@raisindb/client 0.4.1 → 0.4.2

package/dist/index.js

@@ -60,6 +60,7 @@ __export(src_exports, {
   HttpFunctionsApi: () => HttpFunctionsApi,
   HttpNodeTypes: () => HttpNodeTypes,
   HttpWorkspaceClient: () => HttpWorkspaceClient,
+  IdentityAuthApi: () => IdentityAuthApi,
   InboxApi: () => InboxApi,
   LocalStorageTokenStorage: () => LocalStorageTokenStorage,
   LogLevel: () => LogLevel,
@@ -135,6 +136,7 @@ __export(src_exports, {
   logger: () => logger,
   normalizeHomePath: () => normalizeHomePath,
   projectPlansFromMessages: () => projectPlansFromMessages,
+  readTokensFromFragment: () => readTokensFromFragment,
   rowsToObjects: () => rowsToObjects,
   setLogLevel: () => setLogLevel,
   sleep: () => sleep,
@@ -7039,6 +7041,101 @@ var McpClient = class {
   }
 };
 
+// src/identity-auth.ts
+var IdentityAuthApi = class {
+  constructor(repository, transport) {
+    this.repository = repository;
+    this.transport = transport;
+  }
+  get base() {
+    return `/auth/${encodeURIComponent(this.repository)}`;
+  }
+  /**
+   * Ask RaisinDB to email a sign-in link.
+   *
+   * The reply is an acknowledgement, never a token — the token only exists in
+   * the email. It also resolves for an address that has no account, because a
+   * response that differed would turn this endpoint into an account-existence
+   * oracle.
+   */
+  async sendMagicLink(email, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/magic-link`,
+      body: { email, redirect_url: options?.redirectUrl },
+      skipAuth: true
+    });
+  }
+  /**
+   * Exchange a magic-link token for a session.
+   *
+   * Most applications never call this: following the emailed link hits
+   * RaisinDB directly, which verifies and 302s to the redirect URL with the
+   * tokens in the URL **fragment** (so they stay out of server logs and out
+   * of the Referer header) — see {@link readTokensFromFragment}. Call this
+   * only when handling the token yourself, and note it is single-use.
+   */
+  async verifyMagicLink(token) {
+    return this.transport({
+      method: "GET",
+      path: `${this.base}/magic-link/verify?token=${encodeURIComponent(token)}`,
+      skipAuth: true
+    });
+  }
+  /** Sign in with email and password, where the repository enables it. */
+  async login(email, password, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/login`,
+      body: { email, password, remember_me: options?.rememberMe ?? false },
+      skipAuth: true
+    });
+  }
+  /** Create an account with email and password. */
+  async register(email, password, options) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/register`,
+      body: { email, password, display_name: options?.displayName },
+      skipAuth: true
+    });
+  }
+  /** Trade a refresh token for a fresh pair. */
+  async refresh(refreshToken) {
+    return this.transport({
+      method: "POST",
+      path: `${this.base}/refresh`,
+      body: { refresh_token: refreshToken },
+      skipAuth: true
+    });
+  }
+  /**
+   * Which sign-in methods to render.
+   *
+   * Ask rather than hard-code: magic link and password are per-repository
+   * configuration, and a button for a disabled method is a dead end.
+   */
+  async providers() {
+    return this.transport({
+      method: "GET",
+      path: `${this.base}/providers`,
+      skipAuth: true
+    });
+  }
+  /** Who the current token belongs to in this repository. */
+  async me() {
+    return this.transport({ method: "GET", path: `${this.base}/me` });
+  }
+};
+function readTokensFromFragment(hashOrUrl) {
+  const hash = hashOrUrl.includes("#") ? hashOrUrl.slice(hashOrUrl.indexOf("#") + 1) : hashOrUrl;
+  if (!hash) return null;
+  const params = new URLSearchParams(hash);
+  const accessToken = params.get("access_token");
+  if (!accessToken) return null;
+  return { accessToken, refreshToken: params.get("refresh_token") };
+}
+
 // src/http-client.ts
 var RaisinHttpClient = class extends import_events3.EventEmitter {
   constructor(baseUrl, options = {}) {
@@ -7437,6 +7534,65 @@ var RaisinHttpClient = class extends import_events3.EventEmitter {
     return this.authManager;
   }
   // ============================================================================
+  // Identity Authentication
+  // ============================================================================
+  /**
+   * Identity authentication (magic link, password, providers) for one
+   * repository.
+   *
+   * Identities are per repository — their home nodes and roles live there — so
+   * the repository is required rather than inferred from client state, which
+   * would silently sign somebody into whichever one happened to be current.
+   *
+   * ```ts
+   * const auth = client.auth('studio');
+   * await auth.sendMagicLink('a@example.com', {
+   *   redirectUrl: 'https://app.example.com/account/callback',
+   * });
+   * // …on the callback route:
+   * const tokens = readTokensFromFragment(window.location.hash);
+   * if (tokens) client.setIdentityTokens(tokens.accessToken, tokens.refreshToken);
+   * ```
+   */
+  auth(repository) {
+    return new IdentityAuthApi(repository, async (options) => {
+      const response = await this.request({
+        method: options.method,
+        path: options.path,
+        body: options.body,
+        skipAuth: options.skipAuth
+      });
+      return response.data;
+    });
+  }
+  /**
+   * Adopt an identity's tokens for every subsequent call on this client.
+   *
+   * Takes the loose form so it serves both callers: the whole result of a
+   * sign-in, and the pair recovered from a redirect fragment (which carries no
+   * identity object and may carry no refresh token).
+   */
+  setIdentityTokens(accessTokenOrResult, refreshToken) {
+    if (typeof accessTokenOrResult === "string") {
+      this.authManager.storage.setAccessToken(accessTokenOrResult);
+      if (refreshToken) this.authManager.storage.setRefreshToken(refreshToken);
+      return;
+    }
+    const result = accessTokenOrResult;
+    this.authManager.setTokens({
+      access_token: result.access_token,
+      refresh_token: result.refresh_token,
+      // The server reports an absolute expiry; AuthManager schedules from a
+      // duration. Deriving it here keeps the refresh timer honest instead of
+      // leaving it unset, which reads as "never expires".
+      expires_in: Math.max(0, result.expires_at - Math.floor(Date.now() / 1e3))
+    });
+  }
+  /** Forget the current identity's tokens. */
+  clearIdentityTokens() {
+    this.authManager.clear();
+  }
+  // ============================================================================
   // Upload Methods
   // ============================================================================
   /**
@@ -12317,6 +12473,7 @@ function createRaisinVue(vue) {
   HttpFunctionsApi,
   HttpNodeTypes,
   HttpWorkspaceClient,
+  IdentityAuthApi,
   InboxApi,
   LocalStorageTokenStorage,
   LogLevel,
@@ -12392,6 +12549,7 @@ function createRaisinVue(vue) {
   logger,
   normalizeHomePath,
   projectPlansFromMessages,
+  readTokensFromFragment,
   rowsToObjects,
   setLogLevel,
   sleep,