@webround/commerce 0.0.0-stage → 0.3.0

package/dist/addresses/types.d.ts

@@ -0,0 +1,48 @@
+/** What an address is made of to be taken (the store's own bounds). */
+export interface AddressInput {
+    fullName: string;
+    company?: string;
+    phone?: string;
+    addressLine1: string;
+    addressLine2?: string;
+    city: string;
+    province?: string;
+    postalCode: string;
+    /** The country's two letters (`IT`). */
+    countryCode: string;
+    vatCode?: string | null;
+    additionalInfo?: string;
+    /** The customer's default for shipping / for billing: making one default takes it from the one that was. */
+    isDefaultShipping?: boolean;
+    isDefaultBilling?: boolean;
+}
+/** What is changed of an address: any of it. */
+export type AddressPatch = Partial<AddressInput>;
+/** An address as the store keeps it: what was given, with what it adds, and `null` for what was not given. */
+export interface Address {
+    id: string;
+    storeId: string;
+    customerId: string;
+    fullName: string;
+    company: string | null;
+    phone: string | null;
+    addressLine1: string;
+    addressLine2: string | null;
+    city: string;
+    postalCode: string;
+    province: string | null;
+    countryCode: string;
+    additionalInfo: string | null;
+    vatCode: string | null;
+    isDefaultShipping: boolean;
+    isDefaultBilling: boolean;
+    createdAt: string | null;
+    updatedAt: string | null;
+}
+/** An address as a screen has it, a customer's or a guest's: what it says and whether it is a default (a guest's has an id of its own, `local-…`, and no more than that). */
+export type BookAddress = Pick<Address, 'id' | 'fullName' | 'company' | 'phone' | 'addressLine1' | 'addressLine2' | 'city' | 'postalCode' | 'province' | 'countryCode' | 'additionalInfo' | 'vatCode' | 'isDefaultShipping' | 'isDefaultBilling'>;
+/** The `code` the store gives to what an address call refuses. */
+export declare const ADDRESS_ERROR_CODES: {
+    readonly notFound: "ADDRESS_NOT_FOUND";
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/addresses/types.js

@@ -0,0 +1,6 @@
+// What the address calls of commerce-core take and give, as the store says it. A customer's addresses are kept by the store; a guest's are not kept anywhere (see book.ts).
+/** The `code` the store gives to what an address call refuses. */
+export const ADDRESS_ERROR_CODES = {
+    notFound: 'ADDRESS_NOT_FOUND',
+};
+//# sourceMappingURL=types.js.map

package/dist/auth/api.d.ts

@@ -0,0 +1,43 @@
+import type { HttpClient } from '../http.js';
+import type { CallOptions } from '../catalog/types.js';
+import type { EmailOptions, LoginAnswer, LoginInput, LogoutInput, RefreshedSession, RefreshInput, RequestResetInput, SignupInput, AuthSession, NewsletterAnswer, NewsletterInput, TotpConfirmAnswer, TotpConfirmInput, TotpLoginVerifyInput, TotpSetup } from './types.js';
+/** For the calls that need the JWT: give it here and it is sent as `Authorization: Bearer …` (it wins over what the client adds). Without it the client's `getHeaders` is what carries it. */
+export interface AccessTokenOptions {
+    accessToken?: string;
+}
+export interface AuthApi {
+    /** `POST /store-customers/auth/signup-password`: makes the customer AND logs them in (a session, with the cookie). Their address is not verified yet (`emailVerified: false`): the store sends them the email. */
+    signup(input: SignupInput, options?: CallOptions & EmailOptions): Promise<AuthSession>;
+    /** `POST /store-customers/auth/login-password`: a session (and the cookie), or, for a customer with two-factor authentication, a challenge to answer with `totpLoginVerify`. */
+    login(input: LoginInput, options?: CallOptions): Promise<LoginAnswer>;
+    /** `POST /store-customers/auth/totp/login-verify`: the code of the authenticator app, for the challenge a login answered: the session (and the cookie). */
+    totpLoginVerify(input: TotpLoginVerifyInput, options?: CallOptions): Promise<AuthSession>;
+    /**
+     * `POST /store-customers/auth/refresh-token`: a new JWT, from the refresh token (the cookie) and the `csrfToken` the login gave (`x-wr-csrf`), for this device. A refresh token that is not there, or
+     * that does not match, or that ended, is an error (403 with no cookie or no CSRF token, 401 with a wrong one, 401 `EXPIRED_TOKEN` when it ended): the customer is not logged in any more.
+     */
+    refresh(input: RefreshInput, credentials: {
+        csrfToken: string;
+    }, options?: CallOptions): Promise<RefreshedSession>;
+    /** `POST /store-customers/auth/logout` (needs the JWT): ends the refresh token of this device; the store clears the cookies. Nothing comes back. */
+    logout(input: LogoutInput, options?: CallOptions & AccessTokenOptions): Promise<void>;
+    /** `POST /store-customers/auth/request-reset`: the store sends an email with a link to a page where the password is chosen. It answers the same for an address it does not know. Nothing comes back. */
+    requestReset(input: RequestResetInput, options?: CallOptions & EmailOptions): Promise<void>;
+    /** `POST /store-customers/auth/resend-verification` (needs the JWT): the email that verifies the address, again. Nothing comes back. */
+    resendVerification(options?: CallOptions & EmailOptions & AccessTokenOptions): Promise<void>;
+    /** `DELETE /store-customers/auth/request-delete` (needs the JWT): the store sends an email with a link to a page that confirms the deletion of the account. Nothing comes back. */
+    requestDelete(options?: CallOptions & EmailOptions & AccessTokenOptions): Promise<void>;
+    /** `POST /store-customers/auth/totp/setup` (needs the JWT): a secret for an authenticator app, to be confirmed with `totpConfirm`. A second request within 15 minutes is `TWO_FA_SETUP_ALREADY_REQUESTED`. */
+    totpSetup(options?: CallOptions & AccessTokenOptions): Promise<TotpSetup>;
+    /** `POST /store-customers/auth/totp/confirm` (needs the JWT): turns two-factor authentication on with the code the app shows. */
+    totpConfirm(input: TotpConfirmInput, options?: CallOptions & AccessTokenOptions): Promise<TotpConfirmAnswer>;
+    /**
+     * `POST /store-customers/auth/newsletter/subscribe` (with or without the JWT): a logged-in customer with a verified address is subscribed at once (`direct: true`); a guest, or a customer whose address is not verified,
+     * is sent an email with a link that confirms it (`direct: false`). With the JWT the store uses the customer's own address and ignores the one in the body.
+     */
+    newsletterSubscribe(input: NewsletterInput, options?: CallOptions & EmailOptions & AccessTokenOptions): Promise<NewsletterAnswer>;
+    /** `POST /store-customers/auth/newsletter/unsubscribe`: the same two ways (at once for a verified logged-in customer, by an email's link otherwise). */
+    newsletterUnsubscribe(input: NewsletterInput, options?: CallOptions & EmailOptions & AccessTokenOptions): Promise<NewsletterAnswer>;
+}
+export declare function createAuthApi(http: HttpClient): AuthApi;
+//# sourceMappingURL=api.d.ts.map

package/dist/auth/api.js

@@ -0,0 +1,22 @@
+const bearer = (options) => (options?.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {});
+const PREFIX = '/store-customers/auth';
+const language = (options) => (options?.language ? { 'Accept-Language': options.language } : undefined);
+export function createAuthApi(http) {
+    return {
+        signup: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/signup-password`, body: input, credentials: 'include', headers: language(options), signal: options?.signal }),
+        login: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/login-password`, body: input, credentials: 'include', signal: options?.signal }),
+        totpLoginVerify: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/totp/login-verify`, body: input, credentials: 'include', signal: options?.signal }),
+        refresh: (input, credentials, options) => http.request({
+            method: 'POST', path: `${PREFIX}/refresh-token`, body: input, credentials: 'include', headers: { 'x-wr-csrf': credentials.csrfToken }, signal: options?.signal,
+        }),
+        logout: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/logout`, body: input, credentials: 'include', headers: bearer(options), signal: options?.signal }),
+        requestReset: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/request-reset`, body: input, headers: language(options), signal: options?.signal }),
+        resendVerification: (options) => http.request({ method: 'POST', path: `${PREFIX}/resend-verification`, headers: { ...language(options), ...bearer(options) }, signal: options?.signal }),
+        requestDelete: (options) => http.request({ method: 'DELETE', path: `${PREFIX}/request-delete`, headers: { ...language(options), ...bearer(options) }, signal: options?.signal }),
+        totpSetup: (options) => http.request({ method: 'POST', path: `${PREFIX}/totp/setup`, headers: bearer(options), signal: options?.signal }),
+        totpConfirm: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/totp/confirm`, body: input, credentials: 'include', headers: bearer(options), signal: options?.signal }),
+        newsletterSubscribe: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/newsletter/subscribe`, body: input, headers: { ...language(options), ...bearer(options) }, signal: options?.signal }),
+        newsletterUnsubscribe: (input, options) => http.request({ method: 'POST', path: `${PREFIX}/newsletter/unsubscribe`, body: input, headers: { ...language(options), ...bearer(options) }, signal: options?.signal }),
+    };
+}
+//# sourceMappingURL=api.js.map

package/dist/auth/auth.d.ts

@@ -0,0 +1,32 @@
+import { type HttpClient, type HttpClientConfig } from '../http.js';
+import { type AuthApi } from './api.js';
+import { type AuthStorage, type CookiePort, type CookieStorageOptions } from './cookies.js';
+import { type WakePort } from './wake.js';
+import { type AuthStore, type AuthStoreOptions } from './store.js';
+export interface AuthConfig extends Pick<HttpClientConfig, 'baseUrl' | 'storeId' | 'timeoutMs' | 'fetch'> {
+    /** Where the CSRF token and the device id are kept: the browser's cookies and the page's own `localStorage` by default (a page in a frame of another site is refused its cookies: see `browserSessionPort`). */
+    cookies?: CookiePort;
+    cookieOptions?: CookieStorageOptions;
+    /** What the device says besides its id (`platform: 'web'`). */
+    device?: AuthStoreOptions['device'];
+    renewBeforeMs?: number;
+    now?: AuthStoreOptions['now'];
+    timers?: AuthStoreOptions['timers'];
+    /** When the page is back (visible, online): the browser's by default. */
+    wake?: WakePort;
+}
+export interface Auth {
+    /** A client of commerce-core for this store, whose calls carry the customer's JWT: renewed when it is about to end, and once more when the store refuses it (a 401 with no code), asking again after it. */
+    http: HttpClient;
+    /** A client like `http` for another backend of the same store (the checkout's address), carrying the same JWT. */
+    httpFor(baseUrl: string): HttpClient;
+    api: AuthApi;
+    store: AuthStore;
+    storage: AuthStorage;
+}
+/**
+ * Everything for the customer's session of ONE store, joined: the client carries the JWT the store gives. The store asks what it asks for itself through another client that carries none (a login, a
+ * refresh), so that neither waits for the other. The client and the store need each other, which is why this is one place.
+ */
+export declare function createAuth(config: AuthConfig): Auth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.js

@@ -0,0 +1,23 @@
+import { createHttpClient } from '../http.js';
+import { createAuthApi } from './api.js';
+import { browserSessionPort, createCookieAuthStorage } from './cookies.js';
+import { withTokenRenewal } from './renewal.js';
+import { browserWakePort } from './wake.js';
+import { createAuthStore } from './store.js';
+/**
+ * Everything for the customer's session of ONE store, joined: the client carries the JWT the store gives. The store asks what it asks for itself through another client that carries none (a login, a
+ * refresh), so that neither waits for the other. The client and the store need each other, which is why this is one place.
+ */
+export function createAuth(config) {
+    const storage = createCookieAuthStorage(config.cookies ?? browserSessionPort(), config.storeId, config.cookieOptions);
+    const connection = { baseUrl: config.baseUrl, storeId: config.storeId, timeoutMs: config.timeoutMs, fetch: config.fetch };
+    let store;
+    // What the store asks for itself (a login, a refresh) goes through a client that carries no JWT: it is asked for when there may be none
+    const ownApi = createAuthApi(createHttpClient(connection));
+    // What the site asks for (and the calls of the customer's that need the JWT) goes through this one: it carries the store's JWT (renewed when it is about to end) and, when the store refuses it, renews it once and asks again
+    const carryingJwt = (baseUrl) => withTokenRenewal(createHttpClient({ ...connection, baseUrl }), { accessToken: () => store.accessToken(), renew: (rejected) => store.renew(rejected) });
+    const http = carryingJwt(config.baseUrl);
+    store = createAuthStore({ api: ownApi, storage, device: config.device, renewBeforeMs: config.renewBeforeMs, now: config.now, timers: config.timers, wake: config.wake ?? browserWakePort() });
+    return { http, httpFor: carryingJwt, api: createAuthApi(http), store, storage };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/cookies.d.ts

@@ -0,0 +1,46 @@
+export interface CookiePort {
+    /** Every cookie, as `document.cookie` says it: `a=1; b=2`. */
+    read(): string;
+    /** One cookie, as `document.cookie = …` takes it: `name=value; Path=/; Max-Age=…`. */
+    write(cookie: string): void;
+}
+/** What the client keeps, by what it is, not by where: the cookies are one way to keep it. */
+export interface AuthStorage {
+    /** The CSRF token of the session, or null when there is none. */
+    csrfToken(): string | null;
+    saveCsrfToken(token: string): void;
+    forgetCsrfToken(): void;
+    /** This device's id (5 characters at least): made and kept the first time it is asked for. */
+    deviceId(): string;
+}
+export interface CookieStorageOptions {
+    /** Written with `Secure` (only over https). Default: when the page is on https. */
+    secure?: boolean;
+    /** How long the CSRF token is kept: as long as the refresh token (30 days) by default. */
+    csrfMaxAgeSeconds?: number;
+    /** How long the device id is kept: a year by default. */
+    deviceMaxAgeSeconds?: number;
+    /** Makes a device id; by default a random UUID. */
+    makeDeviceId?: () => string;
+}
+/** The cookies of a header, by name (a value that is not valid escaping is kept as it is). */
+export declare function parseCookies(header: string): Record<string, string>;
+/** A cookie as `document.cookie = …` takes it. `maxAgeSeconds: 0` deletes it. */
+export declare function cookieText(name: string, value: string, options: {
+    maxAgeSeconds: number;
+    secure: boolean;
+}): string;
+export declare function createCookieAuthStorage(port: CookiePort, storeId: string, options?: CookieStorageOptions): AuthStorage;
+/** The browser's own cookies. Where there is no document (a server render, a worker) it reads nothing and writes nothing: a customer there is signed out until the page itself runs. */
+export declare function browserCookiePort(): CookiePort;
+/** Cookies in memory, behaving as a browser's jar does for what is written here (a `Max-Age=0` deletes). For a test, and for a runtime that has no document and wants to keep a session anyway. */
+export declare function memoryCookiePort(initial?: Record<string, string>): CookiePort & {
+    all(): Record<string, string>;
+};
+/** A `Storage` (`localStorage`) as a port of cookies: each cookie is a key of its own, with the time it ends. A write that the browser refuses (blocked storage, no room) is nothing: it never throws. */
+export declare function storageCookiePort(storage: Pick<Storage, 'getItem' | 'setItem' | 'removeItem' | 'key' | 'length'>, now?: () => number): CookiePort;
+/** Two places for the same cookies: a write goes to both, a read takes the first's and, for a name it does not have, the second's. So a place that refuses what is written to it (cookies in a frame of another site) is not missed. */
+export declare function fallbackCookiePort(first: CookiePort, second: CookiePort): CookiePort;
+/** What a session keeps its CSRF token and device id in, in a browser: the cookies, and the page's own `localStorage` besides (see the top of this file). Without `localStorage` (a server render, blocked storage) it is the cookies alone. */
+export declare function browserSessionPort(): CookiePort;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.js

@@ -0,0 +1,156 @@
+// What the client keeps of a customer's session between page loads, and where. The refresh token is not here: it is a cookie the store sets (HttpOnly, Secure, SameSite=None) that JavaScript never sees; the
+// browser sends it where `credentials: 'include'` says. What the client keeps is two cookies of its own, written by JavaScript (so a server render can read them too):
+//  - `wrCsrfToken_<storeId>`: the CSRF token the login gave. It is made with the refresh token and lives as long as it does (30 days); a refresh asks for it IN A HEADER (`x-wr-csrf`), the cookie only keeps it.
+//  - `wrDeviceId_<storeId>`: who this device is to the store (the refresh token belongs to it): made once, kept a year.
+// A cookie is read and written through a PORT of two functions, so the browser, a server render and a test are all the same to what uses it.
+//
+// Where a page is shown inside another site's (the editor's preview is an iframe of the editor), the browser refuses the cookies the page writes itself (`SameSite=Lax`, in a frame of another site): the CSRF
+// token and the device id would be lost at the first reload, and the customer would be signed out. So the session's port (`browserSessionPort`) keeps them in two places of the PAGE's own: the cookies, and
+// its `localStorage` (which a frame of another site has, for itself). Nothing of the backend changes: the CSRF token is still sent in a header, and the refresh token is still the store's `HttpOnly` cookie.
+const DAY = 60 * 60 * 24;
+/** The cookies of a header, by name (a value that is not valid escaping is kept as it is). */
+export function parseCookies(header) {
+    const out = {};
+    for (const part of header.split(';')) {
+        const at = part.indexOf('=');
+        const name = at < 0 ? '' : part.slice(0, at).trim();
+        if (name === '')
+            continue;
+        const raw = part.slice(at + 1).trim();
+        if (name in out)
+            continue; // the first one counts, as in a browser
+        try {
+            out[name] = decodeURIComponent(raw);
+        }
+        catch {
+            out[name] = raw;
+        }
+    }
+    return out;
+}
+/** A cookie as `document.cookie = …` takes it. `maxAgeSeconds: 0` deletes it. */
+export function cookieText(name, value, options) {
+    return `${name}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(0, Math.floor(options.maxAgeSeconds))}; SameSite=Lax${options.secure ? '; Secure' : ''}`;
+}
+const newDeviceId = () => globalThis.crypto.randomUUID();
+export function createCookieAuthStorage(port, storeId, options = {}) {
+    const secure = options.secure ?? globalThis.location?.protocol === 'https:';
+    const csrfName = `wrCsrfToken_${storeId}`;
+    const deviceName = `wrDeviceId_${storeId}`;
+    const read = (name) => {
+        const value = parseCookies(port.read())[name];
+        return value === undefined || value === '' ? null : value;
+    };
+    return {
+        csrfToken: () => read(csrfName),
+        saveCsrfToken: (token) => port.write(cookieText(csrfName, token, { maxAgeSeconds: options.csrfMaxAgeSeconds ?? 30 * DAY, secure })),
+        forgetCsrfToken: () => port.write(cookieText(csrfName, '', { maxAgeSeconds: 0, secure })),
+        deviceId() {
+            const known = read(deviceName);
+            if (known !== null && known.length >= 5)
+                return known;
+            const made = (options.makeDeviceId ?? newDeviceId)();
+            port.write(cookieText(deviceName, made, { maxAgeSeconds: options.deviceMaxAgeSeconds ?? 365 * DAY, secure }));
+            return made;
+        },
+    };
+}
+/** The browser's own cookies. Where there is no document (a server render, a worker) it reads nothing and writes nothing: a customer there is signed out until the page itself runs. */
+export function browserCookiePort() {
+    const doc = globalThis.document;
+    return {
+        read: () => doc?.cookie ?? '',
+        write: (cookie) => { if (doc)
+            doc.cookie = cookie; },
+    };
+}
+/** Cookies in memory, behaving as a browser's jar does for what is written here (a `Max-Age=0` deletes). For a test, and for a runtime that has no document and wants to keep a session anyway. */
+export function memoryCookiePort(initial = {}) {
+    const jar = new Map(Object.entries(initial));
+    return {
+        read: () => [...jar].map(([name, value]) => `${name}=${encodeURIComponent(value)}`).join('; '),
+        write(cookie) {
+            const [pair = '', ...attributes] = cookie.split(';');
+            const at = pair.indexOf('=');
+            if (at < 1)
+                return;
+            const name = pair.slice(0, at).trim();
+            const value = pair.slice(at + 1);
+            const maxAge = attributes.map((a) => /^\s*max-age\s*=\s*(-?\d+)/i.exec(a)?.[1]).find((v) => v !== undefined);
+            if (value === '' || (maxAge !== undefined && Number(maxAge) <= 0))
+                jar.delete(name);
+            else
+                jar.set(name, decodeURIComponent(value));
+        },
+        all: () => Object.fromEntries(jar),
+    };
+}
+/** A `Storage` (`localStorage`) as a port of cookies: each cookie is a key of its own, with the time it ends. A write that the browser refuses (blocked storage, no room) is nothing: it never throws. */
+export function storageCookiePort(storage, now = Date.now) {
+    const PREFIX = 'wr-cookie:';
+    const safely = (call, otherwise) => { try {
+        return call();
+    }
+    catch {
+        return otherwise;
+    } };
+    return {
+        read() {
+            const parts = [];
+            const names = safely(() => Array.from({ length: storage.length }, (_, i) => storage.key(i)).filter((key) => key !== null && key.startsWith(PREFIX)), []);
+            for (const key of names) {
+                const kept = safely(() => JSON.parse(storage.getItem(key) ?? 'null'), null);
+                if (kept === null || typeof kept.v !== 'string')
+                    continue;
+                if (typeof kept.e === 'number' && kept.e <= now()) {
+                    safely(() => storage.removeItem(key), undefined);
+                    continue;
+                }
+                parts.push(`${key.slice(PREFIX.length)}=${encodeURIComponent(kept.v)}`);
+            }
+            return parts.join('; ');
+        },
+        write(cookie) {
+            const [pair = '', ...attributes] = cookie.split(';');
+            const at = pair.indexOf('=');
+            if (at < 1)
+                return;
+            const name = pair.slice(0, at).trim();
+            const value = safely(() => decodeURIComponent(pair.slice(at + 1)), pair.slice(at + 1));
+            const maxAge = attributes.map((a) => /^\s*max-age\s*=\s*(-?\d+)/i.exec(a)?.[1]).find((v) => v !== undefined);
+            if (value === '' || (maxAge !== undefined && Number(maxAge) <= 0)) {
+                safely(() => storage.removeItem(PREFIX + name), undefined);
+                return;
+            }
+            const kept = { v: value, ...(maxAge !== undefined ? { e: now() + Number(maxAge) * 1000 } : {}) };
+            safely(() => storage.setItem(PREFIX + name, JSON.stringify(kept)), undefined);
+        },
+    };
+}
+/** Two places for the same cookies: a write goes to both, a read takes the first's and, for a name it does not have, the second's. So a place that refuses what is written to it (cookies in a frame of another site) is not missed. */
+export function fallbackCookiePort(first, second) {
+    return {
+        read() {
+            const merged = { ...parseCookies(second.read()), ...parseCookies(first.read()) };
+            return Object.entries(merged).map(([name, value]) => `${name}=${encodeURIComponent(value)}`).join('; ');
+        },
+        write(cookie) {
+            first.write(cookie);
+            second.write(cookie);
+        },
+    };
+}
+/** What a session keeps its CSRF token and device id in, in a browser: the cookies, and the page's own `localStorage` besides (see the top of this file). Without `localStorage` (a server render, blocked storage) it is the cookies alone. */
+export function browserSessionPort() {
+    const cookies = browserCookiePort();
+    let storage;
+    try {
+        storage = globalThis.localStorage;
+        void storage?.length;
+    }
+    catch {
+        storage = undefined;
+    }
+    return storage ? fallbackCookiePort(cookies, storageCookiePort(storage)) : cookies;
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/index.d.ts

@@ -0,0 +1,14 @@
+export { createAuthApi } from './api.js';
+export type { AccessTokenOptions, AuthApi } from './api.js';
+export { requiresTwoFactor } from './types.js';
+export type { AuthSession, DeviceInput, EmailOptions, LoginAnswer, LoginInput, LogoutInput, NewsletterAnswer, NewsletterInput, RefreshedSession, RefreshInput, RequestResetInput, SignupInput, TotpConfirmAnswer, TotpConfirmInput, TotpLoginVerifyInput, TotpSetup, TwoFactorChallenge, } from './types.js';
+export { createAuth } from './auth.js';
+export type { Auth, AuthConfig } from './auth.js';
+export { browserCookiePort, browserSessionPort, cookieText, createCookieAuthStorage, fallbackCookiePort, memoryCookiePort, parseCookies, storageCookiePort } from './cookies.js';
+export type { AuthStorage, CookiePort, CookieStorageOptions } from './cookies.js';
+export { createAuthStore } from './store.js';
+export type { AuthState, AuthStatus, AuthStore, AuthStoreOptions, Customer } from './store.js';
+export { withTokenRenewal } from './renewal.js';
+export { browserWakePort } from './wake.js';
+export type { WakePort } from './wake.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+export { createAuthApi } from './api.js';
+export { requiresTwoFactor } from './types.js';
+export { createAuth } from './auth.js';
+export { browserCookiePort, browserSessionPort, cookieText, createCookieAuthStorage, fallbackCookiePort, memoryCookiePort, parseCookies, storageCookiePort } from './cookies.js';
+export { createAuthStore } from './store.js';
+export { withTokenRenewal } from './renewal.js';
+export { browserWakePort } from './wake.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/renewal.d.ts

@@ -0,0 +1,4 @@
+import type { HttpClient } from '../http.js';
+import type { AuthStore } from './store.js';
+export declare function withTokenRenewal(http: HttpClient, store: Pick<AuthStore, 'accessToken' | 'renew'>): HttpClient;
+//# sourceMappingURL=renewal.d.ts.map

package/dist/auth/renewal.js

@@ -0,0 +1,37 @@
+import { isCommerceError } from '../errors.js';
+// A client that carries the customer's JWT, and when the store says the JWT is not good renews it ONCE and asks again. The store answers a JWT that has ended the way it answers one that was never one: a 401
+// with no `code` (seen against a real commerce-core; the guard cannot tell them apart). So the rule is the same for both: a 401 with no code, for a request that carried the JWT, is "get a new one".
+//  - a 401 that has a code is about something else (`INVALID_CREDENTIALS` of a wrong password): it is not a JWT's, and nothing is renewed;
+//  - a 403 is not renewed either: right after a signup or a login the store may answer 403 "Customer not found" for a moment (it answers before it has saved), and that is not "log out";
+//  - one renewal however many requests were refused at once (the store's `renew` is one at a time), and a request refused with a JWT that is already not the current one just asks again with the current;
+//  - a request is asked again ONCE: if the new JWT is refused too, that 401 is the answer (the session is not ended for it: something else is wrong);
+//  - if the renewal fails the caller gets the 401 it got, not the renewal's error: the request was refused, and the session says why (signedOut, or the store not reached);
+//  - a caller that sets `Authorization` itself is left alone: it is not asking for the customer's JWT.
+/** What the paths of the refresh token itself do: they are never renewed (they are asked for with the cookie and the CSRF token). */
+const NOT_RENEWED = /\/store-customers\/auth\/refresh-token$/;
+export function withTokenRenewal(http, store) {
+    return {
+        get baseUrl() { return http.baseUrl; },
+        get storeId() { return http.storeId; },
+        async request(options) {
+            const own = Object.keys(options.headers ?? {}).some((name) => name.toLowerCase() === 'authorization');
+            if (own)
+                return http.request(options);
+            const token = await store.accessToken();
+            const withToken = (jwt) => ({ ...options, headers: { ...options.headers, ...(jwt === null ? {} : { Authorization: `Bearer ${jwt}` }) } });
+            try {
+                return await http.request(withToken(token));
+            }
+            catch (error) {
+                const refused = isCommerceError(error) && error.kind === 'http' && error.status === 401 && error.code === null;
+                if (!refused || token === null || NOT_RENEWED.test(options.path) || options.signal?.aborted)
+                    throw error;
+                const renewed = await store.renew(token);
+                if (renewed === null)
+                    throw error;
+                return http.request(withToken(renewed));
+            }
+        },
+    };
+}
+//# sourceMappingURL=renewal.js.map

package/dist/auth/store.d.ts

@@ -0,0 +1,70 @@
+import { CommerceError } from '../errors.js';
+import type { AuthApi } from './api.js';
+import type { AuthStorage } from './cookies.js';
+import type { WakePort } from './wake.js';
+import { type AuthSession, type LoginInput, type SignupInput, type TwoFactorChallenge } from './types.js';
+export type AuthStatus = 'unknown' | 'signedOut' | 'signingIn' | 'challenge' | 'signedIn';
+/** The customer, as the store says: the session without what is the session's (the JWT, the CSRF token). */
+export type Customer = Omit<AuthSession, 'token' | 'csrfToken' | 'expiresIn' | 'extraData'>;
+export interface AuthState {
+    status: AuthStatus;
+    customer: Customer | null;
+    /** The code of the authenticator app is wanted for this (status `challenge`). */
+    challenge: TwoFactorChallenge | null;
+    /** What stopped the session from being renewed or restored without ending it (the store not reached): it goes when it works again. An action that fails does not put its error here: it throws it. */
+    error: CommerceError | null;
+}
+export interface AuthStore {
+    getState(): AuthState;
+    subscribe(listener: () => void): () => void;
+    /** Takes the customer back if a session was kept: asks for a new JWT. Once; the same promise for whoever asks while it is under way. */
+    restore(): Promise<void>;
+    signup(input: Omit<SignupInput, 'deviceId'>, options?: {
+        language?: string;
+    }): Promise<void>;
+    /** Logs in: `signedIn`, or `challenge` when the customer has two-factor authentication on (then `verifyTwoFactor`). A refused login throws what the store said and leaves the state as it was. */
+    login(input: Omit<LoginInput, 'deviceId'>): Promise<void>;
+    /** The code of the app, for the challenge: `signedIn`. A wrong code throws and leaves the challenge to try again; a challenge that ended is `signedOut`. */
+    verifyTwoFactor(totpCode: string): Promise<void>;
+    /** Gives up on a challenge. */
+    cancelChallenge(): void;
+    /** Ends the session here (always) and at the store (if it can be reached). Never throws. */
+    logout(): Promise<void>;
+    /** A new JWT from the refresh token. Once at a time. True when there is a session after it. */
+    refresh(): Promise<boolean>;
+    /** The JWT to send, renewed first if it is about to end; null when nobody is logged in. */
+    accessToken(): Promise<string | null>;
+    /** The store did not accept this JWT: the one to ask again with. The current one if it is not the one that was refused (another request already renewed it); else a new one (one renewal at a time); null when there is none (not logged in any more, or the renewal did not work). */
+    renew(rejected: string): Promise<string | null>;
+    /** `{ Authorization: 'Bearer …' }` or `{}`: what `getHeaders` of a client gives. */
+    authHeaders(): Promise<Record<string, string>>;
+    /** Takes a session that was made elsewhere (a confirmed two-factor setup answers one): the same as a login. */
+    accept(session: AuthSession): void;
+    /** Stops what runs by itself (the timer, the wake port). The store still answers what it is asked. */
+    dispose(): void;
+}
+export interface AuthStoreOptions {
+    /**
+     * What the store asks of commerce-core. It must NOT be made over a client that gets its JWT from this store (`authHeaders`): a refresh and a login are asked for while there may be no JWT, and a client that
+     * waits for the store's JWT in order to ask the store for a JWT waits for itself. `createAuth` makes it right; the JWT of the one call that needs it here (logout) is given explicitly.
+     */
+    api: AuthApi;
+    storage: AuthStorage;
+    /** What the device says besides its id, in each signup and login (`platform: 'web'`). */
+    device?: {
+        platform?: string;
+        region?: string;
+    };
+    /** A JWT with less than this left (ms) is renewed before it is used, and by the timer. Default a minute. */
+    renewBeforeMs?: number;
+    /** The time, in ms. */
+    now?: () => number;
+    timers?: {
+        setTimeout(fn: () => void, ms: number): unknown;
+        clearTimeout(handle: unknown): void;
+    };
+    /** Says when the page is back (visible again, online again, restored from a sleep): the store then looks at its JWT at once, since a timer does not run while a machine sleeps. None by default. */
+    wake?: WakePort;
+}
+export declare function createAuthStore(options: AuthStoreOptions): AuthStore;
+//# sourceMappingURL=store.d.ts.map