@pylonsync/client 0.21.0 → 0.22.1

package/dist/index.d.ts

@@ -34,5 +34,5 @@ export type { RouteSpec, MatchedRoute } from "./router/match";
 export { useRouter, useParams, useSearchParams, usePathname, } from "./router/useRouter";
 export { useAuth } from "./hooks/useAuth";
 export type { UseAuthReturn } from "./hooks/useAuth";
-export { acceptInvite, ApiError, changePassword, completePasswordReset, ensureGuestSession, connectionAuthUrl, createApiKey, createInvite, createOrg, deleteOrg, renameOrg, listActiveSessions, listApiKeys, listAuthProviders, listInvites, listOrgMembers, listOrgs, passwordLogin, passwordRegister, persistSession, removeMember, requestPasswordReset, revokeAllSessions, revokeApiKey, revokeInvite, sendMagicLink, updateMemberRole, verifyMagicLink, } from "./lib/api";
-export type { ActiveSession, ApiKeyCreated, ApiKeySummary, AuthProvider, InviteResult, OrgMember, OrgSummary, PendingInvite, SessionResponse, } from "./lib/api";
+export { acceptInvite, acceptInviteById, myInvites, ApiError, changePassword, completePasswordReset, ensureGuestSession, connectionAuthUrl, createApiKey, createInvite, createOrg, deleteOrg, renameOrg, listActiveSessions, listApiKeys, listAuthProviders, listInvites, listOrgMembers, listOrgs, passwordLogin, passwordRegister, persistSession, removeMember, requestPasswordReset, revokeAllSessions, revokeApiKey, revokeInvite, sendMagicLink, updateMemberRole, verifyMagicLink, } from "./lib/api";
+export type { ActiveSession, ApiKeyCreated, ApiKeySummary, AuthProvider, InviteResult, OrgMember, OrgSummary, PendingInvite, MyInvite, SessionResponse, } from "./lib/api";

package/dist/lib/api.d.ts

@@ -114,6 +114,26 @@ export declare function acceptInvite(token: string): Promise<{
     org_id: string;
     role: string;
 }>;
+/** A pending invite addressed to the signed-in user's email. */
+export interface MyInvite {
+    id: string;
+    org_id: string;
+    email: string;
+    role: string;
+    invited_by: string;
+    created_at: number;
+    expires_at: number;
+}
+/**
+ * Pending invites for the signed-in user's verified email, across orgs.
+ * Rejects with `EMAIL_NOT_VERIFIED` until the User row has `emailVerified`.
+ */
+export declare function myInvites(): Promise<MyInvite[]>;
+/** Accept an invite from {@link myInvites} without the emailed token. */
+export declare function acceptInviteById(inviteId: string): Promise<{
+    org_id: string;
+    role: string;
+}>;
 export interface ConnectionAuthUrl {
     url: string;
 }

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.21.0",
+  "version": "0.22.1",
   "type": "module",
   "main": "src/index.ts",
   "types": "./dist/index.d.ts",
@@ -20,8 +20,8 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@pylonsync/react": "0.21.0",
-    "@pylonsync/sync": "0.21.0",
+    "@pylonsync/react": "0.22.1",
+    "@pylonsync/sync": "0.22.1",
     "clsx": "^2.1.1"
   },
   "peerDependencies": {

package/src/index.ts

@@ -91,6 +91,8 @@ export type { UseAuthReturn } from "./hooks/useAuth";
 // + error-mapping logic the built-in components use.
 export {
 	acceptInvite,
+	acceptInviteById,
+	myInvites,
 	ApiError,
 	changePassword,
 	completePasswordReset,
@@ -128,5 +130,6 @@ export type {
 	OrgMember,
 	OrgSummary,
 	PendingInvite,
+	MyInvite,
 	SessionResponse,
 } from "./lib/api";

package/src/lib/api.ts

@@ -85,10 +85,22 @@ async function get<T>(path: string): Promise<T> {
  * reset (e.g. "switch identity"), clear the token from storage and
  * call this again.
  */
-export async function ensureGuestSession(): Promise<SessionResponse | null> {
-	if (typeof window === "undefined") return null;
+export function ensureGuestSession(): Promise<SessionResponse | null> {
+	if (typeof window === "undefined") return Promise.resolve(null);
 	const existing = window.localStorage?.getItem(storageKey("token"));
-	if (existing) return null;
+	if (existing) return Promise.resolve(null);
+	// Concurrent callers (two <EnsureGuest> mounts, StrictMode's double
+	// effect) share one request, so the browser gets one guest identity.
+	if (guestInFlight) return guestInFlight;
+	guestInFlight = mintGuestSession().finally(() => {
+		guestInFlight = null;
+	});
+	return guestInFlight;
+}
+
+let guestInFlight: Promise<SessionResponse | null> | null = null;
+
+async function mintGuestSession(): Promise<SessionResponse | null> {
 	try {
 		const res = await fetch(`${getBaseUrl()}/api/auth/guest`, {
 			method: "POST",
@@ -288,6 +300,35 @@ export async function acceptInvite(
 	);
 }
 
+/** A pending invite addressed to the signed-in user's email. */
+export interface MyInvite {
+	id: string;
+	org_id: string;
+	email: string;
+	role: string;
+	invited_by: string;
+	created_at: number;
+	expires_at: number;
+}
+
+/**
+ * Pending invites for the signed-in user's verified email, across orgs.
+ * Rejects with `EMAIL_NOT_VERIFIED` until the User row has `emailVerified`.
+ */
+export async function myInvites(): Promise<MyInvite[]> {
+	return get<MyInvite[]>("/api/auth/invites/mine");
+}
+
+/** Accept an invite from {@link myInvites} without the emailed token. */
+export async function acceptInviteById(
+	inviteId: string,
+): Promise<{ org_id: string; role: string }> {
+	return post<{ org_id: string; role: string }>(
+		`/api/auth/invites/by-id/${encodeURIComponent(inviteId)}/accept`,
+		{},
+	);
+}
+
 export interface ConnectionAuthUrl {
 	url: string;
 }

package/src/lib/ensureGuestSession.test.ts

@@ -0,0 +1,89 @@
+// Two <EnsureGuest> mounts (or StrictMode's double effect) called
+// ensureGuestSession() at the same time; both saw no token and each minted
+// its own guest, so the browser ended up with two identities and the second
+// overwrote the first's token.
+
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const stored = new Map<string, string>();
+let sessionRefreshes = 0;
+
+mock.module("@pylonsync/react", () => ({
+	db: {
+		sync: {
+			notifySessionChanged: async () => {
+				sessionRefreshes += 1;
+			},
+		},
+	},
+	getBaseUrl: () => "http://test.invalid",
+	storageKey: (k: string) => `pylon:test:${k}`,
+}));
+
+const { ensureGuestSession } = await import("./api");
+
+const realFetch = globalThis.fetch;
+const realWindow = (globalThis as { window?: unknown }).window;
+let guestRequests = 0;
+
+beforeEach(() => {
+	stored.clear();
+	sessionRefreshes = 0;
+	guestRequests = 0;
+	(globalThis as { window?: unknown }).window = {
+		localStorage: {
+			getItem: (k: string) => stored.get(k) ?? null,
+			setItem: (k: string, v: string) => void stored.set(k, v),
+			removeItem: (k: string) => void stored.delete(k),
+		},
+	};
+	globalThis.fetch = (async (url: string) => {
+		if (String(url).endsWith("/api/auth/guest")) {
+			guestRequests += 1;
+			const n = guestRequests;
+			await new Promise((r) => setTimeout(r, 5));
+			return new Response(JSON.stringify({ token: `tok-${n}`, user_id: `guest_${n}` }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}
+		return new Response("{}", { status: 404 });
+	}) as typeof fetch;
+});
+
+afterEach(() => {
+	globalThis.fetch = realFetch;
+	(globalThis as { window?: unknown }).window = realWindow;
+});
+
+describe("ensureGuestSession", () => {
+	test("concurrent calls mint one guest session", async () => {
+		const [a, b, c] = await Promise.all([
+			ensureGuestSession(),
+			ensureGuestSession(),
+			ensureGuestSession(),
+		]);
+		expect(guestRequests).toBe(1);
+		expect(a?.user_id).toBe("guest_1");
+		expect(b?.user_id).toBe("guest_1");
+		expect(c?.user_id).toBe("guest_1");
+		expect(stored.get("pylon:test:token")).toBe("tok-1");
+		expect(sessionRefreshes).toBe(1);
+	});
+
+	test("a call after the session exists does not mint again", async () => {
+		await ensureGuestSession();
+		expect(await ensureGuestSession()).toBeNull();
+		expect(guestRequests).toBe(1);
+	});
+
+	test("a failed mint does not block a later retry", async () => {
+		globalThis.fetch = (async () => {
+			guestRequests += 1;
+			return new Response("{}", { status: 503 });
+		}) as unknown as typeof fetch;
+		expect(await ensureGuestSession()).toBeNull();
+		expect(await ensureGuestSession()).toBeNull();
+		expect(guestRequests).toBe(2);
+	});
+});