@spacelr/sdk 0.9.1 → 0.10.0

package/dist/index.mjs

@@ -385,7 +385,7 @@ var BrowserTokenStorage = class {
 
 // libs/sdk/src/core/token-manager.ts
 var TokenManager = class {
-  constructor(storage, refreshBufferSeconds = 60) {
+  constructor(storage, refreshBufferSeconds = 60, refreshLockName = "spacelr_token_refresh") {
     this.refreshCallback = null;
     this.refreshPromise = null;
     this.tokenRefreshedListeners = /* @__PURE__ */ new Set();
@@ -396,6 +396,7 @@ var TokenManager = class {
     this.authLostEmitted = false;
     this.storage = storage ?? new MemoryTokenStorage();
     this.refreshBufferSeconds = refreshBufferSeconds;
+    this.refreshLockName = refreshLockName;
   }
   setRefreshCallback(callback) {
     this.refreshCallback = callback;
@@ -425,7 +426,7 @@ var TokenManager = class {
     this.authLostEmitted = false;
   }
   async getStoredTokens() {
-    return this.storage.getTokens();
+    return this.safeGetTokens();
   }
   /**
    * Force a refresh using the current stored refresh token.
@@ -492,9 +493,18 @@ var TokenManager = class {
     }
   }
   async executeRefresh(refreshToken) {
+    return this.withCrossTabLock(() => this.doRefresh(refreshToken));
+  }
+  async doRefresh(refreshToken) {
     const callback = this.refreshCallback;
+    const current = await this.safeGetTokens();
+    if (current && current.refreshToken && current.refreshToken !== refreshToken && !this.isTokenExpired(current)) {
+      this.emitTokenRefreshed(current);
+      return current;
+    }
+    const activeRefreshToken = current?.refreshToken || refreshToken;
     try {
-      const newTokens = await callback(refreshToken);
+      const newTokens = await callback(activeRefreshToken);
       await this.storage.setTokens(newTokens);
       this.emitTokenRefreshed(newTokens);
       return newTokens;
@@ -503,6 +513,22 @@ var TokenManager = class {
       throw error;
     }
   }
+  async safeGetTokens() {
+    try {
+      return await this.storage.getTokens();
+    } catch {
+      return null;
+    }
+  }
+  withCrossTabLock(fn) {
+    const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+    if (!locks) return fn();
+    try {
+      return locks.request(this.refreshLockName, fn);
+    } catch {
+      return fn();
+    }
+  }
   emitTokenRefreshed(tokens) {
     for (const listener of this.tokenRefreshedListeners) {
       try {
@@ -588,6 +614,57 @@ var PERMANENT_STREAM_ACK_ERRORS = /* @__PURE__ */ new Set([
   "Not a member of this project",
   "Subscribe denied"
 ]);
+function isWhereScalar(value) {
+  const t = typeof value;
+  return t === "string" || t === "number" || t === "boolean";
+}
+function isWhereOperator(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 1) return false;
+  const op = keys[0];
+  if (op !== "in" && op !== "array-contains-any") return false;
+  const candidates = value[op];
+  return Array.isArray(candidates) && candidates.every(isWhereScalar);
+}
+var WHERE_PATH_ABSENT = /* @__PURE__ */ Symbol("where-path-absent");
+var WHERE_PATH_UNRESOLVABLE = /* @__PURE__ */ Symbol("where-path-unresolvable");
+var RESERVED_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var MAX_WHERE_PATH_SEGMENTS = 16;
+function resolveWherePath(document2, key) {
+  const segments = key.split(".");
+  if (segments.length > MAX_WHERE_PATH_SEGMENTS) return WHERE_PATH_ABSENT;
+  let cur = document2;
+  for (const segment of segments) {
+    if (RESERVED_PATH_SEGMENTS.has(segment)) return WHERE_PATH_ABSENT;
+    if (cur === null || cur === void 0) return WHERE_PATH_ABSENT;
+    if (Array.isArray(cur)) return WHERE_PATH_UNRESOLVABLE;
+    if (typeof cur !== "object") return WHERE_PATH_ABSENT;
+    if (!Object.prototype.hasOwnProperty.call(cur, segment)) {
+      return WHERE_PATH_ABSENT;
+    }
+    cur = cur[segment];
+  }
+  return cur === void 0 ? WHERE_PATH_ABSENT : cur;
+}
+function whereValueMatches(actual, expected) {
+  if (actual === WHERE_PATH_ABSENT || actual === WHERE_PATH_UNRESOLVABLE) {
+    return false;
+  }
+  if (isWhereOperator(expected)) {
+    if ("in" in expected) {
+      if (Array.isArray(actual)) return false;
+      return expected.in.includes(actual);
+    }
+    if (!Array.isArray(actual)) return false;
+    const candidates = expected["array-contains-any"];
+    return actual.some((el) => candidates.includes(el));
+  }
+  if (Array.isArray(actual)) return actual.includes(expected);
+  return actual === expected;
+}
 var RealtimeClient = class {
   constructor(config) {
     this.socket = null;
@@ -976,12 +1053,7 @@ var RealtimeClient = class {
     if (!where) return false;
     if (!event.document) return false;
     for (const [key, value] of Object.entries(where)) {
-      const docValue = event.document[key];
-      if (Array.isArray(docValue)) {
-        if (!docValue.includes(value)) {
-          return false;
-        }
-      } else if (docValue !== value) {
+      if (!whereValueMatches(resolveWherePath(event.document, key), value)) {
         return false;
       }
     }
@@ -2942,10 +3014,14 @@ var FunctionsModule = class {
    * `config.apiUrl` (which already carries the `/api/v1` prefix).
    *
    * Auth defaults, based on `invokeMode` semantics:
-   *  - webhook:       pass `secret` → Authorization is NOT attached
-   *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
-   *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
-   *  - hybrid:        pass both `secret` and `authenticated: true`
+   *  - webhook:                 pass `secret` → Authorization is NOT attached
+   *  - authenticated:           pass nothing  → Authorization IS attached (from token manager);
+   *                             caller must be a member of the target project
+   *  - public:                  pass nothing  → Authorization is attached if logged in, else omitted
+   *  - hybrid:                  pass both `secret` and `authenticated: true`; JWT path
+   *                             requires project membership like `authenticated`
+   *  - platform-authenticated:  pass nothing  → Authorization IS attached (from token manager);
+   *                             any signed-in user is accepted, still just attaches the bearer token
    *
    * To force a specific behaviour, set `authenticated` explicitly — it wins
    * over the `secret`-based default.
@@ -3031,7 +3107,8 @@ function createClient(config) {
   const tokenStorage = config.tokenStorage ?? (typeof window !== "undefined" && typeof window.localStorage !== "undefined" ? new BrowserTokenStorage() : new MemoryTokenStorage());
   const tokenManager = new TokenManager(
     tokenStorage,
-    config.refreshBufferSeconds ?? 60
+    config.refreshBufferSeconds ?? 60,
+    `spacelr_token_refresh:${config.projectId}`
   );
   const httpClient = new HttpClient(config, tokenManager);
   const realtime = new RealtimeClient({
@@ -3058,6 +3135,9 @@ function createClient(config) {
     clearTokens() {
       return tokenManager.clearTokens();
     },
+    hasStoredSession() {
+      return tokenManager.getStoredTokens().then((tokens) => !!tokens);
+    },
     disconnect() {
       realtime.disconnect();
     },