@kasuvia/sdk 0.0.1

package/src/client/authClient.ts

@@ -0,0 +1,135 @@
+/**
+ * Auth Client - Token Store and Refresh Logic
+ *
+ * - Access token: in-memory only (XSS protection)
+ * - Refresh token: localStorage (persists across page loads), keyed per tenant
+ */
+import axios from 'axios'
+import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
+
+let _accessToken: string | null = null
+let _isRefreshing = false
+let _pendingQueue: Array<{
+  resolve: (newAccessToken: string) => void
+  reject: (error: unknown) => void
+}> = []
+
+/**
+ * Returns a BID-prefixed key for storage isolation.
+ * Prevents data leakage when multiple storefronts run on the same domain.
+ */
+function getStorageKey(): string {
+  if (!isInitialized()) return 'kasuvia-sf-anon-refresh'
+  const config = getRuntimeConfig()
+  return `kasuvia-sf-${config.businessId}-refresh`
+}
+
+function drainQueue(error: unknown, newToken: string | null = null): void {
+  _pendingQueue.forEach(({ resolve, reject }) => {
+    if (newToken) resolve(newToken)
+    else reject(error)
+  })
+  _pendingQueue = []
+}
+
+export const tokenStore = {
+  getAccessToken: (): string | null => _accessToken,
+
+  setAccessToken: (token: string | null): void => {
+    _accessToken = token
+  },
+
+  getRefreshToken: (): string | null => {
+    if (typeof window === 'undefined') return null
+    const key = getStorageKey()
+    return localStorage.getItem(key) || sessionStorage.getItem(key)
+  },
+
+  setRefreshToken: (token: string | null, remember = true): void => {
+    if (typeof window === 'undefined') return
+    const key = getStorageKey()
+    localStorage.removeItem(key)
+    sessionStorage.removeItem(key)
+    if (token) {
+      const store = remember ? localStorage : sessionStorage
+      store.setItem(key, token)
+    }
+  },
+
+  clearAll: (): void => {
+    _accessToken = null
+    if (typeof window !== 'undefined') {
+      const key = getStorageKey()
+      localStorage.removeItem(key)
+      sessionStorage.removeItem(key)
+    }
+  },
+
+  hasSession: (): boolean => {
+    if (typeof window === 'undefined') return false
+    const key = getStorageKey()
+    return !!(localStorage.getItem(key) || sessionStorage.getItem(key))
+  },
+
+  isPersistent: (): boolean => {
+    if (typeof window === 'undefined') return true
+    const key = getStorageKey()
+    return !!localStorage.getItem(key)
+  },
+} as const
+
+/**
+ * Refresh-only Axios instance.
+ * CRITICAL: NO auth interceptors — avoids infinite recursion when the 401
+ * interceptor on authAxios calls refreshToken() and itself receives a 401.
+ * baseURL is set eagerly from the static BACKEND_URLS constant.
+ */
+const refreshAxios = axios.create({
+  baseURL: getBackendUrl('auth'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  withCredentials: true,
+  timeout: 30_000,
+})
+
+/**
+ * Perform token refresh with queue-coalescing to avoid parallel refresh races.
+ */
+export async function refreshToken(): Promise<string> {
+  if (_isRefreshing) {
+    // Queue subsequent callers so they all get the new token from a single refresh
+    return new Promise((resolve, reject) => {
+      _pendingQueue.push({ resolve, reject })
+    })
+  }
+
+  _isRefreshing = true
+
+  const refresh = tokenStore.getRefreshToken()
+  if (!refresh) {
+    _isRefreshing = false
+    tokenStore.clearAll()
+    throw new Error('[kasuvia SDK] No refresh token available')
+  }
+
+  try {
+    const { data } = await refreshAxios.post('/auth/token/refresh/', { refresh })
+    const newAccess: string = data.access
+    tokenStore.setAccessToken(newAccess)
+
+    if (data.refresh) {
+      tokenStore.setRefreshToken(data.refresh, tokenStore.isPersistent())
+    }
+
+    drainQueue(null, newAccess)
+    return newAccess
+  } catch (err) {
+    drainQueue(err)
+    tokenStore.clearAll()
+    throw err
+  } finally {
+    _isRefreshing = false
+  }
+}

package/src/client/graphqlClient.ts

@@ -0,0 +1,53 @@
+/**
+ * GraphQL Client
+ *
+ * Provides a GraphQL client with tenant and auth headers for product queries.
+ * The endpoint URL is derived from the static BACKEND_URLS constant (eager,
+ * module-load safe). Auth headers are injected fresh on each request via a
+ * factory so the token is always current.
+ */
+import { GraphQLClient } from 'graphql-request'
+import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
+import { tokenStore } from './authClient'
+
+const GRAPHQL_URL = `${getBackendUrl('store')}/graphql`
+
+/**
+ * Build fresh request headers.
+ * Called on every getGraphQLClient() so token changes are always reflected.
+ */
+function buildHeaders(): Record<string, string> {
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  }
+
+  if (isInitialized()) {
+    const config = getRuntimeConfig()
+    headers['X-Storefront-Key'] = config.storefrontApiKey
+    headers['X-Business-ID'] = config.businessId
+  }
+
+  const token = tokenStore.getAccessToken()
+  if (token) headers['Authorization'] = `Bearer ${token}`
+
+  return headers
+}
+
+/**
+ * Returns a GraphQL client instance with up-to-date auth headers.
+ * A new client is created on each call so token/config changes take effect
+ * immediately without requiring an explicit reset.
+ */
+export function getGraphQLClient(): GraphQLClient {
+  return new GraphQLClient(GRAPHQL_URL, { headers: buildHeaders() })
+}
+
+/**
+ * No-op — kept for backward compatibility.
+ * Clients are now stateless (created fresh on each call), so there is no
+ * cached instance to reset.
+ */
+export function resetGraphQLClient(): void {
+  // No-op: clients are built fresh on every call.
+}

package/src/client/httpClient.ts

@@ -0,0 +1,298 @@
+/**
+ * HTTP Client - Pre-configured Axios instances
+ *
+ * Each Axios instance is created with a default baseURL based on the static
+ * service URL. The baseURLs are complete URLs including the API version,
+ * selected based on the configured environment (development/production).
+ */
+import axios, { type AxiosInstance } from 'axios'
+import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
+import { tokenStore, refreshToken } from './authClient'
+
+// ── Guest session management ─────────────────────────────────────────────────
+
+let _guestSessionId: string | null = null
+
+export function getOrCreateGuestSessionId(): string {
+  if (_guestSessionId) return _guestSessionId
+
+  const storageKey = isInitialized()
+    ? `kasuvia-guest-${getRuntimeConfig().businessId}`
+    : 'kasuvia-guest-anon'
+
+  if (typeof window !== 'undefined') {
+    _guestSessionId = sessionStorage.getItem(storageKey) || crypto.randomUUID()
+    sessionStorage.setItem(storageKey, _guestSessionId)
+  } else {
+    _guestSessionId = crypto.randomUUID()
+  }
+
+  return _guestSessionId
+}
+
+export function getGuestSessionId(): string | null {
+  if (!_guestSessionId && typeof window !== 'undefined') {
+    const storageKey = isInitialized()
+      ? `kasuvia-guest-${getRuntimeConfig().businessId}`
+      : 'kasuvia-guest-anon'
+    _guestSessionId = sessionStorage.getItem(storageKey)
+  }
+  return _guestSessionId
+}
+
+export function clearGuestSessionId(): void {
+  _guestSessionId = null
+  if (typeof window !== 'undefined') {
+    const storageKey = isInitialized()
+      ? `kasuvia-guest-${getRuntimeConfig().businessId}`
+      : 'kasuvia-guest-anon'
+    sessionStorage.removeItem(storageKey)
+  }
+}
+
+// ── Store Management Axios ───────────────────────────────────────────────────
+
+export const storeManagementAxios = axios.create({
+  baseURL: getBackendUrl('store'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  timeout: 30_000,
+}) as AxiosInstance
+
+storeManagementAxios.interceptors.request.use((cfg) => {
+  const config = getRuntimeConfig()
+
+  const token = tokenStore.getAccessToken()
+  if (token) {
+    cfg.headers = cfg.headers ?? {}
+    cfg.headers['Authorization'] = `Bearer ${token}`
+  }
+
+  cfg.headers = cfg.headers ?? {}
+  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
+  cfg.headers['X-Business-ID'] = config.businessId
+
+  if (!token) {
+    const sid = getOrCreateGuestSessionId()
+    if (sid) cfg.headers['X-Guest-Session'] = sid
+  }
+
+  return cfg
+})
+
+storeManagementAxios.interceptors.response.use(
+  (res) => res,
+  async (err) => {
+    const originalRequest = err.config
+    if (!originalRequest) return Promise.reject(err)
+
+    const status = err.response?.status
+    const isUnauthorized = status === 401
+    const isRefreshEndpoint = originalRequest.url?.includes('/auth/token/refresh/')
+    const alreadyRetried = originalRequest._retry === true
+
+    if (isUnauthorized && isRefreshEndpoint) {
+      tokenStore.clearAll()
+      return Promise.reject(err)
+    }
+
+    if (!isUnauthorized || alreadyRetried) return Promise.reject(err)
+
+    try {
+      const newToken = await refreshToken()
+      originalRequest._retry = true
+      if (originalRequest.headers) {
+        originalRequest.headers['Authorization'] = `Bearer ${newToken}`
+      }
+      return storeManagementAxios(originalRequest)
+    } catch (refreshErr) {
+      tokenStore.clearAll()
+      return Promise.reject(refreshErr)
+    }
+  }
+)
+
+// ── Public Store Axios ───────────────────────────────────────────────────────
+
+export const publicStoreAxios = axios.create({
+  baseURL: getBackendUrl('store'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  timeout: 30_000,
+})
+
+publicStoreAxios.interceptors.request.use((cfg) => {
+  const config = getRuntimeConfig()
+  cfg.headers = cfg.headers ?? {}
+  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
+  cfg.headers['X-Business-ID'] = config.businessId
+  return cfg
+})
+
+publicStoreAxios.interceptors.response.use(
+  (res) => res,
+  (err) => Promise.reject(err)
+)
+
+// ── Auth Axios ───────────────────────────────────────────────────────────────
+
+export const authAxios = axios.create({
+  baseURL: getBackendUrl('auth'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  withCredentials: true,
+  timeout: 30_000,
+}) as AxiosInstance
+
+authAxios.interceptors.request.use((cfg) => {
+  const config = getRuntimeConfig()
+
+  const token = tokenStore.getAccessToken()
+  if (token) {
+    cfg.headers = cfg.headers ?? {}
+    cfg.headers['Authorization'] = `Bearer ${token}`
+  }
+
+  cfg.headers = cfg.headers ?? {}
+  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
+  cfg.headers['X-Business-ID'] = config.businessId
+
+  return cfg
+})
+
+authAxios.interceptors.response.use(
+  (res) => res,
+  async (err) => {
+    const originalRequest = err.config
+    if (!originalRequest) return Promise.reject(err)
+
+    const status = err.response?.status
+    const isUnauthorized = status === 401
+    const isRefreshEndpoint = originalRequest.url?.includes('/auth/token/refresh/')
+    const alreadyRetried = originalRequest._retry === true
+
+    if (isUnauthorized && isRefreshEndpoint) {
+      tokenStore.clearAll()
+      return Promise.reject(err)
+    }
+
+    if (!isUnauthorized || alreadyRetried) return Promise.reject(err)
+
+    try {
+      const newToken = await refreshToken()
+      originalRequest._retry = true
+      if (originalRequest.headers) {
+        originalRequest.headers['Authorization'] = `Bearer ${newToken}`
+      }
+      return authAxios(originalRequest)
+    } catch (refreshErr) {
+      tokenStore.clearAll()
+      return Promise.reject(refreshErr)
+    }
+  }
+)
+
+// ── Payment Axios ────────────────────────────────────────────────────────────
+
+export const paymentAxios = axios.create({
+  baseURL: getBackendUrl('payment'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  timeout: 30_000,
+})
+
+paymentAxios.interceptors.request.use((cfg) => {
+  const config = getRuntimeConfig()
+  cfg.headers = cfg.headers ?? {}
+  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
+  cfg.headers['X-Business-ID'] = config.businessId
+  return cfg
+})
+
+paymentAxios.interceptors.response.use(
+  (res) => res,
+  (err) => Promise.reject(err)
+)
+
+// ── Notifications Axios ──────────────────────────────────────────────────────
+
+export const notificationsAxios = axios.create({
+  baseURL: getBackendUrl('notifications'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  timeout: 30_000,
+})
+
+notificationsAxios.interceptors.response.use(
+  (res) => res,
+  (err) => Promise.reject(err)
+)
+
+// ── CMS Axios ───────────────────────────────────────────────────────────────
+
+export const cmsAxios = axios.create({
+  baseURL: getBackendUrl('cms'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  timeout: 30_000,
+})
+
+cmsAxios.interceptors.request.use((cfg) => {
+  const config = getRuntimeConfig()
+  cfg.headers = cfg.headers ?? {}
+  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
+  cfg.headers['X-Business-ID'] = config.businessId
+  return cfg
+})
+
+cmsAxios.interceptors.response.use(
+  (res) => res,
+  (err) => Promise.reject(err)
+)
+
+// ── Refresh Axios ────────────────────────────────────────────────────────────
+
+export const refreshAxios = axios.create({
+  baseURL: getBackendUrl('auth'),
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+  },
+  withCredentials: true,
+  timeout: 30_000,
+})
+
+/**
+ * configureHttpClients()
+ * Updates the baseURL of all Axios instances to match the configured environment.
+ * This must be called after initSdk() to ensure the correct environment URLs are used.
+ */
+export function configureHttpClients(): void {
+  if (!isInitialized()) return
+
+  const storeUrl = getBackendUrl('store')
+  const authUrl = getBackendUrl('auth')
+  const paymentUrl = getBackendUrl('payment')
+  const notificationsUrl = getBackendUrl('notifications')
+  const cmsUrl = getBackendUrl('cms')
+
+  storeManagementAxios.defaults.baseURL = storeUrl
+  publicStoreAxios.defaults.baseURL = storeUrl
+  authAxios.defaults.baseURL = authUrl
+  paymentAxios.defaults.baseURL = paymentUrl
+  notificationsAxios.defaults.baseURL = notificationsUrl
+  cmsAxios.defaults.baseURL = cmsUrl
+  refreshAxios.defaults.baseURL = authUrl
+}

package/src/config/index.ts

@@ -0,0 +1,102 @@
+/**
+ * Kasuvia SDK Configuration
+ * 
+ * This module manages SDK initialization and runtime configuration.
+ * The SDK is client-based and runs in the browser.
+ * All backend URLs are bundled with the SDK.
+ * 
+ * SECURITY NOTE: The storefront API key has limited permissions - it only provides
+ * customer-based resources from a business owner to customers, not full platform access.
+ * This key is safe to expose to the browser as a NEXT_PUBLIC_ environment variable.
+ */
+
+import { logger, setEnvironmentMode, setLoggerEnvironmentMode } from "../utils"
+
+export interface SdkConfig {
+  businessId: string
+  storefrontApiKey: string
+}
+
+interface SdkRuntimeConfig {
+  businessId: string
+  storefrontApiKey: string
+}
+
+let runtimeConfig: SdkRuntimeConfig | null = null
+
+/**
+ * Backend URLs - bundled with the SDK
+ * These are the complete URLs (including API version) that the SDK uses internally.
+ * The storefront never sees or configures these URLs.
+ * 
+ * Currently set to localhost development URLs.
+ * Update to production URLs when ready for deployment.
+ */
+const BACKEND_URLS = {
+  auth: 'https://127.0.0.1:8000/api/v1',
+  store: 'https://127.0.0.1:8001/api/v1',
+  payment: 'https://127.0.0.1:8002/api/v1',
+  notifications: 'https://127.0.0.1:8007/api/v1',
+  cms: 'https://127.0.0.1:8003/api/v1',
+} as const
+
+/**
+ * Initialize the SDK with runtime credentials
+ * This must be called before any SDK operations
+ * 
+ * IMPORTANT: In Next.js, this should be called in layout.tsx (server component)
+ * using private environment variables (kasuvia_BUSINESS_ID, kasuvia_STOREFRONT_API_KEY).
+ * The config is stored in module scope and will be available to client components
+ * through the SDK's bundled code.
+ * 
+ * @param config - SDK configuration including credentials
+ */
+export function initSdk(config: SdkConfig): void {
+  runtimeConfig = {
+    businessId: config.businessId,
+    storefrontApiKey: config.storefrontApiKey,
+  }
+  
+  // Determine environment from NODE_ENV for logging/cache behavior
+  // In browser (window exists), default to production behavior
+  // In Node.js (window undefined), check NODE_ENV
+  const isDevelopment = typeof window === 'undefined' && 
+    (globalThis as any).process?.env?.NODE_ENV === 'development'
+  setEnvironmentMode(isDevelopment)
+  setLoggerEnvironmentMode(isDevelopment)
+  
+  logger.log('SDK initialized with businessId:', config.businessId)
+}
+
+/**
+ * Get the current runtime configuration
+ * Throws if SDK is not initialized
+ */
+export function getRuntimeConfig(): SdkRuntimeConfig {
+  if (!runtimeConfig) {
+    throw new Error('SDK not initialized. Call initSdk() before using SDK functions.')
+  }
+  return runtimeConfig
+}
+
+/**
+ * Get backend URL for a specific service
+ * Internal use only - never exposed to storefront
+ */
+export function getBackendUrl(service: 'auth' | 'store' | 'payment' | 'notifications' | 'cms'): string {
+  return BACKEND_URLS[service]
+}
+
+/**
+ * Check if SDK is initialized
+ */
+export function isInitialized(): boolean {
+  return runtimeConfig !== null
+}
+
+/**
+ * Reset SDK configuration (mainly for testing)
+ */
+export function resetConfig(): void {
+  runtimeConfig = null
+}

package/src/graphql/collections.graphql.ts

@@ -0,0 +1,56 @@
+/**
+ * GraphQL queries for collections
+ */
+import { gql } from 'graphql-request'
+
+export const GET_STOREFRONT_COLLECTIONS = gql`
+  query GetStorefrontCollections($page: Int = 1, $pageSize: Int = 20) {
+    storefront_collections(page: $page, pageSize: $pageSize) {
+      items {
+        id
+        business_id
+        name
+        slug
+        description
+        collection_type
+        rules
+        image {
+          id
+          url
+          alt
+        }
+        status
+        sort_order
+        created_at
+        updated_at
+      }
+      total
+      page
+      page_size
+      total_pages
+    }
+  }
+`
+
+export const GET_STOREFRONT_COLLECTION_BY_SLUG = gql`
+  query GetStorefrontCollectionBySlug($slug: String!) {
+    storefront_collection_by_slug(slug: $slug) {
+      id
+      business_id
+      name
+      slug
+      description
+      collection_type
+      rules
+      image {
+        id
+        url
+        alt
+      }
+      status
+      sort_order
+      created_at
+      updated_at
+    }
+  }
+`

package/src/graphql/index.ts

@@ -0,0 +1,7 @@
+/**
+ * GraphQL Queries Barrel Export
+ */
+
+export * from './products.graphql'
+export * from './collections.graphql'
+export * from './wishlist.graphql'