@spacelr/sdk 0.1.8 → 0.1.10

package/dist/index.mjs

@@ -869,6 +869,8 @@ var RealtimeClient = class {
 // libs/sdk/src/modules/auth.module.ts
 var AuthModule = class {
   constructor(http, tokenManager, config) {
+    this.stateListeners = /* @__PURE__ */ new Set();
+    this.lastEmittedState = null;
     this.http = http;
     this.tokenManager = tokenManager;
     this.config = config;
@@ -881,6 +883,84 @@ var AuthModule = class {
         expiresAt
       };
     });
+    this.unsubscribeAuthLost = this.tokenManager.onAuthLost(
+      () => this.emitState("unauthenticated")
+    );
+  }
+  /**
+   * Returns true if a non-expired access token is currently in storage.
+   * Does NOT make a network request — safe for route guards and other
+   * hot paths that run on every navigation.
+   *
+   * A token within the refresh buffer (about to expire) still counts as
+   * authenticated because the next protected request will auto-refresh it.
+   *
+   * Any error from the underlying TokenStorage (corrupt JSON, quota, etc.)
+   * is treated as "not authenticated" rather than propagated, so route
+   * guards can't be crashed by a misbehaving storage backend.
+   */
+  async isAuthenticated() {
+    try {
+      const tokens = await this.tokenManager.getStoredTokens();
+      if (!tokens?.accessToken) return false;
+      if (tokens.expiresAt && tokens.expiresAt * 1e3 <= Date.now()) return false;
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Subscribe to auth-state transitions. The callback fires:
+   *   - 'authenticated' after a successful login/register/exchange/2FA-verify
+   *   - 'unauthenticated' after logout or when a token refresh fails
+   *
+   * Only fires for transitions that happen after the subscription. If the
+   * user is already logged in at subscribe time (e.g. tokens restored from
+   * storage on app boot), no 'authenticated' event is emitted — call
+   * `isAuthenticated()` once up-front for the initial state.
+   *
+   * Silent token refreshes do NOT produce an event (auth state is
+   * unchanged). Subscribe to `spacelrClient.onTokenRefreshed(...)` if you
+   * need to observe successful refreshes.
+   *
+   * Listener may return `void` or `Promise<void>`. Rejections are swallowed
+   * so one broken subscriber can't poison others or the auth flow. The
+   * dispatch is fire-and-forget: `logout()` / `login()` resolve as soon as
+   * the dispatch loop returns, without awaiting async listeners.
+   *
+   * Returns an unsubscribe function.
+   */
+  onAuthStateChange(listener) {
+    this.stateListeners.add(listener);
+    return () => {
+      this.stateListeners.delete(listener);
+    };
+  }
+  /**
+   * Detach this AuthModule from the TokenManager. Call when discarding the
+   * client (tests, HMR, multi-client setups) to avoid leaking the internal
+   * onAuthLost subscription. Idempotent — safe to call more than once.
+   */
+  dispose() {
+    this.unsubscribeAuthLost();
+    this.unsubscribeAuthLost = () => {
+    };
+    this.stateListeners.clear();
+    this.lastEmittedState = null;
+  }
+  emitState(state) {
+    if (state === this.lastEmittedState) return;
+    this.lastEmittedState = state;
+    for (const listener of this.stateListeners) {
+      try {
+        const result = listener(state);
+        if (result && typeof result.then === "function") {
+          result.then(void 0, () => {
+          });
+        }
+      } catch {
+      }
+    }
   }
   async login(params) {
     const response = await this.http.request({
@@ -926,6 +1006,7 @@ var AuthModule = class {
     } catch {
     }
     await this.tokenManager.clearTokens();
+    this.emitState("unauthenticated");
   }
   async verifyEmail(token) {
     return this.http.request({
@@ -996,6 +1077,7 @@ var AuthModule = class {
       refreshToken: response.refresh_token,
       expiresAt
     });
+    this.emitState("authenticated");
     return response;
   }
   async generatePKCE() {
@@ -1078,6 +1160,7 @@ var AuthModule = class {
       refreshToken: response.refresh_token,
       expiresAt
     });
+    this.emitState("authenticated");
   }
   async storeTokensFromRegister(response) {
     if (!response.access_token) return;
@@ -1085,6 +1168,7 @@ var AuthModule = class {
       accessToken: response.access_token,
       refreshToken: response.refresh_token
     });
+    this.emitState("authenticated");
   }
 };
 
@@ -1656,19 +1740,32 @@ var FunctionsModule = class {
     this.http = http;
   }
   /**
-   * Invoke a function via webhook trigger.
-   * Calls POST /api/v1/functions/:projectId/:functionId/invoke
-   * with X-Webhook-Secret header.
+   * Invoke a function.
+   * Calls POST `/functions/:projectId/:functionId/invoke`, resolved against
+   * `config.apiUrl` (which already carries the `/api/v1` prefix).
+   *
+   * Auth defaults, based on `invokeMode` semantics:
+   *  - webhook:       pass `secret` → Authorization is NOT attached
+   *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
+   *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
+   *  - hybrid:        pass both `secret` and `authenticated: true`
+   *
+   * To force a specific behaviour, set `authenticated` explicitly — it wins
+   * over the `secret`-based default.
    */
-  async invoke(projectId, functionId, options) {
+  async invoke(projectId, functionId, options = {}) {
+    const hasSecret = (options.secret?.length ?? 0) > 0;
+    const headers = {};
+    if (hasSecret) {
+      headers["X-Webhook-Secret"] = options.secret;
+    }
+    const authenticated = options.authenticated ?? !hasSecret;
     return this.http.request({
       method: "POST",
-      path: `/api/v1/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
-      headers: {
-        "X-Webhook-Secret": options.secret
-      },
+      path: `/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
+      headers,
       body: options.payload ?? {},
-      authenticated: false
+      authenticated
     });
   }
 };