@witnium-tech/witniumchain 0.9.0 → 0.11.0

package/dist/index.mjs

@@ -109,6 +109,16 @@ var WitniumchainClient = class {
   // tokens rotate on use (D10), so a second concurrent refresh would race the
   // first and one of them would 401.
   refreshInFlight;
+  // True when the current `accessToken` was minted by the session→token
+  // exchange (`exchangeSessionForToken`) rather than the OAuth code/refresh
+  // flow. Drives the 401-retry: a session-exchanged token has no refresh
+  // credential, so on expiry the SDK re-mints from the cookie instead of
+  // refreshing. Reset to false whenever an OAuth /token response lands.
+  accessTokenFromSession = false;
+  // Single-flight gate for the session→token exchange. A cookie-only client's
+  // first BearerJWT call (and any concurrent fan-out) awaits one in-flight
+  // mint rather than minting N tokens.
+  sessionExchangeInFlight;
   /** Subscriptions / billing helpers. See {@link Subscriptions}. */
   subscriptions;
   /** Delegated-key namespace including the one-call {@link DelegatedKeys.provision} flow. */
@@ -263,43 +273,6 @@ var WitniumchainClient = class {
     return this.req("GET", "/v1/orgs/me/users", { auth: "OrgApiKey" });
   }
   // ────────────────────────────────────────────────────────────────────────
-  // Admin (/v1/admin/organizations/*)
-  // ────────────────────────────────────────────────────────────────────────
-  createOrganization(body) {
-    return this.req("POST", "/v1/admin/organizations", {
-      auth: "AdminToken",
-      body
-    });
-  }
-  setOrgAccountType(id, body) {
-    return this.req(
-      "PATCH",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/account-type`,
-      { auth: "AdminToken", body }
-    );
-  }
-  verifyOrganization(id) {
-    return this.req(
-      "PATCH",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/verify`,
-      { auth: "AdminToken" }
-    );
-  }
-  rotateOrgApiKey(id) {
-    return this.req(
-      "POST",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/rotate-key`,
-      { auth: "AdminToken" }
-    );
-  }
-  adjustOrgCredits(id, body) {
-    return this.req(
-      "POST",
-      `/v1/admin/organizations/${encodeURIComponent(id)}/adjust-credits`,
-      { auth: "AdminToken", body }
-    );
-  }
-  // ────────────────────────────────────────────────────────────────────────
   // Delegated keys (/v1/users/me/delegated-keys/*)
   // ────────────────────────────────────────────────────────────────────────
   listDelegatedKeys(query) {
@@ -785,6 +758,84 @@ var WitniumchainClient = class {
     })();
     return this.refreshInFlight;
   }
+  /**
+   * Exchange the logged-in session (the `wac_session` cookie) for a short-lived
+   * bearer access token and cache it as the client's `accessToken`.
+   *
+   * This is the SDK side of the session→token model (accounts'
+   * `POST /v1/auth/access-token`): the dashboard authenticates with the
+   * cookie, but the operational API (delegated keys, witness writes, chain
+   * reads) is bearer-only — no endpoint accepts the ambient cookie, so there's
+   * no CSRF surface even with `SameSite=None`. The minted token is
+   * byte-compatible with an OAuth user token (same signing key, `iss`, `aud`,
+   * scope + org/role/contracts claims), so every `BearerJWT` route accepts it.
+   *
+   * Callers rarely invoke this directly — {@link applyAuth} mints transparently
+   * on the first `BearerJWT` call when no token is set and re-mints on a 401.
+   * It's exposed so a dashboard can pre-warm the token right after login.
+   *
+   * Requires a session: either `sessionCookie` on the constructor (Node) or an
+   * ambient `wac_session` cookie carried by the browser (`credentials:
+   * 'include'`). Throws {@link WitniumchainApiError} (401) when there's no
+   * valid session.
+   */
+  async exchangeSessionForToken() {
+    if (this.sessionExchangeInFlight) return this.sessionExchangeInFlight;
+    this.sessionExchangeInFlight = (async () => {
+      try {
+        const res = await this.req("POST", "/v1/auth/access-token", { auth: "SessionCookie" });
+        this.accessToken = res.accessToken;
+        this.accessTokenFromSession = true;
+        this.refreshToken = void 0;
+        this.hasRefreshCookie = false;
+        return {
+          accessToken: res.accessToken,
+          expiresAt: Math.floor(new Date(res.expiresAt).getTime() / 1e3)
+        };
+      } finally {
+        this.sessionExchangeInFlight = void 0;
+      }
+    })();
+    return this.sessionExchangeInFlight;
+  }
+  /**
+   * Best-effort transparent mint for the `BearerJWT` path: if no access token
+   * is cached, try the session exchange (single-flight). Swallows failure so
+   * the caller in {@link applyAuth} surfaces the actionable "no token / no
+   * session" guidance rather than a raw 401 from the exchange endpoint.
+   */
+  async ensureSessionAccessToken() {
+    if (this.accessToken) return;
+    try {
+      await this.exchangeSessionForToken();
+    } catch {
+    }
+  }
+  /**
+   * Obtain a fresh access token for a 401-retry, picking the right mechanism:
+   * an OAuth refresh when a refresh credential exists, else a session re-mint
+   * for a session-exchanged token. Returns true when a fresh token is in hand.
+   */
+  async reauthenticateForRetry() {
+    if (this.refreshToken || this.hasRefreshCookie) {
+      try {
+        await this.refreshAccessToken();
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    if (this.accessTokenFromSession) {
+      this.accessToken = void 0;
+      try {
+        await this.exchangeSessionForToken();
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return false;
+  }
   /**
    * End the OAuth session.
    *
@@ -799,6 +850,7 @@ var WitniumchainClient = class {
    */
   signOut() {
     this.accessToken = void 0;
+    this.accessTokenFromSession = false;
     this.refreshToken = void 0;
     this.hasRefreshCookie = false;
     this.pendingLogins.clear();
@@ -896,6 +948,7 @@ var WitniumchainClient = class {
       });
     }
     this.accessToken = tokens.access_token;
+    this.accessTokenFromSession = false;
     if (tokens.refresh_token) {
       this.refreshToken = tokens.refresh_token;
     } else {
@@ -1026,13 +1079,9 @@ var WitniumchainClient = class {
     if (opts._isRetry) return false;
     if (opts.auth !== "BearerJWT") return false;
     if (res.status !== 401) return false;
-    if (!this.refreshToken && !this.hasRefreshCookie) return false;
-    try {
-      await this.refreshAccessToken();
-      return true;
-    } catch {
+    if (!this.refreshToken && !this.hasRefreshCookie && !this.accessTokenFromSession)
       return false;
-    }
+    return this.reauthenticateForRetry();
   }
   /**
    * Same decision as `shouldRefreshAndRetry` but for the JSON-parsed path,
@@ -1046,18 +1095,14 @@ var WitniumchainClient = class {
     if (opts._isRetry) return false;
     if (opts.auth !== "BearerJWT") return false;
     if (status !== 401) return false;
-    if (!this.refreshToken && !this.hasRefreshCookie) return false;
+    if (!this.refreshToken && !this.hasRefreshCookie && !this.accessTokenFromSession)
+      return false;
     const body = parsed;
     const label = typeof body?.error === "string" ? body.error : void 0;
     if (label !== void 0 && label !== "token_expired" && label !== "invalid_token") {
       return false;
     }
-    try {
-      await this.refreshAccessToken();
-      return true;
-    } catch {
-      return false;
-    }
+    return this.reauthenticateForRetry();
   }
   /**
    * Resolve which base URL to call. Default is accounts (`baseUrl`). When a
@@ -1097,9 +1142,12 @@ var WitniumchainClient = class {
         return;
       }
       case "BearerJWT": {
+        if (!this.accessToken) {
+          await this.ensureSessionAccessToken();
+        }
         if (!this.accessToken) {
           throw new Error(
-            `WitniumchainClient: ${method} ${path} requires an OAuth access token. Pass \`accessToken\` to the constructor, or call \`beginOAuthLogin\`/\`completeOAuthLogin\` to obtain one.`
+            `WitniumchainClient: ${method} ${path} requires an OAuth access token. Pass \`accessToken\` to the constructor, call \`beginOAuthLogin\`/\`completeOAuthLogin\`, or \u2014 for a logged-in dashboard \u2014 provide \`sessionCookie\` (Node) or rely on the browser \`wac_session\` cookie so the SDK can mint one.`
           );
         }
         headers["authorization"] = `Bearer ${this.accessToken}`;
@@ -1114,15 +1162,6 @@ var WitniumchainClient = class {
         headers["authorization"] = `Bearer ${this.cfg.orgApiKey}`;
         return;
       }
-      case "AdminToken": {
-        if (!this.cfg.adminToken) {
-          throw new Error(
-            `WitniumchainClient: ${method} ${path} requires an admin token. Pass \`adminToken\` to the constructor.`
-          );
-        }
-        headers["authorization"] = `Bearer ${this.cfg.adminToken}`;
-        return;
-      }
       case "SignedRequest": {
         if (!this.cfg.signedRequest) {
           throw new Error(
@@ -1409,60 +1448,6 @@ async function sha256Hex(input) {
   return out;
 }
 
-// src/admin-client.ts
-var WitniumchainAdminClient = class {
-  inner;
-  constructor(config) {
-    if (!config.adminToken) {
-      throw new Error("WitniumchainAdminClient: adminToken is required");
-    }
-    this.inner = new WitniumchainClient({
-      baseUrl: config.baseUrl,
-      adminToken: config.adminToken,
-      timeout: config.timeout,
-      fetch: config.fetch
-    });
-  }
-  /**
-   * Mint a new organisation. The returned `apiKey` is shown ONCE — the server
-   * only retains its SHA-256 hash. Persist it before the response leaves
-   * scope; there is no recovery path.
-   *
-   * @param body  Organisation seed: name, email, optional accountType and
-   *              signup credit grant, optional skip-email-verification flag.
-   */
-  createOrganization(body) {
-    return this.inner.createOrganization(body);
-  }
-  /** Flip an org between `metered` (Stripe checkout + credit ledger) and `unlimited` (flat-fee). */
-  setAccountType(orgId, accountType) {
-    return this.inner.setOrgAccountType(orgId, { accountType });
-  }
-  /** Mark an org's email as verified. Prerequisite for the org to create users. */
-  verifyEmail(orgId) {
-    return this.inner.verifyOrganization(orgId);
-  }
-  /**
-   * Rotate the org's API key. The previous `wcorg_live_…` is invalidated and
-   * the new key is returned ONCE — same one-time-secret semantics as
-   * {@link createOrganization}.
-   */
-  rotateApiKey(orgId) {
-    return this.inner.rotateOrgApiKey(orgId);
-  }
-  /**
-   * Apply a signed credit delta to an org's ledger. Positive `delta` grants
-   * credits (goodwill, migration backfill); negative claws them back.
-   * Recorded as `reason: adjustment` with the supplied `note`.
-   *
-   * Use sparingly — this bypasses Stripe and should be auditable from the
-   * `note` alone.
-   */
-  adjustCredits(orgId, delta, note) {
-    return this.inner.adjustOrgCredits(orgId, { delta, note });
-  }
-};
-
 // src/chain-admin-client.ts
 var WitniumchainChainAdminClient = class {
   baseUrl;
@@ -1653,6 +1638,6 @@ function buildRevokeSigningKeyPayload(args) {
   });
 }
 
-export { DelegatedKeys, MfaNamespace, MfaRecoveryCodes, MfaTotp, OWNER_OP, OauthNamespace, OauthSessions, OrgMembers, OrgUsers, SigningKeys, Subscriptions, WitniumchainAdminClient, WitniumchainApiError, WitniumchainChainAdminClient, WitniumchainClient, WitniumchainOrgClient, buildAddSigningKeyPayload, buildPausePayload, buildRevokeSigningKeyPayload, buildUnpausePayload, defaultVerifierStorage };
+export { DelegatedKeys, MfaNamespace, MfaRecoveryCodes, MfaTotp, OWNER_OP, OauthNamespace, OauthSessions, OrgMembers, OrgUsers, SigningKeys, Subscriptions, WitniumchainApiError, WitniumchainChainAdminClient, WitniumchainClient, WitniumchainOrgClient, buildAddSigningKeyPayload, buildPausePayload, buildRevokeSigningKeyPayload, buildUnpausePayload, defaultVerifierStorage };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map