@scayle/storefront-core 7.57.0 → 7.58.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @scayle/storefront-core
 
+## 7.58.1
+
+### Patch Changes
+
+- Fixed an issue by respecting `forceTokenRefresh` flag when calling the `getAccessToken` RPC
+
+## 7.58.0
+
+### Minor Changes
+
+- Deprecate `storefrontAccessToken` of `UserAuthentication`. Use `getAccessToken` RPC to get a valid access token instead.
+  Deprecated `loginShopId`. `loginShopId` is no longer needed, because each shop now has its own session cookie.
+- Add `getAccessToken` RPC to retrieve refreshed access tokens
+
 ## 7.57.0
 
 ### Minor Changes

package/dist/rpc/methods/checkout/checkout.cjs

@@ -5,10 +5,17 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.getCheckoutToken = void 0;
 var _jose = require("jose");
-const getCheckoutToken = exports.getCheckoutToken = async function getCheckoutToken2(jwtPayload, context) {
+var _user = require("../user.cjs");
+const getCheckoutToken = exports.getCheckoutToken = async function getCheckoutToken2(jwtPayload = {}, context) {
   if (!context.accessToken) {
     throw new Error("No access token present");
   }
+  const refreshedAccessToken = await (0, _user.getAccessToken)({
+    forceTokenRefresh: true
+  }, context);
+  if (refreshedAccessToken instanceof Response) {
+    return refreshedAccessToken;
+  }
   const secret = new TextEncoder().encode(context.checkout.secret);
   const now = /* @__PURE__ */new Date();
   const {
@@ -16,7 +23,7 @@ const getCheckoutToken = exports.getCheckoutToken = async function getCheckoutTo
     customData,
     preferredCollectionPoint,
     carrier
-  } = jwtPayload || {};
+  } = jwtPayload;
   const checkoutJwt = await new _jose.SignJWT({
     voucher,
     customData,
@@ -24,12 +31,12 @@ const getCheckoutToken = exports.getCheckoutToken = async function getCheckoutTo
     carrier,
     basketId: context.basketKey,
     campaignKey: context.campaignKey
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.56.0"}`).setProtectedHeader({
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.58.0"}`).setProtectedHeader({
     alg: "HS256",
     typ: "JWT"
   }).sign(secret);
   return {
-    accessToken: context.accessToken,
+    accessToken: refreshedAccessToken,
     checkoutJwt
   };
 };

package/dist/rpc/methods/checkout/checkout.d.ts

@@ -8,7 +8,7 @@ interface CheckoutJwtPayload {
     };
     carrier?: string;
 }
-export declare const getCheckoutToken: (jwtPayload: CheckoutJwtPayload | undefined, context: RpcContext) => Promise<{
+export declare const getCheckoutToken: (jwtPayload: CheckoutJwtPayload | undefined, context: RpcContext) => Promise<Response | {
     accessToken: string;
     checkoutJwt: string;
 }>;

package/dist/rpc/methods/checkout/checkout.mjs

@@ -1,11 +1,19 @@
 import { SignJWT } from "jose";
-export const getCheckoutToken = async function getCheckoutToken2(jwtPayload, context) {
+import { getAccessToken } from "../user.mjs";
+export const getCheckoutToken = async function getCheckoutToken2(jwtPayload = {}, context) {
   if (!context.accessToken) {
     throw new Error("No access token present");
   }
+  const refreshedAccessToken = await getAccessToken(
+    { forceTokenRefresh: true },
+    context
+  );
+  if (refreshedAccessToken instanceof Response) {
+    return refreshedAccessToken;
+  }
   const secret = new TextEncoder().encode(context.checkout.secret);
   const now = /* @__PURE__ */ new Date();
-  const { voucher, customData, preferredCollectionPoint, carrier } = jwtPayload || {};
+  const { voucher, customData, preferredCollectionPoint, carrier } = jwtPayload;
   const checkoutJwt = await new SignJWT({
     voucher,
     customData,
@@ -13,9 +21,9 @@ export const getCheckoutToken = async function getCheckoutToken2(jwtPayload, con
     carrier,
     basketId: context.basketKey,
     campaignKey: context.campaignKey
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.56.0"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.58.0"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
   return {
-    accessToken: context.accessToken,
+    accessToken: refreshedAccessToken,
     checkoutJwt
   };
 };

package/dist/rpc/methods/session.cjs

@@ -23,8 +23,7 @@ const convertErrorForRpcCall = (error, httpStatuses) => {
 };
 async function postLogin(context, tokens) {
   const user = await (0, _response.unwrap)((0, _user2.fetchUser)({
-    accessToken: tokens.access_token,
-    callback: ""
+    accessToken: tokens.access_token
   }, context));
   context.updateTokens({
     accessToken: tokens.access_token,

package/dist/rpc/methods/session.mjs

@@ -13,7 +13,7 @@ const convertErrorForRpcCall = (error, httpStatuses) => {
 };
 export async function postLogin(context, tokens) {
   const user = await unwrap(
-    fetchUser({ accessToken: tokens.access_token, callback: "" }, context)
+    fetchUser({ accessToken: tokens.access_token }, context)
   );
   context.updateTokens({
     accessToken: tokens.access_token,

package/dist/rpc/methods/user.cjs

@@ -3,9 +3,10 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.refreshUser = exports.getUser = exports.fetchUser = void 0;
+exports.refreshUser = exports.getUser = exports.getAccessToken = exports.fetchUser = void 0;
 var _types = require("../../types/index.cjs");
 var _customer = require("../../api/customer.cjs");
+var _oauth = require("../../api/oauth.cjs");
 const getUser = exports.getUser = function getUser2(context) {
   const {
     user,
@@ -23,10 +24,9 @@ const getUser = exports.getUser = function getUser2(context) {
     user
   };
 };
-const fetchUser = exports.fetchUser = async function fetchUser2(payload, context) {
-  const {
-    accessToken
-  } = payload;
+const fetchUser = exports.fetchUser = async function fetchUser2({
+  accessToken
+}, context) {
   const {
     shopId
   } = context;
@@ -44,36 +44,56 @@ const fetchUser = exports.fetchUser = async function fetchUser2(payload, context
 const refreshUser = exports.refreshUser = async function refreshUser2(context) {
   (0, _types.assertSession)(context);
   const {
-    accessToken,
-    shopId,
-    user
+    accessToken
   } = context;
   if (!accessToken) {
     return {
       user: void 0
     };
   }
-  const isLoggedIn = !!user;
-  const client = new _customer.CustomerAPIClient(context);
   try {
-    const user2 = await client.getMe(shopId);
-    if (!user2.authentication) {
-      user2.authentication = {
-        type: "idp"
-      };
-    }
-    user2.authentication.storefrontAccessToken = accessToken;
-    user2.loginShopId = shopId;
-    context.updateUser(user2);
+    const user = await fetchUser({
+      accessToken
+    }, context);
+    context.updateUser(user);
     return {
-      user: user2
+      user
     };
   } catch {
-    if (isLoggedIn) {
-      await context.destroySession();
-    }
+    await context.destroySession();
     return {
       user: void 0
     };
   }
+};
+const getAccessToken = exports.getAccessToken = async function getAccessToken2({
+  forceTokenRefresh = false
+}, context) {
+  (0, _types.assertSession)(context);
+  if (!context.accessToken) {
+    return new Response("No access token present", {
+      status: 401
+    });
+  }
+  if (forceTokenRefresh) {
+    if (!context.refreshToken) {
+      return new Response("No refresh token present", {
+        status: 401
+      });
+    }
+    const client = (0, _oauth.getOAuthClient)(context);
+    const tokens = await client.refreshToken({
+      grant_type: "refresh_token",
+      refresh_token: context.refreshToken
+    });
+    context.updateTokens({
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token
+    });
+    const user = await fetchUser({
+      accessToken: tokens.access_token
+    }, context);
+    context.updateUser(user);
+  }
+  return context.accessToken;
 };

package/dist/rpc/methods/user.d.ts

@@ -1,8 +1,10 @@
-import type { AuthConfig, RpcContext, ShopUser } from '../../types';
+import type { RpcContext, ShopUser } from '../../types';
 declare const getUser: (context: RpcContext) => {
     user: ShopUser | undefined;
 };
-declare const fetchUser: (payload: AuthConfig, context: RpcContext) => Promise<ShopUser>;
+declare const fetchUser: ({ accessToken }: {
+    accessToken?: string;
+}, context: RpcContext) => Promise<ShopUser>;
 /**
  * This function adds a way to force fetch the user from checkout.
  * In case the user is not logged in any longer the session will be destroyed and the returned user will be undefined.
@@ -14,4 +16,7 @@ declare const refreshUser: (context: RpcContext) => Promise<{
 } | {
     user: ShopUser;
 }>;
-export { getUser, fetchUser, refreshUser };
+declare const getAccessToken: ({ forceTokenRefresh }: {
+    forceTokenRefresh?: boolean | undefined;
+}, context: RpcContext) => Promise<string | Response>;
+export { getUser, fetchUser, refreshUser, getAccessToken };

package/dist/rpc/methods/user.mjs

@@ -1,5 +1,6 @@
 import { assertSession } from "../../types/index.mjs";
 import { CustomerAPIClient } from "../../api/customer.mjs";
+import { getOAuthClient } from "../../api/oauth.mjs";
 const getUser = function getUser2(context) {
   const { user, accessToken, shopId } = context;
   if (user) {
@@ -13,8 +14,7 @@ const getUser = function getUser2(context) {
     user
   };
 };
-const fetchUser = async function fetchUser2(payload, context) {
-  const { accessToken } = payload;
+const fetchUser = async function fetchUser2({ accessToken }, context) {
   const { shopId } = context;
   const client = new CustomerAPIClient(context);
   const user = await client.getMe(shopId, accessToken);
@@ -29,28 +29,43 @@ const fetchUser = async function fetchUser2(payload, context) {
 };
 const refreshUser = async function refreshUser2(context) {
   assertSession(context);
-  const { accessToken, shopId, user } = context;
+  const { accessToken } = context;
   if (!accessToken) {
     return { user: void 0 };
   }
-  const isLoggedIn = !!user;
-  const client = new CustomerAPIClient(context);
   try {
-    const user2 = await client.getMe(shopId);
-    if (!user2.authentication) {
-      user2.authentication = {
-        type: "idp"
-      };
-    }
-    user2.authentication.storefrontAccessToken = accessToken;
-    user2.loginShopId = shopId;
-    context.updateUser(user2);
-    return { user: user2 };
+    const user = await fetchUser({ accessToken }, context);
+    context.updateUser(user);
+    return { user };
   } catch {
-    if (isLoggedIn) {
-      await context.destroySession();
-    }
+    await context.destroySession();
     return { user: void 0 };
   }
 };
-export { getUser, fetchUser, refreshUser };
+const getAccessToken = async function getAccessToken2({ forceTokenRefresh = false }, context) {
+  assertSession(context);
+  if (!context.accessToken) {
+    return new Response("No access token present", { status: 401 });
+  }
+  if (forceTokenRefresh) {
+    if (!context.refreshToken) {
+      return new Response("No refresh token present", { status: 401 });
+    }
+    const client = getOAuthClient(context);
+    const tokens = await client.refreshToken({
+      grant_type: "refresh_token",
+      refresh_token: context.refreshToken
+    });
+    context.updateTokens({
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token
+    });
+    const user = await fetchUser(
+      { accessToken: tokens.access_token },
+      context
+    );
+    context.updateUser(user);
+  }
+  return context.accessToken;
+};
+export { getUser, fetchUser, refreshUser, getAccessToken };

package/dist/server.cjs

@@ -3,6 +3,13 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+var _exportNames = {
+  createClient: true,
+  RedisCache: true,
+  UnstorageCache: true,
+  CACHE_TIMEOUT: true,
+  initBapi: true
+};
 Object.defineProperty(exports, "CACHE_TIMEOUT", {
   enumerable: true,
   get: function () {
@@ -36,4 +43,28 @@ Object.defineProperty(exports, "initBapi", {
 var _redis = require("./cache/providers/redis.cjs");
 var _unstorage = require("./cache/providers/unstorage.cjs");
 var _cache = require("./constants/cache.cjs");
-var _init = require("./bapi/init.cjs");
+var _init = require("./bapi/init.cjs");
+var _customer = require("./api/customer.cjs");
+Object.keys(_customer).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _customer[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _customer[key];
+    }
+  });
+});
+var _oauth = require("./api/oauth.cjs");
+Object.keys(_oauth).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _oauth[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _oauth[key];
+    }
+  });
+});

package/dist/server.d.ts

@@ -3,3 +3,5 @@ export { UnstorageCache } from './cache/providers/unstorage';
 export { CACHE_TIMEOUT } from './constants/cache';
 export type { RedisOptions } from './cache/providers/redis';
 export { init as initBapi } from './bapi/init';
+export * from './api/customer';
+export * from './api/oauth';

package/dist/server.mjs

@@ -2,3 +2,5 @@ export { createClient, RedisCache } from "./cache/providers/redis.mjs";
 export { UnstorageCache } from "./cache/providers/unstorage.mjs";
 export { CACHE_TIMEOUT } from "./constants/cache.mjs";
 export { init as initBapi } from "./bapi/init.mjs";
+export * from "./api/customer.mjs";
+export * from "./api/oauth.mjs";

package/dist/types/api/auth.d.ts

@@ -1,4 +1,7 @@
 import type { Gender } from '../user';
+/**
+ * @deprecated
+ */
 export interface AuthConfig {
     callback: string;
     scopes?: string[];

package/dist/types/user.d.ts

@@ -20,6 +20,7 @@ interface UserAuthentication {
         accessToken?: string;
         userId?: string;
     };
+    /** @deprecated use `getAccessToken` RPC instead */
     storefrontAccessToken?: string;
     type: AuthenticationType;
 }
@@ -90,6 +91,7 @@ export interface ShopUser {
     customData?: {
         memberRoles?: MemberRole[];
     };
+    /** @deprecated `loginShopId` is no longer needed, because each shop now has it's own session cookie */
     loginShopId?: number;
 }
 export interface UseUserFacetParams {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-core",
-  "version": "7.57.0",
+  "version": "7.58.1",
   "description": "Collection of essential utilities to work with the Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -71,10 +71,10 @@
   "devDependencies": {
     "@scayle/eslint-config-storefront": "4.2.0",
     "@types/crypto-js": "4.2.2",
-    "@types/node": "20.14.2",
+    "@types/node": "20.14.5",
     "@types/webpack-env": "1.18.5",
     "@vitest/coverage-v8": "1.6.0",
-    "dprint": "0.46.2",
+    "dprint": "0.46.3",
     "eslint": "9.5.0",
     "eslint-formatter-gitlab": "5.1.0",
     "publint": "0.2.8",