@nebulr-group/bridge-svelte 0.4.0-beta.0 → 0.4.0-beta.2

package/dist/client/BridgeBootstrap.js

@@ -3,6 +3,7 @@ import { redirect, isRedirect } from '@sveltejs/kit';
 import { get } from 'svelte/store';
 import { createRouteGuard } from '../auth/route-guard.js';
 import { getBridgeAuth, bridgeReadyStore, markReady, waitForBridge as _waitForBridge, } from '../core/bridge-instance.js';
+import { installBridgeAuthFetch } from '../core/bridge-runtime.js';
 import { useBridge } from '@nebulr-group/bridge-auth-core';
 import { featureFlags } from '../shared/feature-flag.js';
 import { logger } from '../shared/logger.js';
@@ -21,6 +22,11 @@ export async function bridgeBootstrap(url, config, routeConfig = { rules: [], de
     }
     // 1. Initialize configuration (synchronously) — this also calls initBridge()
     bridgeConfig.initConfig(finalConfig, routeConfig);
+    // 1b. Patch globalThis.fetch early so GraphQL/HTTP calls made in this load()
+    //     function (before any component mounts) already carry the Bearer token.
+    //     installBridgeAuthFetch() is idempotent — startBridgeRuntime() (onMount)
+    //     is a no-op when it finds the patch already in place.
+    installBridgeAuthFetch();
     // 1a. Unified callback handler — detects what is calling back and routes accordingly
     try {
         const resolvedCallbackUrl = getConfig().callbackUrl;

package/dist/core/bridge-fetch.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Wraps a fetch function with Bridge auth concerns for requests to `apiBaseUrl`.
+ * Requests to other URLs pass through completely untouched.
+ *
+ * Two responsibilities:
+ *   1. Inject the current access token as `Authorization: Bearer` so consumers
+ *      never need auth code in their HTTP/GraphQL clients.
+ *   2. Detect `TOKEN_VERSION_STALE` in GraphQL 200 responses (the reactive
+ *      fallback when the WebSocket broadcast was missed), call `refreshTokens()`,
+ *      and retry once with the fresh token.
+ *
+ * Both paths converge on `getBridgeAuth().refreshTokens()` — the same call the
+ * WebSocket `user.state_changed` handler uses. The dedup gate in `BridgeAuth`
+ * ensures only one POST /auth/token goes out even if both paths fire at once.
+ *
+ * Installed by `startBridgeRuntime()` patching `globalThis.fetch`.
+ */
+export declare function wrapFetchWithBridgeAuth(baseFetch: typeof fetch, apiBaseUrl: string): typeof fetch;

package/dist/core/bridge-fetch.js

@@ -0,0 +1,59 @@
+import { getBridgeAuth } from './bridge-instance.js';
+/**
+ * Wraps a fetch function with Bridge auth concerns for requests to `apiBaseUrl`.
+ * Requests to other URLs pass through completely untouched.
+ *
+ * Two responsibilities:
+ *   1. Inject the current access token as `Authorization: Bearer` so consumers
+ *      never need auth code in their HTTP/GraphQL clients.
+ *   2. Detect `TOKEN_VERSION_STALE` in GraphQL 200 responses (the reactive
+ *      fallback when the WebSocket broadcast was missed), call `refreshTokens()`,
+ *      and retry once with the fresh token.
+ *
+ * Both paths converge on `getBridgeAuth().refreshTokens()` — the same call the
+ * WebSocket `user.state_changed` handler uses. The dedup gate in `BridgeAuth`
+ * ensures only one POST /auth/token goes out even if both paths fire at once.
+ *
+ * Installed by `startBridgeRuntime()` patching `globalThis.fetch`.
+ */
+export function wrapFetchWithBridgeAuth(baseFetch, apiBaseUrl) {
+    return async function bridgeAuthFetch(input, init) {
+        const url = typeof input === 'string'
+            ? input
+            : input instanceof URL
+                ? input.href
+                : input.url;
+        // Only act on requests to the bridge API — everything else passes through.
+        if (!url.startsWith(apiBaseUrl))
+            return baseFetch(input, init);
+        // 1. Inject current access token.
+        const token = getBridgeAuth().getTokens()?.accessToken;
+        const headers = new Headers(init?.headers);
+        if (token)
+            headers.set('Authorization', `Bearer ${token}`);
+        const response = await baseFetch(input, { ...init, headers });
+        // Non-200s are returned as-is; httpFetch handles REST auth errors separately.
+        if (!response.ok)
+            return response;
+        // 2. Inspect body for TOKEN_VERSION_STALE without consuming the original
+        //    response (URQL / callers need to read it themselves).
+        const clone = response.clone();
+        const body = await clone.json().catch(() => null);
+        const isStale = Array.isArray(body?.errors) && body.errors.some((e) => typeof e === 'object' &&
+            e !== null &&
+            e
+                .extensions?.response?.code === 'TOKEN_VERSION_STALE');
+        if (!isStale)
+            return response;
+        // 3. Refresh — same call as the WebSocket user.state_changed path.
+        //    Dedup gate in BridgeAuth coalesces concurrent calls into one HTTP request.
+        await getBridgeAuth().refreshTokens().catch(() => { });
+        const freshToken = getBridgeAuth().getTokens()?.accessToken;
+        const freshHeaders = new Headers(init?.headers);
+        if (freshToken)
+            freshHeaders.set('Authorization', `Bearer ${freshToken}`);
+        else
+            freshHeaders.delete('Authorization');
+        return baseFetch(input, { ...init, headers: freshHeaders });
+    };
+}

package/dist/core/bridge-runtime.d.ts

@@ -61,6 +61,17 @@ export interface StartBridgeRuntimeOptions {
  * Must be called AFTER `bridgeConfig.initConfig({...})` runs — typically from
  * `<BridgeBootstrap />`'s onMount.
  */
+/**
+ * Patch globalThis.fetch so every request to the bridge API automatically
+ * gets the current access token injected as Authorization: Bearer, and
+ * TOKEN_VERSION_STALE responses are retried with a fresh token.
+ *
+ * Idempotent — safe to call from both bridgeBootstrap() (load-function context,
+ * before any component mounts) and startBridgeRuntime() (onMount). Whichever
+ * runs first installs the patch; the second call is a no-op.
+ * Restored by stopBridgeRuntime().
+ */
+export declare function installBridgeAuthFetch(): void;
 export declare function startBridgeRuntime(options?: StartBridgeRuntimeOptions): void;
 /**
  * Stop the runtime. Idempotent — safe to call without a prior start. Flushes

package/dist/core/bridge-runtime.js

@@ -44,12 +44,14 @@
 import { RealtimeClient, useBridge, } from '@nebulr-group/bridge-auth-core';
 import { getConfig } from '../client/stores/config.store.js';
 import { getBridgeAuth, tokenStore } from './bridge-instance.js';
+import { wrapFetchWithBridgeAuth } from './bridge-fetch.js';
 import { applySessionSnapshot } from './snapshot-stores.js';
 import { bridgeEvents } from './events.js';
 import { _setRealtimeStatus } from './realtime-status.js';
 let _realtime;
 let _unsubscribeAuth;
 let _currentAuthToken;
+let _originalFetch;
 const _onOpenSubs = new Set();
 const _onCloseSubs = new Set();
 const _onSnapshotSubs = new Set();
@@ -60,10 +62,30 @@ const _onUserStateSubs = new Set();
  * Must be called AFTER `bridgeConfig.initConfig({...})` runs — typically from
  * `<BridgeBootstrap />`'s onMount.
  */
+/**
+ * Patch globalThis.fetch so every request to the bridge API automatically
+ * gets the current access token injected as Authorization: Bearer, and
+ * TOKEN_VERSION_STALE responses are retried with a fresh token.
+ *
+ * Idempotent — safe to call from both bridgeBootstrap() (load-function context,
+ * before any component mounts) and startBridgeRuntime() (onMount). Whichever
+ * runs first installs the patch; the second call is a no-op.
+ * Restored by stopBridgeRuntime().
+ */
+export function installBridgeAuthFetch() {
+    if (_originalFetch)
+        return; // already installed
+    if (typeof globalThis === 'undefined' || typeof globalThis.fetch === 'undefined')
+        return;
+    const config = getConfig();
+    _originalFetch = globalThis.fetch;
+    globalThis.fetch = wrapFetchWithBridgeAuth(_originalFetch, config.apiBaseUrl ?? 'https://api.thebridge.dev');
+}
 export function startBridgeRuntime(options = {}) {
     if (_realtime)
         return;
     const config = getConfig();
+    installBridgeAuthFetch();
     // `appId` may come from BridgeAuth's API context if available; falls back
     // to the value from `getConfig()`. The auth context one is what gets bound
     // to the per-app channel scope at boot, before any user JWT arrives.
@@ -81,8 +103,18 @@ export function startBridgeRuntime(options = {}) {
         appId: _bootstrapAppId,
         getAuthToken: () => _currentAuthToken,
     });
+    let _connectedOnce = false;
     _realtime.setOnOpen(() => {
         _setRealtimeStatus('open');
+        // On reconnect (not initial connect), proactively refresh tokens.
+        // If the WS was down when tokenVersion was bumped on the server, the
+        // client missed the user.state_changed broadcast. Refreshing here
+        // syncs tokens before the first post-reconnect request can fail with
+        // TOKEN_VERSION_STALE.
+        if (_connectedOnce) {
+            getBridgeAuth().refreshTokens().catch(() => { });
+        }
+        _connectedOnce = true;
         for (const fn of _onOpenSubs) {
             try {
                 fn();
@@ -217,6 +249,10 @@ export async function stopBridgeRuntime() {
         _realtime = undefined;
     }
     _currentAuthToken = undefined;
+    if (_originalFetch) {
+        globalThis.fetch = _originalFetch;
+        _originalFetch = undefined;
+    }
 }
 /**
  * Get the shared RealtimeClient. Returns `undefined` if `startBridgeRuntime()`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-svelte",
-  "version": "0.4.0-beta.0",
+  "version": "0.4.0-beta.2",
   "description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
   "author": "Iman Pouya",
   "license": "MIT",
@@ -67,7 +67,7 @@
     }
   },
   "dependencies": {
-    "@nebulr-group/bridge-auth-core": "0.4.0-beta.0"
+    "@nebulr-group/bridge-auth-core": "0.4.0-beta.2"
   },
   "devDependencies": {
     "@sveltejs/kit": "^2.16.0",