lazypock 0.12.0 → 0.13.0

package/README.md

@@ -57,6 +57,10 @@ const user = await client.collection('users').create({
 const session = await client.authWithPassword('users', 'ada@example.com', 'correct-horse-battery');
 // session.token — stored in client.authStore for subsequent requests
 
+// OAuth2 login — one call: opens the provider popup and stores the session
+const oauth = await client.collection('users').authWithOAuth2({ provider: 'google' });
+// oauth.token + oauth.record + oauth.meta (isNew, email, avatarURL, …)
+
 // File upload
 const file = await client.files.upload(fileInput.files[0]);
 
@@ -399,7 +403,9 @@ Returned by `client.collection(name)`.
 - `unsubscribe(topic?)` — `unsubscribe('*')` / `unsubscribe('id')` / `unsubscribe()` (all)
 - `authWithPassword(identity, password, options?)` — Login to this auth collection
 - `authRefresh(options?)` — Refresh token for this auth collection
-- `authMethods(options?)` — Get available auth methods
+- `listAuthMethods(options?)` — Get available auth methods (password + OAuth2 providers)
+- `authWithOAuth2(options)` — Sign in with an OAuth2 provider (popup flow)
+- `authWithOAuth2Code(options)` — Exchange an OAuth2 authorization code directly
 
 ### AuthStore
 

package/dist/index.cjs

@@ -44,12 +44,13 @@ module.exports = __toCommonJS(index_exports);
 
 // src/types.ts
 var ApiError = class extends Error {
-  constructor(message, data, status, isAbort = false) {
+  constructor(message, data, status, isAbort = false, code) {
     super(message);
     this.name = "ApiError";
     this.data = data;
     this.status = status;
     this.isAbort = isAbort;
+    this.code = code;
   }
 };
 
@@ -80,11 +81,15 @@ var HttpClient = class {
     this.inflight = {};
     /** Global toggle for the auto-cancellation behaviour (default: on). */
     this.enableAutoCancellation = true;
-    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this._baseUrl = baseUrl.replace(/\/+$/, "");
     this.authStore = authStore;
     this.connectionId = connectionId;
     this.defaultFetch = globalThis.fetch.bind(globalThis);
   }
+  /** The API base URL (trailing slash stripped). Used for OAuth2 origin checks. */
+  get baseUrl() {
+    return this._baseUrl;
+  }
   async refreshAuth() {
     const collection = this.authStore.collectionName;
     if (!collection) return null;
@@ -470,6 +475,202 @@ var memoryStorage = {
   }
 };
 
+// src/oauth2.ts
+var DEFAULT_POPUP_WIDTH = 500;
+var DEFAULT_POPUP_HEIGHT = 700;
+var DEFAULT_OAUTH2_TIMEOUT_MS = 12e4;
+var CLOSE_POLL_MS = 500;
+function oauth2RedirectOrigin(baseUrl) {
+  try {
+    return new URL(baseUrl).origin;
+  } catch {
+    throw new ApiError(
+      `Invalid baseUrl for OAuth2 origin check: "${baseUrl}"`,
+      {},
+      0,
+      false,
+      "oauth2_invalid_base_url"
+    );
+  }
+}
+function isSafeBrowserUrl(url) {
+  try {
+    const protocol = new URL(url).protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function isRecordAuth(value) {
+  return !!value && typeof value === "object" && typeof value.token === "string" && !!value.record && typeof value.record === "object";
+}
+function authorizeWithOAuth2Popup(opts) {
+  return new Promise((resolve, reject) => {
+    if (typeof window === "undefined") {
+      reject(
+        new ApiError(
+          "OAuth2 popup flow requires a browser window. Use `authWithOAuth2Code()` in non-browser environments.",
+          {},
+          0,
+          false,
+          "oauth2_popup_unavailable"
+        )
+      );
+      return;
+    }
+    let settled = false;
+    let popup = null;
+    let closePoll = null;
+    let timeout = null;
+    const cleanup = () => {
+      if (timeout) {
+        clearTimeout(timeout);
+        timeout = null;
+      }
+      if (closePoll) {
+        clearInterval(closePoll);
+        closePoll = null;
+      }
+      window.removeEventListener("message", onMessage);
+    };
+    const finish = (err, result) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (err) reject(err);
+      else resolve(result);
+    };
+    const onMessage = (event) => {
+      if (event.origin !== opts.expectedOrigin) return;
+      if (popup && event.source && event.source !== popup) return;
+      const data = event.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "lazypock:oauth2") {
+        if (isRecordAuth(data.result)) {
+          if (popup) {
+            try {
+              popup.close();
+            } catch {
+            }
+          }
+          finish(null, data.result);
+        } else {
+          finish(
+            new ApiError(
+              "OAuth2 callback returned an invalid result.",
+              data,
+              400,
+              false,
+              "oauth2_provider_error"
+            )
+          );
+        }
+        return;
+      }
+      if (data.type === "lazypock:oauth2:error") {
+        const result = data.result ?? {};
+        const message = typeof result.message === "string" && result.message ? result.message : "OAuth2 authorization failed.";
+        finish(
+          new ApiError(
+            message,
+            result,
+            typeof result.code === "number" ? result.code : 400,
+            false,
+            "oauth2_provider_error"
+          )
+        );
+      }
+    };
+    const openPopup = () => {
+      if (!isSafeBrowserUrl(opts.authURL)) {
+        finish(
+          new ApiError(
+            "OAuth2 authorization URL has an unsupported protocol.",
+            {},
+            0,
+            false,
+            "oauth2_provider_error"
+          )
+        );
+        return;
+      }
+      const width = opts.popup?.width ?? DEFAULT_POPUP_WIDTH;
+      const height = opts.popup?.height ?? DEFAULT_POPUP_HEIGHT;
+      const features = "width=" + width + ",height=" + height + ",scrollbars=yes,resizable=yes";
+      const win = window.open(opts.authURL, "_blank", features);
+      if (!win) {
+        finish(
+          new ApiError(
+            "OAuth2 popup was blocked by the browser. Please allow popups for this site and try again.",
+            {},
+            0,
+            false,
+            "oauth2_popup_blocked"
+          )
+        );
+        return;
+      }
+      popup = win;
+      closePoll = setInterval(() => {
+        if (popup && popup.closed) {
+          finish(
+            new ApiError(
+              "OAuth2 sign-in was cancelled.",
+              {},
+              0,
+              false,
+              "oauth2_cancelled"
+            )
+          );
+        }
+      }, CLOSE_POLL_MS);
+    };
+    window.addEventListener("message", onMessage);
+    timeout = setTimeout(() => {
+      if (popup) {
+        try {
+          popup.close();
+        } catch {
+        }
+      }
+      finish(
+        new ApiError(
+          "OAuth2 sign-in timed out.",
+          {},
+          0,
+          false,
+          "oauth2_timeout"
+        )
+      );
+    }, opts.timeoutMs);
+    if (opts.urlCallback) {
+      Promise.resolve(opts.urlCallback(opts.authURL)).catch((err) => {
+        finish(
+          err instanceof ApiError ? err : new ApiError(
+            `OAuth2 urlCallback failed: ${String(err)}`,
+            {},
+            0,
+            false,
+            "oauth2_provider_error"
+          )
+        );
+      });
+    } else if (typeof window.open === "function") {
+      openPopup();
+    } else {
+      finish(
+        new ApiError(
+          "OAuth2 popup flow requires a browser window. Use `authWithOAuth2Code()` in non-browser environments.",
+          {},
+          0,
+          false,
+          "oauth2_popup_unavailable"
+        )
+      );
+    }
+  });
+}
+
 // src/collection.ts
 function stableStringify(value) {
   const seen = /* @__PURE__ */ new Set();
@@ -904,15 +1105,108 @@ var CollectionService = class _CollectionService {
     return data;
   }
   /**
-   * Get available auth methods for this collection.
+   * Get available auth methods for this collection (PocketBase `listAuthMethods`).
+   * Returns `password`, `oauth2.providers` (each with `name`, `authURL`,
+   * `state`, `codeVerifier`), and `mfa`.
    */
-  // ── end Realtime ──
-  async authMethods(options) {
+  async listAuthMethods(options) {
     return this.http.get(
       "/" + this.encodeId(this.collectionName) + "/auth-methods",
       options
     );
   }
+  /**
+   * Get available auth methods for this collection.
+   * @deprecated Use {@link listAuthMethods} (typed).
+   */
+  authMethods(options) {
+    return this.listAuthMethods(options);
+  }
+  /**
+   * Sign in with an OAuth2 provider (PocketBase `authWithOAuth2` parity).
+   *
+   * One call handles the whole web flow: fetch the provider's `authURL`,
+   * open a popup (or call `options.urlCallback`), wait for the backend's
+   * `postMessage` result, populate the auth store, and resolve with
+   * `{ token, record, meta }`.
+   *
+   * `options.createData` is accepted for PocketBase signature parity but is
+   * **not** forwarded by the backend's popup redirect flow — use
+   * {@link authWithOAuth2Code} when you need extra fields on first sign-up.
+   *
+   * React Native / non-browser: the popup flow depends on
+   * `window.postMessage`. Use {@link listAuthMethods} + {@link authWithOAuth2Code}
+   * instead.
+   */
+  async authWithOAuth2(options) {
+    const {
+      provider,
+      urlCallback,
+      popup,
+      timeoutMs = DEFAULT_OAUTH2_TIMEOUT_MS
+    } = options;
+    const methods = await this.listAuthMethods();
+    const providerInfo = methods?.oauth2?.providers?.find(
+      (p) => p.name === provider
+    );
+    if (!providerInfo) {
+      throw new ApiError(
+        `OAuth2 provider "${provider}" is not enabled for this collection.`,
+        methods ?? {},
+        400,
+        false,
+        "oauth2_unknown_provider"
+      );
+    }
+    const result = await authorizeWithOAuth2Popup({
+      authURL: providerInfo.authURL,
+      expectedOrigin: oauth2RedirectOrigin(this.http.baseUrl),
+      urlCallback,
+      popup,
+      timeoutMs
+    });
+    if (this.authStore) {
+      this.authStore.setCollectionName(this.collectionName);
+      this.authStore.set(result.token, result.record);
+    }
+    return result;
+  }
+  /**
+   * Exchange an OAuth2 authorization code directly (PocketBase
+   * `authWithOAuth2Code` parity).
+   *
+   * Used by mobile / non-browser flows: fetch {@link listAuthMethods} to get
+   * the provider `authURL` + `codeVerifier`, present the URL yourself,
+   * capture the `code` from your redirect/deep link, then call this to
+   * finish and populate the auth store.
+   */
+  async authWithOAuth2Code(options) {
+    const { provider, code, codeVerifier, redirectUrl, createData } = options;
+    const data = await this.http.post(
+      "/" + this.encodeId(this.collectionName) + "/auth-with-oauth2",
+      {
+        provider,
+        code,
+        codeVerifier,
+        redirectUrl: redirectUrl ?? this.http.baseUrl + "/oauth2-redirect",
+        createData: createData ?? {}
+      }
+    );
+    if (!data) {
+      throw new ApiError(
+        "OAuth2 code exchange returned no data.",
+        {},
+        0,
+        false,
+        "oauth2_exchange_failed"
+      );
+    }
+    if (this.authStore) {
+      this.authStore.setCollectionName(this.collectionName);
+      this.authStore.set(data.token, data.record);
+    }
+    return data;
+  }
 };
 
 // src/realtime.ts