brainerce 1.46.2 → 1.47.3

package/dist/bot/index.d.ts

@@ -33,12 +33,29 @@ interface BrainerceBotOptions {
         variantId?: string | null;
         quantity: number;
     }) => boolean | Promise<boolean>;
+    /**
+     * Part 2 (order-lookup login gating) — a SAME-ORIGIN path (e.g. `/api/store`, the
+     * Next.js template's own BFF proxy) that forwards to the backend and attaches the
+     * shopper's customer-session cookie as a Bearer header. When set, the widget calls
+     * `${customerSessionProxyPath}/api/storefront-bot/:connectionId/customer-session`
+     * (through THIS path, not `baseUrl` — a cross-origin request to `baseUrl` would
+     * never carry the httpOnly session cookie) to learn login state and obtain a
+     * short-lived token it attaches to its normal direct-to-backend /chat call, so
+     * streaming is completely unaffected. Omit entirely on any site without such a
+     * proxy — checkOrderStatus then simply always answers as a guest, no error.
+     */
+    customerSessionProxyPath?: string;
 }
 declare class BrainerceBot {
     private readonly connectionId;
     private readonly baseUrl;
     private readonly storageKey;
     private readonly onAddToCart?;
+    private readonly customerSessionProxyPath?;
+    /** Part 2 (order-lookup login gating) — short-lived, in-memory only (never
+     *  persisted): refreshed opportunistically before a chat send when stale. */
+    private botSessionToken;
+    private botSessionFetchedAt;
     private host?;
     private root?;
     private windowEl?;
@@ -83,6 +100,15 @@ declare class BrainerceBot {
     private toggleExpand;
     /** First open: restore the server thread, or show the greeting. */
     private primeThread;
+    /**
+     * Part 2 (order-lookup login gating) — refresh the short-lived bot-session token
+     * if this site opted in (`customerSessionProxyPath` set) and the current one is
+     * stale or absent. Comfortably under the backend's 5-minute expiry so a token
+     * fetched here is never expired by the time /chat reads it. Fails silently on any
+     * error (offline, no proxy configured server-side, etc.) — a guest must always be
+     * able to chat regardless of this call's outcome.
+     */
+    private refreshCustomerSession;
     private send;
     private handleFrame;
     private appendCard;

package/dist/bot/index.js

@@ -164,6 +164,10 @@ function renderRich(el, text) {
 }
 var BrainerceBot = class _BrainerceBot {
   constructor(options) {
+    /** Part 2 (order-lookup login gating) — short-lived, in-memory only (never
+     *  persisted): refreshed opportunistically before a chat send when stale. */
+    this.botSessionToken = null;
+    this.botSessionFetchedAt = 0;
     this.settings = { enabled: false };
     this.locale = "en";
     this.sessionId = null;
@@ -185,6 +189,7 @@ var BrainerceBot = class _BrainerceBot {
     this.baseUrl = (options.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
     this.storageKey = `brainerce-bot:${this.connectionId}`;
     this.onAddToCart = options.onAddToCart;
+    this.customerSessionProxyPath = options.customerSessionProxyPath?.replace(/\/$/, "");
   }
   /** Boot the widget. Resolves to null when the bot is disabled server-side. */
   static async mount(options) {
@@ -749,6 +754,30 @@ var BrainerceBot = class _BrainerceBot {
   // --------------------------------------------------------------------------
   // The chat turn
   // --------------------------------------------------------------------------
+  /**
+   * Part 2 (order-lookup login gating) — refresh the short-lived bot-session token
+   * if this site opted in (`customerSessionProxyPath` set) and the current one is
+   * stale or absent. Comfortably under the backend's 5-minute expiry so a token
+   * fetched here is never expired by the time /chat reads it. Fails silently on any
+   * error (offline, no proxy configured server-side, etc.) — a guest must always be
+   * able to chat regardless of this call's outcome.
+   */
+  async refreshCustomerSession() {
+    if (!this.customerSessionProxyPath) return;
+    const FOUR_MINUTES_MS = 4 * 60 * 1e3;
+    if (this.botSessionToken && Date.now() - this.botSessionFetchedAt < FOUR_MINUTES_MS) return;
+    try {
+      const res = await fetch(
+        `${this.customerSessionProxyPath}/api/storefront-bot/${encodeURIComponent(this.connectionId)}/customer-session`,
+        { credentials: "include" }
+      );
+      if (!res.ok) return;
+      const data = await res.json();
+      this.botSessionToken = data.loggedIn && data.botSessionToken ? data.botSessionToken : null;
+      this.botSessionFetchedAt = Date.now();
+    } catch {
+    }
+  }
   async send(text) {
     const message = text.trim();
     if (!message || this.busy) return;
@@ -763,6 +792,7 @@ var BrainerceBot = class _BrainerceBot {
     this.cardIds = /* @__PURE__ */ new Set();
     let botBubble = null;
     try {
+      await this.refreshCustomerSession();
       const res = await fetch(
         `${this.baseUrl}/api/storefront-bot/${encodeURIComponent(this.connectionId)}/chat`,
         {
@@ -773,7 +803,8 @@ var BrainerceBot = class _BrainerceBot {
             turnId: randomId("trn_"),
             ...this.conversationId ? { conversationId: this.conversationId } : {},
             ...this.sessionId ? { anonymousSessionId: this.sessionId } : {},
-            locale: this.locale
+            locale: this.locale,
+            ...this.botSessionToken ? { botSessionToken: this.botSessionToken } : {}
           })
         }
       );

package/dist/bot/index.mjs

@@ -138,6 +138,10 @@ function renderRich(el, text) {
 }
 var BrainerceBot = class _BrainerceBot {
   constructor(options) {
+    /** Part 2 (order-lookup login gating) — short-lived, in-memory only (never
+     *  persisted): refreshed opportunistically before a chat send when stale. */
+    this.botSessionToken = null;
+    this.botSessionFetchedAt = 0;
     this.settings = { enabled: false };
     this.locale = "en";
     this.sessionId = null;
@@ -159,6 +163,7 @@ var BrainerceBot = class _BrainerceBot {
     this.baseUrl = (options.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
     this.storageKey = `brainerce-bot:${this.connectionId}`;
     this.onAddToCart = options.onAddToCart;
+    this.customerSessionProxyPath = options.customerSessionProxyPath?.replace(/\/$/, "");
   }
   /** Boot the widget. Resolves to null when the bot is disabled server-side. */
   static async mount(options) {
@@ -723,6 +728,30 @@ var BrainerceBot = class _BrainerceBot {
   // --------------------------------------------------------------------------
   // The chat turn
   // --------------------------------------------------------------------------
+  /**
+   * Part 2 (order-lookup login gating) — refresh the short-lived bot-session token
+   * if this site opted in (`customerSessionProxyPath` set) and the current one is
+   * stale or absent. Comfortably under the backend's 5-minute expiry so a token
+   * fetched here is never expired by the time /chat reads it. Fails silently on any
+   * error (offline, no proxy configured server-side, etc.) — a guest must always be
+   * able to chat regardless of this call's outcome.
+   */
+  async refreshCustomerSession() {
+    if (!this.customerSessionProxyPath) return;
+    const FOUR_MINUTES_MS = 4 * 60 * 1e3;
+    if (this.botSessionToken && Date.now() - this.botSessionFetchedAt < FOUR_MINUTES_MS) return;
+    try {
+      const res = await fetch(
+        `${this.customerSessionProxyPath}/api/storefront-bot/${encodeURIComponent(this.connectionId)}/customer-session`,
+        { credentials: "include" }
+      );
+      if (!res.ok) return;
+      const data = await res.json();
+      this.botSessionToken = data.loggedIn && data.botSessionToken ? data.botSessionToken : null;
+      this.botSessionFetchedAt = Date.now();
+    } catch {
+    }
+  }
   async send(text) {
     const message = text.trim();
     if (!message || this.busy) return;
@@ -737,6 +766,7 @@ var BrainerceBot = class _BrainerceBot {
     this.cardIds = /* @__PURE__ */ new Set();
     let botBubble = null;
     try {
+      await this.refreshCustomerSession();
       const res = await fetch(
         `${this.baseUrl}/api/storefront-bot/${encodeURIComponent(this.connectionId)}/chat`,
         {
@@ -747,7 +777,8 @@ var BrainerceBot = class _BrainerceBot {
             turnId: randomId("trn_"),
             ...this.conversationId ? { conversationId: this.conversationId } : {},
             ...this.sessionId ? { anonymousSessionId: this.sessionId } : {},
-            locale: this.locale
+            locale: this.locale,
+            ...this.botSessionToken ? { botSessionToken: this.botSessionToken } : {}
           })
         }
       );