@roundtable-bb/sdk 0.1.6 → 0.1.12

package/src/request.ts

@@ -1,36 +1,74 @@
 export interface RoundtableClientOpts {
-  baseUrl: string
-  token?: string
+  baseURL: string;
+  token?: string;
+}
+
+interface RouteAuth {
+  acceptsApiKey?: boolean;
+  acceptsBetterAuth?: boolean;
+  acceptsTenantJwt?: boolean;
+  requiresToken?: boolean;
+  tenantUseCredentials?: boolean;
 }
 
 export async function request<T>(
   opts: RoundtableClientOpts,
   method: string,
   path: string,
-  options?: { body?: unknown; query?: Record<string, unknown>; useCredentials?: boolean },
+  options?: {
+    body?: unknown;
+    query?: Record<string, unknown>;
+    useCredentials?: boolean;
+    routeAuth?: RouteAuth;
+  },
 ): Promise<T> {
-  const url = new URL(`${opts.baseUrl}${path}`)
+  const routeAuth = options?.routeAuth;
+  let useCredentials = options?.useCredentials ?? false;
+
+  // Decide auth strategy
+  if (routeAuth) {
+    // TenantClient: use credentials if explicitly required by route
+    if (routeAuth.tenantUseCredentials) {
+      useCredentials = true;
+    }
+    // If token is available, use it (prefer token over credentials)
+    else if (opts.token && routeAuth.acceptsApiKey) {
+      useCredentials = false;
+    }
+    // If no token but route accepts better-auth: use credentials
+    else if (!opts.token && routeAuth.acceptsBetterAuth) {
+      useCredentials = true;
+    }
+    // Otherwise: make request without auth (backend will respond 401/403 if needed)
+  }
+
+  const url = new URL(`${opts.baseURL}${path}`);
   if (options?.query) {
     for (const [k, v] of Object.entries(options.query)) {
-      if (v !== undefined && v !== null) url.searchParams.set(k, String(v))
+      if (v !== undefined && v !== null) url.searchParams.set(k, String(v));
     }
   }
 
   const res = await fetch(url.toString(), {
     method,
-    credentials: options?.useCredentials ? 'include' : undefined,
+    credentials: useCredentials ? 'include' : undefined,
     headers: {
-      ...(options?.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
-      ...(opts.token ? { Authorization: `Bearer ${opts.token}` } : {}),
+      ...(options?.body !== undefined
+        ? { 'Content-Type': 'application/json' }
+        : {}),
+      ...(opts.token && !useCredentials
+        ? { Authorization: `Bearer ${opts.token}` }
+        : {}),
     },
-    body: options?.body !== undefined ? JSON.stringify(options.body) : undefined,
-  })
+    body:
+      options?.body !== undefined ? JSON.stringify(options.body) : undefined,
+  });
 
-  if (res.status === 204) return undefined as T
+  if (res.status === 204) return undefined as T;
   if (!res.ok) {
-    const err = await res.json().catch(() => ({ message: res.statusText }))
-    const msg = (err as { message?: string }).message ?? res.statusText
-    throw Object.assign(new Error(msg), { status: res.status })
+    const err = await res.json().catch(() => ({ message: res.statusText }));
+    const msg = (err as { message?: string }).message ?? res.statusText;
+    throw Object.assign(new Error(msg), { status: res.status });
   }
-  return res.json() as Promise<T>
+  return (await res.json()) as T;
 }