@seliseblocks/client 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/auth/auth-client.d.ts

@@ -234,9 +234,13 @@ export declare class BlocksAuthenticationClient {
      */
     accessToken(): Promise<string | undefined>;
     /**
-     * What: checks whether `accessToken()` currently resolves a non-empty token.
-     * Why: apps may need a lightweight UI/session guard before rendering protected areas.
-     * How: use it as a convenience only; real authorization still comes from Blocks API responses and IAM permissions.
+     * What: validates the current session against IAM through `GET /iam/v4/auth/me`.
+     * Why: a caller-owned `accessToken` may be absent by design -- IAM's hosted IdP flow sets the
+     * session as a Secure, httpOnly cookie by default, so checking for a local token would report
+     * "signed out" even when the browser holds a valid session cookie. IAM is the source of truth.
+     * How: checks the raw response status rather than `userInfo()` -- `json()` intentionally never
+     * throws on non-2xx (auth endpoints can return protocol-shaped error bodies), so a 401 there
+     * would otherwise resolve as if the call had succeeded.
      */
     isAuthenticated(): Promise<boolean>;
     /**

package/dist/auth/auth-client.js

@@ -1,7 +1,7 @@
 export class BlocksAuthenticationClient {
     clientConfig;
     fetchImpl;
-    constructor(clientConfig, fetchImpl = globalThis.fetch) {
+    constructor(clientConfig, fetchImpl = globalThis.fetch?.bind(globalThis)) {
         this.clientConfig = clientConfig;
         this.fetchImpl = fetchImpl;
         if (!this.fetchImpl)
@@ -332,12 +332,22 @@ export class BlocksAuthenticationClient {
             : this.clientConfig.accessToken;
     }
     /**
-     * What: checks whether `accessToken()` currently resolves a non-empty token.
-     * Why: apps may need a lightweight UI/session guard before rendering protected areas.
-     * How: use it as a convenience only; real authorization still comes from Blocks API responses and IAM permissions.
+     * What: validates the current session against IAM through `GET /iam/v4/auth/me`.
+     * Why: a caller-owned `accessToken` may be absent by design -- IAM's hosted IdP flow sets the
+     * session as a Secure, httpOnly cookie by default, so checking for a local token would report
+     * "signed out" even when the browser holds a valid session cookie. IAM is the source of truth.
+     * How: checks the raw response status rather than `userInfo()` -- `json()` intentionally never
+     * throws on non-2xx (auth endpoints can return protocol-shaped error bodies), so a 401 there
+     * would otherwise resolve as if the call had succeeded.
      */
     async isAuthenticated() {
-        return Boolean(await this.accessToken());
+        try {
+            const response = await this.raw("/iam/v4/auth/me", { method: "GET" });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
     }
     /**
      * What: sends a JSON Auth/IdPController request and returns the parsed response body.
@@ -385,6 +395,9 @@ export class BlocksAuthenticationClient {
         }
         return this.fetchImpl(url, {
             body: options.body,
+            // IAM's hosted IdP flow sets the session as a Secure, httpOnly cookie by default;
+            // without this the browser never sends it back on subsequent Auth/IdP requests.
+            credentials: "include",
             headers,
             method: options.method
         });

package/dist/http/http-client.js

@@ -3,7 +3,7 @@ export class BlocksHttpClient {
     config;
     auth;
     fetchImpl;
-    constructor(config, auth, fetchImpl = globalThis.fetch) {
+    constructor(config, auth, fetchImpl = globalThis.fetch?.bind(globalThis)) {
         this.config = config;
         this.auth = auth;
         this.fetchImpl = fetchImpl;
@@ -26,6 +26,9 @@ export class BlocksHttpClient {
         }
         const response = await this.fetchImpl(url, {
             body: rawBody ?? (options.body === undefined ? undefined : JSON.stringify(options.body)),
+            // IAM's hosted IdP flow sets the session as a Secure, httpOnly cookie by default;
+            // without this the browser never sends it back on subsequent Blocks API calls.
+            credentials: "include",
             headers,
             method: options.method ?? (options.body === undefined ? "GET" : "POST")
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seliseblocks/client",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.2",
   "description": "Framework-neutral TypeScript client SDK for SELISE Blocks frontend applications.",
   "license": "MIT",
   "type": "module",