@unhingged/vizu-core 0.1.0 → 0.1.2

package/dist/index.d.cts

@@ -465,16 +465,47 @@ interface CloudStorageOptions {
     apiUrl?: string;
     /** Open the sign-in popup automatically on the first auth-needed write. Defaults to true. */
     autoSignIn?: boolean;
+    /**
+     * Fired whenever the cached host-token transitions to authenticated —
+     * either freshly from the popup or rehydrated from sessionStorage.
+     * Vizu wires this to `setUser()` so comments attributed after sign-in
+     * carry the proper display name + avatar.
+     */
+    onAuthChanged?: (info: {
+        userId: string;
+        user: VizuUser | null;
+    }) => void;
 }
 declare class CloudStorageAdapter implements StorageAdapter {
     private readonly apiUrl;
     private readonly workspace;
     private readonly autoSignIn;
+    private onAuthChanged;
     /** Cached current-tab token. Mirrored to sessionStorage. */
     private cachedToken;
     /** Single-flight: at most one popup at a time. Subsequent requests await this. */
     private pendingAuth;
+    /** Whether we've already fired onAuthChanged for the current token. */
+    private lastNotifiedTokenId;
     constructor(opts: CloudStorageOptions);
+    /**
+     * Open the sign-in popup right now (or no-op if a valid token is
+     * cached). Vizu calls this on enable() so the user signs in BEFORE
+     * trying to leave a comment — no surprise modal mid-comment.
+     *
+     * Throws auth_canceled if the user closes the popup. Caller can
+     * decide whether to disable the surface or leave it in a read-only
+     * state.
+     */
+    preflightAuth(): Promise<void>;
+    /**
+     * Synchronous accessor for the currently cached bearer token, used
+     * by sibling modules that need to authenticate against the same
+     * backend (live-collab cross-origin polling). Returns null when no
+     * valid token is cached — callers fall back to credentials:'include'
+     * for same-origin or just disable themselves.
+     */
+    getCachedAuthToken(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -512,6 +543,12 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * a friendly message instead of a blank failure.
      */
     private resolveToken;
+    /**
+     * Notify the host that the authenticated identity changed. De-duped
+     * via the token string so multiple resolveToken() hits with the same
+     * cached token don't re-call setUser on every fetch.
+     */
+    private fireAuthChanged;
     private openSignInPopup;
     /**
      * Perform an authenticated fetch with one-shot retry on 401 (re-opens

package/dist/index.d.ts

@@ -465,16 +465,47 @@ interface CloudStorageOptions {
     apiUrl?: string;
     /** Open the sign-in popup automatically on the first auth-needed write. Defaults to true. */
     autoSignIn?: boolean;
+    /**
+     * Fired whenever the cached host-token transitions to authenticated —
+     * either freshly from the popup or rehydrated from sessionStorage.
+     * Vizu wires this to `setUser()` so comments attributed after sign-in
+     * carry the proper display name + avatar.
+     */
+    onAuthChanged?: (info: {
+        userId: string;
+        user: VizuUser | null;
+    }) => void;
 }
 declare class CloudStorageAdapter implements StorageAdapter {
     private readonly apiUrl;
     private readonly workspace;
     private readonly autoSignIn;
+    private onAuthChanged;
     /** Cached current-tab token. Mirrored to sessionStorage. */
     private cachedToken;
     /** Single-flight: at most one popup at a time. Subsequent requests await this. */
     private pendingAuth;
+    /** Whether we've already fired onAuthChanged for the current token. */
+    private lastNotifiedTokenId;
     constructor(opts: CloudStorageOptions);
+    /**
+     * Open the sign-in popup right now (or no-op if a valid token is
+     * cached). Vizu calls this on enable() so the user signs in BEFORE
+     * trying to leave a comment — no surprise modal mid-comment.
+     *
+     * Throws auth_canceled if the user closes the popup. Caller can
+     * decide whether to disable the surface or leave it in a read-only
+     * state.
+     */
+    preflightAuth(): Promise<void>;
+    /**
+     * Synchronous accessor for the currently cached bearer token, used
+     * by sibling modules that need to authenticate against the same
+     * backend (live-collab cross-origin polling). Returns null when no
+     * valid token is cached — callers fall back to credentials:'include'
+     * for same-origin or just disable themselves.
+     */
+    getCachedAuthToken(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -512,6 +543,12 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * a friendly message instead of a blank failure.
      */
     private resolveToken;
+    /**
+     * Notify the host that the authenticated identity changed. De-duped
+     * via the token string so multiple resolveToken() hits with the same
+     * cached token don't re-call setUser on every fetch.
+     */
+    private fireAuthChanged;
     private openSignInPopup;
     /**
      * Perform an authenticated fetch with one-shot retry on 401 (re-opens

package/dist/index.js

@@ -342,10 +342,40 @@ var CloudStorageAdapter = class {
     this.cachedToken = null;
     /** Single-flight: at most one popup at a time. Subsequent requests await this. */
     this.pendingAuth = null;
+    /** Whether we've already fired onAuthChanged for the current token. */
+    this.lastNotifiedTokenId = null;
     this.workspace = opts.workspace;
     this.apiUrl = (opts.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
     this.autoSignIn = opts.autoSignIn !== false;
+    this.onAuthChanged = opts.onAuthChanged;
     this.cachedToken = this.readStoredToken();
+    if (this.cachedToken && !this.isExpired(this.cachedToken)) {
+      this.fireAuthChanged(this.cachedToken);
+    }
+  }
+  /**
+   * Open the sign-in popup right now (or no-op if a valid token is
+   * cached). Vizu calls this on enable() so the user signs in BEFORE
+   * trying to leave a comment — no surprise modal mid-comment.
+   *
+   * Throws auth_canceled if the user closes the popup. Caller can
+   * decide whether to disable the surface or leave it in a read-only
+   * state.
+   */
+  async preflightAuth() {
+    await this.resolveToken();
+  }
+  /**
+   * Synchronous accessor for the currently cached bearer token, used
+   * by sibling modules that need to authenticate against the same
+   * backend (live-collab cross-origin polling). Returns null when no
+   * valid token is cached — callers fall back to credentials:'include'
+   * for same-origin or just disable themselves.
+   */
+  getCachedAuthToken() {
+    if (!this.cachedToken) return null;
+    if (this.isExpired(this.cachedToken)) return null;
+    return this.cachedToken.token;
   }
   /* ─── StorageAdapter v2 ───────────────────────────────────────────── */
   async load(_namespace) {
@@ -519,7 +549,7 @@ var CloudStorageAdapter = class {
     }
   }
   sessionKey() {
-    return `vizu:cloud-token:${this.workspace}`;
+    return `vizu:cloud-token:v2:${this.workspace}`;
   }
   /**
    * Resolve a valid token, opening the popup if needed.
@@ -534,6 +564,7 @@ var CloudStorageAdapter = class {
     const fresh = this.readStoredToken();
     if (fresh) {
       this.cachedToken = fresh;
+      this.fireAuthChanged(fresh);
       return fresh;
     }
     if (!this.autoSignIn) {
@@ -542,6 +573,7 @@ var CloudStorageAdapter = class {
     if (!this.pendingAuth) {
       this.pendingAuth = this.openSignInPopup().then((t) => {
         this.writeStoredToken(t);
+        this.fireAuthChanged(t);
         return t;
       }).finally(() => {
         this.pendingAuth = null;
@@ -549,6 +581,22 @@ var CloudStorageAdapter = class {
     }
     return this.pendingAuth;
   }
+  /**
+   * Notify the host that the authenticated identity changed. De-duped
+   * via the token string so multiple resolveToken() hits with the same
+   * cached token don't re-call setUser on every fetch.
+   */
+  fireAuthChanged(token) {
+    if (this.lastNotifiedTokenId === token.token) return;
+    this.lastNotifiedTokenId = token.token;
+    try {
+      this.onAuthChanged?.({ userId: token.userId, user: token.user });
+    } catch (err) {
+      if (typeof console !== "undefined") {
+        console.warn("[vizu/cloud] onAuthChanged callback threw", err);
+      }
+    }
+  }
   openSignInPopup() {
     return new Promise((resolve, reject) => {
       if (typeof window === "undefined") {
@@ -581,7 +629,13 @@ var CloudStorageAdapter = class {
         if (typeof data.token !== "string" || typeof data.expiresAt !== "string" || typeof data.userId !== "string") return;
         resolved = true;
         cleanup();
-        resolve({ token: data.token, expiresAt: data.expiresAt, userId: data.userId });
+        const userPayload = data.user;
+        const user = userPayload && typeof userPayload.name === "string" ? {
+          id: typeof userPayload.id === "string" ? userPayload.id : data.userId,
+          name: userPayload.name,
+          avatarUrl: typeof userPayload.avatarUrl === "string" ? userPayload.avatarUrl : void 0
+        } : null;
+        resolve({ token: data.token, expiresAt: data.expiresAt, userId: data.userId, user });
       };
       const onPoll = window.setInterval(() => {
         if (popup.closed) {
@@ -2676,7 +2730,7 @@ var DEFAULTS = {
   namespace: "default",
   accent: "#FF6647"
 };
-function resolveStorage(storage, cloud, defaultMode) {
+function resolveStorage(storage, cloud, defaultMode, onAuthChanged) {
   if (cloud) {
     if (storage && typeof console !== "undefined") {
       console.warn("[vizu] Both `cloud` and `storage` set; `cloud` wins. Drop `storage` to silence this.");
@@ -2684,7 +2738,8 @@ function resolveStorage(storage, cloud, defaultMode) {
     return new CloudStorageAdapter({
       workspace: cloud.workspace,
       apiUrl: cloud.apiUrl,
-      autoSignIn: cloud.autoSignIn
+      autoSignIn: cloud.autoSignIn,
+      onAuthChanged
     });
   }
   if (!storage) return defaultMode === "local" ? new LocalStorageAdapter() : new InMemoryStorageAdapter();
@@ -2790,19 +2845,39 @@ var Vizu = class {
     this.opts.namespace = options.namespace ?? DEFAULTS.namespace;
     this.opts.accent = options.accent ?? DEFAULTS.accent;
     this.parsedShortcut = parseShortcut(this.opts.shortcut);
-    this.storage = resolveStorage(options.storage, options.cloud, _defaultStorage);
+    this.storage = resolveStorage(
+      options.storage,
+      options.cloud,
+      _defaultStorage,
+      (info) => {
+        if (info.user) this.setUser(info.user);
+      }
+    );
     this.user = options.user ?? null;
     if (options.actions) this.actions = [...options.actions];
     if (options.onCommentAdded) this.bus.on("comment:added", (p) => options.onCommentAdded(p.comment));
     if (options.onCommentRemoved) this.bus.on("comment:removed", (p) => options.onCommentRemoved(p.id));
-    if (options.liveblocks && options.cloud) {
-      const live = options.liveblocks;
+    if (options.cloud) {
       const cloud = options.cloud;
-      void import("./live-collab-IRUNFAPE.js").then(({ LiveCollab }) => {
+      const apiUrl = (cloud.apiUrl ?? "https://vizu.unhingged.com").replace(/\/$/, "");
+      void import("./live-collab-BVLNJ5QI.js").then(({ LiveCollab }) => {
         this.liveCollab = new LiveCollab({
-          publicKey: live.publicKey,
-          authEndpoint: live.authEndpoint,
-          workspaceSlug: cloud.workspace
+          workspaceSlug: cloud.workspace,
+          apiUrl,
+          getAuthHeader: async () => {
+            if (typeof window === "undefined") return null;
+            try {
+              if (new URL(apiUrl).origin === window.location.origin) return null;
+            } catch {
+              return null;
+            }
+            const adapter = this.storage;
+            if (adapter instanceof CloudStorageAdapter) {
+              const token = adapter.getCachedAuthToken();
+              if (token) return { Authorization: `Bearer ${token}` };
+            }
+            return null;
+          }
         });
         void this.liveCollab.start();
       });
@@ -2836,6 +2911,14 @@ var Vizu = class {
     this.enabled = true;
     this.bus.emit("enabled", {});
     this.deferred(() => this.mount());
+    if (this.storage instanceof CloudStorageAdapter) {
+      void this.storage.preflightAuth().catch((err) => {
+        if (err?.code === "auth_canceled" || err?.code === "popup_blocked") return;
+        if (typeof console !== "undefined") {
+          console.warn("[vizu] preflight auth failed:", err);
+        }
+      });
+    }
   }
   disable() {
     if (!this.enabled) return;