@kasuvia/sdk 0.0.2 → 0.0.4

package/src/client/authClient.ts

@@ -1,135 +0,0 @@
-/**
- * Auth Client - Token Store and Refresh Logic
- *
- * - Access token: in-memory only (XSS protection)
- * - Refresh token: localStorage (persists across page loads), keyed per tenant
- */
-import axios from 'axios'
-import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
-
-let _accessToken: string | null = null
-let _isRefreshing = false
-let _pendingQueue: Array<{
-  resolve: (newAccessToken: string) => void
-  reject: (error: unknown) => void
-}> = []
-
-/**
- * Returns a BID-prefixed key for storage isolation.
- * Prevents data leakage when multiple storefronts run on the same domain.
- */
-function getStorageKey(): string {
-  if (!isInitialized()) return 'kasuvia-sf-anon-refresh'
-  const config = getRuntimeConfig()
-  return `kasuvia-sf-${config.businessId}-refresh`
-}
-
-function drainQueue(error: unknown, newToken: string | null = null): void {
-  _pendingQueue.forEach(({ resolve, reject }) => {
-    if (newToken) resolve(newToken)
-    else reject(error)
-  })
-  _pendingQueue = []
-}
-
-export const tokenStore = {
-  getAccessToken: (): string | null => _accessToken,
-
-  setAccessToken: (token: string | null): void => {
-    _accessToken = token
-  },
-
-  getRefreshToken: (): string | null => {
-    if (typeof window === 'undefined') return null
-    const key = getStorageKey()
-    return localStorage.getItem(key) || sessionStorage.getItem(key)
-  },
-
-  setRefreshToken: (token: string | null, remember = true): void => {
-    if (typeof window === 'undefined') return
-    const key = getStorageKey()
-    localStorage.removeItem(key)
-    sessionStorage.removeItem(key)
-    if (token) {
-      const store = remember ? localStorage : sessionStorage
-      store.setItem(key, token)
-    }
-  },
-
-  clearAll: (): void => {
-    _accessToken = null
-    if (typeof window !== 'undefined') {
-      const key = getStorageKey()
-      localStorage.removeItem(key)
-      sessionStorage.removeItem(key)
-    }
-  },
-
-  hasSession: (): boolean => {
-    if (typeof window === 'undefined') return false
-    const key = getStorageKey()
-    return !!(localStorage.getItem(key) || sessionStorage.getItem(key))
-  },
-
-  isPersistent: (): boolean => {
-    if (typeof window === 'undefined') return true
-    const key = getStorageKey()
-    return !!localStorage.getItem(key)
-  },
-} as const
-
-/**
- * Refresh-only Axios instance.
- * CRITICAL: NO auth interceptors — avoids infinite recursion when the 401
- * interceptor on authAxios calls refreshToken() and itself receives a 401.
- * baseURL is set eagerly from the static BACKEND_URLS constant.
- */
-const refreshAxios = axios.create({
-  baseURL: getBackendUrl('auth'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  withCredentials: true,
-  timeout: 30_000,
-})
-
-/**
- * Perform token refresh with queue-coalescing to avoid parallel refresh races.
- */
-export async function refreshToken(): Promise<string> {
-  if (_isRefreshing) {
-    // Queue subsequent callers so they all get the new token from a single refresh
-    return new Promise((resolve, reject) => {
-      _pendingQueue.push({ resolve, reject })
-    })
-  }
-
-  _isRefreshing = true
-
-  const refresh = tokenStore.getRefreshToken()
-  if (!refresh) {
-    _isRefreshing = false
-    tokenStore.clearAll()
-    throw new Error('[kasuvia SDK] No refresh token available')
-  }
-
-  try {
-    const { data } = await refreshAxios.post('/auth/token/refresh/', { refresh })
-    const newAccess: string = data.access
-    tokenStore.setAccessToken(newAccess)
-
-    if (data.refresh) {
-      tokenStore.setRefreshToken(data.refresh, tokenStore.isPersistent())
-    }
-
-    drainQueue(null, newAccess)
-    return newAccess
-  } catch (err) {
-    drainQueue(err)
-    tokenStore.clearAll()
-    throw err
-  } finally {
-    _isRefreshing = false
-  }
-}

package/src/client/graphqlClient.ts

@@ -1,53 +0,0 @@
-/**
- * GraphQL Client
- *
- * Provides a GraphQL client with tenant and auth headers for product queries.
- * The endpoint URL is derived from the static BACKEND_URLS constant (eager,
- * module-load safe). Auth headers are injected fresh on each request via a
- * factory so the token is always current.
- */
-import { GraphQLClient } from 'graphql-request'
-import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
-import { tokenStore } from './authClient'
-
-const GRAPHQL_URL = `${getBackendUrl('store')}/graphql`
-
-/**
- * Build fresh request headers.
- * Called on every getGraphQLClient() so token changes are always reflected.
- */
-function buildHeaders(): Record<string, string> {
-  const headers: Record<string, string> = {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  }
-
-  if (isInitialized()) {
-    const config = getRuntimeConfig()
-    headers['X-Storefront-Key'] = config.storefrontApiKey
-    headers['X-Business-ID'] = config.businessId
-  }
-
-  const token = tokenStore.getAccessToken()
-  if (token) headers['Authorization'] = `Bearer ${token}`
-
-  return headers
-}
-
-/**
- * Returns a GraphQL client instance with up-to-date auth headers.
- * A new client is created on each call so token/config changes take effect
- * immediately without requiring an explicit reset.
- */
-export function getGraphQLClient(): GraphQLClient {
-  return new GraphQLClient(GRAPHQL_URL, { headers: buildHeaders() })
-}
-
-/**
- * No-op — kept for backward compatibility.
- * Clients are now stateless (created fresh on each call), so there is no
- * cached instance to reset.
- */
-export function resetGraphQLClient(): void {
-  // No-op: clients are built fresh on every call.
-}

package/src/client/httpClient.ts

@@ -1,298 +0,0 @@
-/**
- * HTTP Client - Pre-configured Axios instances
- *
- * Each Axios instance is created with a default baseURL based on the static
- * service URL. The baseURLs are complete URLs including the API version,
- * selected based on the configured environment (development/production).
- */
-import axios, { type AxiosInstance } from 'axios'
-import { getRuntimeConfig, getBackendUrl, isInitialized } from '../config'
-import { tokenStore, refreshToken } from './authClient'
-
-// ── Guest session management ─────────────────────────────────────────────────
-
-let _guestSessionId: string | null = null
-
-export function getOrCreateGuestSessionId(): string {
-  if (_guestSessionId) return _guestSessionId
-
-  const storageKey = isInitialized()
-    ? `kasuvia-guest-${getRuntimeConfig().businessId}`
-    : 'kasuvia-guest-anon'
-
-  if (typeof window !== 'undefined') {
-    _guestSessionId = sessionStorage.getItem(storageKey) || crypto.randomUUID()
-    sessionStorage.setItem(storageKey, _guestSessionId)
-  } else {
-    _guestSessionId = crypto.randomUUID()
-  }
-
-  return _guestSessionId
-}
-
-export function getGuestSessionId(): string | null {
-  if (!_guestSessionId && typeof window !== 'undefined') {
-    const storageKey = isInitialized()
-      ? `kasuvia-guest-${getRuntimeConfig().businessId}`
-      : 'kasuvia-guest-anon'
-    _guestSessionId = sessionStorage.getItem(storageKey)
-  }
-  return _guestSessionId
-}
-
-export function clearGuestSessionId(): void {
-  _guestSessionId = null
-  if (typeof window !== 'undefined') {
-    const storageKey = isInitialized()
-      ? `kasuvia-guest-${getRuntimeConfig().businessId}`
-      : 'kasuvia-guest-anon'
-    sessionStorage.removeItem(storageKey)
-  }
-}
-
-// ── Store Management Axios ───────────────────────────────────────────────────
-
-export const storeManagementAxios = axios.create({
-  baseURL: getBackendUrl('store'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  timeout: 30_000,
-}) as AxiosInstance
-
-storeManagementAxios.interceptors.request.use((cfg) => {
-  const config = getRuntimeConfig()
-
-  const token = tokenStore.getAccessToken()
-  if (token) {
-    cfg.headers = cfg.headers ?? {}
-    cfg.headers['Authorization'] = `Bearer ${token}`
-  }
-
-  cfg.headers = cfg.headers ?? {}
-  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
-  cfg.headers['X-Business-ID'] = config.businessId
-
-  if (!token) {
-    const sid = getOrCreateGuestSessionId()
-    if (sid) cfg.headers['X-Guest-Session'] = sid
-  }
-
-  return cfg
-})
-
-storeManagementAxios.interceptors.response.use(
-  (res) => res,
-  async (err) => {
-    const originalRequest = err.config
-    if (!originalRequest) return Promise.reject(err)
-
-    const status = err.response?.status
-    const isUnauthorized = status === 401
-    const isRefreshEndpoint = originalRequest.url?.includes('/auth/token/refresh/')
-    const alreadyRetried = originalRequest._retry === true
-
-    if (isUnauthorized && isRefreshEndpoint) {
-      tokenStore.clearAll()
-      return Promise.reject(err)
-    }
-
-    if (!isUnauthorized || alreadyRetried) return Promise.reject(err)
-
-    try {
-      const newToken = await refreshToken()
-      originalRequest._retry = true
-      if (originalRequest.headers) {
-        originalRequest.headers['Authorization'] = `Bearer ${newToken}`
-      }
-      return storeManagementAxios(originalRequest)
-    } catch (refreshErr) {
-      tokenStore.clearAll()
-      return Promise.reject(refreshErr)
-    }
-  }
-)
-
-// ── Public Store Axios ───────────────────────────────────────────────────────
-
-export const publicStoreAxios = axios.create({
-  baseURL: getBackendUrl('store'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  timeout: 30_000,
-})
-
-publicStoreAxios.interceptors.request.use((cfg) => {
-  const config = getRuntimeConfig()
-  cfg.headers = cfg.headers ?? {}
-  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
-  cfg.headers['X-Business-ID'] = config.businessId
-  return cfg
-})
-
-publicStoreAxios.interceptors.response.use(
-  (res) => res,
-  (err) => Promise.reject(err)
-)
-
-// ── Auth Axios ───────────────────────────────────────────────────────────────
-
-export const authAxios = axios.create({
-  baseURL: getBackendUrl('auth'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  withCredentials: true,
-  timeout: 30_000,
-}) as AxiosInstance
-
-authAxios.interceptors.request.use((cfg) => {
-  const config = getRuntimeConfig()
-
-  const token = tokenStore.getAccessToken()
-  if (token) {
-    cfg.headers = cfg.headers ?? {}
-    cfg.headers['Authorization'] = `Bearer ${token}`
-  }
-
-  cfg.headers = cfg.headers ?? {}
-  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
-  cfg.headers['X-Business-ID'] = config.businessId
-
-  return cfg
-})
-
-authAxios.interceptors.response.use(
-  (res) => res,
-  async (err) => {
-    const originalRequest = err.config
-    if (!originalRequest) return Promise.reject(err)
-
-    const status = err.response?.status
-    const isUnauthorized = status === 401
-    const isRefreshEndpoint = originalRequest.url?.includes('/auth/token/refresh/')
-    const alreadyRetried = originalRequest._retry === true
-
-    if (isUnauthorized && isRefreshEndpoint) {
-      tokenStore.clearAll()
-      return Promise.reject(err)
-    }
-
-    if (!isUnauthorized || alreadyRetried) return Promise.reject(err)
-
-    try {
-      const newToken = await refreshToken()
-      originalRequest._retry = true
-      if (originalRequest.headers) {
-        originalRequest.headers['Authorization'] = `Bearer ${newToken}`
-      }
-      return authAxios(originalRequest)
-    } catch (refreshErr) {
-      tokenStore.clearAll()
-      return Promise.reject(refreshErr)
-    }
-  }
-)
-
-// ── Payment Axios ────────────────────────────────────────────────────────────
-
-export const paymentAxios = axios.create({
-  baseURL: getBackendUrl('payment'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  timeout: 30_000,
-})
-
-paymentAxios.interceptors.request.use((cfg) => {
-  const config = getRuntimeConfig()
-  cfg.headers = cfg.headers ?? {}
-  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
-  cfg.headers['X-Business-ID'] = config.businessId
-  return cfg
-})
-
-paymentAxios.interceptors.response.use(
-  (res) => res,
-  (err) => Promise.reject(err)
-)
-
-// ── Notifications Axios ──────────────────────────────────────────────────────
-
-export const notificationsAxios = axios.create({
-  baseURL: getBackendUrl('notifications'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  timeout: 30_000,
-})
-
-notificationsAxios.interceptors.response.use(
-  (res) => res,
-  (err) => Promise.reject(err)
-)
-
-// ── CMS Axios ───────────────────────────────────────────────────────────────
-
-export const cmsAxios = axios.create({
-  baseURL: getBackendUrl('cms'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  timeout: 30_000,
-})
-
-cmsAxios.interceptors.request.use((cfg) => {
-  const config = getRuntimeConfig()
-  cfg.headers = cfg.headers ?? {}
-  cfg.headers['X-Storefront-Key'] = config.storefrontApiKey
-  cfg.headers['X-Business-ID'] = config.businessId
-  return cfg
-})
-
-cmsAxios.interceptors.response.use(
-  (res) => res,
-  (err) => Promise.reject(err)
-)
-
-// ── Refresh Axios ────────────────────────────────────────────────────────────
-
-export const refreshAxios = axios.create({
-  baseURL: getBackendUrl('auth'),
-  headers: {
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  },
-  withCredentials: true,
-  timeout: 30_000,
-})
-
-/**
- * configureHttpClients()
- * Updates the baseURL of all Axios instances to match the configured environment.
- * This must be called after initSdk() to ensure the correct environment URLs are used.
- */
-export function configureHttpClients(): void {
-  if (!isInitialized()) return
-
-  const storeUrl = getBackendUrl('store')
-  const authUrl = getBackendUrl('auth')
-  const paymentUrl = getBackendUrl('payment')
-  const notificationsUrl = getBackendUrl('notifications')
-  const cmsUrl = getBackendUrl('cms')
-
-  storeManagementAxios.defaults.baseURL = storeUrl
-  publicStoreAxios.defaults.baseURL = storeUrl
-  authAxios.defaults.baseURL = authUrl
-  paymentAxios.defaults.baseURL = paymentUrl
-  notificationsAxios.defaults.baseURL = notificationsUrl
-  cmsAxios.defaults.baseURL = cmsUrl
-  refreshAxios.defaults.baseURL = authUrl
-}