@plitzi/sdk-auth 0.32.25 → 0.33.1

package/dist/index.mjs

@@ -1,5 +1,8 @@
-import { AuthManager as e } from "./AuthManager.mjs";
-import t from "./hooks/useAuth/index.mjs";
-import { AuthContext as n } from "./AuthContext.mjs";
-import r from "./AuthContextProvider.mjs";
-export { n as AuthContext, r as AuthContextProvider, e as AuthManager, t as useAuth };
+import { readSessionHint as e } from "./helpers/sessionHint.mjs";
+import { nowInSeconds as t, tokenExpiresAt as n } from "./helpers/tokenClaims.mjs";
+import r from "./AuthProvider.mjs";
+import { AuthManager as i, getAuthProviderNames as a, registerAuthProvider as o } from "./AuthManager.mjs";
+import s from "./hooks/useAuth/index.mjs";
+import { AuthContext as c } from "./AuthContext.mjs";
+import l from "./AuthContextProvider.mjs";
+export { c as AuthContext, l as AuthContextProvider, i as AuthManager, r as AuthProvider, a as getAuthProviderNames, t as nowInSeconds, e as readSessionHint, o as registerAuthProvider, n as tokenExpiresAt, s as useAuth };

package/dist/providers/BasicAuthProvider.d.ts

@@ -1,39 +1,52 @@
 import { default as AuthProvider, AuthProviderProps } from '../AuthProvider';
-import { Schema, TokenResult } from '@plitzi/sdk-shared';
+import { AuthResult, Schema } from '@plitzi/sdk-shared';
 export type BasicAuthProviderProps = AuthProviderProps & {
-    tokenStorage?: Schema['settings']['tokenStorage'];
     loginUrl?: string;
     userUrl?: string;
     refreshUrl?: string;
     logoutUrl?: string;
-    detailsPath?: string;
-    tokenPath?: string;
-    refreshTokenPath?: string;
-    expirationTimePath?: string;
-    isSSR?: boolean;
+    sessionExchangeUrl?: Schema['settings']['sessionExchangeUrl'];
+    detailsPath?: Schema['settings']['detailsPath'];
+    tokenPath?: Schema['settings']['tokenPath'];
+    refreshTokenPath?: Schema['settings']['refreshTokenPath'];
+    expirationTimePath?: Schema['settings']['expirationTimePath'];
+    refreshExpirationTimePath?: Schema['settings']['refreshExpirationTimePath'];
 };
-declare class BasicAuthProvider<T = Record<string, unknown>> extends AuthProvider<T> {
+declare class BasicAuthProvider<U = Record<string, unknown>> extends AuthProvider<U> {
     readonly name = "basic";
-    protected baseUrl?: string;
-    protected options: {
-        tokenStorage: Exclude<Schema['settings']['tokenStorage'], undefined>;
-        loginUrl: string;
-        userUrl: string;
-        refreshUrl: string;
-        logoutUrl: string;
-        detailsPath: string;
-        tokenPath: string;
-        refreshTokenPath: string;
-        expirationTimePath: string;
-        isSSR: boolean;
+    private readonly options;
+    constructor({ loginUrl, userUrl, refreshUrl, logoutUrl, sessionExchangeUrl, detailsPath, tokenPath, refreshTokenPath, expirationTimePath, refreshExpirationTimePath, ...providerProps }?: BasicAuthProviderProps);
+    protected get capabilities(): {
+        renew: boolean;
+        identity: boolean;
     };
-    constructor({ tokenStorage, enableRefresh, loginUrl, userUrl, refreshUrl, logoutUrl, detailsPath, tokenPath, refreshTokenPath, expirationTimePath, isSSR }?: BasicAuthProviderProps);
-    init(user?: T, skipAuth?: boolean): Promise<void>;
-    login(authParams: Record<string, string>): Promise<TokenResult | undefined>;
-    getUser(): Promise<T | undefined>;
-    refresh(): Promise<TokenResult | undefined>;
-    can(permission: string): boolean;
-    logout(): Promise<void>;
-    private getTokenFromResponse;
+    protected get endpoints(): string[];
+    /**
+     * Two ways in, because a page may already hold a credential.
+     *
+     * `mode: 'token'` adopts one the page obtained some other way — handed over by a host application, carried in a
+     * link, minted by a CLI — and confirms it against the identity endpoint rather than posting anything. Nothing is
+     * taken on trust: an unusable token is refused here rather than becoming a session that fails on its first real
+     * request. `mode: 'normal'` (the default) posts the credentials.
+     */
+    protected requestLogin(params: Record<string, unknown>): Promise<AuthResult<U>>;
+    /** Confirms a token by asking who it belongs to, and only then reports it as a session. */
+    private adoptToken;
+    /**
+     * The refresh token travels in the body under the name the backend reads it by, and by cookie when the backend
+     * keeps it in one — a browser session normally does, which is why this works with nothing in storage at all.
+     */
+    protected requestRenewal(refreshToken?: string): Promise<AuthResult<U>>;
+    /**
+     * Only happens when the space declares `sessionExchangeUrl`, which is how it says its credentials are obtained in
+     * the browser rather than issued by the server that renders it. The server is handed the credential and the name
+     * of the provider that issued it — it has to know who to verify it with, and it must refuse anything else.
+     */
+    protected requestExchange(): Promise<AuthResult<U> | undefined>;
+    protected requestIdentity(): Promise<AuthResult<U>>;
+    protected requestLogout(): Promise<void>;
+    private request;
+    private toResult;
+    private tokenFrom;
 }
 export default BasicAuthProvider;

package/dist/providers/BasicAuthProvider.mjs

@@ -1,94 +1,174 @@
 import e from "../AuthProvider.mjs";
 import { get as t } from "@plitzi/plitzi-ui/helpers";
+import { authFailureFromResponse as n } from "@plitzi/sdk-shared/auth";
 //#region src/providers/BasicAuthProvider.ts
-var n = class extends e {
+var r = (e, n) => t(e, n, void 0), i = (e, t) => {
+	let n = r(e, t);
+	return typeof n == "string" && n !== "" ? n : null;
+}, a = (e, t) => {
+	let n = r(e, t), i = typeof n == "string" ? Number(n) : n;
+	return typeof i == "number" && Number.isFinite(i) ? i : null;
+}, o = (e) => typeof e == "string" ? e : typeof e == "number" && Number.isFinite(e) ? String(e) : "", s = class extends e {
 	name = "basic";
-	baseUrl;
 	options;
-	constructor({ tokenStorage: e = "localStorage", enableRefresh: t = !0, loginUrl: n = "", userUrl: r = "", refreshUrl: i = "", logoutUrl: a = "", detailsPath: o = "", tokenPath: s = "", refreshTokenPath: c = "", expirationTimePath: l = "", isSSR: u = !1 } = {}) {
-		super({
-			enableRefresh: t,
-			tokenStorage: e
-		}), this.options = {
-			tokenStorage: e,
-			loginUrl: n,
-			userUrl: r,
-			refreshUrl: i,
-			logoutUrl: a,
-			detailsPath: o,
-			tokenPath: s,
-			refreshTokenPath: c,
-			expirationTimePath: l,
-			isSSR: u
+	constructor({ loginUrl: e = "", userUrl: t = "", refreshUrl: n = "", logoutUrl: r = "", sessionExchangeUrl: i = "", detailsPath: a = "details", tokenPath: o = "access_token", refreshTokenPath: s = "refresh_token", expirationTimePath: c = "expire_at", refreshExpirationTimePath: l = "refresh_expire_at", ...u } = {}) {
+		super(u), this.options = {
+			loginUrl: e,
+			userUrl: t,
+			refreshUrl: n,
+			logoutUrl: r,
+			sessionExchangeUrl: i,
+			detailsPath: a,
+			tokenPath: o,
+			refreshTokenPath: s,
+			expirationTimePath: c,
+			refreshExpirationTimePath: l
 		};
 	}
-	async init(e, t) {
-		if (t) {
-			this.setState("guest");
-			return;
-		}
-		if (this.setState("initLoading"), !this.options.isSSR) {
-			await this.getUser();
-			return;
-		}
-		e ? super.internalGetUser(e) : this.setState("guest");
+	get capabilities() {
+		return {
+			renew: !!this.options.refreshUrl,
+			identity: !!this.options.userUrl
+		};
 	}
-	async login(e) {
-		let { username: n = "", password: r = "" } = e;
-		super.setState("authenticating");
-		let i = await this.request(this.options.loginUrl, {
-			credentials: "include",
+	get endpoints() {
+		let { loginUrl: e, userUrl: t, refreshUrl: n, logoutUrl: r } = this.options;
+		return [
+			e,
+			t,
+			n,
+			r
+		];
+	}
+	async requestLogin(e) {
+		let t = o(e.token).trim();
+		if (e.mode === "token") return t ? this.adoptToken(t) : {
+			ok: !1,
+			reason: "missing"
+		};
+		if (!this.options.loginUrl) return {
+			ok: !1,
+			reason: "missing"
+		};
+		let n = await this.request(this.options.loginUrl, {
 			method: "POST",
-			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({
-				username: n,
-				password: r
+				username: o(e.username),
+				password: o(e.password)
 			})
-		}), a = this.getTokenFromResponse(i);
-		return super.internalLogin(t(i.data, this.options.detailsPath), a), a;
+		});
+		return this.toResult(n);
 	}
-	async getUser() {
-		if (this.cache?.user && this.state !== "init") return this.cache.user;
-		if (!this.options.userUrl) {
-			super.internalGetUser(void 0);
-			return;
-		}
-		let e = await this.request(this.options.userUrl, {
+	async adoptToken(e) {
+		if (!this.options.userUrl) return {
+			ok: !1,
+			reason: "missing"
+		};
+		let t = await this.request(this.options.userUrl, {
 			method: "GET",
-			credentials: "include",
-			headers: { "Content-Type": "application/json" }
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${e}`
+			}
+		}), n = this.toResult(t);
+		return n.ok ? {
+			ok: !0,
+			user: n.user,
+			token: {
+				accessToken: e,
+				expiresAt: null,
+				refreshToken: null
+			}
+		} : n;
+	}
+	async requestRenewal(e) {
+		if (!this.options.refreshUrl) return {
+			ok: !1,
+			reason: "missing"
+		};
+		let t = await this.request(this.options.refreshUrl, {
+			method: "POST",
+			body: JSON.stringify(e ? { [this.options.refreshTokenPath]: e } : {})
 		});
-		return super.internalGetUser(t(e.data, this.options.detailsPath)), e.data;
+		return this.toResult(t);
 	}
-	async refresh() {
-		let e = await this.request(this.options.refreshUrl, {
+	async requestExchange() {
+		let e = this.token?.accessToken;
+		if (!this.options.sessionExchangeUrl || !e) return;
+		let t = await this.request(this.options.sessionExchangeUrl, {
 			method: "POST",
-			credentials: "include",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ refreshToken: this.cache?.token?.refreshToken ?? "" })
-		}), t = this.getTokenFromResponse(e);
-		return super.internalRefresh(t), t;
+			headers: {
+				"Content-Type": "application/json",
+				...this.spaceKey ? { "x-access-token": this.spaceKey } : {}
+			},
+			body: JSON.stringify({
+				provider: this.name,
+				token: e
+			})
+		});
+		return this.toResult(t);
 	}
-	can(e) {
-		return this.cache?.user ? t(this.cache.user, "permissions", []).includes(e) : !1;
+	async requestIdentity() {
+		if (!this.options.userUrl) return {
+			ok: !1,
+			reason: "missing"
+		};
+		let e = await this.request(this.options.userUrl, { method: "GET" });
+		return this.toResult(e);
 	}
-	async logout() {
-		await this.request(this.options.logoutUrl, {
-			method: "POST",
-			credentials: "include",
-			headers: { "Content-Type": "application/json" }
-		}), super.internalLogout();
+	async requestLogout() {
+		this.options.logoutUrl && await this.request(this.options.logoutUrl, { method: "POST" });
+	}
+	async request(e, t) {
+		let r;
+		try {
+			r = await fetch(e, {
+				credentials: "include",
+				headers: { "Content-Type": "application/json" },
+				...t
+			});
+		} catch {
+			return {
+				status: 0,
+				reason: "network"
+			};
+		}
+		let i;
+		try {
+			i = await r.json();
+		} catch {
+			i = void 0;
+		}
+		return {
+			data: i,
+			status: r.status,
+			reason: r.ok ? void 0 : n(r.status, i) ?? "network"
+		};
+	}
+	toResult(e) {
+		if (e.reason) return {
+			ok: !1,
+			reason: e.reason
+		};
+		let t = r(e.data, this.options.detailsPath);
+		return {
+			ok: !0,
+			user: typeof t == "object" && t ? t : void 0,
+			token: this.tokenFrom(e.data)
+		};
 	}
-	getTokenFromResponse(e) {
-		if (e.status >= 400) return;
-		let n = {
-			errors: t(e.data, "errors", {}),
-			accessToken: t(e.data, this.options.tokenPath, ""),
-			refreshToken: t(e.data, this.options.refreshTokenPath, ""),
-			expiresAt: t(e.data, this.options.expirationTimePath, 0)
+	tokenFrom(e) {
+		let t = i(e, this.options.tokenPath);
+		if (!t) return;
+		let n = r(e, "errors");
+		return {
+			...typeof n == "object" && n ? { errors: n } : {},
+			accessToken: t,
+			expiresAt: a(e, this.options.expirationTimePath),
+			refreshToken: i(e, this.options.refreshTokenPath),
+			refreshExpiresAt: a(e, this.options.refreshExpirationTimePath)
 		};
-		return e.data && !("errors" in e.data) && delete n.errors, n;
 	}
 };
 //#endregion
-export { n as default };
+export { s as default };

package/dist/types.d.ts

@@ -0,0 +1,6 @@
+import { Schema } from '@plitzi/sdk-shared';
+/**
+ * Everything a space declares about its auth backend, handed to whichever provider it selected. Derived from the
+ * schema rather than restated, so a setting added there reaches providers without a second definition to keep in step.
+ */
+export type AuthProviderSettings = Pick<Schema['settings'], 'tokenStorage' | 'loginUrl' | 'userUrl' | 'refreshUrl' | 'logoutUrl' | 'detailsPath' | 'tokenPath' | 'refreshTokenPath' | 'expirationTimePath' | 'refreshExpirationTimePath' | 'sessionHintCookie' | 'sessionExchangeUrl' | 'sessionGate' | 'sessionRevalidateSeconds'>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-auth",
-  "version": "0.32.25",
+  "version": "0.33.1",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -19,12 +19,25 @@
       "import": "./dist/AuthContextProvider.mjs"
     },
     "./AuthManager": {
+      "types": "./dist/AuthManager.d.ts",
       "import": "./dist/AuthManager.mjs"
     },
     "./AuthProvider": {
       "types": "./dist/AuthProvider.d.ts",
       "import": "./dist/AuthProvider.mjs"
     },
+    "./helpers/SessionStore": {
+      "types": "./dist/helpers/SessionStore.d.ts",
+      "import": "./dist/helpers/SessionStore.mjs"
+    },
+    "./helpers/sessionHint": {
+      "types": "./dist/helpers/sessionHint.d.ts",
+      "import": "./dist/helpers/sessionHint.mjs"
+    },
+    "./helpers/tokenClaims": {
+      "types": "./dist/helpers/tokenClaims.d.ts",
+      "import": "./dist/helpers/tokenClaims.mjs"
+    },
     "./hooks/useAuth": {
       "types": "./dist/hooks/useAuth/index.d.ts",
       "import": "./dist/hooks/useAuth/index.mjs"
@@ -41,13 +54,12 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.mjs"
     },
-    "./providers/Auth0Provider": {
-      "types": "./dist/providers/Auth0Provider.d.ts",
-      "import": "./dist/providers/Auth0Provider.mjs"
-    },
     "./providers/BasicAuthProvider": {
       "types": "./dist/providers/BasicAuthProvider.d.ts",
       "import": "./dist/providers/BasicAuthProvider.mjs"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts"
     }
   },
   "type": "module",
@@ -63,15 +75,15 @@
     "build:prod": "vite build && node ../sdk-shared/scripts/generate-exports.mjs"
   },
   "dependencies": {
-    "@plitzi/plitzi-ui": "^1.6.18",
-    "@plitzi/sdk-navigation": "0.32.25",
-    "@plitzi/sdk-schema": "0.32.25",
-    "@plitzi/sdk-shared": "0.32.25"
+    "@plitzi/plitzi-ui": "^1.6.19",
+    "@plitzi/sdk-navigation": "0.33.1",
+    "@plitzi/sdk-schema": "0.33.1",
+    "@plitzi/sdk-shared": "0.33.1"
   },
   "devDependencies": {
     "eslint": "^9.39.5",
     "typescript": "^6.0.3",
-    "vite": "^8.2.0",
+    "vite": "^8.2.1",
     "vitest": "^4.1.10"
   }
 }

package/dist/providers/Auth0Provider.d.ts

@@ -1,22 +0,0 @@
-import { default as AuthProvider, AuthProviderProps } from '../AuthProvider';
-import { Schema, TokenResult } from '@plitzi/sdk-shared';
-export type Auth0ProviderProps = AuthProviderProps & {
-    tokenStorage?: Schema['settings']['tokenStorage'];
-    loginUrl?: string;
-    userUrl?: string;
-    refreshUrl?: string;
-    logoutUrl?: string;
-    detailsPath?: string;
-    tokenPath?: string;
-    expirationTimePath?: string;
-};
-declare class Auth0Provider<T = Record<string, unknown>> extends AuthProvider<T> {
-    readonly name = "auth0";
-    init(): Promise<void>;
-    login(...args: unknown[]): Promise<TokenResult | undefined>;
-    getUser(): Promise<T | undefined>;
-    refresh(): Promise<TokenResult | undefined>;
-    can(permission: string): boolean;
-    logout(): Promise<void>;
-}
-export default Auth0Provider;

package/dist/providers/Auth0Provider.mjs

@@ -1,25 +0,0 @@
-import e from "../AuthProvider.mjs";
-//#region src/providers/Auth0Provider.ts
-var t = class extends e {
-	name = "auth0";
-	init() {
-		throw Error("Method not implemented.");
-	}
-	login(...e) {
-		throw console.log(e), Error("Method not implemented.");
-	}
-	getUser() {
-		throw Error("Method not implemented.");
-	}
-	refresh() {
-		throw Error("Method not implemented.");
-	}
-	can(e) {
-		throw console.log(e), Error("Method not implemented.");
-	}
-	logout() {
-		throw Error("Method not implemented.");
-	}
-};
-//#endregion
-export { t as default };