minutework 0.1.0

package/assets/templates/next-tenant-app/src/lib/platform/client.server.ts

@@ -0,0 +1,661 @@
+import "server-only";
+
+import { z, type ZodSchema } from "zod";
+
+import type {
+  AuthenticatedPlatformSession,
+  CommandDispatchRequest,
+  CommandRun,
+  LoginRequest,
+  PasswordChangeRequest,
+  PasswordStatus,
+  PlatformSession,
+  TenantSessionContextRequest,
+} from "@/lib/platform/contracts";
+import {
+  commandDispatchRequestSchema,
+  commandRunSchema,
+  loginRequestSchema,
+  passwordChangeRequestSchema,
+  passwordStatusSchema,
+  platformErrorPayloadSchema,
+  tenantSessionContextRequestSchema,
+  upstreamPasswordChangeRequestSchema,
+  upstreamSessionPayloadSchema,
+} from "@/lib/platform/contracts";
+import {
+  platformAuthEndpoints,
+  platformGatewayEndpoints,
+} from "@/lib/platform/endpoints.server";
+import type { PlatformAuthState } from "@/lib/platform/session.server";
+
+export type PlatformResult<T> = {
+  data: T;
+  authState: PlatformAuthState;
+};
+
+export class PlatformClientError extends Error {
+  status: number;
+  code: string | null;
+  authState: PlatformAuthState | null;
+
+  constructor(
+    message: string,
+    status: number,
+    code: string | null = null,
+    authState: PlatformAuthState | null = null,
+  ) {
+    super(message);
+    this.name = "PlatformClientError";
+    this.status = status;
+    this.code = code;
+    this.authState = authState;
+  }
+}
+
+function normalizeAuthState(
+  input?: Partial<PlatformAuthState> | string | null,
+): PlatformAuthState {
+  if (typeof input === "string" || input == null) {
+    return {
+      sessionId: input ?? null,
+      csrfToken: null,
+    };
+  }
+
+  return {
+    sessionId: input.sessionId ?? null,
+    csrfToken: input.csrfToken ?? null,
+  };
+}
+
+function mergeAuthState(
+  currentAuthState: PlatformAuthState,
+  partialAuthState?: Partial<PlatformAuthState>,
+): PlatformAuthState {
+  if (!partialAuthState) {
+    return currentAuthState;
+  }
+
+  return {
+    sessionId:
+      partialAuthState.sessionId === undefined
+        ? currentAuthState.sessionId
+        : partialAuthState.sessionId,
+    csrfToken:
+      partialAuthState.csrfToken === undefined
+        ? currentAuthState.csrfToken
+        : partialAuthState.csrfToken,
+  };
+}
+
+function getRequestTarget(input: string) {
+  try {
+    return new URL(input).origin;
+  } catch {
+    return input;
+  }
+}
+
+function toPlatformUnavailableError(
+  input: string,
+  cause: unknown,
+  authState: PlatformAuthState,
+) {
+  const error = new PlatformClientError(
+    `Unable to reach the platform backend at ${getRequestTarget(input)}.`,
+    503,
+    "platform_unavailable",
+    authState,
+  ) as PlatformClientError & { cause?: unknown };
+  error.cause = cause;
+  return error;
+}
+
+function splitCombinedSetCookieHeader(value: string) {
+  const cookies: string[] = [];
+  let start = 0;
+  let inExpiresAttribute = false;
+
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+
+    if (value.slice(index, index + 8).toLowerCase() === "expires=") {
+      inExpiresAttribute = true;
+      continue;
+    }
+
+    if (inExpiresAttribute && character === ";") {
+      inExpiresAttribute = false;
+      continue;
+    }
+
+    if (character === "," && !inExpiresAttribute) {
+      cookies.push(value.slice(start, index).trim());
+      start = index + 1;
+    }
+  }
+
+  const finalCookie = value.slice(start).trim();
+  if (finalCookie) {
+    cookies.push(finalCookie);
+  }
+
+  return cookies.filter(Boolean);
+}
+
+function getSetCookieHeaders(headers: Headers) {
+  const typedHeaders = headers as Headers & {
+    getSetCookie?: () => string[];
+  };
+
+  if (typeof typedHeaders.getSetCookie === "function") {
+    return typedHeaders.getSetCookie();
+  }
+
+  const combinedHeader = headers.get("set-cookie");
+  return combinedHeader ? splitCombinedSetCookieHeader(combinedHeader) : [];
+}
+
+function extractCookieValue(name: string, cookieHeader: string) {
+  const match = cookieHeader.match(new RegExp(`${name}=([^;]*)`));
+
+  if (!match) {
+    return undefined;
+  }
+
+  const value = match[1]?.trim() ?? "";
+  return value || null;
+}
+
+function extractAuthStateFromHeaders(headers: Headers): Partial<PlatformAuthState> {
+  const setCookieHeaders = getSetCookieHeaders(headers);
+  const nextAuthState: Partial<PlatformAuthState> = {};
+
+  for (const cookieHeader of setCookieHeaders) {
+    const sessionId = extractCookieValue("sessionid", cookieHeader);
+    const csrfToken = extractCookieValue("csrftoken", cookieHeader);
+
+    if (sessionId !== undefined) {
+      nextAuthState.sessionId = sessionId;
+    }
+
+    if (csrfToken !== undefined) {
+      nextAuthState.csrfToken = csrfToken;
+    }
+  }
+
+  return nextAuthState;
+}
+
+async function parseJson(response: Response): Promise<unknown> {
+  const text = await response.text();
+
+  if (!text) {
+    return null;
+  }
+
+  const trimmedText = text.trim();
+  const contentType = response.headers.get("content-type") ?? "";
+  const looksLikeJson =
+    contentType.includes("application/json") ||
+    trimmedText.startsWith("{") ||
+    trimmedText.startsWith("[");
+
+  if (!looksLikeJson) {
+    return trimmedText;
+  }
+
+  try {
+    return JSON.parse(trimmedText) as unknown;
+  } catch {
+    return trimmedText;
+  }
+}
+
+function extractErrorDetails(data: unknown) {
+  if (typeof data === "string" && data.trim()) {
+    const snippet = data.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+
+    return {
+      message: snippet.slice(0, 240) || "Platform request failed",
+      code: null,
+    };
+  }
+
+  const parsed = platformErrorPayloadSchema.safeParse(data);
+
+  if (!parsed.success) {
+    return {
+      message: "Platform request failed",
+      code: null,
+    };
+  }
+
+  return {
+    message: parsed.data.detail ?? parsed.data.error ?? "Platform request failed",
+    code: parsed.data.code ?? null,
+  };
+}
+
+function toAuthenticatedPlatformSession(
+  payload: z.infer<typeof upstreamSessionPayloadSchema>,
+): AuthenticatedPlatformSession {
+  return {
+    authenticated: true,
+    user: payload.user,
+    active_tenant_id: payload.active_tenant_id,
+    active_tenant: payload.active_tenant,
+    memberships: payload.memberships,
+  };
+}
+
+function platformCookieHeader(authState: PlatformAuthState) {
+  const cookieParts = [
+    authState.sessionId ? `sessionid=${authState.sessionId}` : null,
+    authState.csrfToken ? `csrftoken=${authState.csrfToken}` : null,
+  ].filter(Boolean);
+
+  return cookieParts.length > 0 ? cookieParts.join("; ") : null;
+}
+
+function platformHeaders(
+  input: string,
+  authState: PlatformAuthState,
+  headers?: HeadersInit,
+  includeCsrf = false,
+) {
+  const resolvedHeaders = new Headers(headers);
+  const cookieHeader = platformCookieHeader(authState);
+
+  resolvedHeaders.set("Accept", "application/json");
+
+  if (cookieHeader) {
+    resolvedHeaders.set("Cookie", cookieHeader);
+  }
+
+  if (includeCsrf && authState.csrfToken) {
+    resolvedHeaders.set("X-CSRFToken", authState.csrfToken);
+    try {
+      const target = new URL(input);
+      resolvedHeaders.set("Origin", target.origin);
+      resolvedHeaders.set("Referer", input);
+    } catch {
+      // Platform endpoints are expected to be absolute URLs, but keep the
+      // header helper tolerant if a caller ever passes a relative path.
+    }
+  }
+
+  return resolvedHeaders;
+}
+
+async function performPlatformFetch(
+  input: string,
+  init: RequestInit,
+  authState: PlatformAuthState,
+  includeCsrf = false,
+) {
+  let response: Response;
+
+  try {
+    response = await fetch(input, {
+      ...init,
+      cache: init.cache ?? "no-store",
+      headers: platformHeaders(input, authState, init.headers, includeCsrf),
+    });
+  } catch (error) {
+    throw toPlatformUnavailableError(input, error, authState);
+  }
+
+  return {
+    response,
+    authState: mergeAuthState(authState, extractAuthStateFromHeaders(response.headers)),
+  };
+}
+
+async function ensureCsrfToken(authState: PlatformAuthState) {
+  if (authState.csrfToken) {
+    return authState;
+  }
+
+  const { response, authState: nextAuthState } = await performPlatformFetch(
+    platformAuthEndpoints.currentSession,
+    { method: "GET" },
+    authState,
+  );
+  const data = await parseJson(response);
+
+  if (response.ok || response.status === 401) {
+    if (nextAuthState.csrfToken) {
+      return nextAuthState;
+    }
+
+    throw new PlatformClientError(
+      "Platform did not return a CSRF cookie.",
+      502,
+      "missing_csrf_cookie",
+      nextAuthState,
+    );
+  }
+
+  const { message, code } = extractErrorDetails(data);
+  throw new PlatformClientError(message, response.status, code, nextAuthState);
+}
+
+async function requestJson<T>(
+  input: string,
+  schema: ZodSchema<T>,
+  init: RequestInit,
+  options?: {
+    authState?: Partial<PlatformAuthState> | string | null;
+    requireCsrf?: boolean;
+  },
+): Promise<PlatformResult<T>> {
+  let authState = normalizeAuthState(options?.authState);
+
+  if (options?.requireCsrf) {
+    authState = await ensureCsrfToken(authState);
+  }
+
+  const { response, authState: nextAuthState } = await performPlatformFetch(
+    input,
+    init,
+    authState,
+    options?.requireCsrf ?? false,
+  );
+  const data = await parseJson(response);
+
+  if (!response.ok) {
+    const { message, code } = extractErrorDetails(data);
+    throw new PlatformClientError(message, response.status, code, nextAuthState);
+  }
+
+  return {
+    data: schema.parse(data),
+    authState: nextAuthState,
+  };
+}
+
+export async function fetchCurrentSession(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<AuthenticatedPlatformSession>> {
+  const result = await requestJson(
+    platformAuthEndpoints.currentSession,
+    upstreamSessionPayloadSchema,
+    {
+      method: "GET",
+    },
+    {
+      authState: authInput,
+    },
+  );
+
+  return {
+    data: toAuthenticatedPlatformSession(result.data),
+    authState: result.authState,
+  };
+}
+
+export async function loadCurrentSession(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<PlatformSession>> {
+  const authState = normalizeAuthState(authInput);
+
+  if (!authState.sessionId) {
+    return {
+      data: {
+        authenticated: false,
+      },
+      authState: authState.csrfToken ? authState : await ensureCsrfToken(authState),
+    };
+  }
+
+  try {
+    return await fetchCurrentSession(authState);
+  } catch (error) {
+    if (error instanceof PlatformClientError) {
+      if (error.status === 401) {
+        return {
+          data: { authenticated: false },
+          authState: {
+            ...normalizeAuthState(error.authState),
+            sessionId: null,
+          },
+        };
+      }
+
+      if (error.status >= 500) {
+        return {
+          data: { authenticated: false },
+          authState: normalizeAuthState(error.authState ?? authState),
+        };
+      }
+    }
+
+    throw error;
+  }
+}
+
+export async function resolveCurrentSession(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformSession> {
+  return (await loadCurrentSession(authInput)).data;
+}
+
+export async function loginWithPassword(
+  authInput: Partial<PlatformAuthState> | string | null,
+  credentials: LoginRequest,
+): Promise<PlatformResult<AuthenticatedPlatformSession>> {
+  const payload = loginRequestSchema.parse(credentials);
+  const result = await requestJson(
+    platformAuthEndpoints.login,
+    upstreamSessionPayloadSchema,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(payload),
+    },
+    {
+      authState: authInput,
+      requireCsrf: true,
+    },
+  );
+
+  if (!result.authState.sessionId) {
+    throw new PlatformClientError(
+      "Platform login did not return a session cookie.",
+      502,
+      "missing_session_cookie",
+      result.authState,
+    );
+  }
+
+  return {
+    data: toAuthenticatedPlatformSession(result.data),
+    authState: result.authState,
+  };
+}
+
+export async function logoutPlatformSession(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<null>> {
+  const authState = normalizeAuthState(authInput);
+
+  if (!authState.sessionId) {
+    return {
+      data: null,
+      authState: {
+        ...authState,
+        sessionId: null,
+      },
+    };
+  }
+
+  const result = await requestJson(
+    platformAuthEndpoints.logout,
+    z.null(),
+    {
+      method: "POST",
+    },
+    {
+      authState,
+      requireCsrf: true,
+    },
+  );
+
+  return {
+    data: null,
+    authState: {
+      ...result.authState,
+      sessionId: null,
+    },
+  };
+}
+
+export async function fetchSessionContext(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<AuthenticatedPlatformSession>> {
+  const result = await requestJson(
+    platformAuthEndpoints.sessionContext,
+    upstreamSessionPayloadSchema,
+    {
+      method: "GET",
+    },
+    {
+      authState: authInput,
+    },
+  );
+
+  return {
+    data: toAuthenticatedPlatformSession(result.data),
+    authState: result.authState,
+  };
+}
+
+export async function updateSessionContext(
+  authInput: Partial<PlatformAuthState> | string | null,
+  request: TenantSessionContextRequest,
+): Promise<PlatformResult<AuthenticatedPlatformSession>> {
+  const payload = tenantSessionContextRequestSchema.parse(request);
+  const result = await requestJson(
+    platformAuthEndpoints.sessionContext,
+    upstreamSessionPayloadSchema,
+    {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(payload),
+    },
+    {
+      authState: authInput,
+      requireCsrf: true,
+    },
+  );
+
+  return {
+    data: toAuthenticatedPlatformSession(result.data),
+    authState: result.authState,
+  };
+}
+
+export async function resetSessionContext(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<AuthenticatedPlatformSession>> {
+  const result = await requestJson(
+    platformAuthEndpoints.sessionContext,
+    upstreamSessionPayloadSchema,
+    {
+      method: "DELETE",
+    },
+    {
+      authState: authInput,
+      requireCsrf: true,
+    },
+  );
+
+  return {
+    data: toAuthenticatedPlatformSession(result.data),
+    authState: result.authState,
+  };
+}
+
+export async function fetchPasswordStatus(
+  authInput: Partial<PlatformAuthState> | string | null,
+): Promise<PlatformResult<PasswordStatus>> {
+  return requestJson(
+    platformAuthEndpoints.passwordStatus,
+    passwordStatusSchema,
+    {
+      method: "GET",
+    },
+    {
+      authState: authInput,
+    },
+  );
+}
+
+export async function changePassword(
+  authInput: Partial<PlatformAuthState> | string | null,
+  request: PasswordChangeRequest,
+): Promise<PlatformResult<PasswordStatus>> {
+  const payload = passwordChangeRequestSchema.parse(request);
+
+  return requestJson(
+    platformAuthEndpoints.passwordChange,
+    passwordStatusSchema,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(
+        upstreamPasswordChangeRequestSchema.parse({
+          current_password: payload.current_password,
+          new_password: payload.new_password,
+        }),
+      ),
+    },
+    {
+      authState: authInput,
+      requireCsrf: true,
+    },
+  );
+}
+
+export async function dispatchTenantCommand(
+  authInput: Partial<PlatformAuthState> | string | null,
+  request: CommandDispatchRequest,
+): Promise<PlatformResult<CommandRun>> {
+  const payload = commandDispatchRequestSchema.parse(request);
+
+  return requestJson(platformGatewayEndpoints.tenantCommands, commandRunSchema, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(payload),
+  }, {
+    authState: authInput,
+    requireCsrf: true,
+  });
+}
+
+export async function fetchTenantCommandRun(
+  authInput: Partial<PlatformAuthState> | string | null,
+  runId: string,
+  tenantId: string,
+): Promise<PlatformResult<CommandRun>> {
+  return requestJson(
+    platformGatewayEndpoints.tenantCommandRun(runId, tenantId),
+    commandRunSchema,
+    {
+      method: "GET",
+    },
+    {
+      authState: authInput,
+    },
+  );
+}