rastack 0.0.62 → 0.0.63

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.63](https://github.com/theserverkid/reactapistack/compare/v0.0.62...v0.0.63) (2026-07-20)
+
+
+### Features
+
+* **deploy:** dev + prod environments with per-env Cognito, proxy, and .env ([996e726](https://github.com/theserverkid/reactapistack/commit/996e726e7e0d55f01e3111579594c2b66e88a79c))
+
 ### [0.0.62](https://github.com/theserverkid/reactapistack/compare/v0.0.61...v0.0.62) (2026-07-19)
 
 

package/auth/provider.ts

@@ -74,10 +74,7 @@ export interface CognitoAuthProviderConfig extends Partial<CognitoAuthConfig> {
 }
 
 export type CognitoAuthStatus =
-  | "loading"
-  | "authenticated"
-  | "unauthenticated"
-  | "error";
+  "loading" | "authenticated" | "unauthenticated" | "error";
 
 /** What `useCognitoAuth()` returns. */
 export interface CognitoAuthContextValue {
@@ -178,7 +175,8 @@ export function CognitoAuthProvider({
   const keyBase = config.storageKey ?? "rastack.auth";
   const sessionKey = `${keyBase}.session`;
   const pkceKey = `${keyBase}.pkce`;
-  const doFetch = config.fetchImpl ?? (globalThis.fetch?.bind(globalThis) as typeof fetch);
+  const doFetch =
+    config.fetchImpl ?? (globalThis.fetch?.bind(globalThis) as typeof fetch);
 
   const [session, setSession] = useState<CognitoSession | null>(null);
   const [status, setStatus] = useState<CognitoAuthStatus>("loading");
@@ -242,7 +240,8 @@ export function CognitoAuthProvider({
         const redirect = parseRedirect(dom.window.location.search);
         if (redirect.error) {
           clearUrl();
-          if (!cancelled) fail(new Error(redirect.errorDescription ?? redirect.error));
+          if (!cancelled)
+            fail(new Error(redirect.errorDescription ?? redirect.error));
           return;
         }
         if (redirect.code) {
@@ -288,14 +287,17 @@ export function CognitoAuthProvider({
   ): Promise<CognitoSession> {
     const hosted = requireHostedConfig(config);
     const pending = storage.getItem(pkceKey);
-    if (!pending) throw new Error("No pending PKCE verifier — restart sign-in.");
+    if (!pending)
+      throw new Error("No pending PKCE verifier — restart sign-in.");
     const { verifier, state: expectedState } = JSON.parse(pending) as {
       verifier: string;
       state: string;
     };
     storage.removeItem(pkceKey);
     if (expectedState && state && expectedState !== state) {
-      throw new Error("OAuth state mismatch — possible CSRF, sign-in rejected.");
+      throw new Error(
+        "OAuth state mismatch — possible CSRF, sign-in rejected.",
+      );
     }
     const response = await doFetch(tokenEndpoint(hosted), {
       method: "POST",
@@ -484,3 +486,64 @@ export function useRastackAuthFromCognito(): RastackAuth {
     [auth.isAuthenticated, auth.claims],
   );
 }
+
+// -- Dev-time Cognito runtime config (real dev pool, opt-in) ------------------
+// `rastack dev` serves the dev environment's Cognito coordinates at
+// `/__rastack/cognito.json` so a locally-running app can sign in against the
+// *real* dev user pool (to obtain real tokens — e.g. for the deployed
+// external-API proxy) instead of the unsigned `mode:"local"` shim. These
+// helpers turn that JSON into a `<CognitoAuthProvider config>`; a developer opts
+// in with `cognitoConfigFromGlobal() ?? { mode: "local" }`.
+
+/** The shape `rastack dev` serves at `/__rastack/cognito.json`. */
+export interface RastackCognitoRuntime {
+  userPoolId?: string;
+  clientId: string;
+  /** Hosted UI base URL (`https://…amazoncognito.com`). */
+  hostedUiUrl: string;
+  region: string;
+}
+
+/**
+ * Map a served runtime config into a `CognitoAuthProviderConfig` for the real
+ * Hosted UI flow. `redirectUri` defaults to the current page origin (where
+ * `rastack dev` serves the app), so local sign-in round-trips back correctly.
+ */
+export function cognitoRuntimeToConfig(
+  runtime: RastackCognitoRuntime,
+  opts: { redirectUri?: string } & Partial<CognitoAuthProviderConfig> = {},
+): CognitoAuthProviderConfig {
+  const origin = dom.window?.location?.origin as string | undefined;
+  const { redirectUri, ...rest } = opts;
+  return {
+    mode: "hosted-ui",
+    domain: runtime.hostedUiUrl,
+    clientId: runtime.clientId,
+    region: runtime.region,
+    userPoolId: runtime.userPoolId,
+    redirectUri: redirectUri ?? origin ?? "",
+    ...rest,
+  };
+}
+
+/**
+ * Read the runtime Cognito config `rastack dev` injects as
+ * `globalThis.__RASTACK_COGNITO__`, mapped to a provider config — or undefined
+ * when none is present (so the caller falls back to `{ mode: "local" }`). Set
+ * the global from the served JSON, e.g.:
+ *
+ * ```html
+ * <script>
+ *   fetch("/__rastack/cognito.json").then(r => r.ok && r.json())
+ *     .then(c => { if (c) window.__RASTACK_COGNITO__ = c; })
+ * </script>
+ * ```
+ */
+export function cognitoConfigFromGlobal(
+  opts: { redirectUri?: string } & Partial<CognitoAuthProviderConfig> = {},
+): CognitoAuthProviderConfig | undefined {
+  const runtime = (dom as { __RASTACK_COGNITO__?: RastackCognitoRuntime })
+    .__RASTACK_COGNITO__;
+  if (!runtime?.clientId || !runtime?.hostedUiUrl) return undefined;
+  return cognitoRuntimeToConfig(runtime, opts);
+}