@lumibase/sdk 0.20.0 → 0.21.0

package/dist/index.cjs

@@ -111,12 +111,52 @@ function toErrorBody(status, body) {
 function createLumiClient(opts) {
   const fetcher = opts.fetcher ?? globalThis.fetch;
   const base = opts.url.replace(/\/$/, "");
-  async function rawRequest(path, init = {}) {
+  let currentToken = opts.token;
+  let currentRefreshToken = opts.refreshToken;
+  let refreshInFlight = null;
+  async function attemptRefresh() {
+    if (!currentRefreshToken) return false;
+    if (!refreshInFlight) {
+      refreshInFlight = (async () => {
+        try {
+          const res = await fetcher(`${base}/api/v1/auth/refresh`, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-lumi-site": opts.siteId
+            },
+            // Body transport is CSRF-exempt (the token isn't ambient).
+            body: JSON.stringify({ refreshToken: currentRefreshToken })
+          });
+          if (!res.ok) return false;
+          const data = parseResponseBody(await res.text())?.data;
+          if (!data?.token || !data.refreshToken) return false;
+          currentToken = data.token;
+          currentRefreshToken = data.refreshToken;
+          try {
+            opts.onTokensRefreshed?.({
+              token: data.token,
+              refreshToken: data.refreshToken,
+              refreshTokenExpiresAt: data.refreshTokenExpiresAt
+            });
+          } catch {
+          }
+          return true;
+        } catch {
+          return false;
+        } finally {
+          refreshInFlight = null;
+        }
+      })();
+    }
+    return refreshInFlight;
+  }
+  async function rawRequest(path, init = {}, retried = false) {
     const headers = new Headers(init.headers);
     for (const [key, value] of Object.entries(opts.headers ?? {})) {
       headers.set(key, value);
     }
-    headers.set("authorization", `Bearer ${opts.token}`);
+    headers.set("authorization", `Bearer ${currentToken}`);
     headers.set("x-lumi-site", opts.siteId);
     if (!headers.has("content-type") && init.body) {
       headers.set("content-type", "application/json");
@@ -125,6 +165,11 @@ function createLumiClient(opts) {
     const text = await res.text();
     const body = parseResponseBody(text);
     if (!res.ok) {
+      if (res.status === 401 && !retried && currentRefreshToken && path !== "/api/v1/auth/refresh") {
+        if (await attemptRefresh()) {
+          return rawRequest(path, init, true);
+        }
+      }
       if (res.status === 401 && opts.onUnauthorized) {
         try {
           opts.onUnauthorized();
@@ -137,7 +182,9 @@ function createLumiClient(opts) {
   }
   const baseClient = {
     url: opts.url,
-    token: opts.token,
+    get token() {
+      return currentToken;
+    },
     siteId: opts.siteId,
     fetcher,
     rawRequest,

package/dist/index.d.cts

@@ -1371,8 +1371,29 @@ interface LumiClientOptions {
      * is thrown so a host (e.g. Studio) can clear the stale token and route
      * the operator back to the login screen. Errors thrown by the callback
      * are swallowed so they never mask the original `LumiError`.
+     *
+     * When auto-refresh is enabled (see `refreshToken`), `onUnauthorized`
+     * fires only AFTER a refresh attempt has also failed.
      */
     onUnauthorized?: () => void;
+    /**
+     * Rotating refresh token (body transport). When set, a `401` triggers a
+     * single `POST /api/v1/auth/refresh` with this token; on success the new
+     * access token is adopted and the original request is retried once. The
+     * refresh token rotates each call, so the new pair is surfaced via
+     * {@link onTokensRefreshed} for the host to persist. Omit to keep the
+     * legacy behaviour (no retry; `onUnauthorized` fires immediately).
+     */
+    refreshToken?: string;
+    /**
+     * Called after a successful silent refresh with the rotated token pair so
+     * the host can persist them (the old refresh token is now revoked).
+     */
+    onTokensRefreshed?: (tokens: {
+        token: string;
+        refreshToken: string;
+        refreshTokenExpiresAt?: string;
+    }) => void;
 }
 interface LumiResponse<T> {
     data: T;

package/dist/index.d.ts

@@ -1371,8 +1371,29 @@ interface LumiClientOptions {
      * is thrown so a host (e.g. Studio) can clear the stale token and route
      * the operator back to the login screen. Errors thrown by the callback
      * are swallowed so they never mask the original `LumiError`.
+     *
+     * When auto-refresh is enabled (see `refreshToken`), `onUnauthorized`
+     * fires only AFTER a refresh attempt has also failed.
      */
     onUnauthorized?: () => void;
+    /**
+     * Rotating refresh token (body transport). When set, a `401` triggers a
+     * single `POST /api/v1/auth/refresh` with this token; on success the new
+     * access token is adopted and the original request is retried once. The
+     * refresh token rotates each call, so the new pair is surfaced via
+     * {@link onTokensRefreshed} for the host to persist. Omit to keep the
+     * legacy behaviour (no retry; `onUnauthorized` fires immediately).
+     */
+    refreshToken?: string;
+    /**
+     * Called after a successful silent refresh with the rotated token pair so
+     * the host can persist them (the old refresh token is now revoked).
+     */
+    onTokensRefreshed?: (tokens: {
+        token: string;
+        refreshToken: string;
+        refreshTokenExpiresAt?: string;
+    }) => void;
 }
 interface LumiResponse<T> {
     data: T;

package/dist/index.js

@@ -34,12 +34,52 @@ function toErrorBody(status, body) {
 function createLumiClient(opts) {
   const fetcher = opts.fetcher ?? globalThis.fetch;
   const base = opts.url.replace(/\/$/, "");
-  async function rawRequest(path, init = {}) {
+  let currentToken = opts.token;
+  let currentRefreshToken = opts.refreshToken;
+  let refreshInFlight = null;
+  async function attemptRefresh() {
+    if (!currentRefreshToken) return false;
+    if (!refreshInFlight) {
+      refreshInFlight = (async () => {
+        try {
+          const res = await fetcher(`${base}/api/v1/auth/refresh`, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-lumi-site": opts.siteId
+            },
+            // Body transport is CSRF-exempt (the token isn't ambient).
+            body: JSON.stringify({ refreshToken: currentRefreshToken })
+          });
+          if (!res.ok) return false;
+          const data = parseResponseBody(await res.text())?.data;
+          if (!data?.token || !data.refreshToken) return false;
+          currentToken = data.token;
+          currentRefreshToken = data.refreshToken;
+          try {
+            opts.onTokensRefreshed?.({
+              token: data.token,
+              refreshToken: data.refreshToken,
+              refreshTokenExpiresAt: data.refreshTokenExpiresAt
+            });
+          } catch {
+          }
+          return true;
+        } catch {
+          return false;
+        } finally {
+          refreshInFlight = null;
+        }
+      })();
+    }
+    return refreshInFlight;
+  }
+  async function rawRequest(path, init = {}, retried = false) {
     const headers = new Headers(init.headers);
     for (const [key, value] of Object.entries(opts.headers ?? {})) {
       headers.set(key, value);
     }
-    headers.set("authorization", `Bearer ${opts.token}`);
+    headers.set("authorization", `Bearer ${currentToken}`);
     headers.set("x-lumi-site", opts.siteId);
     if (!headers.has("content-type") && init.body) {
       headers.set("content-type", "application/json");
@@ -48,6 +88,11 @@ function createLumiClient(opts) {
     const text = await res.text();
     const body = parseResponseBody(text);
     if (!res.ok) {
+      if (res.status === 401 && !retried && currentRefreshToken && path !== "/api/v1/auth/refresh") {
+        if (await attemptRefresh()) {
+          return rawRequest(path, init, true);
+        }
+      }
       if (res.status === 401 && opts.onUnauthorized) {
         try {
           opts.onUnauthorized();
@@ -60,7 +105,9 @@ function createLumiClient(opts) {
   }
   const baseClient = {
     url: opts.url,
-    token: opts.token,
+    get token() {
+      return currentToken;
+    },
     siteId: opts.siteId,
     fetcher,
     rawRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumibase/sdk",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "LumiBase JS SDK (REST + WebSocket) + typegen core. Isomorphic ESM.",
   "type": "module",
   "repository": {