flowlink-auth 2.6.9

package/dist/api.js

@@ -0,0 +1,55 @@
+// src/init.js
+var CONFIG = null;
+function getConfigSafe() {
+  return CONFIG;
+}
+function getCSRFToken() {
+  return CONFIG?.csrfToken || null;
+}
+
+// src/api.js
+var makeApi = () => {
+  const cfg = getConfigSafe();
+  return {
+    call: async (path, opts = {}) => {
+      if (!cfg) {
+        return { status: 400, body: { error: "flowlink-auth: SDK not initialized (publishable key missing)" } };
+      }
+      if (!path || typeof path !== "string") {
+        return { status: 400, body: { error: "Invalid API path" } };
+      }
+      if (path.startsWith("//") || path.startsWith("http")) {
+        return { status: 400, body: { error: "Invalid API path" } };
+      }
+      const headers = {
+        "Content-Type": "application/json",
+        "x-publishable-key": cfg.publishableKey,
+        ...opts.headers || {}
+      };
+      const csrfToken = getCSRFToken();
+      if (csrfToken && opts.method && opts.method.toUpperCase() !== "GET") {
+        headers["x-csrf-token"] = csrfToken;
+      }
+      try {
+        const fullUrl = new URL(cfg.baseUrl + path).href;
+        const res = await fetch(fullUrl, {
+          ...opts,
+          headers,
+          // Security: Include credentials for cookie-based auth
+          credentials: "include",
+          // Security: Enforce no referrer for sensitive requests
+          referrerPolicy: "strict-origin-when-cross-origin"
+        });
+        const body = await res.json().catch(() => null);
+        return { status: res.status, body };
+      } catch (err) {
+        console.error("API call failed:", err.message);
+        return { status: 500, body: { error: "Request failed. Please try again." } };
+      }
+    }
+  };
+};
+export {
+  makeApi
+};
+