@kasuvia/sdk 0.0.2 → 0.0.5

package/src/services/auth.service.ts

@@ -1,17 +1,10 @@
 /**
  * Customer auth service — all API calls scoped to this storefront's business tenant.
- * Every request automatically receives:
- *  - Authorization: Bearer <accessToken>   (from interceptors)
- *  - X-Storefront-Key: <storefrontApiKey>  (from interceptors)
- *
- * The `tenant_id` field in login/register payloads is the permanent business_id (B-XXXXXXXX).
+ * Stateless - all configuration passed as parameters.
  */
-import { authAxios, refreshAxios } from '../client/httpClient'
-import { tokenStore } from '../client/authClient'
-import { resetGraphQLClient } from '../client/graphqlClient'
-import { getRuntimeConfig } from '../config'
+import type { SdkConfig } from '../config'
 import { logger } from '../utils/logger'
-import { mergeGuestCartIfPresent } from './cart.service'
+import { STORAGE_KEYS } from '../constants'
 import type {
   CustomerAuthResponse,
   CustomerLoginPayload,
@@ -27,94 +20,127 @@ import type {
 
 /**
  * POST /auth/login/customer/
- * The `tenant_id` is automatically filled from config.api.storefrontBusinessId.
+ * The `tenant_id` is automatically filled from config.businessId.
  */
-export async function loginCustomer(payload: Omit<CustomerLoginPayload, 'tenant_id'>): Promise<CustomerAuthResponse> {
-  const config = getRuntimeConfig()
-  const { data } = await authAxios.post<CustomerAuthResponse>('/auth/login/customer/', {
-    ...payload,
-    tenant_id: config.businessId,
+export async function loginCustomer(
+  config: SdkConfig,
+  payload: Omit<CustomerLoginPayload, 'tenant_id'>
+): Promise<CustomerAuthResponse> {
+  const response = await fetch(`${config.backendUrls.auth}/auth/login/customer/`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Storefront-Key': config.storefrontApiKey,
+      'X-Business-ID': config.businessId,
+    },
+    body: JSON.stringify({
+      ...payload,
+      tenant_id: config.businessId,
+    }),
   })
 
-  tokenStore.setAccessToken(data.access)
-  tokenStore.setRefreshToken(data.refresh)
-  resetGraphQLClient()
-
-  // Merge guest cart after successful login
-  await mergeGuestCartIfPresent()
+  if (!response.ok) {
+    throw new Error('Login failed')
+  }
 
+  const data = await response.json()
   return data
 }
 
 /**
  * POST /auth/register/customer/
- * The `tenant_id` is automatically filled from config.api.storefrontBusinessId.
+ * The `tenant_id` is automatically filled from config.businessId.
  */
-export async function registerCustomer(payload: Omit<CustomerRegisterPayload, 'tenant_id'>): Promise<CustomerAuthResponse> {
-  const config = getRuntimeConfig()
-  const { data } = await authAxios.post<CustomerAuthResponse>('/auth/register/customer/', {
-    ...payload,
-    tenant_id: config.businessId,
+export async function registerCustomer(
+  config: SdkConfig,
+  payload: Omit<CustomerRegisterPayload, 'tenant_id'>
+): Promise<CustomerAuthResponse> {
+  const response = await fetch(`${config.backendUrls.auth}/auth/register/customer/`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Storefront-Key': config.storefrontApiKey,
+      'X-Business-ID': config.businessId,
+    },
+    body: JSON.stringify({
+      ...payload,
+      tenant_id: config.businessId,
+    }),
   })
 
-  tokenStore.setAccessToken(data.access)
-  tokenStore.setRefreshToken(data.refresh)
-  resetGraphQLClient()
-
-  // Merge guest cart after successful registration
-  await mergeGuestCartIfPresent()
+  if (!response.ok) {
+    throw new Error('Registration failed')
+  }
 
+  const data = await response.json()
   return data
 }
 
 /** POST /auth/token/refresh/
- * CRITICAL: Uses refreshAxios (no interceptors) to prevent interceptor recursion.
  */
-export async function refreshToken(refresh: string): Promise<RefreshTokenResponse> {
-  const { data } = await refreshAxios.post<RefreshTokenResponse>('/auth/token/refresh/', { refresh })
+export async function refreshToken(
+  config: SdkConfig,
+  refresh: string
+): Promise<RefreshTokenResponse> {
+  const response = await fetch(`${config.backendUrls.auth}/auth/token/refresh/`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ refresh }),
+  })
+
+  if (!response.ok) {
+    throw new Error('Token refresh failed')
+  }
+
+  const data = await response.json()
   return data
 }
 
-/** POST /auth/logout/ — revokes the server-side session. Always clears local tokens. */
-export async function logout(): Promise<void> {
-  const refresh = tokenStore.getRefreshToken()
+/** POST /auth/logout/ — revokes the server-side session. */
+export async function logout(
+  config: SdkConfig,
+  refresh?: string
+): Promise<void> {
   const payload: LogoutPayload = refresh ? { refresh } : {}
   try {
-    await authAxios.post('/auth/logout/', payload)
+    await fetch(`${config.backendUrls.auth}/auth/logout/`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(payload),
+    })
   } catch {
-    // Swallow server errors (401 = already expired, network = offline).
-    // Local token cleanup in `finally` is what actually logs the user out.
-  } finally {
-    tokenStore.clearAll()
-    resetGraphQLClient()
+    // Swallow server errors
   }
 }
 
 /**
  * Verify a social provider id_token (or access_token for Facebook) with the backend.
- * The backend validates the token with the provider and creates/finds the customer.
- *
- * Industry-standard "ID Token Exchange" pattern:
- *   1. Customer completes Google/Facebook sign-in on the storefront
- *   2. Storefront receives an id_token / access_token from the provider
- *   3. This function sends it to the backend for server-side verification
- *   4. Backend returns our JWT tokens
  */
 export async function verifySocialToken(
+  config: SdkConfig,
   provider: 'google' | 'facebook',
   token: string
 ): Promise<CustomerAuthResponse> {
-  const config = getRuntimeConfig()
-  const { data } = await authAxios.post<CustomerAuthResponse>(
-    `/auth/social/verify/${provider}/`,
-    {
+  const response = await fetch(`${config.backendUrls.auth}/auth/social/verify/${provider}/`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
       id_token: token,
       storefront_key: config.storefrontApiKey,
-    }
-  )
-  tokenStore.setAccessToken(data.access)
-  tokenStore.setRefreshToken(data.refresh)
-  resetGraphQLClient()
+    }),
+  })
+
+  if (!response.ok) {
+    throw new Error('Social token verification failed')
+  }
+
+  const data = await response.json()
   return data
 }
 
@@ -143,7 +169,7 @@ function resolveAvatar(profilePicture: unknown): string | null {
   return null
 }
 
-/** Map luxe-auth UserSerializer response to storefront CustomerUser. */
+/** Map kasuvia-auth UserSerializer response to storefront CustomerUser. */
 export function mapAuthUserToCustomer(data: AuthUserResponse, provider?: CustomerUser['provider']): CustomerUser {
   const firstname = data.profile?.firstname?.trim() || undefined
   const lastname = data.profile?.lastname?.trim() || undefined
@@ -184,130 +210,112 @@ function buildCustomerFromClaims(claims: Record<string, unknown>): CustomerUser
 }
 
 /** GET /auth/profile/ */
-export async function getMe(): Promise<CustomerUser> {
-  const { data } = await authAxios.get<AuthUserResponse>('/auth/profile/')
+export async function getMe(config?: SdkConfig, accessToken?: string): Promise<CustomerUser> {
+  if (!config || !accessToken) {
+    const response = await fetch('/api/auth/me', { credentials: 'include' })
+    if (!response.ok) throw new Error('Failed to fetch profile')
+    const data = await response.json()
+    return data.user
+  }
+
+  const response = await fetch(`${config.backendUrls.auth}/auth/profile/`, {
+    headers: {
+      'Authorization': `Bearer ${accessToken}`,
+    },
+  })
+
+  if (!response.ok) {
+    throw new Error('Failed to fetch profile')
+  }
+
+  const data = await response.json()
   return mapAuthUserToCustomer(data)
 }
 
 /** GET /auth/profile/ - alias for getMe for backward compatibility */
-export async function getAuthUser(): Promise<AuthUserResponse> {
-  const { data } = await authAxios.get<AuthUserResponse>('/auth/profile/')
+export async function getAuthUser(config?: SdkConfig, accessToken?: string): Promise<AuthUserResponse> {
+  if (!config || !accessToken) {
+    const response = await fetch('/api/auth/me', { credentials: 'include' })
+    if (!response.ok) throw new Error('Failed to fetch auth user')
+    const data = await response.json()
+    return data.user
+  }
+
+  const response = await fetch(`${config.backendUrls.auth}/auth/profile/`, {
+    headers: {
+      'Authorization': `Bearer ${accessToken}`,
+    },
+  })
+
+  if (!response.ok) {
+    throw new Error('Failed to fetch auth user')
+  }
+
+  const data = await response.json()
   return data
 }
 
 /** PUT /auth/profile/ — update firstname, lastname, phone */
-export async function updateProfile(payload: UpdateProfilePayload): Promise<CustomerUser> {
-  const { data } = await authAxios.put<AuthUserResponse>('/auth/profile/', payload)
-  return mapAuthUserToCustomer(data)
-}
-
-let refreshPromise: Promise<{ user: CustomerUser; provider: CustomerUser['provider'] } | null> | null = null;
+export async function updateProfile(
+  configOrPayload: SdkConfig | UpdateProfilePayload,
+  accessTokenOrPayload?: string | UpdateProfilePayload,
+  payloadParam?: UpdateProfilePayload
+): Promise<CustomerUser> {
+  const isArg1Config = typeof configOrPayload === 'object' && configOrPayload !== null && 'businessId' in configOrPayload
+  if (!isArg1Config) {
+    const payload = configOrPayload as UpdateProfilePayload
+    const response = await fetch('/api/auth/profile', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      credentials: 'include',
+      body: JSON.stringify(payload),
+    })
+    if (!response.ok) throw new Error('Failed to update profile')
+    return response.json()
+  }
 
-/**
- * Helper to classify error types for proper handling.
- */
-function classifyError(error: unknown): { isNetworkError: boolean; isAuthError: boolean; isBlacklistedError: boolean } {
-  const err = error as { response?: { status?: number; data?: { detail?: string } }; code?: string; message?: string }
-  const isNetworkError = !!(!err.response && (err.code === 'ECONNABORTED' || err.code === 'ERR_NETWORK' || err.message?.includes('Network Error')))
-  const isAuthError = !!(err.response?.status === 401 || err.response?.status === 403)
-  const isBlacklistedError = !!(err.response?.data?.detail === 'Token is blacklisted' || err.message === 'Token is blacklisted')
-  return { isNetworkError, isAuthError, isBlacklistedError }
-}
+  const config = configOrPayload as SdkConfig
+  const accessToken = accessTokenOrPayload as string
+  const payload = payloadParam as UpdateProfilePayload
+
+  const response = await fetch(`${config.backendUrls.auth}/auth/profile/`, {
+    method: 'PUT',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${accessToken}`,
+    },
+    body: JSON.stringify(payload),
+  })
 
-/**
- * Helper to retry with exponential backoff for transient network errors.
- */
-async function retryWithBackoff<T>(
-  fn: () => Promise<T>,
-  maxRetries: number = 2,
-  baseDelay: number = 1000
-): Promise<T> {
-  let lastError: unknown
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      return await fn()
-    } catch (error) {
-      lastError = error
-      const { isNetworkError, isAuthError } = classifyError(error)
-
-      // Only retry on network errors, not auth errors
-      if (!isNetworkError || isAuthError) {
-        throw error
-      }
-
-      // Don't retry on the last attempt
-      if (attempt === maxRetries) {
-        throw error
-      }
-
-      // Exponential backoff: 1s, 2s, 4s, etc.
-      const delay = baseDelay * Math.pow(2, attempt)
-      await new Promise(resolve => setTimeout(resolve, delay))
-    }
+  if (!response.ok) {
+    throw new Error('Failed to update profile')
   }
-  throw lastError
+
+  const data = await response.json()
+  return mapAuthUserToCustomer(data)
 }
 
 /**
  * Silently refresh the access token on app boot.
  * Builds CustomerUser from JWT claims — no additional profile API call needed.
  * Returns null if no refresh token exists or if the refresh fails.
- * Includes a concurrent lock to prevent React Strict Mode from double-firing and blacklisting the token.
- * 
- * Network error resilience:
- * - Classifies errors as network vs auth
- * - Retries transient network errors with exponential backoff
- * - Immediately fails on auth errors (401/403) to avoid infinite loops
- * - Clears auth state on any failure to ensure consistent logout behavior
  */
-export async function silentRefresh(): Promise<{ user: CustomerUser; provider: CustomerUser['provider'] } | null> {
-  const refresh = tokenStore.getRefreshToken()
-  if (!refresh) return null
-
-  if (refreshPromise) return refreshPromise;
-
-  refreshPromise = (async () => {
-    try {
-      // Use retry with backoff for network resilience
-      const tokens = await retryWithBackoff(() => refreshToken(refresh), 2, 1000)
-
-      tokenStore.setAccessToken(tokens.access)
-      if (tokens.refresh) tokenStore.setRefreshToken(tokens.refresh, tokenStore.isPersistent())
-
-      // Decode user identity from the new access token — avoids a fragile /profile/ round-trip
-      const claims = parseJwtPayload(tokens.access)
-      const user = buildCustomerFromClaims(claims)
-
-      return { user, provider: user.provider }
-    } catch (error: unknown) {
-      const { isNetworkError, isAuthError, isBlacklistedError } = classifyError(error)
-
-      if (isNetworkError) {
-        logger.warn('[silentRefresh] Network error during token refresh (offline/CORS), clearing session:', error)
-      } else if (isBlacklistedError) {
-        logger.log('[silentRefresh] Token was blacklisted (likely from logout), clearing session')
-      } else if (isAuthError) {
-        logger.log('[silentRefresh] Token refresh failed with auth error (expired/invalid), clearing session')
-      } else {
-        logger.error('[silentRefresh] Unexpected error during token refresh, clearing session:', error)
-      }
-
-      // CRITICAL: Clear auth state immediately on ANY refresh failure
-      // This prevents partial session state and ensures consistent logout behavior
-      tokenStore.clearAll()
+export async function silentRefresh(
+  config: SdkConfig,
+  refresh: string
+): Promise<{ user: CustomerUser; provider: CustomerUser['provider']; newAccessToken: string; newRefreshToken: string } | null> {
+  try {
+    const data = await refreshToken(config, refresh)
+    if (!data.access || !data.refresh) {
       return null
-    } finally {
-      refreshPromise = null;
     }
-  })();
-
-  return refreshPromise;
-}
-
-/** Store tokens after OAuth callback or login/register response. */
-export function storeTokens(access: string, refresh: string, remember = true): void {
-  tokenStore.setAccessToken(access)
-  tokenStore.setRefreshToken(refresh, remember)
+    const claims = parseJwtPayload(data.access)
+    const user = buildCustomerFromClaims(claims)
+    const provider = user.provider
+    return { user, provider, newAccessToken: data.access, newRefreshToken: data.refresh }
+  } catch {
+    return null
+  }
 }
 
 // ── Helper Functions ─────────────────────────────────────────────────────────
@@ -330,3 +338,37 @@ function splitFullName(fullName?: string): { firstname: string; lastname: string
     lastname: parts.slice(1).join(' ')
   }
 }
+
+/**
+ * Store tokens in localStorage (client-side utility)
+ * This is a convenience function for storefronts to store auth tokens
+ */
+export function storeTokens(accessToken: string, refreshToken: string): void {
+  if (typeof window !== 'undefined') {
+    localStorage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken)
+    localStorage.setItem(STORAGE_KEYS.REFRESH_TOKEN, refreshToken)
+  }
+}
+
+/**
+ * Clear tokens from localStorage (client-side utility)
+ */
+export function clearTokens(): void {
+  if (typeof window !== 'undefined') {
+    localStorage.removeItem(STORAGE_KEYS.ACCESS_TOKEN)
+    localStorage.removeItem(STORAGE_KEYS.REFRESH_TOKEN)
+  }
+}
+
+/**
+ * Get stored tokens from localStorage (client-side utility)
+ */
+export function getStoredTokens(): { accessToken: string | null; refreshToken: string | null } {
+  if (typeof window === 'undefined') {
+    return { accessToken: null, refreshToken: null }
+  }
+  return {
+    accessToken: localStorage.getItem(STORAGE_KEYS.ACCESS_TOKEN),
+    refreshToken: localStorage.getItem(STORAGE_KEYS.REFRESH_TOKEN),
+  }
+}

package/src/services/bespoke.service.ts

@@ -2,13 +2,21 @@
  * Bespoke Service
  * 
  * Handles bespoke product availability checks.
+ * Stateless - all configuration passed as parameters.
  */
-import { storeManagementAxios } from '../client/httpClient'
+import type { SdkConfig } from '../config'
 import type { BespokeAvailability } from '../types/consultations'
 
-export async function checkAvailability(product_id: string): Promise<BespokeAvailability> {
-  const { data } = await storeManagementAxios.get<BespokeAvailability>(`bespoke/availability/${product_id}`)
-  return data
+export async function checkAvailability(config: SdkConfig, product_id: string): Promise<BespokeAvailability> {
+  const response = await fetch(`${config.backendUrls.store}/bespoke/availability/${product_id}`, {
+    headers: {
+      "X-Storefront-Key": config.storefrontApiKey,
+      "X-Business-ID": config.businessId,
+    },
+  })
+
+  if (!response.ok) throw new Error('Failed to check bespoke availability')
+  return response.json()
 }
 
 // Service object export for backward compatibility