@workos-inc/widgets 1.18.0 → 1.19.0-next.1790102694835

package/dist/cjs/api/client-graphql/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/api/client-graphql/client.ts"],"sourcesContent":["import { useQueryClient } from \"@tanstack/react-query\";\nimport { ClientError, GraphQLClient } from \"graphql-request\";\nimport * as React from \"react\";\nimport {\n  AuthTokenQueryData,\n  authTokenQueryKey,\n  useApi,\n  WidgetType,\n} from \"../api-provider.js\";\nimport { WIDGETS_API_VERSION } from \"../constants.js\";\nimport { ApiError, FetchError } from \"../errors.js\";\nimport {\n  ExpiredTokenError,\n  IncorrectPermissionsError,\n} from \"../../lib/errors.js\";\nimport { getSdk, Sdk, SdkFunctionWrapper } from \"./generated.js\";\nimport { CLIENT_API_GRAPHQL_PATH } from \"./constants.js\";\n\ntype QueryType = \"query\" | \"mutation\";\n\n/**\n * A GraphQL request failed because the request was unauthenticated or the token\n * no longer carries the required permissions.\n *\n * The Client API's auth guard fails closed by returning `false`, which NestJS\n * turns into a `ForbiddenException`. Because the GraphQL layer runs with\n * `autoTransformHttpErrors: false`, that surfaces as an HTTP 200 whose\n * `errors[].extensions.code` is `\"FORBIDDEN\"` — not as a 401/403 status. So the\n * `code` check below is load-bearing; the HTTP-status check is only a safety net\n * for transport-level rejections (proxies, gateways) that never reach GraphQL.\n * `\"UNAUTHENTICATED\"` is included defensively in case the backend adds it later.\n */\nfunction isAuthError(error: ClientError): boolean {\n  const status = error.response.status;\n  if (status === 401 || status === 403) {\n    return true;\n  }\n\n  return (error.response.errors ?? []).some((graphQlError) => {\n    const code = graphQlError.extensions?.code;\n    return code === \"UNAUTHENTICATED\" || code === \"FORBIDDEN\";\n  });\n}\n\n/**\n * The Client API returns GraphQL-level errors (validation, not-found, etc.) as\n * an HTTP 200 with an `errors` array. Surfacing that raw `200` on an `ApiError`\n * is misleading for downstream consumers and telemetry, so normalize any\n * non-error HTTP status to a 500.\n */\nfunction normalizeErrorStatus(status: number): number {\n  return status >= 400 ? status : 500;\n}\n\n/**\n * Translate a graphql-request failure into the same error classes the REST\n * Widgets client throws, so presentational components and error boundaries can\n * handle both transports uniformly.\n */\nfunction toWidgetError(\n  error: unknown,\n  queryType: QueryType,\n  isExpiredToken: boolean,\n): Error {\n  if (error instanceof ClientError) {\n    if (isAuthError(error)) {\n      const context = { status: error.response.status, queryType } as const;\n      return isExpiredToken\n        ? new ExpiredTokenError({ context })\n        : new IncorrectPermissionsError({ context });\n    }\n\n    const firstError = error.response.errors?.[0];\n    return new ApiError({\n      message: firstError?.message ?? error.message,\n      status: normalizeErrorStatus(error.response.status),\n      queryType,\n      context: { errors: error.response.errors },\n    });\n  }\n\n  return new FetchError({\n    message: error instanceof Error ? error.message : \"GraphQL request failed\",\n    queryType,\n    context: { error },\n  });\n}\n\n/**\n * Returns a typed SDK for the WorkOS Client GraphQL API, wired up to the same\n * `ApiProvider` auth plumbing the REST Widgets client uses:\n *\n * - Sends the current bearer token plus the widget-type / version headers.\n * - On an auth failure, re-mints the token via the shared `authToken` query and\n *   retries the operation once (mirrors the REST client's 403 retry).\n * - Maps GraphQL/network failures onto the widget error classes.\n *\n * Elevated-access tokens are intentionally not attached here; the Client API\n * takes them as mutation input fields, so call sites read them from\n * `useElevatedAccessToken` and pass them through the relevant inputs.\n */\nexport function useClientGraphql(): Sdk {\n  const { authToken, baseUrl, widgetType } = useApi();\n  const queryClient = useQueryClient();\n\n  return React.useMemo(() => {\n    const endpoint = new URL(baseUrl);\n    endpoint.pathname = CLIENT_API_GRAPHQL_PATH;\n    const client = new GraphQLClient(endpoint.toString());\n\n    const buildHeaders = (\n      token: string | undefined,\n    ): Record<string, string> => {\n      const headers: Record<string, string> = {\n        \"WorkOS-Widgets-Version\": WIDGETS_API_VERSION,\n        \"WorkOS-Widgets-Type\": widgetType,\n      };\n      if (token) {\n        headers.Authorization = `Bearer ${token}`;\n      }\n      return headers;\n    };\n\n    const refetchToken = async (\n      currentWidgetType: WidgetType,\n    ): Promise<string | undefined> => {\n      const tokenQueryKey = authTokenQueryKey(currentWidgetType);\n      await queryClient.refetchQueries({ queryKey: tokenQueryKey });\n      const refreshed =\n        queryClient.getQueryData<AuthTokenQueryData>(tokenQueryKey);\n      return refreshed?.authToken;\n    };\n\n    const isTokenExpired = (): boolean => {\n      const refreshed = queryClient.getQueryData<AuthTokenQueryData>(\n        authTokenQueryKey(widgetType),\n      );\n      const exp = refreshed?.exp;\n      return exp !== undefined && exp * 1000 <= Date.now();\n    };\n\n    const wrapper: SdkFunctionWrapper = async (\n      action,\n      _operationName,\n      operationType,\n    ) => {\n      const queryType: QueryType =\n        operationType === \"mutation\" ? \"mutation\" : \"query\";\n\n      try {\n        return await action(buildHeaders(authToken));\n      } catch (error) {\n        if (error instanceof ClientError && isAuthError(error)) {\n          let freshToken: string | undefined;\n          try {\n            freshToken = await refetchToken(widgetType);\n          } catch (refetchError) {\n            throw new ExpiredTokenError({\n              context: { queryType, refetchError },\n            });\n          }\n\n          if (freshToken && freshToken !== authToken) {\n            try {\n              return await action(buildHeaders(freshToken));\n            } catch (retryError) {\n              throw toWidgetError(retryError, queryType, isTokenExpired());\n            }\n          }\n        }\n\n        throw toWidgetError(error, queryType, isTokenExpired());\n      }\n    };\n\n    return getSdk(client, wrapper);\n  }, [authToken, baseUrl, widgetType, queryClient]);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA+B;AAC/B,6BAA2C;AAC3C,YAAuB;AACvB,0BAKO;AACP,uBAAoC;AACpC,oBAAqC;AACrC,IAAAA,iBAGO;AACP,uBAAgD;AAChD,IAAAC,oBAAwC;AAgBxC,SAAS,YAAY,OAA6B;AAChD,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,SAAS,UAAU,CAAC,GAAG,KAAK,CAAC,iBAAiB;AAC1D,UAAM,OAAO,aAAa,YAAY;AACtC,WAAO,SAAS,qBAAqB,SAAS;AAAA,EAChD,CAAC;AACH;AAQA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,UAAU,MAAM,SAAS;AAClC;AAOA,SAAS,cACP,OACA,WACA,gBACO;AACP,MAAI,iBAAiB,oCAAa;AAChC,QAAI,YAAY,KAAK,GAAG;AACtB,YAAM,UAAU,EAAE,QAAQ,MAAM,SAAS,QAAQ,UAAU;AAC3D,aAAO,iBACH,IAAI,iCAAkB,EAAE,QAAQ,CAAC,IACjC,IAAI,yCAA0B,EAAE,QAAQ,CAAC;AAAA,IAC/C;AAEA,UAAM,aAAa,MAAM,SAAS,SAAS,CAAC;AAC5C,WAAO,IAAI,uBAAS;AAAA,MAClB,SAAS,YAAY,WAAW,MAAM;AAAA,MACtC,QAAQ,qBAAqB,MAAM,SAAS,MAAM;AAAA,MAClD;AAAA,MACA,SAAS,EAAE,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC3C,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,yBAAW;AAAA,IACpB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,IACA,SAAS,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;AAeO,SAAS,mBAAwB;AACtC,QAAM,EAAE,WAAW,SAAS,WAAW,QAAI,4BAAO;AAClD,QAAM,kBAAc,mCAAe;AAEnC,SAAO,MAAM,QAAQ,MAAM;AACzB,UAAM,WAAW,IAAI,IAAI,OAAO;AAChC,aAAS,WAAW;AACpB,UAAM,SAAS,IAAI,qCAAc,SAAS,SAAS,CAAC;AAEpD,UAAM,eAAe,CACnB,UAC2B;AAC3B,YAAM,UAAkC;AAAA,QACtC,0BAA0B;AAAA,QAC1B,uBAAuB;AAAA,MACzB;AACA,UAAI,OAAO;AACT,gBAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,OACnB,sBACgC;AAChC,YAAM,oBAAgB,uCAAkB,iBAAiB;AACzD,YAAM,YAAY,eAAe,EAAE,UAAU,cAAc,CAAC;AAC5D,YAAM,YACJ,YAAY,aAAiC,aAAa;AAC5D,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,iBAAiB,MAAe;AACpC,YAAM,YAAY,YAAY;AAAA,YAC5B,uCAAkB,UAAU;AAAA,MAC9B;AACA,YAAM,MAAM,WAAW;AACvB,aAAO,QAAQ,UAAa,MAAM,OAAQ,KAAK,IAAI;AAAA,IACrD;AAEA,UAAM,UAA8B,OAClC,QACA,gBACA,kBACG;AACH,YAAM,YACJ,kBAAkB,aAAa,aAAa;AAE9C,UAAI;AACF,eAAO,MAAM,OAAO,aAAa,SAAS,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,YAAI,iBAAiB,sCAAe,YAAY,KAAK,GAAG;AACtD,cAAI;AACJ,cAAI;AACF,yBAAa,MAAM,aAAa,UAAU;AAAA,UAC5C,SAAS,cAAc;AACrB,kBAAM,IAAI,iCAAkB;AAAA,cAC1B,SAAS,EAAE,WAAW,aAAa;AAAA,YACrC,CAAC;AAAA,UACH;AAEA,cAAI,cAAc,eAAe,WAAW;AAC1C,gBAAI;AACF,qBAAO,MAAM,OAAO,aAAa,UAAU,CAAC;AAAA,YAC9C,SAAS,YAAY;AACnB,oBAAM,cAAc,YAAY,WAAW,eAAe,CAAC;AAAA,YAC7D;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc,OAAO,WAAW,eAAe,CAAC;AAAA,MACxD;AAAA,IACF;AAEA,eAAO,yBAAO,QAAQ,OAAO;AAAA,EAC/B,GAAG,CAAC,WAAW,SAAS,YAAY,WAAW,CAAC;AAClD;","names":["import_errors","import_constants"]}
+{"version":3,"sources":["../../../../src/api/client-graphql/client.ts"],"sourcesContent":["import { useQueryClient } from \"@tanstack/react-query\";\nimport { ClientError, GraphQLClient } from \"graphql-request\";\nimport * as React from \"react\";\nimport {\n  AuthTokenQueryData,\n  authTokenQueryKey,\n  useApi,\n  WidgetType,\n} from \"../api-provider.js\";\nimport { WIDGETS_API_VERSION } from \"../constants.js\";\nimport { ApiError, FetchError } from \"../errors.js\";\nimport {\n  ExpiredTokenError,\n  IncorrectPermissionsError,\n} from \"../../lib/errors.js\";\nimport { getSdk, Sdk, SdkFunctionWrapper } from \"./generated.js\";\nimport { CLIENT_API_GRAPHQL_PATH } from \"./constants.js\";\n\ntype QueryType = \"query\" | \"mutation\";\n\n/**\n * Message NestJS attaches to a bare `ForbiddenException`, which is what the\n * Client API's auth guard produces when it rejects a token (expired, revoked,\n * or otherwise invalid). The GraphQL layer reports it as an HTTP 200 whose\n * error carries `extensions.code: \"INTERNAL_SERVER_ERROR\"`, so the message is\n * the only signal that distinguishes it from a genuine server fault.\n */\nconst GUARD_DENIAL_MESSAGE = \"Forbidden resource\";\n\n/**\n * A GraphQL request failed because the request was unauthenticated or the token\n * no longer carries the required permissions.\n *\n * Permission denials surface as an HTTP 200 whose `errors[].extensions.code`\n * is `\"FORBIDDEN\"`; token rejections from the auth guard surface as described\n * on `GUARD_DENIAL_MESSAGE`. The HTTP-status check is only a safety net for\n * transport-level rejections (proxies, gateways) that never reach GraphQL.\n * `\"UNAUTHENTICATED\"` is included for when the backend reports it directly.\n */\nfunction isAuthError(error: ClientError): boolean {\n  const status = error.response.status;\n  if (status === 401 || status === 403) {\n    return true;\n  }\n\n  return (error.response.errors ?? []).some((graphQlError) => {\n    const code = graphQlError.extensions?.code;\n    return (\n      code === \"UNAUTHENTICATED\" ||\n      code === \"FORBIDDEN\" ||\n      graphQlError.message === GUARD_DENIAL_MESSAGE\n    );\n  });\n}\n\n/**\n * The Client API returns GraphQL-level errors (validation, not-found, etc.) as\n * an HTTP 200 with an `errors` array. Surfacing that raw `200` on an `ApiError`\n * is misleading for downstream consumers and telemetry, so normalize any\n * non-error HTTP status to a 500.\n */\nfunction normalizeErrorStatus(status: number): number {\n  return status >= 400 ? status : 500;\n}\n\n/**\n * Translate a graphql-request failure into the same error classes the REST\n * Widgets client throws, so presentational components and error boundaries can\n * handle both transports uniformly.\n */\nfunction toWidgetError(\n  error: unknown,\n  queryType: QueryType,\n  isExpiredToken: boolean,\n): Error {\n  if (error instanceof ClientError) {\n    if (isAuthError(error)) {\n      const context = { status: error.response.status, queryType } as const;\n      return isExpiredToken\n        ? new ExpiredTokenError({ context })\n        : new IncorrectPermissionsError({ context });\n    }\n\n    const firstError = error.response.errors?.[0];\n    return new ApiError({\n      message: firstError?.message ?? error.message,\n      status: normalizeErrorStatus(error.response.status),\n      queryType,\n      context: { errors: error.response.errors },\n    });\n  }\n\n  return new FetchError({\n    message: error instanceof Error ? error.message : \"GraphQL request failed\",\n    queryType,\n    context: { error },\n  });\n}\n\n/**\n * Returns a typed SDK for the WorkOS Client GraphQL API, wired up to the same\n * `ApiProvider` auth plumbing the REST Widgets client uses:\n *\n * - Sends the current bearer token plus the widget-type / version headers.\n * - On an auth failure, re-mints the token via the shared `authToken` query and\n *   retries the operation once (mirrors the REST client's 403 retry).\n * - Maps GraphQL/network failures onto the widget error classes.\n *\n * Elevated-access tokens are intentionally not attached here; the Client API\n * takes them as mutation input fields, so call sites read them from\n * `useElevatedAccessToken` and pass them through the relevant inputs.\n */\nexport function useClientGraphql(): Sdk {\n  const { authToken, baseUrl, widgetType } = useApi();\n  const queryClient = useQueryClient();\n\n  return React.useMemo(() => {\n    const endpoint = new URL(baseUrl);\n    endpoint.pathname = CLIENT_API_GRAPHQL_PATH;\n    const client = new GraphQLClient(endpoint.toString());\n\n    const buildHeaders = (\n      token: string | undefined,\n    ): Record<string, string> => {\n      const headers: Record<string, string> = {\n        \"WorkOS-Widgets-Version\": WIDGETS_API_VERSION,\n        \"WorkOS-Widgets-Type\": widgetType,\n      };\n      if (token) {\n        headers.Authorization = `Bearer ${token}`;\n      }\n      return headers;\n    };\n\n    const refetchToken = async (\n      currentWidgetType: WidgetType,\n    ): Promise<string | undefined> => {\n      const tokenQueryKey = authTokenQueryKey(currentWidgetType);\n      await queryClient.refetchQueries({ queryKey: tokenQueryKey });\n      const refreshed =\n        queryClient.getQueryData<AuthTokenQueryData>(tokenQueryKey);\n      return refreshed?.authToken;\n    };\n\n    const isTokenExpired = (): boolean => {\n      const refreshed = queryClient.getQueryData<AuthTokenQueryData>(\n        authTokenQueryKey(widgetType),\n      );\n      const exp = refreshed?.exp;\n      return exp !== undefined && exp * 1000 <= Date.now();\n    };\n\n    const wrapper: SdkFunctionWrapper = async (\n      action,\n      _operationName,\n      operationType,\n    ) => {\n      const queryType: QueryType =\n        operationType === \"mutation\" ? \"mutation\" : \"query\";\n\n      try {\n        return await action(buildHeaders(authToken));\n      } catch (error) {\n        if (error instanceof ClientError && isAuthError(error)) {\n          let freshToken: string | undefined;\n          try {\n            freshToken = await refetchToken(widgetType);\n          } catch (refetchError) {\n            throw new ExpiredTokenError({\n              context: { queryType, refetchError },\n            });\n          }\n\n          if (freshToken && freshToken !== authToken) {\n            try {\n              return await action(buildHeaders(freshToken));\n            } catch (retryError) {\n              throw toWidgetError(retryError, queryType, isTokenExpired());\n            }\n          }\n        }\n\n        throw toWidgetError(error, queryType, isTokenExpired());\n      }\n    };\n\n    return getSdk(client, wrapper);\n  }, [authToken, baseUrl, widgetType, queryClient]);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA+B;AAC/B,6BAA2C;AAC3C,YAAuB;AACvB,0BAKO;AACP,uBAAoC;AACpC,oBAAqC;AACrC,IAAAA,iBAGO;AACP,uBAAgD;AAChD,IAAAC,oBAAwC;AAWxC,MAAM,uBAAuB;AAY7B,SAAS,YAAY,OAA6B;AAChD,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,SAAS,UAAU,CAAC,GAAG,KAAK,CAAC,iBAAiB;AAC1D,UAAM,OAAO,aAAa,YAAY;AACtC,WACE,SAAS,qBACT,SAAS,eACT,aAAa,YAAY;AAAA,EAE7B,CAAC;AACH;AAQA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,UAAU,MAAM,SAAS;AAClC;AAOA,SAAS,cACP,OACA,WACA,gBACO;AACP,MAAI,iBAAiB,oCAAa;AAChC,QAAI,YAAY,KAAK,GAAG;AACtB,YAAM,UAAU,EAAE,QAAQ,MAAM,SAAS,QAAQ,UAAU;AAC3D,aAAO,iBACH,IAAI,iCAAkB,EAAE,QAAQ,CAAC,IACjC,IAAI,yCAA0B,EAAE,QAAQ,CAAC;AAAA,IAC/C;AAEA,UAAM,aAAa,MAAM,SAAS,SAAS,CAAC;AAC5C,WAAO,IAAI,uBAAS;AAAA,MAClB,SAAS,YAAY,WAAW,MAAM;AAAA,MACtC,QAAQ,qBAAqB,MAAM,SAAS,MAAM;AAAA,MAClD;AAAA,MACA,SAAS,EAAE,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC3C,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,yBAAW;AAAA,IACpB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,IACA,SAAS,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;AAeO,SAAS,mBAAwB;AACtC,QAAM,EAAE,WAAW,SAAS,WAAW,QAAI,4BAAO;AAClD,QAAM,kBAAc,mCAAe;AAEnC,SAAO,MAAM,QAAQ,MAAM;AACzB,UAAM,WAAW,IAAI,IAAI,OAAO;AAChC,aAAS,WAAW;AACpB,UAAM,SAAS,IAAI,qCAAc,SAAS,SAAS,CAAC;AAEpD,UAAM,eAAe,CACnB,UAC2B;AAC3B,YAAM,UAAkC;AAAA,QACtC,0BAA0B;AAAA,QAC1B,uBAAuB;AAAA,MACzB;AACA,UAAI,OAAO;AACT,gBAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,OACnB,sBACgC;AAChC,YAAM,oBAAgB,uCAAkB,iBAAiB;AACzD,YAAM,YAAY,eAAe,EAAE,UAAU,cAAc,CAAC;AAC5D,YAAM,YACJ,YAAY,aAAiC,aAAa;AAC5D,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,iBAAiB,MAAe;AACpC,YAAM,YAAY,YAAY;AAAA,YAC5B,uCAAkB,UAAU;AAAA,MAC9B;AACA,YAAM,MAAM,WAAW;AACvB,aAAO,QAAQ,UAAa,MAAM,OAAQ,KAAK,IAAI;AAAA,IACrD;AAEA,UAAM,UAA8B,OAClC,QACA,gBACA,kBACG;AACH,YAAM,YACJ,kBAAkB,aAAa,aAAa;AAE9C,UAAI;AACF,eAAO,MAAM,OAAO,aAAa,SAAS,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,YAAI,iBAAiB,sCAAe,YAAY,KAAK,GAAG;AACtD,cAAI;AACJ,cAAI;AACF,yBAAa,MAAM,aAAa,UAAU;AAAA,UAC5C,SAAS,cAAc;AACrB,kBAAM,IAAI,iCAAkB;AAAA,cAC1B,SAAS,EAAE,WAAW,aAAa;AAAA,YACrC,CAAC;AAAA,UACH;AAEA,cAAI,cAAc,eAAe,WAAW;AAC1C,gBAAI;AACF,qBAAO,MAAM,OAAO,aAAa,UAAU,CAAC;AAAA,YAC9C,SAAS,YAAY;AACnB,oBAAM,cAAc,YAAY,WAAW,eAAe,CAAC;AAAA,YAC7D;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc,OAAO,WAAW,eAAe,CAAC;AAAA,MACxD;AAAA,IACF;AAEA,eAAO,yBAAO,QAAQ,OAAO;AAAA,EAC/B,GAAG,CAAC,WAAW,SAAS,YAAY,WAAW,CAAC;AAClD;","names":["import_errors","import_constants"]}