@tumbaland/frontend-core 1.1.0 → 1.2.0

package/dist/apiClient.d.ts

@@ -7,6 +7,8 @@ export interface ApiClientOptions {
 export interface ApiRequestOptions extends RequestInit {
     /** Skip the onUnauthorized callback for this call (e.g. an auth-check that expects 401 as a normal "not logged in" result, not a hard redirect). */
     skipAuthRedirect?: boolean;
+    /** Serialized onto the URL as a query string; undefined/null values are omitted. */
+    params?: Record<string, string | number | boolean | undefined | null>;
 }
 export declare class ApiError extends Error {
     status: number;
@@ -18,9 +20,7 @@ export declare class ApiError extends Error {
  * correlation/session headers, structured errors, and an opt-in 401 →
  * redirect-to-auth hook, per TECHNICAL_REVIEW.md P1.3. `authService` and
  * `groupService` don't route through this: they use different auth
- * transports (cookie vs. Bearer token) that predate this client. New
- * call sites (the many per-front album/finance/etc. service files that
- * still hand-roll fetch) can adopt this incrementally.
+ * transports (cookie vs. Bearer token) that predate this client.
  */
 export declare function createApiClient(options: ApiClientOptions): {
     request: <T = unknown>(path: string, init?: ApiRequestOptions) => Promise<T>;

package/dist/apiClient.js

@@ -1,4 +1,18 @@
 import { getCorrelationId, getSessionId } from '@tumbaland/components';
+function appendParams(path, params) {
+    if (!params)
+        return path;
+    const searchParams = new URLSearchParams();
+    Object.entries(params).forEach(([key, value]) => {
+        if (value !== undefined && value !== null) {
+            searchParams.append(key, String(value));
+        }
+    });
+    const query = searchParams.toString();
+    if (!query)
+        return path;
+    return `${path}${path.includes('?') ? '&' : '?'}${query}`;
+}
 export class ApiError extends Error {
     constructor(status, message, body) {
         super(message);
@@ -12,14 +26,12 @@ export class ApiError extends Error {
  * correlation/session headers, structured errors, and an opt-in 401 →
  * redirect-to-auth hook, per TECHNICAL_REVIEW.md P1.3. `authService` and
  * `groupService` don't route through this: they use different auth
- * transports (cookie vs. Bearer token) that predate this client. New
- * call sites (the many per-front album/finance/etc. service files that
- * still hand-roll fetch) can adopt this incrementally.
+ * transports (cookie vs. Bearer token) that predate this client.
  */
 export function createApiClient(options) {
     async function request(path, init = {}) {
-        const { skipAuthRedirect, headers, ...rest } = init;
-        const response = await fetch(`${options.baseUrl()}${path}`, {
+        const { skipAuthRedirect, headers, params, ...rest } = init;
+        const response = await fetch(`${options.baseUrl()}${appendParams(path, params)}`, {
             credentials: 'include',
             ...rest,
             headers: {

package/dist/authService.d.ts

@@ -14,12 +14,14 @@ export interface AuthServiceConfig {
  *     getAuthServiceUrl: () => getGlobalConfig().AUTH_SERVICE_URL!,
  *     getAuthFrontUrl: () => getGlobalConfig().AUTH_FRONT_URL!
  *   });
+ *
+ * The JWT lives only in an httpOnly `access_token` cookie — it is never
+ * readable from JS (no localStorage mirror, no client-side decode). Every
+ * call here that needs the session sends `credentials: 'include'` so the
+ * browser attaches the cookie automatically; auth state is always read via
+ * the network (checkAuth/getCurrentUser), never decoded locally.
  */
 export declare function createAuthService(config: AuthServiceConfig): {
-    /** Sync the JWT from cookie to localStorage. Call once on app start. */
-    init(): void;
-    getToken(): string | null;
-    syncToken(): void;
     clearAuthCache(): void;
     /** Verifies the session against auth-service. Cached for 5 minutes. */
     checkAuth(): Promise<AuthResponse>;
@@ -28,8 +30,6 @@ export declare function createAuthService(config: AuthServiceConfig): {
     getCurrentUser(): Promise<User | null>;
     /** Full profile (e.g. firstName/lastName) — only auth-service's /auth/profile has this. */
     getProfile(): Promise<User | null>;
-    /** Decodes the local JWT directly — no network call, but can be stale. */
-    getCurrentUserFromToken(): User | null;
     isAuthenticated(): Promise<boolean>;
 };
 export type AuthService = ReturnType<typeof createAuthService>;

package/dist/authService.js

@@ -7,10 +7,6 @@ function authHeaders() {
         'x-session-id': getSessionId()
     };
 }
-function getJwtTokenFromCookie(cookieName = 'access_token') {
-    const match = document.cookie.match(new RegExp('(^| )' + cookieName + '=([^;]+)'));
-    return match ? match[2] : null;
-}
 /**
  * Builds a per-front auth service instance. Each of the 7 frontends that
  * previously hand-rolled their own (six divergent copies, per
@@ -21,27 +17,17 @@ function getJwtTokenFromCookie(cookieName = 'access_token') {
  *     getAuthServiceUrl: () => getGlobalConfig().AUTH_SERVICE_URL!,
  *     getAuthFrontUrl: () => getGlobalConfig().AUTH_FRONT_URL!
  *   });
+ *
+ * The JWT lives only in an httpOnly `access_token` cookie — it is never
+ * readable from JS (no localStorage mirror, no client-side decode). Every
+ * call here that needs the session sends `credentials: 'include'` so the
+ * browser attaches the cookie automatically; auth state is always read via
+ * the network (checkAuth/getCurrentUser), never decoded locally.
  */
 export function createAuthService(config) {
     let authCache = null;
     let authCacheTime = 0;
-    function syncJwtToken() {
-        const token = getJwtTokenFromCookie();
-        if (token && localStorage.getItem('authToken') !== token) {
-            localStorage.setItem('authToken', token);
-        }
-    }
     return {
-        /** Sync the JWT from cookie to localStorage. Call once on app start. */
-        init() {
-            syncJwtToken();
-        },
-        getToken() {
-            return localStorage.getItem('authToken');
-        },
-        syncToken() {
-            syncJwtToken();
-        },
         clearAuthCache() {
             authCache = null;
             authCacheTime = 0;
@@ -93,7 +79,6 @@ export function createAuthService(config) {
                 }
                 const data = await response.json();
                 if (data.success) {
-                    localStorage.removeItem('authToken');
                     authCache = null;
                     authCacheTime = 0;
                     window.location.reload();
@@ -129,31 +114,6 @@ export function createAuthService(config) {
                 return null;
             }
         },
-        /** Decodes the local JWT directly — no network call, but can be stale. */
-        getCurrentUserFromToken() {
-            try {
-                const token = this.getToken();
-                if (!token)
-                    return null;
-                const payload = token.split('.')[1];
-                if (!payload)
-                    return null;
-                const decoded = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-                if (decoded.exp && Date.now() >= decoded.exp * 1000) {
-                    return null;
-                }
-                return {
-                    id: decoded.sub || decoded.id,
-                    email: decoded.email,
-                    name: decoded.name || decoded.preferred_username,
-                    picture: decoded.picture
-                };
-            }
-            catch (error) {
-                console.error('Failed to decode JWT token:', error);
-                return null;
-            }
-        },
         async isAuthenticated() {
             const result = await this.checkAuth();
             return result.authenticated;

package/dist/groupService.js

@@ -1,11 +1,7 @@
 import { getCorrelationId, getSessionId } from '@tumbaland/components';
-function getAuthToken() {
-    return localStorage.getItem('authToken') || '';
-}
 function groupHeaders() {
     return {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${getAuthToken()}`,
         'x-correlation-id': getCorrelationId(),
         'x-session-id': getSessionId()
     };
@@ -24,6 +20,7 @@ export function createGroupService(config) {
         async getUserGroups() {
             try {
                 const response = await fetch(`${config.getGroupApiUrl()}/api/groups/mine`, {
+                    credentials: 'include',
                     headers: groupHeaders()
                 });
                 if (!response.ok) {
@@ -43,6 +40,7 @@ export function createGroupService(config) {
         async getUserGroupIds() {
             try {
                 const response = await fetch(`${config.getGroupApiUrl()}/api/groups/mine/ids`, {
+                    credentials: 'include',
                     headers: groupHeaders()
                 });
                 if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/frontend-core",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Shared frontend auth/group/API-client logic for Tumbaland frontends",
   "author": "Tumbaland",
   "license": "MIT",