nodestack-client 2.0.0 → 2.1.0

package/dist/index.mjs

@@ -340,6 +340,175 @@ var RecordService = class extends BaseService {
     }
     return result;
   }
+  /**
+   * Returns a list of configured and enabled OAuth2 authentication providers.
+   */
+  async listAuthMethods(redirectUri) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-methods`,
+      {
+        method: "GET",
+        query: redirectUri ? { redirectUri } : void 0
+      }
+    );
+  }
+  /**
+   * Authenticates against an auth collection using OAuth2 with PKCE code exchange.
+   * On success, automatically persists the token and record to authStore.
+   */
+  async authWithOAuth2(options) {
+    let code = options.code;
+    let codeVerifier = options.codeVerifier;
+    if ((options.urlCallback || options.popup || typeof window !== "undefined" && !code && !codeVerifier) && (!code || !codeVerifier)) {
+      const authMethods = await this.listAuthMethods(options.redirectUrl);
+      const provider = authMethods.authProviders.find(
+        (p) => p.name.toLowerCase() === options.provider.toLowerCase()
+      );
+      if (!provider) {
+        throw new Error(`OAuth provider '${options.provider}' is not enabled or configured.`);
+      }
+      codeVerifier = provider.codeVerifier;
+      const expectedState = provider.state;
+      let expectedOrigin = null;
+      if (typeof window !== "undefined" && window.location) {
+        if (options.redirectUrl) {
+          try {
+            expectedOrigin = new URL(options.redirectUrl, window.location.href).origin;
+          } catch {
+            expectedOrigin = window.location.origin;
+          }
+        } else {
+          expectedOrigin = window.location.origin;
+        }
+      }
+      let popup = options.popup || null;
+      if (options.urlCallback) {
+        const cbResult = options.urlCallback(provider.authUrl);
+        if (!popup && cbResult && typeof cbResult.postMessage === "function") {
+          popup = cbResult;
+        }
+      } else if (typeof window !== "undefined" && typeof window.open === "function") {
+        popup = window.open(provider.authUrl, "_blank", "width=600,height=700");
+        if (!popup) {
+          throw new Error("Failed to open OAuth popup window. It may have been blocked by the browser.");
+        }
+      }
+      return new Promise((resolve, reject) => {
+        if (typeof window !== "undefined" && window.addEventListener) {
+          let pollTimer = null;
+          const cleanup = () => {
+            if (pollTimer) {
+              clearInterval(pollTimer);
+              pollTimer = null;
+            }
+            if (typeof window !== "undefined" && window.removeEventListener) {
+              window.removeEventListener("message", handler);
+            }
+          };
+          const handler = async (event) => {
+            if (!event.data || typeof event.data !== "object" || event.data.type !== "nodestack_oauth_callback") {
+              return;
+            }
+            if (expectedOrigin && event.origin !== expectedOrigin) {
+              return;
+            }
+            if (popup) {
+              if (event.source !== popup) {
+                return;
+              }
+            } else if (event.source === window) {
+              return;
+            }
+            if (expectedState && event.data.state !== expectedState) {
+              return;
+            }
+            cleanup();
+            if (popup && typeof popup.close === "function") {
+              try {
+                popup.close();
+              } catch {
+              }
+            }
+            if (event.data.error) {
+              const errMsg = typeof event.data.error === "string" ? event.data.error : event.data.error.message || event.data.error_description || JSON.stringify(event.data.error);
+              return reject(new Error(errMsg));
+            }
+            if (!event.data.code) {
+              return reject(new Error("OAuth callback message is missing authorization code."));
+            }
+            try {
+              const res = await this.authWithOAuth2({
+                provider: options.provider,
+                code: event.data.code,
+                codeVerifier,
+                redirectUrl: options.redirectUrl,
+                createData: options.createData,
+                state: expectedState
+              });
+              resolve(res);
+            } catch (err) {
+              reject(err);
+            }
+          };
+          window.addEventListener("message", handler);
+          if (popup) {
+            pollTimer = setInterval(() => {
+              if (popup && popup.closed) {
+                cleanup();
+                reject(new Error("The OAuth popup window was closed before completing authentication."));
+              }
+            }, 500);
+          }
+        } else {
+          reject(new Error("urlCallback requires code and codeVerifier in non-browser environments."));
+        }
+      });
+    }
+    if (!code || !codeVerifier) {
+      throw new Error("Both code and codeVerifier are required for OAuth2 authentication");
+    }
+    const result = await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-with-oauth2`,
+      {
+        method: "POST",
+        body: {
+          provider: options.provider,
+          code,
+          codeVerifier,
+          state: options.state,
+          redirectUrl: options.redirectUrl,
+          createData: options.createData
+        }
+      }
+    );
+    if (result && result.token) {
+      this.client.authStore.save(result.token, result.record);
+    }
+    return result;
+  }
+  /**
+   * Lists external social identities linked to a specific record.
+   */
+  async listExternalAuths(recordId) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  /**
+   * Unlinks an external social identity from a record.
+   */
+  async unlinkExternalAuth(recordId, provider) {
+    await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths/${encodeURIComponent(provider)}`,
+      {
+        method: "DELETE"
+      }
+    );
+    return true;
+  }
   /**
    * Exports records from the collection as CSV or JSON.
    */
@@ -1127,6 +1296,7 @@ var AppService = class extends BaseService {
 var NodeStackClient = class _NodeStackClient {
   baseUrl;
   authStore;
+  apiKey;
   files;
   realtime;
   admins;
@@ -1144,6 +1314,7 @@ var NodeStackClient = class _NodeStackClient {
   constructor(baseUrl = "/", options = {}) {
     this.baseUrl = (baseUrl || "/").replace(/\/+$/, "");
     this.authStore = options.authStore || new LocalAuthStore();
+    this.apiKey = options.apiKey;
     this.customFetch = options.fetch;
     this.defaultHeaders = options.headers || {};
     this.defaultTimeout = options.timeout || 12e4;
@@ -1207,7 +1378,9 @@ var NodeStackClient = class _NodeStackClient {
       ...this.defaultHeaders,
       ...options.headers || {}
     };
-    if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
+    if (this.apiKey && !headers["Authorization"] && !headers["authorization"] && !headers["x-api-key"] && !headers["X-API-Key"]) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    } else if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
       headers["Authorization"] = `Bearer ${this.authStore.token}`;
     }
     if (this.appSlug && !headers["x-nodestack-app"] && !headers["X-NodeStack-App"]) {
@@ -1350,6 +1523,92 @@ var NodeStackClient = class _NodeStackClient {
 var MemoryAuthStore = class extends BaseAuthStore {
   // Inherits default in-memory behavior of BaseAuthStore
 };
+
+// src/auth/PkceUtil.ts
+var PkceUtil = class _PkceUtil {
+  static generateVerifier(length = 64) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const clampedLength = Math.max(43, Math.min(128, length));
+    const randomBytes = new Uint8Array(clampedLength);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(randomBytes);
+    } else if (g.crypto && g.crypto.getRandomValues) {
+      g.crypto.getRandomValues(randomBytes);
+    } else {
+      let filled = false;
+      try {
+        const req = g.require;
+        if (typeof req === "function") {
+          req("crypto").randomFillSync(randomBytes);
+          filled = true;
+        }
+      } catch {
+      }
+      if (!filled) {
+        throw new Error(
+          "A cryptographically secure random number generator (crypto.getRandomValues or node:crypto) is required to generate a PKCE code_verifier."
+        );
+      }
+    }
+    let result = "";
+    for (let i = 0; i < clampedLength; i++) {
+      result += charset[randomBytes[i] % charset.length];
+    }
+    return result;
+  }
+  static async generateChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+      const hash = await crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    } else if (g.crypto && g.crypto.subtle) {
+      const hash = await g.crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    }
+    try {
+      const req = g.require;
+      if (typeof req === "function") {
+        const hash = req("crypto").createHash("sha256").update(data).digest();
+        return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+      }
+    } catch {
+    }
+    throw new Error("Web Crypto API (crypto.subtle) is not available to compute SHA-256 code challenge.");
+  }
+  static base64UrlEncode(bytes) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let base64 = "";
+    const byteLength = bytes.byteLength;
+    const byteRemainder = byteLength % 3;
+    const mainLength = byteLength - byteRemainder;
+    let a, b, c, d;
+    let chunk;
+    for (let i = 0; i < mainLength; i += 3) {
+      chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+      a = (chunk & 16515072) >> 18;
+      b = (chunk & 258048) >> 12;
+      c = (chunk & 4032) >> 6;
+      d = chunk & 63;
+      base64 += chars[a] + chars[b] + chars[c] + chars[d];
+    }
+    if (byteRemainder === 1) {
+      chunk = bytes[mainLength];
+      a = (chunk & 252) >> 2;
+      b = (chunk & 3) << 4;
+      base64 += chars[a] + chars[b] + "==";
+    } else if (byteRemainder === 2) {
+      chunk = bytes[mainLength] << 8 | bytes[mainLength + 1];
+      a = (chunk & 64512) >> 10;
+      b = (chunk & 1008) >> 4;
+      c = (chunk & 15) << 2;
+      base64 += chars[a] + chars[b] + chars[c] + "=";
+    }
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+};
 export {
   AdminService,
   AppService,
@@ -1362,6 +1621,7 @@ export {
   LocalAuthStore,
   MemoryAuthStore,
   NodeStackClient,
+  PkceUtil,
   RealtimeService,
   RecordService,
   SnapshotService,