@qelos/integrator-nuxt 4.0.0

package/src/sdk-factory.ts

@@ -0,0 +1,111 @@
+import QelosSDK from '@qelos/sdk';
+import type { QelosSDKOptions, FetchLike } from '@qelos/sdk/types';
+import type {
+  QelosNuxtRuntimeConfig,
+  QelosTokenPair,
+  ResolvedTokens,
+  TokenRefreshHook,
+} from './types';
+import type { H3Event } from 'h3';
+
+export interface CreateSdkParams {
+  config: QelosNuxtRuntimeConfig;
+  /**
+   * Tokens for the current request. The factory mutates this object in
+   * place when a token refresh occurs, so callers can read the latest pair
+   * after the SDK has been used.
+   */
+  tokens: QelosTokenPair;
+  event: H3Event;
+  onTokenRefresh?: TokenRefreshHook;
+}
+
+const NO_AUTH_URLS = new Set([
+  '/api/token/refresh',
+  '/api/cookie/refresh',
+  '/api/signin',
+  '/api/signup',
+]);
+
+export function createRequestSdk({ config, tokens, event, onTokenRefresh }: CreateSdkParams): QelosSDK {
+  let sdk: QelosSDK;
+  let refreshInFlight: Promise<void> | null = null;
+
+  const baseOptions: Partial<QelosSDKOptions> = config.sdkOptions || {};
+
+  async function performRefresh(): Promise<void> {
+    if (!tokens.refreshToken && !tokens.accessToken) {
+      throw new Error('no refresh token available');
+    }
+    const previous: QelosTokenPair = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+    };
+    let refreshed: ResolvedTokens;
+    if (tokens.refreshToken) {
+      const result = await sdk.authentication.refreshToken(tokens.refreshToken);
+      refreshed = {
+        accessToken: result.payload.token,
+        refreshToken: result.payload.refreshToken,
+      };
+    } else {
+      const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
+      refreshed = {
+        accessToken: result.payload.cookieToken,
+      };
+    }
+    tokens.accessToken = refreshed.accessToken;
+    tokens.refreshToken = refreshed.refreshToken;
+    if (onTokenRefresh) {
+      await onTokenRefresh({ event, oldTokens: previous, newTokens: refreshed, sdk });
+    }
+  }
+
+  function ensureRefresh(): Promise<void> {
+    if (!refreshInFlight) {
+      refreshInFlight = performRefresh().finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+
+  const options: QelosSDKOptions = {
+    appUrl: config.appUrl,
+    fetch: (globalThis.fetch as unknown as FetchLike),
+    forceRefresh: !config.apiToken,
+    ...baseOptions,
+  };
+
+  if (config.apiToken) {
+    options.apiToken = config.apiToken;
+  } else {
+    if (tokens.accessToken) {
+      options.accessToken = tokens.accessToken;
+    }
+    if (tokens.refreshToken) {
+      options.refreshToken = tokens.refreshToken;
+    }
+
+    options.extraHeaders = async (relativeUrl: string, forceRefresh?: boolean) => {
+      if (NO_AUTH_URLS.has(relativeUrl)) {
+        return {};
+      }
+      if (forceRefresh && tokens.refreshToken) {
+        await ensureRefresh();
+      }
+      const token = sdk?.authentication?.accessToken || tokens.accessToken;
+      if (token) {
+        return { authorization: 'Bearer ' + token };
+      }
+      return {};
+    };
+
+    options.onFailedRefreshToken = async () => {
+      await ensureRefresh();
+    };
+  }
+
+  sdk = new QelosSDK(options);
+  return sdk;
+}

package/src/types.ts

@@ -0,0 +1,91 @@
+import type QelosSDK from '@qelos/sdk';
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+import type { QelosSDKOptions } from '@qelos/sdk/types';
+
+export interface QelosTokenPair {
+  accessToken?: string;
+  refreshToken?: string;
+}
+
+export interface QelosNuxtRuntimeConfig {
+  /**
+   * Base URL of the Qelos backend (e.g. https://yourdomain.com).
+   */
+  appUrl: string;
+  /**
+   * Static API token used for service-to-service calls. When provided, no
+   * cookie/refresh-token handling is performed.
+   */
+  apiToken?: string;
+  /**
+   * Cookie name carrying the Qelos access token. Defaults to `q_access_token`.
+   */
+  accessTokenCookie?: string;
+  /**
+   * Cookie name carrying the Qelos refresh token. Defaults to `q_refresh_token`.
+   */
+  refreshTokenCookie?: string;
+  /**
+   * Path to mount the server middleware on. Defaults to `''` (every request).
+   */
+  middlewarePath?: string;
+  /**
+   * If true, the request is rejected (401) when the user cannot be resolved.
+   * Defaults to `false` — anonymous requests pass through with `event.context.qelos.user = null`.
+   */
+  requireAuth?: boolean;
+  /**
+   * Skip the middleware entirely for requests matching any of these path
+   * prefixes. Useful for `/api/_auth`, `/health`, etc.
+   */
+  skipPaths?: string[];
+  /**
+   * Optional extra options merged into the per-request SDK instance.
+   */
+  sdkOptions?: Partial<QelosSDKOptions>;
+}
+
+export interface ResolvedTokens {
+  accessToken: string;
+  refreshToken?: string;
+}
+
+export interface TokenRefreshContext {
+  event: import('h3').H3Event;
+  oldTokens: QelosTokenPair;
+  newTokens: ResolvedTokens;
+  sdk: QelosSDK;
+}
+
+export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
+
+export interface QelosRequestContext {
+  /**
+   * The authenticated user, or `null` when anonymous.
+   */
+  user: IUser | null;
+  /**
+   * The active workspace for the request, or `null` when none is active /
+   * the user is anonymous.
+   */
+  workspace: IWorkspace | null;
+  /**
+   * The full list of workspaces the user has access to.
+   */
+  workspaces: IWorkspace[];
+  /**
+   * SDK instance bound to the current request's tokens.
+   */
+  sdk: QelosSDK;
+  /**
+   * Tokens read from the request. Mutated when a refresh occurs.
+   */
+  tokens: QelosTokenPair;
+}
+
+declare module 'h3' {
+  interface H3EventContext {
+    qelos?: QelosRequestContext;
+  }
+}