@softr/sdk 0.0.10 → 0.0.11

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as readSessionToken, c as writeCookies, i as readSessionData, l as assert, n as makeSessionDataCookie, o as fetchVisitor, t as clearSession } from "./session-Blx62HHJ.js";
+import { a as readSessionToken, c as writeCookies, i as readSessionData, l as assert, n as makeSessionDataCookie, o as fetchVisitor, t as clearSession } from "./session-GUEI96C8.js";
 import { redirect } from "@tanstack/react-router";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 

package/dist/server.js

@@ -1,4 +1,4 @@
-import { a as readSessionToken, c as writeCookies, d as softAssert, f as todo, n as makeSessionDataCookie, o as fetchVisitor, r as makeSessionTokenCookie, s as sessionConfig, t as clearSession, u as panic } from "./session-Blx62HHJ.js";
+import { a as readSessionToken, c as writeCookies, d as softAssert, f as todo, n as makeSessionDataCookie, o as fetchVisitor, r as makeSessionTokenCookie, s as platformFetch, t as clearSession, u as panic } from "./session-GUEI96C8.js";
 import { z } from "zod";
 import "@tanstack/react-start/server-only";
 
@@ -18,9 +18,6 @@ async function describe(response, action) {
 	const said = body.success && body.data.message ? body.data.message : response.statusText;
 	return `Softr platform refused the ${action}: ${response.status} ${said}`.trim();
 }
-function endpoint(config, path) {
-	return `${config.platformApiUrl}/v1/applications/${config.applicationId}/users/${path}`;
-}
 
 //#endregion
 //#region src/auth/methods/password.ts
@@ -35,8 +32,7 @@ const signInBody = z.object({
 * so the next request costs no round-trip.
 */
 async function signIn(credentials) {
-	const config = sessionConfig();
-	const response = await fetch(endpoint(config, "sign-in"), {
+	const response = await platformFetch("sign-in", {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
@@ -73,11 +69,10 @@ async function signIn(credentials) {
 * because the local half already succeeded.
 */
 async function signOut() {
-	const config = sessionConfig();
 	const token = readSessionToken();
 	clearSession();
 	if (!token) return;
-	const response = await fetch(endpoint(config, "sign-out"), {
+	const response = await platformFetch("sign-out", {
 		method: "POST",
 		headers: {
 			authorization: `Bearer ${token}`,
@@ -95,7 +90,7 @@ async function signOut() {
 * User only exists once `confirmSignUp` returns the code.
 */
 async function signUp(details) {
-	const response = await fetch(endpoint(sessionConfig(), "sign-up"), {
+	const response = await platformFetch("sign-up", {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
@@ -120,8 +115,7 @@ async function signUp(details) {
 * `users/new`.
 */
 async function confirmSignUp(details) {
-	const config = sessionConfig();
-	const verified = await fetch(endpoint(config, "sign-up"), {
+	const verified = await platformFetch("sign-up", {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
@@ -138,7 +132,7 @@ async function confirmSignUp(details) {
 	const verifiedBody = await verified.text();
 	let token = tokenBody.parse(verifiedBody.length === 0 ? {} : JSON.parse(verifiedBody)).jwt;
 	if (!token) {
-		const created = await fetch(endpoint(config, "new"), {
+		const created = await platformFetch("new", {
 			method: "POST",
 			headers: {
 				"content-type": "application/json",

package/dist/{session-Blx62HHJ.js → session-GUEI96C8.js}

@@ -103,19 +103,14 @@ function writeCookies(cookies) {
 //#endregion
 //#region src/auth/config.ts
 const DEFAULT_SESSION_MAX_AGE = 2160 * 60 * 60;
-/** 32 bytes, hex encoded. */
-const SESSION_SECRET = /^[0-9a-f]{64}$/i;
 function loadSessionConfig() {
 	const missing = [];
 	const applicationId = process.env.SOFTR_APPLICATION_ID;
 	if (!applicationId) missing.push("SOFTR_APPLICATION_ID");
 	const sessionSecret = process.env.SOFTR_SESSION_SECRET;
 	if (!sessionSecret) missing.push("SOFTR_SESSION_SECRET");
-	const platformApiUrl = process.env.SOFTR_PLATFORM_API_URL;
-	if (!platformApiUrl) missing.push("SOFTR_PLATFORM_API_URL");
 	if (missing.length > 0) throw new Error(`Softr auth is not configured: missing ${missing.join(", ")}.`);
-	assert(applicationId && sessionSecret && platformApiUrl);
-	if (!SESSION_SECRET.test(sessionSecret)) throw new Error("SOFTR_SESSION_SECRET must be 32 random bytes encoded as hex.\nGenerate one with:  openssl rand -hex 32");
+	assert(applicationId && sessionSecret);
 	const rawMaxAge = process.env.SOFTR_SESSION_MAX_AGE;
 	let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
 	if (rawMaxAge) {
@@ -125,7 +120,6 @@ function loadSessionConfig() {
 	return {
 		applicationId,
 		sessionSecret,
-		platformApiUrl,
 		sessionMaxAge
 	};
 }
@@ -135,6 +129,39 @@ function sessionConfig() {
 	return cached;
 }
 
+//#endregion
+//#region src/auth/platform.ts
+const contextSchema = z.object({ platformApiUrl: z.string() });
+/** Calls one of this app's user endpoints on the Softr platform. */
+async function platformFetch(path, init) {
+	const { applicationId } = sessionConfig();
+	const origin = await platformApiUrl();
+	return fetch(`${origin}/v1/applications/${applicationId}/users/${path}`, init);
+}
+/** Origin of the Softr platform API, with no trailing slash. */
+async function platformApiUrl() {
+	const pinned = process.env.SOFTR_PLATFORM_API_URL;
+	if (pinned) return withoutTrailingSlash(pinned);
+	const studioApiUrl = process.env.SOFTR_STUDIO_API_URL;
+	if (!studioApiUrl || process.env.NODE_ENV === "production") panic("Softr auth is not configured: SOFTR_PLATFORM_API_URL is not set.");
+	const { applicationId } = sessionConfig();
+	const url = `${withoutTrailingSlash(studioApiUrl)}/v1/api/applications/${applicationId}/context/public`;
+	let response;
+	try {
+		response = await fetch(url, { headers: { accept: "application/json" } });
+	} catch {
+		panic(`Could not reach studio-api: ${url}`);
+	}
+	if (response.status === 404) panic(`studio-api does not know application ${applicationId}`);
+	if (!response.ok) panic(`studio-api answered ${response.status} for ${url}`);
+	const body = contextSchema.safeParse(await response.json().catch(() => null));
+	if (!body.success) panic(`studio-api returned no platformApiUrl: ${url}`);
+	return withoutTrailingSlash(body.data.platformApiUrl);
+}
+function withoutTrailingSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+
 //#endregion
 //#region src/auth/me.ts
 /**
@@ -143,8 +170,7 @@ function sessionConfig() {
 * informative. Anything else that is not a 200 throws.
 */
 async function fetchVisitor(token) {
-	const config = sessionConfig();
-	const response = await fetch(`${config.platformApiUrl}/v1/applications/${config.applicationId}/users/me`, {
+	const response = await platformFetch("me", {
 		method: "GET",
 		headers: {
 			authorization: `Bearer ${token}`,
@@ -331,4 +357,4 @@ function openEnvelope(raw, purpose) {
 }
 
 //#endregion
-export { readSessionToken as a, writeCookies as c, softAssert as d, todo as f, readSessionData as i, assert as l, makeSessionDataCookie as n, fetchVisitor as o, makeSessionTokenCookie as r, sessionConfig as s, clearSession as t, panic as u };
+export { readSessionToken as a, writeCookies as c, softAssert as d, todo as f, readSessionData as i, assert as l, makeSessionDataCookie as n, fetchVisitor as o, makeSessionTokenCookie as r, platformFetch as s, clearSession as t, panic as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },