@rixl/sdk 0.8.0 → 0.8.1

package/dist/index.d.ts

@@ -11713,6 +11713,7 @@ interface AuthConfig {
 interface ConnectConfig {
   baseUrl: string;
   apiKey?: string;
+  token?: string;
   auth?: AuthConfig;
 }
 declare const connect: (config: ConnectConfig) => Promise<string | undefined>;

package/dist/index.js

@@ -2686,6 +2686,119 @@ function isWireErrorBody(error) {
 	return typeof error === "object" && error !== null;
 }
 let configured = false;
+let tokenResolver = getToken;
+function setTokenResolver(resolver) {
+	tokenResolver = resolver;
+}
+/**
+* Routes that do not require a Bearer token at the gateway edge. These
+* authenticate via credentials in the request body (or are webhooks verified by
+* signature), so attaching an Authorization header here would make the gateway
+* attempt to validate a stale/absent token and reject the request with 401.
+* Mirrors `publicRoutes` in backend/gateway/internal/routes/routes.go.
+*/
+const publicRoutes = [
+	{
+		method: "POST",
+		path: "/auth/v1/token"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/register"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/login"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/email/verify"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/email/verify/resend"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/password/reset"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/password/reset/confirm"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/verify-totp"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/verify-passkey"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/invitations/",
+		prefix: true
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/passkey/login/begin"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/passkey/login/finish"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/logout"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/blog/unsubscribe/email"
+	},
+	{
+		method: "POST",
+		path: "/auth/v1/blog/broadcast"
+	},
+	{
+		method: "GET",
+		path: "/media/v1/videos/",
+		prefix: true
+	},
+	{
+		method: "GET",
+		path: "/media/v1/images/",
+		prefix: true
+	},
+	{
+		method: "GET",
+		path: "/media/v1/languages"
+	},
+	{
+		method: "GET",
+		path: "/posts/v1/feeds/",
+		prefix: true
+	},
+	{
+		method: "POST",
+		path: "/billing/webhooks/stripe"
+	},
+	{
+		method: "POST",
+		path: "/webhooks/storage"
+	},
+	{
+		method: "POST",
+		path: "/platform/auth/v1/token"
+	},
+	{
+		method: "POST",
+		path: "/platform/auth/v1/refresh"
+	}
+];
+function isPublicRoute(method, pathname) {
+	const match = method.toUpperCase();
+	return publicRoutes.some(({ method: m, path, prefix }) => match === m && (prefix ? pathname.startsWith(path) : pathname === path));
+}
 function configureSdkClient() {
 	if (configured) return;
 	configured = true;
@@ -2695,8 +2808,8 @@ function configureSdkClient() {
 	});
 	client.interceptors.request.use(async (request) => {
 		if (request.headers.has("Authorization")) return request;
-		if (new URL(request.url).pathname.endsWith("/auth/v1/token")) return request;
-		const token = await getToken();
+		if (isPublicRoute(request.method, new URL(request.url).pathname)) return request;
+		const token = await tokenResolver();
 		if (token) request.headers.set("Authorization", `Bearer ${token}`);
 		return request;
 	});
@@ -3063,14 +3176,77 @@ const initSocials = async () => {
 	}
 };
 
+//#endregion
+//#region src/platform/platformAuthStore.ts
+const platformAccessToken = atom(void 0);
+const platformRefreshToken = atom(void 0);
+const platformExpireAt = atom(0);
+let currentPlatformTokenPromise = null;
+const setPlatformTokens = (access, refresh, expiresIn) => {
+	platformAccessToken.set(access);
+	platformRefreshToken.set(refresh);
+	platformExpireAt.set(Date.now() + expiresIn * 1e3);
+};
+const clearPlatformTokens = () => {
+	platformAccessToken.set(void 0);
+	platformRefreshToken.set(void 0);
+	platformExpireAt.set(0);
+};
+const exchangeApiKey = async (apiKey) => {
+	const { data } = await platformauthV1PlatformAuthServiceExchangeApiKey({
+		body: { api_key: apiKey },
+		throwOnError: true
+	});
+	if (!data.access_token || !data.refresh_token) throw new Error("Platform token exchange did not return tokens");
+	setPlatformTokens(data.access_token, data.refresh_token, Number(data.expires_in ?? 0));
+};
+const refreshPlatformAccessToken = async (refresh) => {
+	const { data } = await platformauthV1PlatformAuthServiceRefreshPlatformToken({
+		body: { refresh_token: refresh },
+		throwOnError: true
+	});
+	if (!data.access_token || !data.refresh_token) throw new Error("Platform token refresh did not return tokens");
+	setPlatformTokens(data.access_token, data.refresh_token, Number(data.expires_in ?? 0));
+};
+const ensureValidPlatformToken = async (refresh) => {
+	if (platformAccessToken.get() && !isTokenExpired(platformExpireAt.get())) return;
+	try {
+		await refreshPlatformAccessToken(refresh);
+	} catch (refreshError) {
+		console.error("Platform token refresh failed in getPlatformToken:", refreshError);
+		clearPlatformTokens();
+		throw refreshError;
+	}
+};
+const getPlatformToken = async () => {
+	if (currentPlatformTokenPromise) return currentPlatformTokenPromise;
+	const currentRefreshToken = platformRefreshToken.get();
+	if (!currentRefreshToken) return void 0;
+	currentPlatformTokenPromise = (async () => {
+		try {
+			await ensureValidPlatformToken(currentRefreshToken);
+			return platformAccessToken.get();
+		} finally {
+			currentPlatformTokenPromise = null;
+		}
+	})();
+	return currentPlatformTokenPromise;
+};
+
 //#endregion
 //#region src/connect.ts
 const connect = async (config) => {
+	apiURL.set(config.baseUrl);
 	client.setConfig({ baseUrl: config.baseUrl });
-	if (config.apiKey) client.interceptors.request.use(async (request) => {
-		request.headers.set("X-API-Key", config.apiKey);
-		return request;
-	});
+	if (config.apiKey) {
+		await exchangeApiKey(config.apiKey);
+		setTokenResolver(getPlatformToken);
+		configureSdkClient();
+	}
+	if (config.token) {
+		setTokenResolver(async () => config.token);
+		configureSdkClient();
+	}
 	if (config.auth) return initClient({
 		apiUrl: config.baseUrl,
 		loginRedirectUrl: config.auth.loginRedirectUrl,