@seaverse/auth-sdk 0.2.0 → 0.2.2

package/dist/index.cjs

@@ -1042,7 +1042,7 @@ class AuthFactory {
 const ENVIRONMENT_CONFIGS = {
     production: {
         name: 'production',
-        baseURL: 'https://api.seaverse.com',
+        baseURL: 'https://account-hub.seaverse.ai',
         wsURL: 'wss://api.seaverse.com',
         isProduction: true,
     },
@@ -1226,6 +1226,31 @@ class SeaVerseBackendAPIClient {
             ],
         };
     }
+    /**
+     * Set authentication token
+     * Update the client's authentication token (useful after OAuth login)
+     *
+     * @param token - JWT token to set
+     *
+     * @example
+     * // After OAuth login
+     * const token = new URLSearchParams(window.location.search).get('token');
+     * if (token) {
+     *   client.setToken(token);
+     *   localStorage.setItem('token', token);
+     * }
+     */
+    setToken(token) {
+        const auth = AuthFactory.create({
+            type: 'jwt',
+            credentials: {
+                type: 'jwt',
+                token,
+            },
+        });
+        // Update the httpClient's auth
+        this.httpClient.auth = auth;
+    }
     // ============================================================================
     // Authentication & OAuth APIs
     // ============================================================================
@@ -1373,36 +1398,39 @@ class SeaVerseBackendAPIClient {
     // OAuth APIs
     // ============================================================================
     /**
-     * Exchange Google code for token
-     * Exchange Google authorization code for JWT token (for app)
-     */
-    async googleCodeToToken(data, options) {
+     * Google OAuth authorization (Backend Proxy Mode)
+     * Generate OAuth authorization URL for Google login
+     *
+     * @param data - OAuth authorize request (return_url is optional, defaults to window.location.origin)
+     * @param options - Additional axios request options
+     *
+     * @example
+     * // 使用默认 return_url (当前页面)
+     * const { authorize_url } = await client.googleAuthorize();
+     * window.location.href = authorize_url;
+     *
+     * @example
+     * // 自定义 return_url
+     * const { authorize_url } = await client.googleAuthorize({
+     *   return_url: 'https://mygame.com/dashboard'
+     * });
+     * window.location.href = authorize_url;
+     */
+    async googleAuthorize(data, options) {
+        // 如果没有传 return_url，使用当前页面地址
+        const return_url = data?.return_url || (typeof window !== 'undefined' ? window.location.origin : '');
         const config = {
             method: 'POST',
-            url: `/sdk/v1/auth/google/code2token`,
-            data,
+            url: `/sdk/v1/auth/google/authorize`,
+            data: { return_url },
             headers: {
-                'X-Operation-Id': 'googleCodeToToken',
+                'X-Operation-Id': 'googleAuthorize',
                 ...options?.headers,
             },
             ...options,
         };
         const response = await this.httpClient.request(config);
-        // ✅ API返回格式: { data: { token, tempUserId, ... }, success: true }
-        const apiData = response.data?.data || response.data;
-        if (!apiData || !apiData.token) {
-            throw new Error('No token in API response');
-        }
-        return {
-            token: apiData.token,
-            user: {
-                id: apiData.tempUserId || apiData.userId || apiData.id,
-                email: apiData.email,
-                username: apiData.username,
-                ...(apiData.provider && { provider: apiData.provider }),
-                ...(apiData.requiresInvitationCode !== undefined && { requiresInvitationCode: apiData.requiresInvitationCode }),
-            }
-        };
+        return response.data;
     }
     /**
      * Unlink Google account
@@ -1422,35 +1450,27 @@ class SeaVerseBackendAPIClient {
         return response.data;
     }
     /**
-     * Exchange Discord code for token
+     * Discord OAuth authorization (Backend Proxy Mode)
+     * Generate OAuth authorization URL for Discord login
+     *
+     * @param data - OAuth authorize request (return_url is optional, defaults to window.location.origin)
+     * @param options - Additional axios request options
      */
-    async discordCodeToToken(data, options) {
+    async discordAuthorize(data, options) {
+        // 如果没有传 return_url，使用当前页面地址
+        const return_url = data?.return_url || (typeof window !== 'undefined' ? window.location.origin : '');
         const config = {
             method: 'POST',
-            url: `/sdk/v1/auth/discord/code2token`,
-            data,
+            url: `/sdk/v1/auth/discord/authorize`,
+            data: { return_url },
             headers: {
-                'X-Operation-Id': 'discordCodeToToken',
+                'X-Operation-Id': 'discordAuthorize',
                 ...options?.headers,
             },
             ...options,
         };
         const response = await this.httpClient.request(config);
-        // ✅ API返回格式: { data: { token, tempUserId, ... }, success: true }
-        const apiData = response.data?.data || response.data;
-        if (!apiData || !apiData.token) {
-            throw new Error('No token in API response');
-        }
-        return {
-            token: apiData.token,
-            user: {
-                id: apiData.tempUserId || apiData.userId || apiData.id,
-                email: apiData.email,
-                username: apiData.username,
-                ...(apiData.provider && { provider: apiData.provider }),
-                ...(apiData.requiresInvitationCode !== undefined && { requiresInvitationCode: apiData.requiresInvitationCode }),
-            }
-        };
+        return response.data;
     }
     /**
      * Unlink Discord account
@@ -1469,46 +1489,27 @@ class SeaVerseBackendAPIClient {
         return response.data;
     }
     /**
-     * Exchange GitHub code for token
+     * GitHub OAuth authorization (Backend Proxy Mode)
+     * Generate OAuth authorization URL for GitHub login
+     *
+     * @param data - OAuth authorize request (return_url is optional, defaults to window.location.origin)
+     * @param options - Additional axios request options
      */
-    async githubCodeToToken(data, options) {
+    async githubAuthorize(data, options) {
+        // 如果没有传 return_url，使用当前页面地址
+        const return_url = data?.return_url || (typeof window !== 'undefined' ? window.location.origin : '');
         const config = {
             method: 'POST',
-            url: `/sdk/v1/auth/github/code2token`,
-            data,
+            url: `/sdk/v1/auth/github/authorize`,
+            data: { return_url },
             headers: {
-                'X-Operation-Id': 'githubCodeToToken',
+                'X-Operation-Id': 'githubAuthorize',
                 ...options?.headers,
             },
             ...options,
         };
-        console.log('🔐 [SDK Client] Calling githubCodeToToken with config:', config);
         const response = await this.httpClient.request(config);
-        console.log('📡 [SDK Client] Raw response.data:', response.data);
-        // ✅ API返回格式: { data: { token, tempUserId, email, ... }, success: true }
-        // 需要访问 response.data.data 而不是 response.data
-        const apiData = response.data?.data || response.data;
-        console.log('📡 [SDK Client] Extracted apiData:', apiData);
-        console.log('📡 [SDK Client] apiData.token:', apiData?.token);
-        if (!apiData || !apiData.token) {
-            console.error('❌ [SDK Client] No token found!');
-            console.error('❌ [SDK Client] response.data:', JSON.stringify(response.data, null, 2));
-            throw new Error('No token in API response');
-        }
-        // 构造符合SDK期望的响应格式
-        const normalizedResponse = {
-            token: apiData.token,
-            user: {
-                id: apiData.tempUserId || apiData.userId || apiData.id,
-                email: apiData.email,
-                username: apiData.username,
-                // 保留额外的字段
-                ...(apiData.provider && { provider: apiData.provider }),
-                ...(apiData.requiresInvitationCode !== undefined && { requiresInvitationCode: apiData.requiresInvitationCode }),
-            }
-        };
-        console.log('✅ [SDK Client] Normalized response:', normalizedResponse);
-        return normalizedResponse;
+        return response.data;
     }
     /**
      * Unlink GitHub account
@@ -1962,9 +1963,9 @@ class AuthModal {
         submitBtn.appendChild(btnText);
         submitBtn.appendChild(btnLoader);
         form.appendChild(submitBtn);
-        // OAuth buttons - only show if configured
-        const hasOAuth = this.options.oauthConfig &&
-            (this.options.oauthConfig.google || this.options.oauthConfig.discord || this.options.oauthConfig.github);
+        // OAuth buttons - only show if enabled
+        const hasOAuth = this.options.enableOAuth &&
+            (this.options.enableOAuth.google || this.options.enableOAuth.discord || this.options.enableOAuth.github);
         if (hasOAuth) {
             // Divider
             const divider = document.createElement('div');
@@ -1974,13 +1975,13 @@ class AuthModal {
             // Social buttons grid (Google + GitHub)
             const socialGrid = document.createElement('div');
             socialGrid.className = 'social-buttons-grid';
-            // Google button - only if configured
-            if (this.options.oauthConfig?.google) {
+            // Google button - only if enabled
+            if (this.options.enableOAuth?.google) {
                 const googleBtn = this.createSocialButton('google', 'Google', 'login');
                 socialGrid.appendChild(googleBtn);
             }
             // GitHub button - only if configured
-            if (this.options.oauthConfig?.github) {
+            if (this.options.enableOAuth?.github) {
                 const githubBtn = this.createSocialButton('github', 'Github', 'login');
                 socialGrid.appendChild(githubBtn);
             }
@@ -1989,7 +1990,7 @@ class AuthModal {
                 form.appendChild(socialGrid);
             }
             // Discord button (full width) - only if configured
-            if (this.options.oauthConfig?.discord) {
+            if (this.options.enableOAuth?.discord) {
                 const discordBtn = this.createSocialButton('discord', 'Discord', 'login', true);
                 form.appendChild(discordBtn);
             }
@@ -2066,24 +2067,38 @@ class AuthModal {
         submitBtn.appendChild(btnText);
         submitBtn.appendChild(btnLoader);
         form.appendChild(submitBtn);
-        // Divider
-        const divider = document.createElement('div');
-        divider.className = 'divider';
-        divider.textContent = 'OR SIGN UP WITH';
-        form.appendChild(divider);
-        // Social buttons grid (Google + GitHub)
-        const socialGrid = document.createElement('div');
-        socialGrid.className = 'social-buttons-grid';
-        // Google button
-        const googleBtn = this.createSocialButton('google', 'Google', 'signup');
-        socialGrid.appendChild(googleBtn);
-        // GitHub button
-        const githubBtn = this.createSocialButton('github', 'Github', 'signup');
-        socialGrid.appendChild(githubBtn);
-        form.appendChild(socialGrid);
-        // Discord button (full width)
-        const discordBtn = this.createSocialButton('discord', 'Discord', 'signup', true);
-        form.appendChild(discordBtn);
+        // OAuth buttons - only show if enabled
+        const hasOAuth = this.options.enableOAuth &&
+            (this.options.enableOAuth.google || this.options.enableOAuth.discord || this.options.enableOAuth.github);
+        if (hasOAuth) {
+            // Divider
+            const divider = document.createElement('div');
+            divider.className = 'divider';
+            divider.textContent = 'OR SIGN UP WITH';
+            form.appendChild(divider);
+            // Social buttons grid (Google + GitHub)
+            const socialGrid = document.createElement('div');
+            socialGrid.className = 'social-buttons-grid';
+            // Google button - only if enabled
+            if (this.options.enableOAuth?.google) {
+                const googleBtn = this.createSocialButton('google', 'Google', 'signup');
+                socialGrid.appendChild(googleBtn);
+            }
+            // GitHub button - only if configured
+            if (this.options.enableOAuth?.github) {
+                const githubBtn = this.createSocialButton('github', 'Github', 'signup');
+                socialGrid.appendChild(githubBtn);
+            }
+            // Only add grid if it has buttons
+            if (socialGrid.children.length > 0) {
+                form.appendChild(socialGrid);
+            }
+            // Discord button (full width) - only if configured
+            if (this.options.enableOAuth?.discord) {
+                const discordBtn = this.createSocialButton('discord', 'Discord', 'signup', true);
+                form.appendChild(discordBtn);
+            }
+        }
         container.appendChild(form);
         return container;
     }
@@ -2499,134 +2514,74 @@ class AuthModal {
     // OAuth Methods
     // ============================================================================
     /**
-     * Start OAuth flow for a given provider
-     */
-    startOAuthFlow(provider) {
-        const config = this.options.oauthConfig?.[provider];
-        if (!config) {
-            this.showError(`${provider} OAuth is not configured`);
-            return;
-        }
-        // Store the current state (to verify callback)
-        // ✅ 使用 localStorage 而不是 sessionStorage，避免跨页面跳转时丢失
-        const state = this.generateRandomState();
-        localStorage.setItem('oauth_state', state);
-        localStorage.setItem('oauth_provider', provider);
-        // Build authorization URL
-        const authUrl = this.buildAuthUrl(provider, config, state);
-        // Redirect to OAuth provider
-        window.location.href = authUrl;
-    }
-    /**
-     * Generate random state for CSRF protection
-     */
-    generateRandomState() {
-        const array = new Uint8Array(32);
-        crypto.getRandomValues(array);
-        return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
-    }
-    /**
-     * Build authorization URL for each provider
+     * Start OAuth flow for a given provider (Backend Proxy Mode)
+     *
+     * This method calls the backend /authorize endpoint to get the OAuth URL,
+     * then redirects the user. The backend handles:
+     * - State token generation and storage
+     * - OAuth callback processing
+     * - JWT token generation
+     * - Redirecting back to returnUrl with token
      */
-    buildAuthUrl(provider, config, state) {
-        const params = new URLSearchParams({
-            client_id: config.clientId,
-            redirect_uri: config.redirectUri,
-            state,
-            response_type: 'code',
-        });
-        // Provider-specific configurations
-        switch (provider) {
-            case 'google':
-                params.append('scope', config.scope || 'openid email profile');
-                params.append('access_type', 'offline');
-                params.append('prompt', 'consent');
-                return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
-            case 'discord':
-                params.append('scope', config.scope || 'identify email');
-                return `https://discord.com/api/oauth2/authorize?${params.toString()}`;
-            case 'github':
-                params.append('scope', config.scope || 'read:user user:email');
-                return `https://github.com/login/oauth/authorize?${params.toString()}`;
-            default:
-                throw new Error(`Unknown provider: ${provider}`);
-        }
-    }
-    /**
-     * Handle OAuth callback
-     * Call this method from your redirect page with the code and state from URL
-     */
-    async handleOAuthCallback(code, state) {
+    async startOAuthFlow(provider) {
         try {
-            // Verify state
-            // ✅ 使用 localStorage 而不是 sessionStorage
-            const storedState = localStorage.getItem('oauth_state');
-            const provider = localStorage.getItem('oauth_provider');
-            if (!storedState || storedState !== state) {
-                throw new Error('Invalid state parameter - possible CSRF attack');
-            }
-            if (!provider) {
-                throw new Error('No provider stored in session');
-            }
-            // Clear stored state
-            localStorage.removeItem('oauth_state');
-            localStorage.removeItem('oauth_provider');
-            // Exchange code for token using the appropriate SDK method
-            let response;
+            // Get the return URL (where user should be redirected after OAuth)
+            const return_url = this.options.returnUrl || window.location.origin;
+            // Call backend to get OAuth authorization URL
+            let authorizeUrl;
             switch (provider) {
                 case 'google':
-                    response = await this.client.googleCodeToToken({ code });
+                    const googleResult = await this.client.googleAuthorize({ return_url });
+                    authorizeUrl = googleResult.authorize_url;
                     break;
                 case 'discord':
-                    response = await this.client.discordCodeToToken({ code });
+                    const discordResult = await this.client.discordAuthorize({ return_url });
+                    authorizeUrl = discordResult.authorize_url;
                     break;
                 case 'github':
-                    response = await this.client.githubCodeToToken({ code });
+                    const githubResult = await this.client.githubAuthorize({ return_url });
+                    authorizeUrl = githubResult.authorize_url;
                     break;
                 default:
                     throw new Error(`Unknown provider: ${provider}`);
             }
-            // Handle success
-            if (response.token) {
-                if (this.options.onLoginSuccess) {
-                    this.options.onLoginSuccess(response.token, response.user);
-                }
-                return {
-                    success: true,
-                    token: response.token,
-                    user: response.user,
-                };
-            }
-            else {
-                throw new Error('No token received from server');
-            }
+            // Redirect to OAuth provider
+            window.location.href = authorizeUrl;
         }
         catch (error) {
-            const err = error instanceof Error ? error : new Error('OAuth authentication failed');
+            const err = error instanceof Error ? error : new Error(`${provider} OAuth failed`);
+            this.showError(err.message);
             if (this.options.onError) {
                 this.options.onError(err);
             }
-            return {
-                success: false,
-                error: err,
-            };
         }
     }
     /**
-     * Check if current page is an OAuth callback and handle it automatically
+     * Handle OAuth callback (Backend Proxy Mode)
+     *
+     * In Backend Proxy Mode, the backend redirects to returnUrl with token in query param.
+     * This static method checks if current URL has a token and processes it.
      */
-    static async handleOAuthCallbackFromUrl(client, options) {
+    static handleOAuthCallback(options) {
         const urlParams = new URLSearchParams(window.location.search);
-        const code = urlParams.get('code');
-        const state = urlParams.get('state');
-        if (!code || !state) {
+        const token = urlParams.get('token');
+        if (!token) {
             return null; // Not an OAuth callback
         }
-        const modal = new AuthModal({
-            client,
-            ...options,
-        });
-        return await modal.handleOAuthCallback(code, state);
+        // Clean up URL (remove token from query string)
+        const url = new URL(window.location.href);
+        url.searchParams.delete('token');
+        window.history.replaceState({}, document.title, url.toString());
+        // Automatically set token in client for subsequent authenticated requests
+        options.client.setToken(token);
+        // Call success callback
+        if (options.onLoginSuccess) {
+            options.onLoginSuccess(token, {}); // User info can be fetched separately if needed
+        }
+        return {
+            success: true,
+            token,
+        };
     }
 }
 /**