guestItems.length === 0) {
+    return getCart()
+  }
+
+  const payloadItems = guestItems.map((item) => ({
+    product_id: item.product_id,
+    product_slug: item.product_slug,
+    product_name: item.product_name,
+    image: item.image,
+    variant_id: item.variant_id,
+    variant_attributes:
+      typeof item.variant_attributes === "string"
+        ? item.variant_attributes
+        : JSON.stringify(item.variant_attributes ?? {}),
+    unit_price: item.unit_price,
+    quantity: item.quantity,
+    custom_measurements:
+      typeof item.custom_measurements === "string"
+        ? item.custom_measurements
+        : JSON.stringify(item.custom_measurements ?? {}),
+    is_bespoke: item.is_bespoke,
+  }))
+
+  const { data } = await storeManagementAxios.post<CartResponse>(
+    "cart/merge",
+    { items: payloadItems },
+    sid ? { headers: { "X-Guest-Session": sid } } : {}
+  )
+
+  clearGuestSessionId()
+  return { ...data, items: parseItems(data.items || []) }
+}
+
+/**
+ * Convenience wrapper: merge guest cart if it has items (called post-login).
+ */
+export async function mergeGuestCartIfPresent(): Promise<void> {
+  try {
+    const guestItems = await getGuestCart()
+    if (guestItems.length === 0) return
+    await mergeGuestCart()
+  } catch (error) {
+    console.warn("[Cart] Failed to merge guest cart:", error)
+  }
+}
+
+/**
+ * Returns 0 — count is now server-driven. Use the hook instead.
+ * Kept for backward compatibility.
+ */
+export function getGuestCartCount(): number {
+  return 0
+}
+
+/**
+ * Returns 0 — subtotal is now server-driven.
+ * Kept for backward compatibility.
+ */
+export function getGuestCartSubtotal(): number {
+  return 0
+}
+
+/**
+ * Derive product type from items (guest cart, no backend lookup needed).
+ */
+export function getGuestCartProductType(): "physical" | "digital" | "bespoke" {
+  return "physical"
+}

package/src/services/cms.service.ts

@@ -0,0 +1,112 @@
+/**
+ * CMS Service
+ * 
+ * Handles CMS model and entry operations using the kasuvia-cms SDK endpoints.
+ * Protected by X-Storefront-Key and X-Business-ID headers.
+ */
+import { cmsAxios } from '../client/httpClient'
+import { getRuntimeConfig } from '../config'
+import type {
+  CmsEntry,
+  CmsEntryListResponse,
+  CreateCmsEntryParams,
+  UpdateCmsEntryParams,
+  ListCmsEntriesParams,
+} from '../types/cms'
+
+/**
+ * List CMS entries for a specific model.
+ * Requires public_api.read permission on the model.
+ */
+export async function listCmsEntries(
+  modelSlug: string,
+  params?: ListCmsEntriesParams
+): Promise<CmsEntryListResponse> {
+  const config = getRuntimeConfig()
+  const { businessId } = config
+
+  const response = await cmsAxios.get<CmsEntryListResponse>(
+    `/sdk/${businessId}/${modelSlug}/entries`,
+    {
+      params: {
+        page: params?.page || 1,
+        page_size: params?.page_size || 50,
+      },
+    }
+  )
+
+  return response.data
+}
+
+/**
+ * Get a single CMS entry by ID.
+ * Requires public_api.read permission on the model.
+ */
+export async function getCmsEntry(
+  modelSlug: string,
+  entryId: string
+): Promise<CmsEntry> {
+  const config = getRuntimeConfig()
+  const { businessId } = config
+
+  const response = await cmsAxios.get<CmsEntry>(
+    `/sdk/${businessId}/${modelSlug}/entries/${entryId}`
+  )
+
+  return response.data
+}
+
+/**
+ * Create a new CMS entry.
+ * Requires public_api.create permission on the model.
+ */
+export async function createCmsEntry(
+  modelSlug: string,
+  params: CreateCmsEntryParams
+): Promise<CmsEntry> {
+  const config = getRuntimeConfig()
+  const { businessId } = config
+
+  const response = await cmsAxios.post<CmsEntry>(
+    `/sdk/${businessId}/${modelSlug}/entries`,
+    params
+  )
+
+  return response.data
+}
+
+/**
+ * Update an existing CMS entry.
+ * Requires public_api.update permission on the model.
+ */
+export async function updateCmsEntry(
+  modelSlug: string,
+  entryId: string,
+  params: UpdateCmsEntryParams
+): Promise<CmsEntry> {
+  const config = getRuntimeConfig()
+  const { businessId } = config
+
+  const response = await cmsAxios.put<CmsEntry>(
+    `/sdk/${businessId}/${modelSlug}/entries/${entryId}`,
+    params
+  )
+
+  return response.data
+}
+
+/**
+ * Delete a CMS entry.
+ * Requires public_api.delete permission on the model.
+ */
+export async function deleteCmsEntry(
+  modelSlug: string,
+  entryId: string
+): Promise<void> {
+  const config = getRuntimeConfig()
+  const { businessId } = config
+
+  await cmsAxios.delete(
+    `/sdk/${businessId}/${modelSlug}/entries/${entryId}`
+  )
+}