@mercurjs/client 2.3.8-canary.4 → 2.3.9-canary.2

package/dist/index.d.mts

@@ -8,10 +8,92 @@ type InferOutput<TResponse> = TResponse extends MedusaResponse<infer Output> ? O
 type HttpMethod = "GET" | "POST" | "DELETE";
 type ChildKeys<T> = Exclude<keyof T, HttpMethod | "__esModule">;
 
+/**
+ * Token storage and request authentication for the client.
+ *
+ * A token store keeps one credential under one key and survives reloads
+ * through `localStorage` when it exists, falling back to memory on the server
+ * or when storage is blocked. An auth scheme turns stores into the headers a
+ * Mercur API expects, resolved freshly on every request.
+ */
+type TokenStorage = {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+};
+type TokenStore = {
+    readonly key: string;
+    get(): string | null;
+    set(token: string): void;
+    clear(): void;
+    /** Called with the new value after every `set` and `clear`, in this tab. */
+    subscribe(listener: (token: string | null) => void): () => void;
+};
+declare function createTokenStore(key: string, storage?: TokenStorage): TokenStore;
+type MaybePromise<T> = T | Promise<T>;
+type Credential = string | null | undefined;
+/** One way of authenticating a request. Several can be combined in `ClientOptions.auth`. */
+type AuthScheme = {
+    type: "bearer";
+    token: TokenStore | (() => MaybePromise<Credential>);
+} | {
+    type: "api-key";
+    key: TokenStore | (() => MaybePromise<Credential>);
+} | {
+    type: "publishable-key";
+    key: TokenStore | (() => MaybePromise<Credential>);
+} | {
+    type: "header";
+    name: string;
+    value: TokenStore | (() => MaybePromise<Credential>);
+};
+type AuthOption = TokenStore | AuthScheme | AuthScheme[];
+/** The session token of an admin or vendor panel user, as `Authorization: Bearer`. */
+declare const bearerAuth: (token: TokenStore | (() => MaybePromise<Credential>)) => AuthScheme;
+/** A secret API key (`sk_…`), sent the way Medusa expects it: HTTP Basic with the key as the user. */
+declare const apiKeyAuth: (key: TokenStore | (() => MaybePromise<Credential>)) => AuthScheme;
+/** A publishable API key (`pk_…`) for the Store API. */
+declare const publishableKeyAuth: (key: TokenStore | (() => MaybePromise<Credential>)) => AuthScheme;
+/** Any other credential header, e.g. the vendor panel's active seller. */
+declare const headerAuth: (name: string, value: TokenStore | (() => MaybePromise<Credential>)) => AuthScheme;
+declare function resolveAuthHeaders(auth: AuthOption | undefined): Promise<Record<string, string>>;
+/** Clears every token store the auth option reads from; used after a 401. */
+declare function clearAuthStores(auth: AuthOption | undefined): void;
+/**
+ * The stores the admin and vendor panels keep their sessions in. A plugin's
+ * dashboard code reads the same session by using the same store, so it never
+ * has to know the storage key.
+ */
+declare const ADMIN_TOKEN_KEY = "mercur_admin_auth_token";
+declare const VENDOR_TOKEN_KEY = "mercur_vendor_auth_token";
+declare const VENDOR_SELLER_KEY = "mercur_vendor_seller_id";
+declare const adminTokenStore: TokenStore;
+declare const vendorTokenStore: TokenStore;
+declare const vendorSellerStore: TokenStore;
+/** Auth for anything that talks to `/admin/*` as the signed-in panel user. */
+declare const adminAuth: () => AuthScheme[];
+/** Auth for `/vendor/*` as the signed-in seller member, scoped to the active seller. */
+declare const vendorAuth: () => AuthScheme[];
+
 type ClientOptions = {
     baseUrl: string;
     fetchOptions?: RequestInit;
-    headers?: () => Record<string, string>;
+    /**
+     * How requests authenticate: a token store (sent as a bearer token), one
+     * scheme, or several. Resolved on every request, so a token set after the
+     * client was created is picked up by the next call.
+     */
+    auth?: AuthOption;
+    /** Extra headers computed per request, on top of `auth`. */
+    headers?: () => Record<string, string> | Promise<Record<string, string>>;
+    /**
+     * Runs when the API answers 401. By default the bearer token stores in
+     * `auth` are cleared so the panel falls back to its login screen.
+     */
+    onUnauthorized?: (error: {
+        status: number;
+        message: string;
+    }) => void;
 };
 type AddParamsToFn<Fn, TParams> = keyof TParams extends never ? Fn : Fn extends (input?: infer TInput) => infer TOutput ? (input: (TInput extends Record<string, any> ? Omit<TInput, 'fetchOptions'> : {}) & TParams & {
     fetchOptions?: RequestInit;
@@ -59,4 +141,4 @@ declare class ClientError extends Error {
 }
 declare function createClient(options: ClientOptions): any;
 
-export { ClientError, type InferClient, type InferClientInput, type InferClientOutput, createClient };
+export { ADMIN_TOKEN_KEY, type AuthOption, type AuthScheme, ClientError, type InferClient, type InferClientInput, type InferClientOutput, type TokenStorage, type TokenStore, VENDOR_SELLER_KEY, VENDOR_TOKEN_KEY, adminAuth, adminTokenStore, apiKeyAuth, bearerAuth, clearAuthStores, createClient, createTokenStore, headerAuth, publishableKeyAuth, resolveAuthHeaders, vendorAuth, vendorSellerStore, vendorTokenStore };

package/dist/index.mjs

@@ -75,6 +75,123 @@ function createRecursiveProxy(callback, path = []) {
 // src/utils.ts
 var kebabCase = (string) => string.replace(/([a-z])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
 
+// src/auth.ts
+var memoryStorage = () => {
+  const map = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => {
+      var _a;
+      return (_a = map.get(key)) != null ? _a : null;
+    },
+    setItem: (key, value) => void map.set(key, value),
+    removeItem: (key) => void map.delete(key)
+  };
+};
+var resolveStorage = (storage) => {
+  if (storage) return storage;
+  try {
+    if (typeof localStorage !== "undefined") {
+      localStorage.getItem("__mercur_probe__");
+      return localStorage;
+    }
+  } catch (e) {
+  }
+  return memoryStorage();
+};
+function createTokenStore(key, storage) {
+  const backing = resolveStorage(storage);
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = (token) => listeners.forEach((l) => l(token));
+  return {
+    key,
+    get() {
+      try {
+        return backing.getItem(key);
+      } catch (e) {
+        return null;
+      }
+    },
+    set(token) {
+      try {
+        backing.setItem(key, token);
+      } catch (e) {
+        return;
+      }
+      notify(token);
+    },
+    clear() {
+      try {
+        backing.removeItem(key);
+      } catch (e) {
+        return;
+      }
+      notify(null);
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => void listeners.delete(listener);
+    }
+  };
+}
+var read = (source) => typeof source === "function" ? source() : source.get();
+var isTokenStore = (value) => typeof value === "object" && value !== null && "get" in value && "subscribe" in value;
+var toBase64 = (value) => typeof btoa === "function" ? btoa(value) : Buffer.from(value, "utf8").toString("base64");
+var bearerAuth = (token) => ({ type: "bearer", token });
+var apiKeyAuth = (key) => ({ type: "api-key", key });
+var publishableKeyAuth = (key) => ({ type: "publishable-key", key });
+var headerAuth = (name, value) => ({ type: "header", name, value });
+function resolveAuthHeaders(auth) {
+  return __async(this, null, function* () {
+    if (!auth) return {};
+    const schemes = isTokenStore(auth) ? [bearerAuth(auth)] : Array.isArray(auth) ? auth : [auth];
+    const headers = {};
+    for (const scheme of schemes) {
+      switch (scheme.type) {
+        case "bearer": {
+          const token = yield read(scheme.token);
+          if (token) headers.Authorization = `Bearer ${token}`;
+          break;
+        }
+        case "api-key": {
+          const key = yield read(scheme.key);
+          if (key) headers.Authorization = `Basic ${toBase64(`${key}:`)}`;
+          break;
+        }
+        case "publishable-key": {
+          const key = yield read(scheme.key);
+          if (key) headers["x-publishable-api-key"] = key;
+          break;
+        }
+        case "header": {
+          const value = yield read(scheme.value);
+          if (value) headers[scheme.name] = value;
+          break;
+        }
+      }
+    }
+    return headers;
+  });
+}
+function clearAuthStores(auth) {
+  if (!auth) return;
+  const schemes = isTokenStore(auth) ? [bearerAuth(auth)] : Array.isArray(auth) ? auth : [auth];
+  for (const scheme of schemes) {
+    const source = scheme.type === "bearer" ? scheme.token : scheme.type === "header" ? scheme.value : scheme.key;
+    if (isTokenStore(source) && scheme.type === "bearer") source.clear();
+  }
+}
+var ADMIN_TOKEN_KEY = "mercur_admin_auth_token";
+var VENDOR_TOKEN_KEY = "mercur_vendor_auth_token";
+var VENDOR_SELLER_KEY = "mercur_vendor_seller_id";
+var adminTokenStore = createTokenStore(ADMIN_TOKEN_KEY);
+var vendorTokenStore = createTokenStore(VENDOR_TOKEN_KEY);
+var vendorSellerStore = createTokenStore(VENDOR_SELLER_KEY);
+var adminAuth = () => [bearerAuth(adminTokenStore)];
+var vendorAuth = () => [
+  bearerAuth(vendorTokenStore),
+  headerAuth("x-seller-id", vendorSellerStore)
+];
+
 // src/index.ts
 var ClientError = class extends Error {
   constructor(message, statusText, status, code) {
@@ -112,8 +229,8 @@ var toFormData = (payload) => {
   return formData;
 };
 function createClient(options) {
-  const { baseUrl, fetchOptions: defaultFetchOptions, headers: resolveHeaders } = options;
-  return createRecursiveProxy((path, args) => {
+  const { baseUrl, fetchOptions: defaultFetchOptions, headers: resolveHeaders, auth, onUnauthorized } = options;
+  return createRecursiveProxy((path, args) => __async(null, null, function* () {
     var _a;
     const action = path.pop();
     const input = (_a = args[0]) != null ? _a : {};
@@ -153,28 +270,51 @@ function createClient(options) {
     if (!isMultipart) {
       defaultHeaders["Content-Type"] = "application/json";
     }
-    const headers = new Headers(__spreadValues(__spreadValues(__spreadValues(__spreadValues({}, defaultHeaders), defaultFetchOptions == null ? void 0 : defaultFetchOptions.headers), resolveHeaders == null ? void 0 : resolveHeaders()), inputFetchOptions == null ? void 0 : inputFetchOptions.headers));
+    const headers = new Headers(__spreadValues(__spreadValues(__spreadValues(__spreadValues(__spreadValues({}, defaultHeaders), defaultFetchOptions == null ? void 0 : defaultFetchOptions.headers), yield resolveAuthHeaders(auth)), yield resolveHeaders == null ? void 0 : resolveHeaders()), inputFetchOptions == null ? void 0 : inputFetchOptions.headers));
     return fetch(url, __spreadProps(__spreadValues(__spreadValues({}, defaultFetchOptions), inputFetchOptions), {
       method,
       body,
       headers
     })).then((response) => __async(null, null, function* () {
-      var _a2, _b2;
+      var _a2, _b2, _c;
       if (response.status >= 300) {
         const jsonError = yield response.json().catch(() => ({}));
+        if (response.status === 401) {
+          const message = (_a2 = jsonError.message) != null ? _a2 : response.statusText;
+          if (onUnauthorized) {
+            onUnauthorized({ status: 401, message });
+          } else {
+            clearAuthStores(auth);
+          }
+        }
         throw new ClientError(
-          (_a2 = jsonError.message) != null ? _a2 : response.statusText,
+          (_b2 = jsonError.message) != null ? _b2 : response.statusText,
           response.statusText,
           response.status,
           typeof jsonError.code === "string" ? jsonError.code : void 0
         );
       }
-      const isJsonRequest = (_b2 = headers.get("accept")) == null ? void 0 : _b2.includes("application/json");
+      const isJsonRequest = (_c = headers.get("accept")) == null ? void 0 : _c.includes("application/json");
       return isJsonRequest ? yield response.json() : response;
     }));
-  });
+  }));
 }
 export {
+  ADMIN_TOKEN_KEY,
   ClientError,
-  createClient
+  VENDOR_SELLER_KEY,
+  VENDOR_TOKEN_KEY,
+  adminAuth,
+  adminTokenStore,
+  apiKeyAuth,
+  bearerAuth,
+  clearAuthStores,
+  createClient,
+  createTokenStore,
+  headerAuth,
+  publishableKeyAuth,
+  resolveAuthHeaders,
+  vendorAuth,
+  vendorSellerStore,
+  vendorTokenStore
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercurjs/client",
-  "version": "2.3.8-canary.4",
+  "version": "2.3.9-canary.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/mercurjs/mercur",
@@ -32,17 +32,19 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "dev": "tsup --watch",
-    "build": "tsup"
+    "build": "tsup",
+    "test": "vitest run"
   },
   "dependencies": {
     "@tanstack/react-query": "^5.64.2",
     "qs": "^6.12.1"
   },
   "devDependencies": {
-    "@medusajs/framework": "2.21.2",
+    "@medusajs/framework": "2.22.0",
     "@types/qs": "^6.9.18",
     "tsup": "^8.5.0",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "vitest": "^3.2.4"
   },
   "peerDependencies": {
     "typescript": ">=4.8.0"