@softr/sdk 0.0.11 → 0.0.13

package/dist/routes/visibility.js

@@ -0,0 +1,125 @@
+import { redirect } from "@tanstack/react-router";
+
+//#region src/routes/visibility.ts
+/**
+* Why a visitor was denied.
+*
+* - `unauthenticated` — the route needs a signed-in visitor and there is none.
+* - `forbidden` — signed in, but in none of the groups the route names.
+* - `alreadySignedIn` — the route is for signed-out visitors only.
+*/
+const ACCESS_REASONS = [
+	"unauthenticated",
+	"forbidden",
+	"alreadySignedIn"
+];
+/** Decides whether a visitor passes a visibility rule, without throwing. */
+function checkAccess(rule, context) {
+	const { user } = context;
+	switch (rule.userGroup) {
+		case "ALL_USERS": return { ok: true };
+		case "NON_LOGGED_IN_USERS": return user === null ? { ok: true } : {
+			ok: false,
+			reason: "alreadySignedIn"
+		};
+		case "LOGGED_IN_USERS": {
+			if (user === null) return {
+				ok: false,
+				reason: "unauthenticated"
+			};
+			const required = rule.userGroupIds ?? [];
+			if (required.length === 0) return { ok: true };
+			return required.some((id) => user.userGroupIds.includes(id)) ? { ok: true } : {
+				ok: false,
+				reason: "forbidden"
+			};
+		}
+	}
+}
+function isAccessReason(value) {
+	return ACCESS_REASONS.some((reason) => reason === value);
+}
+/**
+* True for any access error thrown by a guard, whatever its reason.
+*
+* An access error arrives as `unknown` — hydrated from the page, or thrown by
+* anything else at all — so every field is checked before it is narrowed.
+*/
+function isAccessError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const candidate = error;
+	if (candidate.type !== "access_error") return false;
+	return isAccessReason(candidate.reason);
+}
+function isReason(error, reason) {
+	return isAccessError(error) && error.reason === reason;
+}
+/** True for an access error thrown because nobody was signed in. */
+function isUnauthenticatedError(error) {
+	return isReason(error, "unauthenticated");
+}
+/** True for an access error thrown because the visitor was in none of the groups. */
+function isForbiddenError(error) {
+	return isReason(error, "forbidden");
+}
+/** True for an access error thrown because a signed-out-only route saw a user. */
+function isAlreadySignedInError(error) {
+	return isReason(error, "alreadySignedIn");
+}
+const DEFAULT_ACCESS_BEHAVIOUR = {
+	unauthenticated: {
+		strategy: "redirect",
+		to: "/login"
+	},
+	forbidden: { strategy: "throw" },
+	alreadySignedIn: {
+		strategy: "redirect",
+		to: "/"
+	}
+};
+/** What a guard throws for a reason: a redirect, or an {@link AccessError}. */
+function thrownFor(reason, overrides) {
+	const behaviour = overrides?.[reason] ?? DEFAULT_ACCESS_BEHAVIOUR[reason];
+	const resolved = typeof behaviour === "string" ? {
+		strategy: "redirect",
+		to: behaviour
+	} : behaviour;
+	if (resolved.strategy === "redirect") return redirect({ to: resolved.to });
+	return {
+		type: "access_error",
+		reason
+	};
+}
+/**
+* Declares who may see a route, and returns the handle that enforces it.
+*
+* One call per route file, at module scope: the build reads these declarations
+* to publish the app's route visibility, so the rule must be a literal.
+*
+* @example
+* const visibility = defineVisibility({ userGroup: "LOGGED_IN_USERS" })
+*
+* export const Route = createFileRoute("/about")({
+*   beforeLoad: visibility.guard(),
+*   component: About,
+* })
+*/
+function defineVisibility(rule) {
+	return {
+		guard: (overrides) => ({ context }) => {
+			const result = checkAccess(rule, context);
+			if (result.ok) return;
+			throw thrownFor(result.reason, overrides);
+		},
+		assert: (context) => {
+			const result = checkAccess(rule, context);
+			if (result.ok) return;
+			throw thrownFor(result.reason, void 0);
+		},
+		isAuthorized: (context) => checkAccess(rule, context).ok,
+		check: (context) => checkAccess(rule, context)
+	};
+}
+
+//#endregion
+export { defineVisibility, isAccessError, isAlreadySignedInError, isForbiddenError, isUnauthenticatedError };

package/dist/server.d.ts

@@ -1,85 +1,6 @@
-import { r as User } from "./user-D23hwTsf.js";
+import { auth } from "./auth/server.js";
+import { ds } from "./core/datasource.js";
+import { workflow } from "./core/workflow.js";
+import { integration } from "./core/integration.js";
 import "@tanstack/react-start/server-only";
-
-//#region src/auth/methods/utils.d.ts
-type Result<T, E = Error> = {
-  success: false;
-  error: E;
-} | {
-  success: true;
-  data: T;
-};
-type AuthError = {
-  code: AuthErrorCode;
-  message: string;
-};
-type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode";
-//#endregion
-//#region src/auth/methods/password.d.ts
-/**
- * Signs a visitor in with an email and password.
- *
- * The cache is primed from the same `/me` the resolver would have called anyway,
- * so the next request costs no round-trip.
- */
-declare function signIn(credentials: {
-  email: string;
-  password: string;
-}): Promise<Result<User, AuthError>>;
-/**
- * Signs the visitor out and clears the session cookies.
- *
- * This revokes **every** outstanding session for that user in this app, on every
- * device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
- * before it. There is no per-device sign-out.
- *
- * A platform that could not revoke leaves the caller signed out here and
- * possibly still signed in elsewhere — loud outside production, logged in it,
- * because the local half already succeeded.
- */
-declare function signOut(): Promise<void>;
-//#endregion
-//#region src/auth/methods/signup.d.ts
-/**
- * Starts a sign-up flow by emailing a verification code.
- *
- * User only exists once `confirmSignUp` returns the code.
- */
-declare function signUp(details: {
-  email: string;
-  name?: string;
-}): Promise<Result<null, AuthError>>;
-/**
- * Finishes sign-up flow with the emailed code and signs the visitor in.
- *
- * The platform splits on how the app is configured: a code-only app creates the
- * user on the second `sign-up` request and answers with a token, while a
- * password app answers it with an empty 200 and expects the password on
- * `users/new`.
- */
-declare function confirmSignUp(details: {
-  email: string;
-  /**
-   * What `users/new` creates the account with, and unused on a code-only app,
-   * which never reaches that request.
-   *
-   * TODO: temporary in one respect — it is spent a second time on the
-   * 400-after-create workaround below, which goes away with the platform fix.
-   */
-  password: string;
-  code: string;
-  name?: string;
-}): Promise<Result<User, AuthError>>;
-//#endregion
-//#region src/auth/server.d.ts
-/**
- * Server-only auth methods, should be called from the app's own `createServerFn` handlers.
- */
-declare const auth: {
-  signIn: typeof signIn;
-  signOut: typeof signOut;
-  signUp: typeof signUp;
-  confirmSignUp: typeof confirmSignUp;
-};
-//#endregion
-export { auth };
+export { auth, ds, integration, workflow };

package/dist/server.js

@@ -1,196 +1,7 @@
-import { a as readSessionToken, c as writeCookies, d as softAssert, f as todo, n as makeSessionDataCookie, o as fetchVisitor, r as makeSessionTokenCookie, s as platformFetch, t as clearSession, u as panic } from "./session-GUEI96C8.js";
-import { z } from "zod";
+import { auth } from "./auth/server.js";
+import { ds } from "./core/datasource.js";
+import { workflow } from "./core/workflow.js";
+import { integration } from "./core/integration.js";
 import "@tanstack/react-start/server-only";
 
-//#region src/auth/methods/utils.ts
-function authError(code, message) {
-	return {
-		success: false,
-		error: {
-			code,
-			message
-		}
-	};
-}
-const errorSchema = z.object({ message: z.string() });
-async function describe(response, action) {
-	const body = errorSchema.safeParse(await response.json().catch(() => null));
-	const said = body.success && body.data.message ? body.data.message : response.statusText;
-	return `Softr platform refused the ${action}: ${response.status} ${said}`.trim();
-}
-
-//#endregion
-//#region src/auth/methods/password.ts
-const signInBody = z.object({
-	jwt: z.string().nullish(),
-	authenticatorAppAction: z.string().nullish()
-});
-/**
-* Signs a visitor in with an email and password.
-*
-* The cache is primed from the same `/me` the resolver would have called anyway,
-* so the next request costs no round-trip.
-*/
-async function signIn(credentials) {
-	const response = await platformFetch("sign-in", {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			accept: "application/json"
-		},
-		body: JSON.stringify(credentials)
-	});
-	if (response.status === 401 || response.status === 429) return authError(response.status === 401 ? "invalidCredentials" : "tooManyAttempts", await describe(response, "sign-in"));
-	if (response.status >= 500) panic(await describe(response, "sign-in"));
-	if (response.status === 400) todo(await describe(response, "sign-in"));
-	if (!response.ok) throw new Error(`${await describe(response, "sign-in")}. Check SOFTR_APPLICATION_ID and that the app allows sign-in.`);
-	const raw = await response.text();
-	const body = signInBody.parse(raw.length === 0 ? {} : JSON.parse(raw));
-	if (body.authenticatorAppAction) todo(`Softr platform asked for an authenticator step (${body.authenticatorAppAction}) to finish the sign-in. This app requires an authenticator app, which the SDK cannot finish yet.`);
-	const token = body.jwt;
-	if (!token) todo("Softr platform answered the sign-in by emailing a one-time code. This app is configured for passwordless sign-in, which the SDK cannot finish yet.");
-	const user = await fetchVisitor(token);
-	if (!user) panic("Session token issued, but no user could be resolved for it.");
-	writeCookies([makeSessionTokenCookie(token), makeSessionDataCookie(user, token)]);
-	return {
-		success: true,
-		data: user
-	};
-}
-/**
-* Signs the visitor out and clears the session cookies.
-*
-* This revokes **every** outstanding session for that user in this app, on every
-* device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
-* before it. There is no per-device sign-out.
-*
-* A platform that could not revoke leaves the caller signed out here and
-* possibly still signed in elsewhere — loud outside production, logged in it,
-* because the local half already succeeded.
-*/
-async function signOut() {
-	const token = readSessionToken();
-	clearSession();
-	if (!token) return;
-	const response = await platformFetch("sign-out", {
-		method: "POST",
-		headers: {
-			authorization: `Bearer ${token}`,
-			accept: "application/json"
-		}
-	});
-	softAssert(response.ok || response.status < 500, () => `Softr platform could not revoke the session: ${response.status}. This browser is signed out, but other devices may still be.`);
-}
-
-//#endregion
-//#region src/auth/methods/signup.ts
-/**
-* Starts a sign-up flow by emailing a verification code.
-*
-* User only exists once `confirmSignUp` returns the code.
-*/
-async function signUp(details) {
-	const response = await platformFetch("sign-up", {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			accept: "application/json"
-		},
-		body: JSON.stringify(signUpBody(details))
-	});
-	if (response.status >= 500) panic(await describe(response, "sign-up"));
-	if (response.status === 409) return authError("emailTaken", await describe(response, "sign-up"));
-	if (!response.ok) return authError("invalidDetails", await describe(response, "sign-up"));
-	return {
-		success: true,
-		data: null
-	};
-}
-/**
-* Finishes sign-up flow with the emailed code and signs the visitor in.
-*
-* The platform splits on how the app is configured: a code-only app creates the
-* user on the second `sign-up` request and answers with a token, while a
-* password app answers it with an empty 200 and expects the password on
-* `users/new`.
-*/
-async function confirmSignUp(details) {
-	const verified = await platformFetch("sign-up", {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			accept: "application/json"
-		},
-		body: JSON.stringify({
-			...signUpBody(details),
-			token: details.code
-		})
-	});
-	if (verified.status >= 500) panic(await describe(verified, "sign-up"));
-	if (verified.status === 409) return authError("emailTaken", await describe(verified, "sign-up"));
-	if (!verified.ok) return authError("invalidCode", await describe(verified, "sign-up"));
-	const verifiedBody = await verified.text();
-	let token = tokenBody.parse(verifiedBody.length === 0 ? {} : JSON.parse(verifiedBody)).jwt;
-	if (!token) {
-		const created = await platformFetch("new", {
-			method: "POST",
-			headers: {
-				"content-type": "application/json",
-				accept: "application/json"
-			},
-			body: JSON.stringify({
-				...signUpBody(details),
-				password: details.password,
-				token: details.code
-			})
-		});
-		if (created.status >= 500) panic(await describe(created, "sign-up"));
-		if (created.status === 409) return authError("emailTaken", await describe(created, "sign-up"));
-		if (created.ok) {
-			const createdBody = await created.text();
-			token = tokenBody.parse(createdBody.length === 0 ? {} : JSON.parse(createdBody)).jwt;
-		} else {
-			const signedIn = await signIn({
-				email: details.email,
-				password: details.password
-			});
-			if (!signedIn.success) return authError("invalidCode", await describe(created, "sign-up"));
-			return signedIn;
-		}
-	}
-	if (!token) todo("Softr platform accepted the sign-up and returned no session token. This app is configured for a sign-up flow the SDK cannot finish yet.");
-	const user = await fetchVisitor(token);
-	if (!user) panic("Session token issued, but no user could be resolved for it.");
-	writeCookies([makeSessionTokenCookie(token), makeSessionDataCookie(user, token)]);
-	return {
-		success: true,
-		data: user
-	};
-}
-/**
-* `name` is dropped when absent rather than sent as `undefined`: the platform's
-* validator runs on whatever key is present, and an explicit null is not the
-* same request as no name at all.
-*/
-function signUpBody(details) {
-	return details.name === void 0 ? { email: details.email } : {
-		email: details.email,
-		name: details.name
-	};
-}
-const tokenBody = z.object({ jwt: z.string().nullish() });
-
-//#endregion
-//#region src/auth/server.ts
-/**
-* Server-only auth methods, should be called from the app's own `createServerFn` handlers.
-*/
-const auth = {
-	signIn,
-	signOut,
-	signUp,
-	confirmSignUp
-};
-
-//#endregion
-export { auth };
+export { auth, ds, integration, workflow };

package/dist/types.d.ts

@@ -0,0 +1,105 @@
+import { AnyConstructable, ConstructableOrderBy } from "./core/query.js";
+import { SoftrUserGroupId } from "./auth/user.js";
+
+//#region src/types.d.ts
+interface SoftrUser {
+  id: string;
+  email: string;
+  name: string;
+  userGroupIds: Array<SoftrUserGroupId>;
+}
+interface DatasourcePermissions {
+  read: boolean;
+  create: boolean;
+  update: boolean;
+  delete: boolean;
+}
+interface SoftrPermissions {
+  datasources: Record<string, DatasourcePermissions>;
+  workflows: Record<string, boolean>;
+}
+interface SoftrMe {
+  user: SoftrUser | null;
+  permissions: SoftrPermissions;
+}
+type GetByIdOptions = {
+  id: string;
+  where?: never;
+  timeZone?: string;
+};
+type GetByWhereOptions = {
+  id?: never;
+  where: AnyConstructable;
+  timeZone?: string;
+};
+type GetOptions = GetByIdOptions | GetByWhereOptions;
+interface ListOptions {
+  /**
+   * Maps human-readable aliases to Softr field IDs.
+   * When provided, returned fields are keyed by alias instead of raw field ID.
+   */
+  select?: Record<string, string>;
+  where?: AnyConstructable;
+  orderBy?: ConstructableOrderBy | ConstructableOrderBy[];
+  /**
+   * Number of records to return per page. Defaults to 20, max 100.
+   */
+  limit?: number;
+  /**
+   * Offset to start from. Pass the `nextOffset` from a previous result to paginate.
+   * Omit or pass `null` to start from the beginning.
+   */
+  offset?: number | null;
+  /** Override the timezone for this request. */
+  timeZone?: string;
+}
+interface ListResult<T = SoftrRecord> {
+  records: T[];
+  total: number;
+  /** Offset to pass as `offset` in the next call, or `null` when there are no more pages. */
+  nextOffset: number | null;
+}
+interface SoftrRecord {
+  id: string;
+  fields: Record<string, unknown>;
+}
+type AggregationFunction = 'SUM' | 'AVG' | 'MAX' | 'MIN' | 'COUNT' | 'DISTINCT';
+interface MetricOptions {
+  select?: Record<string, string>;
+  where?: AnyConstructable;
+  aggregation: AggregationFunction;
+  /** Field alias (resolved via select) or raw field ID. Not required for COUNT. */
+  field?: string;
+  /** Override the timezone for this request. */
+  timeZone?: string;
+}
+interface MetricResult {
+  value: number | null;
+  executionTimestamp: Date;
+}
+interface ChartDataOptions {
+  select?: Record<string, string>;
+  where?: AnyConstructable;
+  /** Field alias (resolved via select) or raw field ID. */
+  groupBy: string | string[];
+  metrics: Record<string, {
+    field?: string;
+    aggregation: AggregationFunction;
+  }>;
+  orderBy?: ConstructableOrderBy;
+  /** Override the timezone for this request. */
+  timeZone?: string;
+}
+interface ChartDataResult {
+  data: Record<string, unknown>[];
+  executionTimestamp: Date;
+}
+interface CreateOptions {
+  fields: Record<string, unknown>;
+}
+interface UpdateOptions {
+  id: string;
+  fields: Record<string, unknown>;
+}
+//#endregion
+export { AggregationFunction, ChartDataOptions, ChartDataResult, CreateOptions, DatasourcePermissions, GetOptions, ListOptions, ListResult, MetricOptions, MetricResult, SoftrMe, SoftrPermissions, SoftrRecord, SoftrUser, UpdateOptions };

package/dist/vite.d.ts

@@ -1,26 +1,6 @@
-import "@tanstack/router-generator";
+import { Manifest, ManifestNode } from "./routes/manifest.js";
 import { PluginOption } from "vite";
 
-//#region src/routes/discover.d.ts
-
-type VisibilityValue = string | Array<VisibilityValue> | {
-  [key: string]: VisibilityValue;
-};
-//#endregion
-//#region src/routes/manifest.d.ts
-type ManifestNode = {
-  routePath: string;
-  filePath: string;
-  _fsRouteType?: string;
-  inferFullPath: string | null;
-  createFileRouteProps: Array<string>;
-  visibility: VisibilityValue | null;
-  children: Array<ManifestNode>;
-};
-type Manifest = {
-  root: ManifestNode;
-};
-//#endregion
 //#region src/vite.d.ts
 declare const MANIFEST_RELATIVE_PATH: string;
 /** Writes `<root>/dist/routes.json` and returns its path. Throws on a rule it cannot read. */