nodestack-client 1.3.0 → 2.1.0

package/dist/index.mjs

@@ -340,6 +340,175 @@ var RecordService = class extends BaseService {
     }
     return result;
   }
+  /**
+   * Returns a list of configured and enabled OAuth2 authentication providers.
+   */
+  async listAuthMethods(redirectUri) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-methods`,
+      {
+        method: "GET",
+        query: redirectUri ? { redirectUri } : void 0
+      }
+    );
+  }
+  /**
+   * Authenticates against an auth collection using OAuth2 with PKCE code exchange.
+   * On success, automatically persists the token and record to authStore.
+   */
+  async authWithOAuth2(options) {
+    let code = options.code;
+    let codeVerifier = options.codeVerifier;
+    if ((options.urlCallback || options.popup || typeof window !== "undefined" && !code && !codeVerifier) && (!code || !codeVerifier)) {
+      const authMethods = await this.listAuthMethods(options.redirectUrl);
+      const provider = authMethods.authProviders.find(
+        (p) => p.name.toLowerCase() === options.provider.toLowerCase()
+      );
+      if (!provider) {
+        throw new Error(`OAuth provider '${options.provider}' is not enabled or configured.`);
+      }
+      codeVerifier = provider.codeVerifier;
+      const expectedState = provider.state;
+      let expectedOrigin = null;
+      if (typeof window !== "undefined" && window.location) {
+        if (options.redirectUrl) {
+          try {
+            expectedOrigin = new URL(options.redirectUrl, window.location.href).origin;
+          } catch {
+            expectedOrigin = window.location.origin;
+          }
+        } else {
+          expectedOrigin = window.location.origin;
+        }
+      }
+      let popup = options.popup || null;
+      if (options.urlCallback) {
+        const cbResult = options.urlCallback(provider.authUrl);
+        if (!popup && cbResult && typeof cbResult.postMessage === "function") {
+          popup = cbResult;
+        }
+      } else if (typeof window !== "undefined" && typeof window.open === "function") {
+        popup = window.open(provider.authUrl, "_blank", "width=600,height=700");
+        if (!popup) {
+          throw new Error("Failed to open OAuth popup window. It may have been blocked by the browser.");
+        }
+      }
+      return new Promise((resolve, reject) => {
+        if (typeof window !== "undefined" && window.addEventListener) {
+          let pollTimer = null;
+          const cleanup = () => {
+            if (pollTimer) {
+              clearInterval(pollTimer);
+              pollTimer = null;
+            }
+            if (typeof window !== "undefined" && window.removeEventListener) {
+              window.removeEventListener("message", handler);
+            }
+          };
+          const handler = async (event) => {
+            if (!event.data || typeof event.data !== "object" || event.data.type !== "nodestack_oauth_callback") {
+              return;
+            }
+            if (expectedOrigin && event.origin !== expectedOrigin) {
+              return;
+            }
+            if (popup) {
+              if (event.source !== popup) {
+                return;
+              }
+            } else if (event.source === window) {
+              return;
+            }
+            if (expectedState && event.data.state !== expectedState) {
+              return;
+            }
+            cleanup();
+            if (popup && typeof popup.close === "function") {
+              try {
+                popup.close();
+              } catch {
+              }
+            }
+            if (event.data.error) {
+              const errMsg = typeof event.data.error === "string" ? event.data.error : event.data.error.message || event.data.error_description || JSON.stringify(event.data.error);
+              return reject(new Error(errMsg));
+            }
+            if (!event.data.code) {
+              return reject(new Error("OAuth callback message is missing authorization code."));
+            }
+            try {
+              const res = await this.authWithOAuth2({
+                provider: options.provider,
+                code: event.data.code,
+                codeVerifier,
+                redirectUrl: options.redirectUrl,
+                createData: options.createData,
+                state: expectedState
+              });
+              resolve(res);
+            } catch (err) {
+              reject(err);
+            }
+          };
+          window.addEventListener("message", handler);
+          if (popup) {
+            pollTimer = setInterval(() => {
+              if (popup && popup.closed) {
+                cleanup();
+                reject(new Error("The OAuth popup window was closed before completing authentication."));
+              }
+            }, 500);
+          }
+        } else {
+          reject(new Error("urlCallback requires code and codeVerifier in non-browser environments."));
+        }
+      });
+    }
+    if (!code || !codeVerifier) {
+      throw new Error("Both code and codeVerifier are required for OAuth2 authentication");
+    }
+    const result = await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-with-oauth2`,
+      {
+        method: "POST",
+        body: {
+          provider: options.provider,
+          code,
+          codeVerifier,
+          state: options.state,
+          redirectUrl: options.redirectUrl,
+          createData: options.createData
+        }
+      }
+    );
+    if (result && result.token) {
+      this.client.authStore.save(result.token, result.record);
+    }
+    return result;
+  }
+  /**
+   * Lists external social identities linked to a specific record.
+   */
+  async listExternalAuths(recordId) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  /**
+   * Unlinks an external social identity from a record.
+   */
+  async unlinkExternalAuth(recordId, provider) {
+    await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths/${encodeURIComponent(provider)}`,
+      {
+        method: "DELETE"
+      }
+    );
+    return true;
+  }
   /**
    * Exports records from the collection as CSV or JSON.
    */
@@ -431,7 +600,8 @@ var FileService = class extends BaseService {
     const cleanCol = encodeURIComponent(collectionName);
     const cleanId = encodeURIComponent(recordId);
     const cleanFile = encodeURIComponent(filename);
-    let url = `${cleanBase}/api/files/${cleanCol}/${cleanId}/${cleanFile}`;
+    const appSlug = options.app || this.client.appSlug;
+    let url = appSlug && appSlug !== "default" ? `${cleanBase}/api/apps/${encodeURIComponent(appSlug)}/files/${cleanCol}/${cleanId}/${cleanFile}` : `${cleanBase}/api/files/${cleanCol}/${cleanId}/${cleanFile}`;
     const queryParts = [];
     if (options.download) {
       queryParts.push("download=1");
@@ -504,8 +674,16 @@ var RealtimeService = class extends BaseService {
         const EventSourceClass = this.getEventSourceConstructor();
         const base = (this.client.baseUrl || "").replace(/\/+$/, "");
         let url = `${base}/api/realtime`;
+        const queryParams = new URLSearchParams();
         if (this.client.authStore.token) {
-          url += `?token=${encodeURIComponent(this.client.authStore.token)}`;
+          queryParams.append("token", this.client.authStore.token);
+        }
+        if (this.client.appSlug) {
+          queryParams.append("app", this.client.appSlug);
+        }
+        const qs = queryParams.toString();
+        if (qs) {
+          url += `?${qs}`;
         }
         this.eventSource = new EventSourceClass(url);
         const handleConnect = async (event) => {
@@ -737,6 +915,8 @@ var AdminService = class extends BaseService {
 
 // src/services/CollectionService.ts
 var CollectionService = class extends BaseService {
+  list = this.getList.bind(this);
+  get = this.getOne.bind(this);
   /**
    * Retrieves all collection schema models.
    */
@@ -843,11 +1023,72 @@ var DemoService = class extends BaseService {
   }
 };
 
+// src/services/SnapshotService.ts
+var SnapshotService = class extends BaseService {
+  /**
+   * Retrieves all snapshots, active baseline, and live drift information.
+   */
+  async list() {
+    return this.send("/api/snapshots", {
+      method: "GET"
+    });
+  }
+  /**
+   * Alias for list() to retrieve status.
+   */
+  async getStatus() {
+    return this.list();
+  }
+  /**
+   * Creates a new application state snapshot.
+   * If snapshot limit (10) is reached, evictOldest: true can be passed to confirm eviction of the oldest.
+   */
+  async create(options) {
+    return this.send("/api/snapshots", {
+      method: "POST",
+      body: options || {}
+    });
+  }
+  /**
+   * Retrieves a specific snapshot by ID.
+   */
+  async get(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}`, {
+      method: "GET"
+    });
+  }
+  /**
+   * Restores application state to a specific snapshot.
+   * Note: Future snapshots are NOT deleted; history remains intact.
+   */
+  async restore(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}/restore`, {
+      method: "POST"
+    });
+  }
+  /**
+   * Deletes a specific snapshot by ID.
+   */
+  async delete(id) {
+    return this.send(`/api/snapshots/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  /**
+   * Clears all saved snapshots.
+   */
+  async clear() {
+    return this.send("/api/snapshots", {
+      method: "DELETE"
+    });
+  }
+};
+
 // src/services/WebhookService.ts
 function computeWebhookSignature(payload, secret) {
   const str = typeof payload === "string" ? payload : JSON.stringify(payload);
   try {
-    const nodeCrypto = typeof __require !== "undefined" ? __require("crypto") : globalThis?.crypto;
+    const nodeCrypto = typeof __require !== "undefined" ? __require("crypto") : typeof globalThis !== "undefined" ? globalThis.require?.("crypto") || globalThis.crypto : null;
     if (nodeCrypto && typeof nodeCrypto.createHmac === "function") {
       return nodeCrypto.createHmac("sha256", secret).update(str, "utf8").digest("hex");
     }
@@ -871,9 +1112,10 @@ function verifyWebhookSignature(payload, signatureHeader, secret) {
   }
   if (cleanHeader.length !== expected.length) return false;
   try {
-    const nodeCrypto = typeof __require !== "undefined" ? __require("crypto") : null;
-    if (nodeCrypto && typeof nodeCrypto.timingSafeEqual === "function" && typeof Buffer !== "undefined") {
-      return nodeCrypto.timingSafeEqual(Buffer.from(cleanHeader, "hex"), Buffer.from(expected, "hex"));
+    const nodeCrypto = typeof __require !== "undefined" ? __require("crypto") : typeof globalThis !== "undefined" ? globalThis.require?.("crypto") : null;
+    const buf = typeof Buffer !== "undefined" ? Buffer : typeof globalThis !== "undefined" ? globalThis.Buffer : null;
+    if (nodeCrypto && typeof nodeCrypto.timingSafeEqual === "function" && buf) {
+      return nodeCrypto.timingSafeEqual(buf.from(cleanHeader, "hex"), buf.from(expected, "hex"));
     }
   } catch {
   }
@@ -1000,16 +1242,70 @@ var WebhookService = class extends BaseService {
   static computeSignature = computeWebhookSignature;
 };
 
+// src/services/AppService.ts
+var AppService = class extends BaseService {
+  list = this.getList.bind(this);
+  get = this.getOne.bind(this);
+  /**
+   * Retrieves all configured applications.
+   */
+  async getList() {
+    const res = await this.send("/api/apps", {
+      method: "GET"
+    });
+    return Array.isArray(res) ? res : res?.items || [];
+  }
+  /**
+   * Retrieves a single application by ID or slug.
+   */
+  async getOne(appId) {
+    return this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "GET"
+    });
+  }
+  /**
+   * Creates a new application.
+   */
+  async create(data) {
+    return this.send("/api/apps", {
+      method: "POST",
+      body: data
+    });
+  }
+  /**
+   * Updates an existing application.
+   */
+  async update(appId, data) {
+    return this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "PATCH",
+      body: data
+    });
+  }
+  /**
+   * Deletes an application by ID or slug.
+   */
+  async delete(appId) {
+    await this.send(`/api/apps/${encodeURIComponent(appId)}`, {
+      method: "DELETE"
+    });
+    return true;
+  }
+};
+
 // src/Client.ts
-var NodeStackClient = class {
+var NodeStackClient = class _NodeStackClient {
   baseUrl;
   authStore;
+  apiKey;
   files;
   realtime;
   admins;
   collections;
+  snapshots;
   demo;
   webhooks;
+  apps;
+  appSlug;
   customFetch;
   defaultHeaders;
   defaultTimeout;
@@ -1018,16 +1314,20 @@ var NodeStackClient = class {
   constructor(baseUrl = "/", options = {}) {
     this.baseUrl = (baseUrl || "/").replace(/\/+$/, "");
     this.authStore = options.authStore || new LocalAuthStore();
+    this.apiKey = options.apiKey;
     this.customFetch = options.fetch;
     this.defaultHeaders = options.headers || {};
     this.defaultTimeout = options.timeout || 12e4;
     this.chaosOptions = options.chaos ? { ...options.chaos } : null;
+    this.appSlug = options.app;
     this.files = new FileService(this);
     this.realtime = new RealtimeService(this, options.EventSource);
     this.admins = new AdminService(this);
     this.collections = new CollectionService(this);
+    this.snapshots = new SnapshotService(this);
     this.demo = new DemoService(this);
     this.webhooks = new WebhookService(this);
+    this.apps = new AppService(this);
   }
   /**
    * Dynamically configure latency & chaos simulation options for all future requests.
@@ -1078,9 +1378,14 @@ var NodeStackClient = class {
       ...this.defaultHeaders,
       ...options.headers || {}
     };
-    if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
+    if (this.apiKey && !headers["Authorization"] && !headers["authorization"] && !headers["x-api-key"] && !headers["X-API-Key"]) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    } else if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
       headers["Authorization"] = `Bearer ${this.authStore.token}`;
     }
+    if (this.appSlug && !headers["x-nodestack-app"] && !headers["X-NodeStack-App"]) {
+      headers["x-nodestack-app"] = this.appSlug;
+    }
     const effectiveChaos = {
       ...this.chaosOptions || {},
       ...options.chaos || {},
@@ -1197,14 +1502,116 @@ var NodeStackClient = class {
   async metrics() {
     return this.send("/api/metrics", { method: "GET" });
   }
+  /**
+   * Returns a new NodeStackClient instance scoped to a specific application/MVP.
+   * Inherits baseUrl, authStore, customFetch, defaultHeaders, and defaultTimeout.
+   */
+  app(slug, options = {}) {
+    return new _NodeStackClient(this.baseUrl, {
+      authStore: options.authStore || this.authStore,
+      fetch: options.fetch || this.customFetch,
+      headers: { ...this.defaultHeaders, ...options.headers || {} },
+      timeout: options.timeout !== void 0 ? options.timeout : this.defaultTimeout,
+      chaos: options.chaos !== void 0 ? options.chaos ? { ...options.chaos } : void 0 : this.chaosOptions ? { ...this.chaosOptions } : void 0,
+      app: slug,
+      EventSource: options.EventSource || this.realtime.customEventSource
+    });
+  }
 };
 
 // src/auth/MemoryAuthStore.ts
 var MemoryAuthStore = class extends BaseAuthStore {
   // Inherits default in-memory behavior of BaseAuthStore
 };
+
+// src/auth/PkceUtil.ts
+var PkceUtil = class _PkceUtil {
+  static generateVerifier(length = 64) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const clampedLength = Math.max(43, Math.min(128, length));
+    const randomBytes = new Uint8Array(clampedLength);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(randomBytes);
+    } else if (g.crypto && g.crypto.getRandomValues) {
+      g.crypto.getRandomValues(randomBytes);
+    } else {
+      let filled = false;
+      try {
+        const req = g.require;
+        if (typeof req === "function") {
+          req("crypto").randomFillSync(randomBytes);
+          filled = true;
+        }
+      } catch {
+      }
+      if (!filled) {
+        throw new Error(
+          "A cryptographically secure random number generator (crypto.getRandomValues or node:crypto) is required to generate a PKCE code_verifier."
+        );
+      }
+    }
+    let result = "";
+    for (let i = 0; i < clampedLength; i++) {
+      result += charset[randomBytes[i] % charset.length];
+    }
+    return result;
+  }
+  static async generateChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+      const hash = await crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    } else if (g.crypto && g.crypto.subtle) {
+      const hash = await g.crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    }
+    try {
+      const req = g.require;
+      if (typeof req === "function") {
+        const hash = req("crypto").createHash("sha256").update(data).digest();
+        return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+      }
+    } catch {
+    }
+    throw new Error("Web Crypto API (crypto.subtle) is not available to compute SHA-256 code challenge.");
+  }
+  static base64UrlEncode(bytes) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let base64 = "";
+    const byteLength = bytes.byteLength;
+    const byteRemainder = byteLength % 3;
+    const mainLength = byteLength - byteRemainder;
+    let a, b, c, d;
+    let chunk;
+    for (let i = 0; i < mainLength; i += 3) {
+      chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+      a = (chunk & 16515072) >> 18;
+      b = (chunk & 258048) >> 12;
+      c = (chunk & 4032) >> 6;
+      d = chunk & 63;
+      base64 += chars[a] + chars[b] + chars[c] + chars[d];
+    }
+    if (byteRemainder === 1) {
+      chunk = bytes[mainLength];
+      a = (chunk & 252) >> 2;
+      b = (chunk & 3) << 4;
+      base64 += chars[a] + chars[b] + "==";
+    } else if (byteRemainder === 2) {
+      chunk = bytes[mainLength] << 8 | bytes[mainLength + 1];
+      a = (chunk & 64512) >> 10;
+      b = (chunk & 1008) >> 4;
+      c = (chunk & 15) << 2;
+      base64 += chars[a] + chars[b] + chars[c] + "=";
+    }
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+};
 export {
   AdminService,
+  AppService,
   BaseAuthStore,
   BaseService,
   ClientResponseError,
@@ -1214,8 +1621,10 @@ export {
   LocalAuthStore,
   MemoryAuthStore,
   NodeStackClient,
+  PkceUtil,
   RealtimeService,
   RecordService,
+  SnapshotService,
   WebhookService,
   computeWebhookSignature,
   decodeJwtPayload,