@sayren/storefront-sdk 0.5.0 → 0.6.0

package/dist/auth/index.d.mts

@@ -1,5 +1,28 @@
-import { a as AnonymousSession, c as TokenPair, l as WithdrawRequest, o as LoginRequest, s as SignupRequest, t as ApiError, u as WithdrawalBlockedDetails } from "../http-CxqZxTfE.mjs";
+import { a as AnonymousSession, c as LoginRequest, d as TokenPair, f as WithdrawRequest, l as SignupRequest, p as WithdrawalBlockedDetails, t as ApiError, u as SocialProvider } from "../http-CqAR0_w4.mjs";
 //#region src/auth/index.d.ts
+/** 소셜 로그인 시작 결과 — `codeVerifier`와 `state`는 돌아올 때까지 서버 세션(httpOnly 쿠키 등)에 보관한다 */
+export interface IdpStart {
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: string;
+  state: string;
+  codeVerifier: string;
+}
+export interface IdpCallbackInput {
+  /** 돌아온 주소의 `code`(성공) — 실패면 `error`가 온다 */
+  code: string | null;
+  /** 돌아온 주소의 `state` */
+  state: string | null;
+  /** `idp()`가 준 값 — 보관해 둔 것 */
+  expectedState: string;
+  codeVerifier: string;
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken?: string;
+}
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+export declare class IdpCallbackError extends Error {
+  readonly reason: "access_denied" | "state_mismatch" | "missing_code" | string;
+  constructor(reason: "access_denied" | "state_mismatch" | "missing_code" | string);
+}
 export interface StorefrontAuthOptions {
   /** 예: https://api.sayren.app/storefront/v1 */
   baseUrl: string;
@@ -30,6 +53,21 @@ export declare function createStorefrontAuth(options: StorefrontAuthOptions): {
   session(body: LoginRequest): Promise<TokenPair>;
   /** 회원가입 — 가입과 동시에 로그인 토큰을 받는다. `cartToken`을 주면 장바구니를 병합한다 */
   signUp(body: SignupRequest): Promise<TokenPair>;
+  /**
+   * 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+   * 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+   * `redirectUri`는 스토어프런트 도메인 목록 안이어야 한다
+   */
+  idp(provider: SocialProvider, options: {
+    redirectUri: string;
+  }): Promise<IdpStart>;
+  /**
+   * 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+   * `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+   */
+  idpCallback(input: IdpCallbackInput & {
+    error?: string | null;
+  }): Promise<TokenPair>;
   /** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
   refresh(refreshToken: string): Promise<TokenPair>;
   /**
@@ -46,4 +84,4 @@ export declare function createStorefrontAuth(options: StorefrontAuthOptions): {
 };
 export type StorefrontAuth = ReturnType<typeof createStorefrontAuth>;
 //#endregion
-export { type AnonymousSession, ApiError, type LoginRequest, type SignupRequest, type TokenPair, type WithdrawRequest, type WithdrawalBlockedDetails };
+export { type AnonymousSession, ApiError, type LoginRequest, type SignupRequest, type SocialProvider, type TokenPair, type WithdrawRequest, type WithdrawalBlockedDetails };

package/dist/auth/index.mjs

@@ -1,5 +1,26 @@
-import { it as ApiError, t as createStorefrontClient } from "../client-D-w3LIU2.mjs";
+import { ct as ApiError, t as createStorefrontClient } from "../client-Do9-LG5X.mjs";
 //#region src/auth/index.ts
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+var IdpCallbackError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`소셜 로그인을 마치지 못했어요 (${reason})`);
+		this.reason = reason;
+		this.name = "IdpCallbackError";
+	}
+};
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+	return base64url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function s256(verifier) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return base64url(new Uint8Array(digest));
+}
 /**
 * 구매자 인증 — 화면은 스토어프런트가 그리고, 계정 저장과 인증 처리는 sayren이 한다.
 * 어느 방식으로 로그인해도 결과는 같은 구매자 토큰(`TokenPair`)이고 `/me/*`·장바구니·주문 API에 그대로 쓴다.
@@ -36,6 +57,39 @@ function createStorefrontAuth(options) {
 		signUp(body) {
 			return client().auth.signup(body);
 		},
+		/**
+		* 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+		* 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+		* `redirectUri`는 스토어프런트 도메인 목록 안이어야 한다
+		*/
+		async idp(provider, options) {
+			const state = randomToken(24);
+			const codeVerifier = randomToken(32);
+			const { url } = await client().auth.idpAuthorize(provider, {
+				redirectUri: options.redirectUri,
+				codeChallenge: await s256(codeVerifier),
+				state
+			});
+			return {
+				url,
+				state,
+				codeVerifier
+			};
+		},
+		/**
+		* 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+		* `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+		*/
+		idpCallback(input) {
+			if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+			if (!input.state || input.state !== input.expectedState) return Promise.reject(new IdpCallbackError("state_mismatch"));
+			if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+			return client().auth.idpToken({
+				code: input.code,
+				codeVerifier: input.codeVerifier,
+				cartToken: input.cartToken
+			});
+		},
 		/** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
 		refresh(refreshToken) {
 			return client().auth.refresh(refreshToken);
@@ -63,4 +117,4 @@ function createStorefrontAuth(options) {
 	};
 }
 //#endregion
-export { ApiError, createStorefrontAuth };
+export { ApiError, IdpCallbackError, createStorefrontAuth };

package/dist/{client-D-w3LIU2.mjs → client-Do9-LG5X.mjs}

@@ -155,7 +155,12 @@ const anonymousSessionSchema = z.object({
 * 진행 중인 주문(결제 대기~배송 중)·클레임·결제가 있으면 409 `WITHDRAWAL_BLOCKED`, 비밀번호가 틀리면
 * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
 */
-const withdrawRequestSchema = z.object({ password: z.string().min(1) });
+const withdrawRequestSchema = z.object({ 
+/**
+* 비밀번호로 가입한 구매자는 필수. 소셜 로그인으로만 가입한 구매자는 비밀번호가 없어 생략하고, 대신 최근 10분 안에
+* 로그인한 액세스 토큰이어야 한다(아니면 403 `REAUTH_REQUIRED` — 다시 로그인한 뒤 호출)
+*/
+password: z.string().min(1).optional() });
 /** `WITHDRAWAL_BLOCKED`의 `error.details` — 탈퇴를 막는 항목 수 */
 const withdrawalBlockedDetailsSchema = z.object({
 	/** 결제 대기~배송 중인 주문 상품 */
@@ -165,6 +170,31 @@ const withdrawalBlockedDetailsSchema = z.object({
 	/** 승인 중이거나 결제창이 열려 있을 수 있는 결제(결제창은 만료되면 풀린다) */
 	pendingPayments: z.number().int()
 });
+/** 소셜 로그인 공급자 */
+const socialProviderSchema = z.enum([
+	"kakao",
+	"naver",
+	"google"
+]);
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+const idpAuthorizeRequestSchema = z.object({
+	/** 로그인을 마치고 돌아올 스토어프런트 주소. 스토어프런트 도메인 목록 안이어야 한다 */
+	redirectUri: z.url(),
+	/** base64url(SHA-256(codeVerifier)) */
+	codeChallenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	/** 스토어프런트가 만든 값 — 돌아올 때 그대로 붙어 온다. 세션에 저장해 두고 비교한다 */
+	state: z.string().min(16).max(128)
+});
+const idpAuthorizeResponseSchema = z.object({ 
+/** 구매자를 보낼 공급자 로그인 주소 */
+url: z.url() });
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+const idpTokenRequestSchema = z.object({
+	code: z.string().min(1),
+	codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+	/** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+	cartToken: z.string().optional()
+});
 //#endregion
 //#region src/schemas/cart.ts
 const cartItemSchema = z.object({
@@ -512,7 +542,8 @@ const createInquiryRequestSchema = z.object({
 //#region src/schemas/member.ts
 const memberSchema = z.object({
 	memberId: z.string(),
-	email: z.email(),
+	/** 소셜 가입에서 공급자가 이메일을 주지 않았으면 null */
+	email: z.email().nullable(),
 	name: z.string(),
 	phone: z.string().nullable(),
 	point: z.number().int(),
@@ -656,7 +687,16 @@ const storefrontStoreSchema = z.object({
 	* 비회원 주문 허용. false면 로그인하지 않은 구매자의 주문서 생성·결제 요청이 403 `GUEST_CHECKOUT_DISABLED`다.
 	* 장바구니 담기는 된다 — 주문 버튼을 로그인 안내로 바꾸면 된다
 	*/
-	guestCheckout: z.boolean()
+	guestCheckout: z.boolean(),
+	/**
+	* 켜진 로그인 방법 — 화면에 이 순서대로 버튼을 그리면 된다. `password`가 없으면 이메일·비밀번호 가입·로그인이 꺼져 있다
+	*/
+	loginMethods: z.array(z.enum([
+		"password",
+		"kakao",
+		"naver",
+		"google"
+	]))
 });
 //#endregion
 //#region src/client.ts
@@ -712,6 +752,10 @@ function createStorefrontClient(options) {
 			login: (body) => http.request("POST", "/auth/login", tokenPairSchema, { body: loginRequestSchema.parse(body) }),
 			refresh: (refreshToken) => http.request("POST", "/auth/token/refresh", tokenPairSchema, { body: { refreshToken } }),
 			logout: () => http.requestVoid("POST", "/auth/logout"),
+			/** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+			idpAuthorize: (provider, body) => http.request("POST", path`/auth/idp/${provider}/authorize`, idpAuthorizeResponseSchema, { body: idpAuthorizeRequestSchema.parse(body) }),
+			/** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+			idpToken: (body) => http.request("POST", "/auth/idp/token", tokenPairSchema, { body: idpTokenRequestSchema.parse(body) }),
 			/** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
 			withdraw: (body) => http.requestVoid("POST", "/auth/withdraw", { body: withdrawRequestSchema.parse(body) })
 		},
@@ -810,4 +854,4 @@ getStatus: (paymentId) => http.request("GET", path`/payments/${paymentId}`, paym
 	};
 }
 //#endregion
-export { loginRequestSchema as $, pageSchema as A, pgParamsSchema as B, claimTypeSchema as C, claimStatusSchema as D, myClaimSchema as E, createCheckoutRequestSchema as F, productDetailSchema as G, shippingAddressInputSchema as H, guestInfoSchema as I, addCartItemRequestSchema as J, productFacetsSchema as K, paymentMethodSchema as L, checkoutSessionSchema as M, confirmPaymentRequestSchema as N, orderItemStatusSchema as O, confirmPaymentResultSchema as P, anonymousSessionSchema as Q, paymentParamsSchema as R, claimReasonSchema as S, createClaimResultSchema as T, categoryNodeSchema as U, requestPaymentRequestSchema as V, productCardSchema as W, cartSchema as X, cartItemSchema as Y, updateCartItemRequestSchema as Z, createInquiryRequestSchema as _, publicReviewSchema as a, buildQuery as at, customerInquiryCategorySchema as b, writableReviewSchema as c, myOrderSchema as d, signupRequestSchema as et, orderShippingAddressSchema as f, updateProfileRequestSchema as g, memberSchema as h, createReviewResultSchema as i, ApiError as it, PAYMENT_STATUS_VALUES as j, pageInfoSchema as k, deliveryTrackingSchema as l, memberAddressSchema as m, storefrontStoreSchema as n, withdrawRequestSchema as nt, reviewSummarySchema as o, toApiError as ot, memberAddressRequestSchema as p, productSortSchema as q, createReviewRequestSchema as r, withdrawalBlockedDetailsSchema as rt, updateReviewRequestSchema as s, unwrapData as st, createStorefrontClient as t, tokenPairSchema as tt, myOrderItemSchema as u, publicInquirySchema as v, createClaimRequestSchema as w, customerInquirySchema as x, createCustomerInquiryRequestSchema as y, paymentStatusSchema as z };
+export { idpAuthorizeRequestSchema as $, pageSchema as A, pgParamsSchema as B, claimTypeSchema as C, claimStatusSchema as D, myClaimSchema as E, createCheckoutRequestSchema as F, productDetailSchema as G, shippingAddressInputSchema as H, guestInfoSchema as I, addCartItemRequestSchema as J, productFacetsSchema as K, paymentMethodSchema as L, checkoutSessionSchema as M, confirmPaymentRequestSchema as N, orderItemStatusSchema as O, confirmPaymentResultSchema as P, anonymousSessionSchema as Q, paymentParamsSchema as R, claimReasonSchema as S, createClaimResultSchema as T, categoryNodeSchema as U, requestPaymentRequestSchema as V, productCardSchema as W, cartSchema as X, cartItemSchema as Y, updateCartItemRequestSchema as Z, createInquiryRequestSchema as _, publicReviewSchema as a, tokenPairSchema as at, customerInquiryCategorySchema as b, writableReviewSchema as c, ApiError as ct, myOrderSchema as d, unwrapData as dt, idpAuthorizeResponseSchema as et, orderShippingAddressSchema as f, updateProfileRequestSchema as g, memberSchema as h, createReviewResultSchema as i, socialProviderSchema as it, PAYMENT_STATUS_VALUES as j, pageInfoSchema as k, deliveryTrackingSchema as l, buildQuery as lt, memberAddressSchema as m, storefrontStoreSchema as n, loginRequestSchema as nt, reviewSummarySchema as o, withdrawRequestSchema as ot, memberAddressRequestSchema as p, productSortSchema as q, createReviewRequestSchema as r, signupRequestSchema as rt, updateReviewRequestSchema as s, withdrawalBlockedDetailsSchema as st, createStorefrontClient as t, idpTokenRequestSchema as tt, myOrderItemSchema as u, toApiError as ut, publicInquirySchema as v, createClaimRequestSchema as w, customerInquirySchema as x, createCustomerInquiryRequestSchema as y, paymentStatusSchema as z };

package/dist/{http-CxqZxTfE.d.mts → http-CqAR0_w4.d.mts}

@@ -41,7 +41,7 @@ type AnonymousSession = z.infer<typeof anonymousSessionSchema>;
  * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
  */
 declare const withdrawRequestSchema: z.ZodObject<{
-  password: z.ZodString;
+  password: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type WithdrawRequest = z.infer<typeof withdrawRequestSchema>;
 /** `WITHDRAWAL_BLOCKED`의 `error.details` — 탈퇴를 막는 항목 수 */
@@ -51,6 +51,30 @@ declare const withdrawalBlockedDetailsSchema: z.ZodObject<{
   pendingPayments: z.ZodNumber;
 }, z.core.$strip>;
 type WithdrawalBlockedDetails = z.infer<typeof withdrawalBlockedDetailsSchema>;
+/** 소셜 로그인 공급자 */
+declare const socialProviderSchema: z.ZodEnum<{
+  kakao: "kakao";
+  naver: "naver";
+  google: "google";
+}>;
+type SocialProvider = z.infer<typeof socialProviderSchema>;
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+declare const idpAuthorizeRequestSchema: z.ZodObject<{
+  redirectUri: z.ZodURL;
+  codeChallenge: z.ZodString;
+  state: z.ZodString;
+}, z.core.$strip>;
+type IdpAuthorizeRequest = z.infer<typeof idpAuthorizeRequestSchema>;
+declare const idpAuthorizeResponseSchema: z.ZodObject<{
+  url: z.ZodURL;
+}, z.core.$strip>;
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+declare const idpTokenRequestSchema: z.ZodObject<{
+  code: z.ZodString;
+  codeVerifier: z.ZodString;
+  cartToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type IdpTokenRequest = z.infer<typeof idpTokenRequestSchema>;
 //#endregion
 //#region src/http.d.ts
 declare class ApiError extends Error {
@@ -68,4 +92,4 @@ type TokenSource = string | null | undefined | (() => string | null | undefined)
 type Query = Record<string, string | number | boolean | undefined>;
 declare function buildQuery(query?: Query): string;
 //#endregion
-export { AnonymousSession as a, TokenPair as c, anonymousSessionSchema as d, loginRequestSchema as f, withdrawalBlockedDetailsSchema as g, withdrawRequestSchema as h, buildQuery as i, WithdrawRequest as l, tokenPairSchema as m, Query as n, LoginRequest as o, signupRequestSchema as p, TokenSource as r, SignupRequest as s, ApiError as t, WithdrawalBlockedDetails as u };
+export { withdrawalBlockedDetailsSchema as C, withdrawRequestSchema as S, idpTokenRequestSchema as _, AnonymousSession as a, socialProviderSchema as b, LoginRequest as c, TokenPair as d, WithdrawRequest as f, idpAuthorizeResponseSchema as g, idpAuthorizeRequestSchema as h, buildQuery as i, SignupRequest as l, anonymousSessionSchema as m, Query as n, IdpAuthorizeRequest as o, WithdrawalBlockedDetails as p, TokenSource as r, IdpTokenRequest as s, ApiError as t, SocialProvider as u, loginRequestSchema as v, tokenPairSchema as x, signupRequestSchema as y };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as AnonymousSession, c as TokenPair, d as anonymousSessionSchema, f as loginRequestSchema, g as withdrawalBlockedDetailsSchema, h as withdrawRequestSchema, i as buildQuery, l as WithdrawRequest, m as tokenPairSchema, n as Query, o as LoginRequest, p as signupRequestSchema, r as TokenSource, s as SignupRequest, t as ApiError, u as WithdrawalBlockedDetails } from "./http-CxqZxTfE.mjs";
+import { C as withdrawalBlockedDetailsSchema, S as withdrawRequestSchema, _ as idpTokenRequestSchema, a as AnonymousSession, b as socialProviderSchema, c as LoginRequest, d as TokenPair, f as WithdrawRequest, g as idpAuthorizeResponseSchema, h as idpAuthorizeRequestSchema, i as buildQuery, l as SignupRequest, m as anonymousSessionSchema, n as Query, o as IdpAuthorizeRequest, p as WithdrawalBlockedDetails, r as TokenSource, s as IdpTokenRequest, t as ApiError, u as SocialProvider, v as loginRequestSchema, x as tokenPairSchema, y as signupRequestSchema } from "./http-CqAR0_w4.mjs";
 import { z } from "zod";
 //#region src/analytics-ids.d.ts
 /**
@@ -489,7 +489,7 @@ export type CreateInquiryRequest = z.infer<typeof createInquiryRequestSchema>;
 //#region src/schemas/member.d.ts
 export declare const memberSchema: z.ZodObject<{
   memberId: z.ZodString;
-  email: z.ZodEmail;
+  email: z.ZodNullable<z.ZodEmail>;
   name: z.ZodString;
   phone: z.ZodNullable<z.ZodString>;
   point: z.ZodNumber;
@@ -672,7 +672,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
   /** session.userinfo() 위임 — session 미전달 시 에러 */
   userinfo(): Promise<{
     memberId: string;
-    email: string;
+    email: string | null;
     name: string;
     phone: string | null;
     point: number;
@@ -701,6 +701,16 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
       expiresIn: number;
     }>;
     logout: () => Promise<void>;
+    /** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+    idpAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) => Promise<{
+      url: string;
+    }>;
+    /** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+    idpToken: (body: IdpTokenRequest) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      expiresIn: number;
+    }>;
     /** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
     withdraw: (body: WithdrawRequest) => Promise<void>;
   };
@@ -713,6 +723,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
       customerCenterPhone: string | null;
       businessHours: string | null;
       guestCheckout: boolean;
+      loginMethods: ("password" | "kakao" | "naver" | "google")[];
     }>;
   };
   catalog: {
@@ -1140,7 +1151,7 @@ export declare function createStorefrontClient(options: StorefrontClientOptions)
   member: {
     me: () => Promise<{
       memberId: string;
-      email: string;
+      email: string | null;
       name: string;
       phone: string | null;
       point: number;
@@ -1507,7 +1518,13 @@ export declare const storefrontStoreSchema: z.ZodObject<{
   customerCenterPhone: z.ZodNullable<z.ZodString>;
   businessHours: z.ZodNullable<z.ZodString>;
   guestCheckout: z.ZodBoolean;
+  loginMethods: z.ZodArray<z.ZodEnum<{
+    password: "password";
+    kakao: "kakao";
+    naver: "naver";
+    google: "google";
+  }>>;
 }, z.core.$strip>;
 export type StorefrontStore = z.infer<typeof storefrontStoreSchema>;
 //#endregion
-export { AnonymousSession, ApiError, LoginRequest, type Query, type SessionStorage, SignupRequest, type StorefrontClient, type StorefrontClientOptions, type StorefrontSession, type StorefrontSessionOptions, TokenPair, type TokenSource, WithdrawRequest, WithdrawalBlockedDetails, anonymousSessionSchema, buildQuery, loginRequestSchema, signupRequestSchema, tokenPairSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema };
+export { AnonymousSession, ApiError, IdpAuthorizeRequest, IdpTokenRequest, LoginRequest, type Query, type SessionStorage, SignupRequest, SocialProvider, type StorefrontClient, type StorefrontClientOptions, type StorefrontSession, type StorefrontSessionOptions, TokenPair, type TokenSource, WithdrawRequest, WithdrawalBlockedDetails, anonymousSessionSchema, buildQuery, idpAuthorizeRequestSchema, idpAuthorizeResponseSchema, idpTokenRequestSchema, loginRequestSchema, signupRequestSchema, socialProviderSchema, tokenPairSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema };

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { a as ANALYTICS_VISITOR_HEADER, c as analyticsClientEventSchema, i as ANALYTICS_VISITOR_COOKIE, l as analyticsIdSchema, n as ANALYTICS_SESSION_COOKIE, o as analyticsBatchSchema, r as ANALYTICS_SESSION_HEADER, s as analyticsClientEventNameSchema, t as ANALYTICS_MAX_BATCH_BYTES, u as analyticsServerEventNameSchema } from "./analytics-CgD70OqH.mjs";
 import { t as analyticsIdsFromCookie } from "./analytics-ids-COElZiI3.mjs";
-import { $ as loginRequestSchema, A as pageSchema, B as pgParamsSchema, C as claimTypeSchema, D as claimStatusSchema, E as myClaimSchema, F as createCheckoutRequestSchema, G as productDetailSchema, H as shippingAddressInputSchema, I as guestInfoSchema, J as addCartItemRequestSchema, K as productFacetsSchema, L as paymentMethodSchema, M as checkoutSessionSchema, N as confirmPaymentRequestSchema, O as orderItemStatusSchema, P as confirmPaymentResultSchema, Q as anonymousSessionSchema, R as paymentParamsSchema, S as claimReasonSchema, T as createClaimResultSchema, U as categoryNodeSchema, V as requestPaymentRequestSchema, W as productCardSchema, X as cartSchema, Y as cartItemSchema, Z as updateCartItemRequestSchema, _ as createInquiryRequestSchema, a as publicReviewSchema, at as buildQuery, b as customerInquiryCategorySchema, c as writableReviewSchema, d as myOrderSchema, et as signupRequestSchema, f as orderShippingAddressSchema, g as updateProfileRequestSchema, h as memberSchema, i as createReviewResultSchema, it as ApiError, j as PAYMENT_STATUS_VALUES, k as pageInfoSchema, l as deliveryTrackingSchema, m as memberAddressSchema, n as storefrontStoreSchema, nt as withdrawRequestSchema, o as reviewSummarySchema, ot as toApiError, p as memberAddressRequestSchema, q as productSortSchema, r as createReviewRequestSchema, rt as withdrawalBlockedDetailsSchema, s as updateReviewRequestSchema, st as unwrapData, t as createStorefrontClient, tt as tokenPairSchema, u as myOrderItemSchema, v as publicInquirySchema, w as createClaimRequestSchema, x as customerInquirySchema, y as createCustomerInquiryRequestSchema, z as paymentStatusSchema } from "./client-D-w3LIU2.mjs";
+import { $ as idpAuthorizeRequestSchema, A as pageSchema, B as pgParamsSchema, C as claimTypeSchema, D as claimStatusSchema, E as myClaimSchema, F as createCheckoutRequestSchema, G as productDetailSchema, H as shippingAddressInputSchema, I as guestInfoSchema, J as addCartItemRequestSchema, K as productFacetsSchema, L as paymentMethodSchema, M as checkoutSessionSchema, N as confirmPaymentRequestSchema, O as orderItemStatusSchema, P as confirmPaymentResultSchema, Q as anonymousSessionSchema, R as paymentParamsSchema, S as claimReasonSchema, T as createClaimResultSchema, U as categoryNodeSchema, V as requestPaymentRequestSchema, W as productCardSchema, X as cartSchema, Y as cartItemSchema, Z as updateCartItemRequestSchema, _ as createInquiryRequestSchema, a as publicReviewSchema, at as tokenPairSchema, b as customerInquiryCategorySchema, c as writableReviewSchema, ct as ApiError, d as myOrderSchema, dt as unwrapData, et as idpAuthorizeResponseSchema, f as orderShippingAddressSchema, g as updateProfileRequestSchema, h as memberSchema, i as createReviewResultSchema, it as socialProviderSchema, j as PAYMENT_STATUS_VALUES, k as pageInfoSchema, l as deliveryTrackingSchema, lt as buildQuery, m as memberAddressSchema, n as storefrontStoreSchema, nt as loginRequestSchema, o as reviewSummarySchema, ot as withdrawRequestSchema, p as memberAddressRequestSchema, q as productSortSchema, r as createReviewRequestSchema, rt as signupRequestSchema, s as updateReviewRequestSchema, st as withdrawalBlockedDetailsSchema, t as createStorefrontClient, tt as idpTokenRequestSchema, u as myOrderItemSchema, ut as toApiError, v as publicInquirySchema, w as createClaimRequestSchema, x as customerInquirySchema, y as createCustomerInquiryRequestSchema, z as paymentStatusSchema } from "./client-Do9-LG5X.mjs";
 //#region src/session.ts
 /** 세션 키 상수 — SDK가 소유한다. store-sdk와 겹치지 않는 별도 네임스페이스. */
 const STOREFRONT_SESSION_KEYS = {
@@ -124,4 +124,4 @@ function createStorefrontSession(options) {
 	};
 }
 //#endregion
-export { ANALYTICS_MAX_BATCH_BYTES, ANALYTICS_SESSION_COOKIE, ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_COOKIE, ANALYTICS_VISITOR_HEADER, ApiError, PAYMENT_STATUS_VALUES, STOREFRONT_SESSION_KEYS, addCartItemRequestSchema, analyticsBatchSchema, analyticsClientEventNameSchema, analyticsClientEventSchema, analyticsIdSchema, analyticsIdsFromCookie, analyticsServerEventNameSchema, anonymousSessionSchema, buildQuery, cartItemSchema, cartSchema, categoryNodeSchema, checkoutSessionSchema, claimReasonSchema, claimStatusSchema, claimTypeSchema, confirmPaymentRequestSchema, confirmPaymentResultSchema, createCheckoutRequestSchema, createClaimRequestSchema, createClaimResultSchema, createCustomerInquiryRequestSchema, createInquiryRequestSchema, createReviewRequestSchema, createReviewResultSchema, createStorefrontClient, createStorefrontSession, customerInquiryCategorySchema, customerInquirySchema, deliveryTrackingSchema, guestInfoSchema, loginRequestSchema, memberAddressRequestSchema, memberAddressSchema, memberSchema, myClaimSchema, myOrderItemSchema, myOrderSchema, orderItemStatusSchema, orderShippingAddressSchema, pageInfoSchema, pageSchema, paymentMethodSchema, paymentParamsSchema, paymentStatusSchema, pgParamsSchema, productCardSchema, productDetailSchema, productFacetsSchema, productSortSchema, publicInquirySchema, publicReviewSchema, requestPaymentRequestSchema, reviewSummarySchema, shippingAddressInputSchema, signupRequestSchema, storefrontStoreSchema, tokenPairSchema, updateCartItemRequestSchema, updateProfileRequestSchema, updateReviewRequestSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema, writableReviewSchema };
+export { ANALYTICS_MAX_BATCH_BYTES, ANALYTICS_SESSION_COOKIE, ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_COOKIE, ANALYTICS_VISITOR_HEADER, ApiError, PAYMENT_STATUS_VALUES, STOREFRONT_SESSION_KEYS, addCartItemRequestSchema, analyticsBatchSchema, analyticsClientEventNameSchema, analyticsClientEventSchema, analyticsIdSchema, analyticsIdsFromCookie, analyticsServerEventNameSchema, anonymousSessionSchema, buildQuery, cartItemSchema, cartSchema, categoryNodeSchema, checkoutSessionSchema, claimReasonSchema, claimStatusSchema, claimTypeSchema, confirmPaymentRequestSchema, confirmPaymentResultSchema, createCheckoutRequestSchema, createClaimRequestSchema, createClaimResultSchema, createCustomerInquiryRequestSchema, createInquiryRequestSchema, createReviewRequestSchema, createReviewResultSchema, createStorefrontClient, createStorefrontSession, customerInquiryCategorySchema, customerInquirySchema, deliveryTrackingSchema, guestInfoSchema, idpAuthorizeRequestSchema, idpAuthorizeResponseSchema, idpTokenRequestSchema, loginRequestSchema, memberAddressRequestSchema, memberAddressSchema, memberSchema, myClaimSchema, myOrderItemSchema, myOrderSchema, orderItemStatusSchema, orderShippingAddressSchema, pageInfoSchema, pageSchema, paymentMethodSchema, paymentParamsSchema, paymentStatusSchema, pgParamsSchema, productCardSchema, productDetailSchema, productFacetsSchema, productSortSchema, publicInquirySchema, publicReviewSchema, requestPaymentRequestSchema, reviewSummarySchema, shippingAddressInputSchema, signupRequestSchema, socialProviderSchema, storefrontStoreSchema, tokenPairSchema, updateCartItemRequestSchema, updateProfileRequestSchema, updateReviewRequestSchema, withdrawRequestSchema, withdrawalBlockedDetailsSchema, writableReviewSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sayren/storefront-sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
   "exports": {

package/src/auth/index.ts

@@ -4,6 +4,7 @@ import type {
   AnonymousSession,
   LoginRequest,
   SignupRequest,
+  SocialProvider,
   TokenPair,
   WithdrawRequest,
 } from "../schemas/auth";
@@ -14,11 +15,60 @@ export type {
   AnonymousSession,
   LoginRequest,
   SignupRequest,
+  SocialProvider,
   TokenPair,
   WithdrawalBlockedDetails,
   WithdrawRequest,
 } from "../schemas/auth";
 
+/** 소셜 로그인 시작 결과 — `codeVerifier`와 `state`는 돌아올 때까지 서버 세션(httpOnly 쿠키 등)에 보관한다 */
+export interface IdpStart {
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: string;
+  state: string;
+  codeVerifier: string;
+}
+
+export interface IdpCallbackInput {
+  /** 돌아온 주소의 `code`(성공) — 실패면 `error`가 온다 */
+  code: string | null;
+  /** 돌아온 주소의 `state` */
+  state: string | null;
+  /** `idp()`가 준 값 — 보관해 둔 것 */
+  expectedState: string;
+  codeVerifier: string;
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken?: string;
+}
+
+/** 소셜 로그인 실패 — 구매자가 취소했거나(`access_denied`) state가 맞지 않는다 */
+export class IdpCallbackError extends Error {
+  constructor(
+    public readonly reason: "access_denied" | "state_mismatch" | "missing_code" | string,
+  ) {
+    super(`소셜 로그인을 마치지 못했어요 (${reason})`);
+    this.name = "IdpCallbackError";
+  }
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes = 32): string {
+  return base64url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+
+async function s256(verifier: string): Promise<string> {
+  const digest = await globalThis.crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier),
+  );
+  return base64url(new Uint8Array(digest));
+}
+
 export interface StorefrontAuthOptions {
   /** 예: https://api.sayren.app/storefront/v1 */
   baseUrl: string;
@@ -65,6 +115,37 @@ export function createStorefrontAuth(options: StorefrontAuthOptions) {
     signUp(body: SignupRequest): Promise<TokenPair> {
       return client().auth.signup(body);
     },
+    /**
+     * 소셜 로그인 시작 — PKCE(S256)와 state를 만들고 공급자 로그인 주소를 받는다. 반환한 `state`·`codeVerifier`를
+     * 서버 세션에 보관하고 구매자를 `url`로 보낸다. 로그인을 마치면 `redirectUri`로 `?code=&state=`가 붙어 돌아온다.
+     * `redirectUri`는 스토어프런트 도메인 목록 안이어야 한다
+     */
+    async idp(provider: SocialProvider, options: { redirectUri: string }): Promise<IdpStart> {
+      const state = randomToken(24);
+      const codeVerifier = randomToken(32);
+      const { url } = await client().auth.idpAuthorize(provider, {
+        redirectUri: options.redirectUri,
+        codeChallenge: await s256(codeVerifier),
+        state,
+      });
+      return { url, state, codeVerifier };
+    },
+    /**
+     * 소셜 로그인 마무리 — 돌아온 `code`를 구매자 토큰으로 바꾼다. state가 다르거나 구매자가 취소했으면
+     * `IdpCallbackError`. code는 1회용이고 1분 안에 바꿔야 한다
+     */
+    idpCallback(input: IdpCallbackInput & { error?: string | null }): Promise<TokenPair> {
+      if (input.error) return Promise.reject(new IdpCallbackError(input.error));
+      if (!input.state || input.state !== input.expectedState) {
+        return Promise.reject(new IdpCallbackError("state_mismatch"));
+      }
+      if (!input.code) return Promise.reject(new IdpCallbackError("missing_code"));
+      return client().auth.idpToken({
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        cartToken: input.cartToken,
+      });
+    },
     /** 토큰 갱신 — refreshToken은 한 번 쓰면 폐기되고 새 쌍이 온다(회전) */
     refresh(refreshToken: string): Promise<TokenPair> {
       return client().auth.refresh(refreshToken);

package/src/client.ts

@@ -4,7 +4,13 @@ import { ANALYTICS_SESSION_HEADER, ANALYTICS_VISITOR_HEADER } from "./schemas/an
 import type { LoginRequest, SignupRequest } from "./schemas/auth";
 import {
   anonymousSessionSchema,
+  type IdpAuthorizeRequest,
+  type IdpTokenRequest,
+  idpAuthorizeRequestSchema,
+  idpAuthorizeResponseSchema,
+  idpTokenRequestSchema,
   loginRequestSchema,
+  type SocialProvider,
   signupRequestSchema,
   tokenPairSchema,
   type WithdrawRequest,
@@ -184,6 +190,16 @@ export function createStorefrontClient(options: StorefrontClientOptions) {
       refresh: (refreshToken: string) =>
         http.request("POST", "/auth/token/refresh", tokenPairSchema, { body: { refreshToken } }),
       logout: () => http.requestVoid("POST", "/auth/logout"),
+      /** 소셜 로그인 시작 — 공급자 로그인 주소를 받는다. PKCE·state는 `@sayren/storefront-sdk/auth`의 `idp()`가 만든다 */
+      idpAuthorize: (provider: SocialProvider, body: IdpAuthorizeRequest) =>
+        http.request("POST", path`/auth/idp/${provider}/authorize`, idpAuthorizeResponseSchema, {
+          body: idpAuthorizeRequestSchema.parse(body),
+        }),
+      /** 소셜 로그인 마무리 — 돌아온 1회용 code + codeVerifier를 구매자 토큰으로 바꾼다 */
+      idpToken: (body: IdpTokenRequest) =>
+        http.request("POST", "/auth/idp/token", tokenPairSchema, {
+          body: idpTokenRequestSchema.parse(body),
+        }),
       /** 구매자 탈퇴 — 로그인 상태(accessToken)에서 비밀번호로 본인 확인. 성공하면 토큰은 모두 무효 */
       withdraw: (body: WithdrawRequest) =>
         http.requestVoid("POST", "/auth/withdraw", { body: withdrawRequestSchema.parse(body) }),

package/src/schemas/auth.ts

@@ -61,7 +61,11 @@ export type AnonymousSession = z.infer<typeof anonymousSessionSchema>;
  * 403 `PASSWORD_MISMATCH`다(로그인과 같은 5회 잠금).
  */
 export const withdrawRequestSchema = z.object({
-  password: z.string().min(1),
+  /**
+   * 비밀번호로 가입한 구매자는 필수. 소셜 로그인으로만 가입한 구매자는 비밀번호가 없어 생략하고, 대신 최근 10분 안에
+   * 로그인한 액세스 토큰이어야 한다(아니면 403 `REAUTH_REQUIRED` — 다시 로그인한 뒤 호출)
+   */
+  password: z.string().min(1).optional(),
 });
 
 export type WithdrawRequest = z.infer<typeof withdrawRequestSchema>;
@@ -77,3 +81,32 @@ export const withdrawalBlockedDetailsSchema = z.object({
 });
 
 export type WithdrawalBlockedDetails = z.infer<typeof withdrawalBlockedDetailsSchema>;
+
+/** 소셜 로그인 공급자 */
+export const socialProviderSchema = z.enum(["kakao", "naver", "google"]);
+export type SocialProvider = z.infer<typeof socialProviderSchema>;
+
+/** `POST /auth/idp/{provider}/authorize` 본문 — PKCE(S256)와 state는 SDK가 만든다 */
+export const idpAuthorizeRequestSchema = z.object({
+  /** 로그인을 마치고 돌아올 스토어프런트 주소. 스토어프런트 도메인 목록 안이어야 한다 */
+  redirectUri: z.url(),
+  /** base64url(SHA-256(codeVerifier)) */
+  codeChallenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  /** 스토어프런트가 만든 값 — 돌아올 때 그대로 붙어 온다. 세션에 저장해 두고 비교한다 */
+  state: z.string().min(16).max(128),
+});
+export type IdpAuthorizeRequest = z.infer<typeof idpAuthorizeRequestSchema>;
+
+export const idpAuthorizeResponseSchema = z.object({
+  /** 구매자를 보낼 공급자 로그인 주소 */
+  url: z.url(),
+});
+
+/** `POST /auth/idp/token` 본문 — 돌아온 1회용 code를 구매자 토큰으로 바꾼다 */
+export const idpTokenRequestSchema = z.object({
+  code: z.string().min(1),
+  codeVerifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+  /** 비회원 장바구니 토큰 — 주면 회원 장바구니로 합친다 */
+  cartToken: z.string().optional(),
+});
+export type IdpTokenRequest = z.infer<typeof idpTokenRequestSchema>;

package/src/schemas/member.ts

@@ -2,7 +2,8 @@ import { z } from "zod";
 
 export const memberSchema = z.object({
   memberId: z.string(),
-  email: z.email(),
+  /** 소셜 가입에서 공급자가 이메일을 주지 않았으면 null */
+  email: z.email().nullable(),
   name: z.string(),
   phone: z.string().nullable(),
   point: z.number().int(),

package/src/schemas/store.ts

@@ -14,6 +14,10 @@ export const storefrontStoreSchema = z.object({
    * 장바구니 담기는 된다 — 주문 버튼을 로그인 안내로 바꾸면 된다
    */
   guestCheckout: z.boolean(),
+  /**
+   * 켜진 로그인 방법 — 화면에 이 순서대로 버튼을 그리면 된다. `password`가 없으면 이메일·비밀번호 가입·로그인이 꺼져 있다
+   */
+  loginMethods: z.array(z.enum(["password", "kakao", "naver", "google"])),
 });
 
 export type StorefrontStore = z.infer<typeof storefrontStoreSchema>;