lazypock 0.16.0 → 0.17.0

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(index_exports, {
   getFileUrl: () => getFileUrl,
   getScaleUrl: () => getScaleUrl,
   getThumbUrl: () => getThumbUrl,
+  getVariantUrl: () => getVariantUrl,
   schemaFieldType: () => schemaFieldType,
   wsUrlFromBaseUrl: () => wsUrlFromBaseUrl
 });
@@ -641,9 +642,6 @@ function isSafeBrowserUrl(url) {
     return false;
   }
 }
-function isRecordAuth(value) {
-  return !!value && typeof value === "object" && typeof value.token === "string" && !!value.record && typeof value.record === "object";
-}
 function authorizeWithOAuth2Popup(opts) {
   return new Promise((resolve, reject) => {
     if (typeof window === "undefined") {
@@ -686,18 +684,20 @@ function authorizeWithOAuth2Popup(opts) {
       const data = event.data;
       if (!data || typeof data !== "object") return;
       if (data.type === "lazypock:oauth2") {
-        if (isRecordAuth(data.result)) {
+        const code = data.code;
+        if (typeof code === "string" && code) {
           if (popup) {
             try {
               popup.close();
             } catch {
             }
           }
-          finish(null, data.result);
+          const state = typeof data.state === "string" ? data.state : void 0;
+          finish(null, { code, state });
         } else {
           finish(
             new ApiError(
-              "OAuth2 callback returned an invalid result.",
+              "OAuth2 callback returned no authorization code.",
               data,
               400,
               false,
@@ -708,16 +708,9 @@ function authorizeWithOAuth2Popup(opts) {
         return;
       }
       if (data.type === "lazypock:oauth2:error") {
-        const result = data.result ?? {};
-        const message = typeof result.message === "string" && result.message ? result.message : "OAuth2 authorization failed.";
+        const message = typeof data.message === "string" && data.message ? data.message : "OAuth2 authorization failed.";
         finish(
-          new ApiError(
-            message,
-            result,
-            typeof result.code === "number" ? result.code : 400,
-            false,
-            "oauth2_provider_error"
-          )
+          new ApiError(message, data, 400, false, "oauth2_provider_error")
         );
       }
     };
@@ -1237,7 +1230,7 @@ var CollectionService = class _CollectionService {
       requestKey,
       autoCancel,
       cancelKey,
-      fetch,
+      fetch: fetch2,
       headers,
       signal,
       singleFlight,
@@ -1281,7 +1274,7 @@ var CollectionService = class _CollectionService {
       requestKey,
       autoCancel,
       cancelKey,
-      fetch,
+      fetch: fetch2,
       headers,
       signal,
       singleFlight,
@@ -1638,14 +1631,13 @@ var CollectionService = class _CollectionService {
   /**
    * Sign in with an OAuth2 provider (PocketBase `authWithOAuth2` parity).
    *
-   * One call handles the whole web flow: fetch the provider's `authURL`,
-   * open a popup (or call `options.urlCallback`), wait for the backend's
-   * `postMessage` result, populate the auth store, and resolve with
-   * `{ token, record, meta }`.
+   * One call handles the whole web flow: fetch the provider's `authURL`, open a
+   * popup (or call `options.urlCallback`), receive the single-use authorization
+   * `code` the backend relays via `postMessage`, exchange it, populate the auth
+   * store, and resolve with `{ token, record, meta }`.
    *
-   * `options.createData` is accepted for PocketBase signature parity but is
-   * **not** forwarded by the backend's popup redirect flow — use
-   * {@link authWithOAuth2Code} when you need extra fields on first sign-up.
+   * `options.createData` is forwarded on first sign-up (the exchange goes
+   * through {@link authWithOAuth2Code}), matching PocketBase.
    *
    * React Native / non-browser: the popup flow depends on
    * `window.postMessage`. Use {@link listAuthMethods} + {@link authWithOAuth2Code}
@@ -1654,6 +1646,7 @@ var CollectionService = class _CollectionService {
   async authWithOAuth2(options) {
     const {
       provider,
+      createData,
       urlCallback,
       popup,
       timeoutMs = DEFAULT_OAUTH2_TIMEOUT_MS
@@ -1671,18 +1664,19 @@ var CollectionService = class _CollectionService {
         "oauth2_unknown_provider"
       );
     }
-    const result = await authorizeWithOAuth2Popup({
+    const { code } = await authorizeWithOAuth2Popup({
       authURL: providerInfo.authURL,
       expectedOrigin: oauth2RedirectOrigin(this.http.baseUrl),
       urlCallback,
       popup,
       timeoutMs
     });
-    if (this.authStore) {
-      this.authStore.setCollectionName(this.collectionName);
-      this.authStore.set(result.token, result.record);
-    }
-    return result;
+    return this.authWithOAuth2Code({
+      provider,
+      code,
+      codeVerifier: providerInfo.codeVerifier,
+      createData
+    });
   }
   /**
    * Exchange an OAuth2 authorization code directly (PocketBase
@@ -2006,9 +2000,28 @@ function getThumbUrl(baseUrl, fileId, size) {
 function getScaleUrl(baseUrl, fileId, size) {
   return baseUrl.replace(/\/+$/, "") + "/files/" + encodeURIComponent(fileId) + "/scale/" + encodeURIComponent(size);
 }
+function getVariantUrl(baseUrl, fileId, preset) {
+  return getScaleUrl(baseUrl, fileId, preset);
+}
+function parseUploadTarget(rawUrl, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("Direct upload: the server returned an invalid upload URL");
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(`Direct upload: unsupported protocol ${parsed.protocol}`);
+  }
+  if (allowedHosts && allowedHosts.length > 0 && !allowedHosts.includes(parsed.host)) {
+    throw new Error(`Direct upload: host ${parsed.host} is not in the allowlist`);
+  }
+  return parsed;
+}
 var FilesService = class {
-  constructor(http) {
+  constructor(http, allowedUploadHosts) {
     this.http = http;
+    this.allowedUploadHosts = allowedUploadHosts;
   }
   /**
    * Upload a file or blob.
@@ -2029,6 +2042,8 @@ var FilesService = class {
       formData.append("collection_name", meta.collectionName);
     if (meta?.recordId) formData.append("record_id", meta.recordId);
     if (meta?.fieldName) formData.append("field_name", meta.fieldName);
+    if (meta?.origin) formData.append("origin", meta.origin);
+    if (meta?.variants?.length) formData.append("variants", meta.variants.join(","));
     const data = await this.http.request(
       "POST",
       "/files",
@@ -2037,6 +2052,62 @@ var FilesService = class {
     );
     return data;
   }
+  /**
+   * Direct upload (Mode B): the browser PUTs straight to S3/R2.
+   *
+   * Presigns, uploads, then asks the server to verify the object. Falls back to
+   * `upload()` when the server has no direct-upload support configured.
+   */
+  async uploadDirect(file, opts) {
+    const filename = opts?.filename || (file instanceof File ? file.name : "file");
+    const mime = file.type || "application/octet-stream";
+    const presigned = await this.presign({
+      filename,
+      size: file.size,
+      mime,
+      collectionName: opts?.collectionName,
+      fieldName: opts?.fieldName,
+      recordId: opts?.recordId
+    });
+    if (!presigned) return this.upload(file, filename, { signal: opts?.signal }, { collectionName: opts?.collectionName, fieldName: opts?.fieldName, recordId: opts?.recordId });
+    const target = parseUploadTarget(presigned.url, this.allowedUploadHosts);
+    const put = await fetch(target.href, {
+      method: presigned.method || "PUT",
+      headers: presigned.headers,
+      body: file,
+      signal: opts?.signal
+    });
+    if (!put.ok) throw new Error(`Direct upload failed: HTTP ${put.status}`);
+    return this.complete(presigned.id, { variant: opts?.variant, signal: opts?.signal });
+  }
+  /** Step 1 of a direct upload: reserve an object and get a presigned PUT. */
+  async presign(params) {
+    const data = await this.http.request(
+      "POST",
+      "/files/presign",
+      {
+        filename: params.filename,
+        size: params.size,
+        mime: params.mime,
+        collection_name: params.collectionName,
+        field_name: params.fieldName,
+        record_id: params.recordId
+      }
+    );
+    if (!data || typeof data.url !== "string") return null;
+    return data;
+  }
+  /** Step 2 of a direct upload: ask the server to verify the object. */
+  async complete(fileId, opts) {
+    const query = opts?.variant ? `?variants=${encodeURIComponent(opts.variant)}` : "";
+    const data = await this.http.request(
+      "POST",
+      `/files/${encodeURIComponent(fileId)}/complete${query}`,
+      {},
+      { signal: opts?.signal }
+    );
+    return data;
+  }
   /**
    * List uploaded files (newest first), with optional filters.
    *
@@ -2849,6 +2920,7 @@ function createClient(options) {
   getFileUrl,
   getScaleUrl,
   getThumbUrl,
+  getVariantUrl,
   schemaFieldType,
   wsUrlFromBaseUrl
 });