react-shopwave-connect 0.1.2 → 0.3.0

package/dist/next/index.js

@@ -0,0 +1,987 @@
+import { cookies } from "next/headers";
+import { NextResponse } from "next/server";
+import { getIronSession, unsealData } from "iron-session";
+
+//#region src/server/errors.ts
+var ShopwaveAuthError = class extends Error {
+	code;
+	status;
+	/** Raw response body from the auth server, if any. Never contains our secret. */
+	body;
+	constructor(code, message, details = {}) {
+		super(message, details.cause !== void 0 ? { cause: details.cause } : void 0);
+		this.name = "ShopwaveAuthError";
+		this.code = code;
+		this.status = details.status;
+		this.body = details.body;
+	}
+	/**
+	* True when the auth server rejected the grant itself (bad/expired code or
+	* refresh token) rather than failing for a transient reason. Callers should
+	* treat the user as logged out.
+	*/
+	get isInvalidGrant() {
+		return (this.code === "token_exchange_failed" || this.code === "token_refresh_failed") && this.status !== void 0 && this.status >= 400 && this.status < 500;
+	}
+};
+
+//#endregion
+//#region src/server/token.ts
+/** Shopwave API error id meaning "access token expired / invalid". */
+const SHOPWAVE_TOKEN_EXPIRED_ERROR_ID = 908;
+/**
+* Converts a token-endpoint response into a {@link ShopwaveToken}.
+* Returns `null` when the response has no access token.
+*
+* @param previous  the token being refreshed; its refresh token is kept when
+*                  the server doesn't send a new one.
+*/
+function tokenFromResponse(response, previous, now = Date.now()) {
+	if (!response || typeof response.access_token !== "string" || !response.access_token) return null;
+	const expiresIn = Number(response.expires_in);
+	return {
+		accessToken: response.access_token,
+		refreshToken: typeof response.refresh_token === "string" && response.refresh_token || previous?.refreshToken,
+		tokenType: typeof response.token_type === "string" && response.token_type || "OAuth",
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? now + expiresIn * 1e3 : void 0
+	};
+}
+/**
+* Reads a token from session storage. Accepts both the current shape and the
+* legacy raw response that older apps (e.g. AdminUI ≤ 0.1) stored directly in
+* the session, so existing sessions survive an upgrade.
+*/
+function normalizeStoredToken(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const t = raw;
+	if (typeof t.accessToken === "string" && t.accessToken) return {
+		accessToken: t.accessToken,
+		refreshToken: typeof t.refreshToken === "string" ? t.refreshToken : void 0,
+		tokenType: typeof t.tokenType === "string" && t.tokenType ? t.tokenType : "OAuth",
+		expiresAt: typeof t.expiresAt === "number" ? t.expiresAt : void 0
+	};
+	if (typeof t.access_token === "string" && t.access_token) return {
+		accessToken: t.access_token,
+		refreshToken: typeof t.refresh_token === "string" ? t.refresh_token : void 0,
+		tokenType: typeof t.token_type === "string" && t.token_type ? t.token_type : "OAuth"
+	};
+	return null;
+}
+/**
+* True when the token has passed its expiry (minus `skewSeconds`).
+* Tokens without a known expiry are treated as valid.
+*
+* Shopwave only issues a new access token once the old one has actually
+* expired, so the default skew is 0 — refreshing early just returns the same
+* token.
+*/
+function isTokenExpired(token, { skewSeconds = 0, now = Date.now() } = {}) {
+	if (token.expiresAt === void 0) return false;
+	return now >= token.expiresAt - skewSeconds * 1e3;
+}
+/** `Authorization` header value, e.g. `OAuth 111ad…`. */
+function authorizationHeader(token) {
+	return `${token.tokenType || "OAuth"} ${token.accessToken}`;
+}
+/**
+* True when a Shopwave API response means "your access token is no longer
+* valid": HTTP 401, or the API error 908 in the response envelope.
+* Use it to trigger a forced refresh + a single retry.
+*/
+function isExpiredTokenResponse(status, body) {
+	if (status === 401) return true;
+	const message = body?.api?.message;
+	const errors = message?.errors ?? message?.error;
+	if (!errors || typeof errors !== "object") return false;
+	return Object.entries(errors).some(([key, value]) => key === String(SHOPWAVE_TOKEN_EXPIRED_ERROR_ID) || Number(value?.id) === SHOPWAVE_TOKEN_EXPIRED_ERROR_ID);
+}
+
+//#endregion
+//#region src/server/oauth.ts
+const REQUIRED_KEYS = [
+	"authServerUrl",
+	"clientId",
+	"clientSecret",
+	"redirectUri"
+];
+/** Throws a readable error when required settings are missing. */
+function assertOAuthConfig(config) {
+	const missing = REQUIRED_KEYS.filter((k) => !config?.[k]);
+	if (missing.length > 0) throw new ShopwaveAuthError("config_invalid", `Shopwave auth is missing required settings: ${missing.join(", ")}`);
+}
+function trimSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+/**
+* Creates a framework-agnostic Shopwave OAuth client (authorization-code flow
+* with a client secret — the Shopwave auth server does not support PKCE, so
+* this must run on a server).
+*
+* Config is validated lazily on first use, so creating the client at module
+* scope doesn't break builds where env vars aren't present.
+*/
+function createShopwaveOAuth(config) {
+	const endpoints = {
+		login: config.endpoints?.login ?? "/login",
+		token: config.endpoints?.token ?? "/oauth/token",
+		logout: config.endpoints?.logout ?? "/logout"
+	};
+	const base = () => {
+		assertOAuthConfig(config);
+		return trimSlash(config.authServerUrl);
+	};
+	const commonParams = (redirectUri) => new URLSearchParams({
+		access_type: config.accessType ?? "online",
+		redirect_uri: redirectUri,
+		response_type: "code",
+		client_id: config.clientId,
+		scope: config.scope ?? "application"
+	});
+	async function postToken(fields, errorCode) {
+		const url = `${base()}${endpoints.token}`;
+		const doFetch = config.fetch ?? globalThis.fetch;
+		let body;
+		if (config.tokenRequestFormat === "multipart") {
+			const fd = new FormData();
+			for (const [k, v] of Object.entries(fields)) fd.append(k, v);
+			body = fd;
+		} else body = new URLSearchParams(fields);
+		let response;
+		try {
+			response = await doFetch(url, {
+				method: "POST",
+				body,
+				headers: { Accept: "application/json" },
+				cache: "no-store"
+			});
+		} catch (cause) {
+			throw new ShopwaveAuthError("network_error", `Could not reach the Shopwave auth server`, { cause });
+		}
+		const text = await response.text();
+		if (!response.ok) throw new ShopwaveAuthError(errorCode, `Shopwave auth server returned ${response.status} for ${fields.grant_type}`, {
+			status: response.status,
+			body: text.slice(0, 2e3)
+		});
+		try {
+			return JSON.parse(text);
+		} catch (cause) {
+			throw new ShopwaveAuthError("token_response_invalid", "Token response was not JSON", {
+				status: response.status,
+				body: text.slice(0, 2e3),
+				cause
+			});
+		}
+	}
+	return {
+		config,
+		buildLoginUrl({ state } = {}) {
+			const params = commonParams(config.redirectUri);
+			if (state) params.set("state", state);
+			return `${base()}${endpoints.login}?${params.toString()}`;
+		},
+		buildLogoutUrl({ redirectUri } = {}) {
+			const params = commonParams(redirectUri ?? config.postLogoutRedirectUri ?? config.redirectUri);
+			return `${base()}${endpoints.logout}?${params.toString()}`;
+		},
+		async exchangeCode(code) {
+			if (!code) throw new ShopwaveAuthError("token_exchange_failed", "Missing authorization code");
+			const token = tokenFromResponse(await postToken({
+				code,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				scope: config.scope ?? "application",
+				grant_type: "authorization_code"
+			}, "token_exchange_failed"));
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Token response had no access_token");
+			return token;
+		},
+		async refreshToken(tokenOrRefreshToken) {
+			const previous = typeof tokenOrRefreshToken === "string" ? {
+				accessToken: "",
+				refreshToken: tokenOrRefreshToken,
+				tokenType: "OAuth"
+			} : tokenOrRefreshToken;
+			if (!previous.refreshToken) throw new ShopwaveAuthError("token_refresh_failed", "No refresh token available", { status: 400 });
+			const token = tokenFromResponse(await postToken({
+				refresh_token: previous.refreshToken,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				grant_type: "refresh_token"
+			}, "token_refresh_failed"), previous);
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Refresh response had no access_token");
+			return token;
+		}
+	};
+}
+
+//#endregion
+//#region src/server/returnTo.ts
+/**
+* Helpers for the round trip through the auth server.
+*/
+/**
+* Only allows same-origin relative paths ("/products?tab=1"). Anything that
+* could send the user to another site after login — absolute URLs,
+* protocol-relative "//evil.com", backslash tricks, control characters —
+* falls back to `fallback`.
+*/
+function sanitizeReturnTo(value, fallback = "/") {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048) return fallback;
+	if (!/^\/(?![/\\])/.test(value)) return fallback;
+	if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+	if (value.includes("\\")) return fallback;
+	return value;
+}
+/** Random, URL-safe value for the OAuth `state` parameter (128 bits, hex). */
+function createState() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Constant-time string comparison for state values. */
+function safeEqual(a, b) {
+	if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+
+//#endregion
+//#region src/core/entities.ts
+/**
+* Addressing per entity, following the Shopwave API reference
+* (https://developer.merchantstack.com/api-reference.html) and checked against
+* the live API where noted:
+* - category/product/store: GET filtered by `<x>Ids`, POST upsert, DELETE with `<x>Id` → 205.
+* - promotion: no DELETE; "deleting" a promotion ends it by setting `endDate` to now.
+* - employee: POST updates `roleId`, `joinedDate`, `exitDate` (names can't be
+*   changed); no DELETE (live API: "Cannot DELETE /employee") → retired via `exitDate`.
+* - consumer: read-only (`GET` with `ids`, comma-separated); live POST → 404.
+*/
+const SHOPWAVE_ENTITIES = Object.freeze({
+	product: {
+		route: "products",
+		collection: "products",
+		upstream: "product",
+		idsHeader: "productIds",
+		idHeader: "productId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	category: {
+		route: "categories",
+		collection: "categories",
+		upstream: "category",
+		idsHeader: "categoryIds",
+		idHeader: "categoryId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	store: {
+		route: "stores",
+		collection: "stores",
+		upstream: "store",
+		idsHeader: "storeIds",
+		idHeader: "storeId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	promotion: {
+		route: "promotions",
+		collection: "promotions",
+		upstream: "promotion",
+		idsHeader: "promotionIds",
+		idHeader: "promotionId",
+		writable: true,
+		deleteMode: "retire",
+		retireField: "endDate"
+	},
+	employee: {
+		route: "employees",
+		collection: "employees",
+		upstream: "employee",
+		idsHeader: "employeeIds",
+		idHeader: "employeeId",
+		writable: true,
+		deleteMode: "retire",
+		retireField: "exitDate"
+	},
+	consumer: {
+		route: "consumer",
+		collection: "consumers",
+		upstream: "consumer",
+		idsHeader: "ids",
+		idHeader: "consumerId",
+		writable: false,
+		deleteMode: "none"
+	}
+});
+
+//#endregion
+//#region src/server/api.ts
+/**
+* The OAuth token a caller sent with the request, without its scheme, or `null`.
+*
+* Reads, in order: `Authorization: OAuth|Bearer <token>` (what the SDK sends
+* from 0.3), the `token` header (SDK ≤ 0.2 writes), and `extras.token`
+* (SDK ≤ 0.2 reads).
+*/
+function readRequestToken(request) {
+	const authz = request.headers.get("authorization");
+	if (authz) {
+		const match = /^(?:oauth|bearer)\s+(\S+)\s*$/i.exec(authz);
+		if (match) return match[1];
+	}
+	const legacyHeader = request.headers.get("token");
+	if (legacyHeader && legacyHeader.trim()) return legacyHeader.trim();
+	const extras = request.headers.get("extras");
+	if (extras) try {
+		const token = JSON.parse(extras)?.token;
+		if (typeof token === "string" && token.trim()) return token.trim();
+	} catch {}
+	return null;
+}
+/**
+* `extras` keys that are never forwarded upstream (case-insensitive).
+* `Content-Type` is allowed (SDK clients have always sent `application/json`
+* on reads) but is replaced by the form content type on writes.
+*/
+const BLOCKED_EXTRAS = new Set([
+	"authorization",
+	"token",
+	"cookie",
+	"host",
+	"x-accept-version",
+	"content-length",
+	"connection",
+	"transfer-encoding",
+	"te",
+	"upgrade",
+	"expect",
+	"keep-alive",
+	"proxy-authorization",
+	"forwarded"
+]);
+const HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+function headerValue(value) {
+	if (value == null) return null;
+	let text;
+	if (Array.isArray(value)) text = value.map((v) => v != null && typeof v === "object" ? JSON.stringify(v) : String(v)).join(",");
+	else if (typeof value === "object") text = JSON.stringify(value);
+	else text = String(value);
+	return /[\r\n\0]/.test(text) ? null : text;
+}
+/**
+* Parses the `extras` request header into upstream headers.
+* Returns `null` when the header isn't a JSON object.
+*/
+function parseExtras(raw, blocked = BLOCKED_EXTRAS) {
+	if (!raw) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const headers = {};
+	for (const [key, value] of Object.entries(parsed)) {
+		const lower = key.toLowerCase();
+		if (!HEADER_NAME.test(key) || blocked.has(lower) || lower.startsWith("x-forwarded-") || lower.startsWith("proxy-")) continue;
+		const text = headerValue(value);
+		if (text !== null) headers[key] = text;
+	}
+	return headers;
+}
+var RequestBodyError = class extends Error {};
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Normalises a write request body into the Shopwave envelope
+* `{ <collection>: { <ref>: entity, … } }`.
+*
+* Accepts:
+*  - the SDK ≥ 0.3 shape `{ <collection>: { "0": {...}, "1": {...} } }` (refs kept),
+*  - the older AdminUI shapes `{ <collection>: { new: {...} } }` / `{ updated: {...} }`,
+*  - a bare entity object `{ title: … }`.
+*
+* With `forcedId` (item routes) exactly one entity is allowed and its `id` is
+* set from the URL.
+*/
+function normalizeWriteBody(def, body, forcedId) {
+	if (!isPlainObject(body)) throw new RequestBodyError("Request body must be a JSON object");
+	let refs;
+	const wrapped = body[def.collection];
+	if (wrapped !== void 0) {
+		if (!isPlainObject(wrapped)) throw new RequestBodyError(`"${def.collection}" must be an object keyed by ref`);
+		const keys = Object.keys(wrapped);
+		const entries = keys.length === 1 && (keys[0] === "new" || keys[0] === "updated") ? [["0", wrapped[keys[0]]]] : Object.entries(wrapped);
+		refs = {};
+		for (const [ref, entity] of entries) {
+			if (!isPlainObject(entity)) throw new RequestBodyError(`"${def.collection}.${ref}" must be an object`);
+			refs[ref] = { ...entity };
+		}
+	} else refs = { "0": { ...body } };
+	const count = Object.keys(refs).length;
+	if (count === 0) throw new RequestBodyError(`No ${def.collection} to save`);
+	if (forcedId !== void 0) {
+		if (count !== 1) throw new RequestBodyError("Only one entity can be saved at an id route");
+		const only = refs[Object.keys(refs)[0]];
+		only.id = /^\d+$/.test(forcedId) ? Number(forcedId) : forcedId;
+	}
+	return { [def.collection]: refs };
+}
+const NO_STORE = { "Cache-Control": "no-store" };
+function jsonError(status, error, message) {
+	return new Response(JSON.stringify({
+		error,
+		message
+	}), {
+		status,
+		headers: {
+			"Content-Type": "application/json",
+			...NO_STORE
+		}
+	});
+}
+/** `YYYY-MM-DD HH:mm:ss` in UTC, the datetime format Shopwave writes use (e.g. promotions). */
+function shopwaveDateTime(date = /* @__PURE__ */ new Date()) {
+	return date.toISOString().slice(0, 19).replace("T", " ");
+}
+const NULL_BODY_STATUS = new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+async function readUpstream(response) {
+	const text = await response.text();
+	if (!text) return {
+		text,
+		json: null
+	};
+	try {
+		return {
+			text,
+			json: JSON.parse(text)
+		};
+	} catch {
+		return {
+			text,
+			json: null
+		};
+	}
+}
+async function routeParam(context, name) {
+	const value = (await context?.params)?.[name];
+	const id = Array.isArray(value) ? value[0] : value;
+	return typeof id === "string" && ID_PATTERN.test(id) ? id : null;
+}
+function createShopwaveApiHandlers(config) {
+	const allowRequestToken = config.allowRequestToken ?? true;
+	const apiVersion = config.apiVersion ?? "2.0";
+	const blocked = new Set([...BLOCKED_EXTRAS, ...(config.blockedExtras ?? []).map((k) => k.toLowerCase())]);
+	const onError = config.onError ?? ((error, ctx) => console.error(`[react-shopwave-connect] Shopwave API ${ctx.method} /${ctx.path} failed:`, error?.message ?? error));
+	function apiBase() {
+		const url = config.apiUrl;
+		if (!url) throw new Error("Shopwave API: apiUrl is not set (e.g. SHOPWAVE_API_SERVER_URL).");
+		return url.replace(/\/+$/, "");
+	}
+	function entity(kind) {
+		const base = SHOPWAVE_ENTITIES[kind];
+		if (!base) throw new Error(`Unknown Shopwave entity "${kind}"`);
+		return {
+			...base,
+			...config.entities?.[kind] ?? {}
+		};
+	}
+	async function forward(request, init) {
+		const method = (init.method ?? "GET").toUpperCase();
+		const path = init.path.replace(/^\/+/, "");
+		const extras = init.forwardExtras === false ? {} : parseExtras(request.headers.get("extras"), blocked);
+		if (!extras) return jsonError(400, "invalid_extras", "The extras header must be a JSON object");
+		const requestToken = allowRequestToken ? readRequestToken(request) : null;
+		let authorization;
+		try {
+			authorization = requestToken ? `OAuth ${requestToken}` : await config.getAuthorization?.() ?? null;
+		} catch (error) {
+			onError(error, {
+				method,
+				path: "oauth/token"
+			});
+			return jsonError(502, "auth_unavailable", "Could not refresh the Shopwave session");
+		}
+		if (!authorization) return jsonError(401, "unauthorized", "Not logged in");
+		const body = init.postBody === void 0 ? void 0 : new URLSearchParams({ postBody: JSON.stringify(init.postBody) });
+		const call = (authz) => {
+			const headers = new Headers(extras);
+			for (const [k, v] of Object.entries(init.headers ?? {})) headers.set(k, v);
+			headers.set("Authorization", authz);
+			headers.set("x-accept-version", apiVersion);
+			if (body) headers.set("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8");
+			return (config.fetch ?? fetch)(`${apiBase()}/${path}`, {
+				method,
+				headers,
+				body,
+				cache: "no-store"
+			});
+		};
+		try {
+			let response = await call(authorization);
+			let upstream = await readUpstream(response);
+			if (!requestToken && config.getAuthorization && isExpiredTokenResponse(response.status, upstream.json)) {
+				const fresh = await config.getAuthorization({ forceRefresh: true });
+				if (!fresh) return jsonError(401, "unauthorized", "The Shopwave session has expired");
+				response = await call(fresh);
+				upstream = await readUpstream(response);
+			}
+			if (NULL_BODY_STATUS.has(response.status) || !upstream.text) return new Response(null, {
+				status: response.status,
+				headers: NO_STORE
+			});
+			return new Response(upstream.text, {
+				status: response.status,
+				headers: {
+					"Content-Type": upstream.json !== null ? "application/json" : response.headers.get("content-type") ?? "text/plain",
+					...NO_STORE
+				}
+			});
+		} catch (error) {
+			onError(error, {
+				method,
+				path
+			});
+			return jsonError(502, "upstream_unavailable", "The Shopwave API could not be reached");
+		}
+	}
+	async function readJsonBody(request) {
+		const text = await request.text();
+		if (!text) throw new RequestBodyError("Request body is empty");
+		try {
+			return JSON.parse(text);
+		} catch {
+			throw new RequestBodyError("Request body is not valid JSON");
+		}
+	}
+	function notSupported(def, what) {
+		return jsonError(405, "method_not_allowed", `The Shopwave API doesn't support ${what} for ${def.collection}`);
+	}
+	async function write(request, def, forcedId) {
+		if (!def.writable) return notSupported(def, "writes");
+		let postBody;
+		try {
+			postBody = normalizeWriteBody(def, await readJsonBody(request), forcedId);
+		} catch (error) {
+			if (error instanceof RequestBodyError) return jsonError(400, "invalid_body", error.message);
+			throw error;
+		}
+		return forward(request, {
+			method: "POST",
+			path: def.upstream,
+			postBody
+		});
+	}
+	function badId() {
+		return jsonError(400, "invalid_id", "Missing or invalid id");
+	}
+	return {
+		forward,
+		entity,
+		collection(kind) {
+			const def = entity(kind);
+			const save = (request) => write(request, def);
+			return {
+				GET: (request) => forward(request, { path: def.upstream }),
+				POST: save,
+				PUT: save
+			};
+		},
+		item(kind, options = {}) {
+			const def = entity(kind);
+			const param = options.param ?? "id";
+			return {
+				async GET(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					return forward(request, {
+						path: def.upstream,
+						headers: { [def.idsHeader]: id }
+					});
+				},
+				async PUT(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					return write(request, def, id);
+				},
+				async DELETE(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					if (def.deleteMode === "none") return notSupported(def, "deletes");
+					if (def.deleteMode === "retire") {
+						const field = def.retireField ?? "exitDate";
+						return forward(request, {
+							method: "POST",
+							path: def.upstream,
+							postBody: { [def.collection]: { 0: {
+								id: /^\d+$/.test(id) ? Number(id) : id,
+								[field]: shopwaveDateTime()
+							} } },
+							forwardExtras: false
+						});
+					}
+					return forward(request, {
+						method: "DELETE",
+						path: def.upstream,
+						headers: { [def.idHeader]: id },
+						forwardExtras: false
+					});
+				}
+			};
+		},
+		passthrough(path) {
+			return { GET: (request) => forward(request, { path }) };
+		}
+	};
+}
+
+//#endregion
+//#region src/next/index.ts
+function normalizePath(p) {
+	const withSlash = p.startsWith("/") ? p : `/${p}`;
+	return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+function pathMatches(pathname, list) {
+	return list.some((raw) => {
+		const p = normalizePath(raw);
+		if (p === "/") return pathname === "/";
+		return pathname === p || pathname.startsWith(`${p}/`);
+	});
+}
+function escapeHtml(s) {
+	return s.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c]);
+}
+function readCookie(request, name) {
+	const fromNext = request.cookies?.get?.(name)?.value;
+	if (fromNext) return fromNext;
+	const header = request.headers.get("cookie");
+	if (!header) return void 0;
+	for (const part of header.split(";")) {
+		const idx = part.indexOf("=");
+		if (idx === -1) continue;
+		if (part.slice(0, idx).trim() === name) {
+			const value = part.slice(idx + 1).trim();
+			try {
+				return decodeURIComponent(value);
+			} catch {
+				return value;
+			}
+		}
+	}
+}
+let warnedAboutReadOnlyCookies = false;
+/**
+* Creates the Shopwave auth instance for one Next.js app. Call once at module
+* scope (e.g. `lib/auth.ts`) and reuse. Config is validated on first use, so
+* a missing env var doesn't fail `next build`.
+*/
+function createShopwaveAuth(config) {
+	if (typeof window !== "undefined") throw new Error("react-shopwave-connect/next is server-only. Import it from route handlers, server code or proxy.ts.");
+	const oauth = createShopwaveOAuth(config);
+	const authPath = normalizePath(config.authPath ?? "/auth");
+	const logoutPath = normalizePath(config.logoutPath ?? `${authPath}/logout`);
+	const sessionPath = normalizePath(config.sessionPath ?? "/api/session");
+	const defaultReturnTo = sanitizeReturnTo(config.defaultReturnTo, "/");
+	const requireState = config.requireState ?? true;
+	const skewSeconds = config.refreshSkewSeconds ?? 0;
+	const loginTimeoutMs = (config.loginTimeoutSeconds ?? 600) * 1e3;
+	const cookieName = config.session?.cookieName ?? "shopwave_session";
+	/**
+	* Refresh de-duplication, per server instance. Requests that read the same
+	* (old) token share one refresh while it's in flight, and for a short while
+	* afterwards reuse its result instead of refreshing again.
+	*/
+	const inflightRefresh = /* @__PURE__ */ new Map();
+	const recentRefresh = /* @__PURE__ */ new Map();
+	const RECENT_REFRESH_MS = 3e4;
+	function sessionOptions() {
+		const password = config.session?.password;
+		const passwords = typeof password === "string" ? [password] : Object.values(password ?? {});
+		if (passwords.length === 0 || passwords.some((p) => typeof p !== "string" || p.length < 32)) throw new ShopwaveAuthError("config_invalid", "Shopwave auth: session.password must be at least 32 characters (set a long random secret in your env).");
+		const cookieOptions = {
+			httpOnly: true,
+			secure: config.session.secure ?? process.env.NODE_ENV === "production",
+			sameSite: config.session.sameSite ?? "lax",
+			path: "/"
+		};
+		if (config.session.domain) cookieOptions.domain = config.session.domain;
+		const options = {
+			cookieName,
+			password,
+			cookieOptions
+		};
+		if (typeof config.session.ttl === "number") options.ttl = config.session.ttl;
+		return options;
+	}
+	async function getSession() {
+		return getIronSession(await cookies(), sessionOptions());
+	}
+	/**
+	* Cookies can only be written from route handlers, server actions and proxy.
+	* From a Server Component the token is still usable for this request; it will
+	* simply be refreshed again next time.
+	*/
+	async function trySave(session) {
+		try {
+			await session.save();
+		} catch (error) {
+			if (!warnedAboutReadOnlyCookies) {
+				warnedAboutReadOnlyCookies = true;
+				console.warn("[react-shopwave-connect] Could not update the session cookie (called outside a route handler / server action?).", error?.message);
+			}
+		}
+	}
+	function tryDestroy(session) {
+		try {
+			session.destroy();
+		} catch {}
+	}
+	function refreshOnce(token) {
+		const key = `${token.refreshToken}\u0000${token.accessToken}`;
+		const now = Date.now();
+		const recent = recentRefresh.get(key);
+		if (recent && now - recent.at < RECENT_REFRESH_MS) return Promise.resolve(recent.token);
+		let pending = inflightRefresh.get(key);
+		if (!pending) {
+			pending = oauth.refreshToken(token).then((fresh) => {
+				for (const [k, v] of recentRefresh) if (now - v.at >= RECENT_REFRESH_MS) recentRefresh.delete(k);
+				recentRefresh.set(key, {
+					token: fresh,
+					at: Date.now()
+				});
+				return fresh;
+			}).finally(() => inflightRefresh.delete(key));
+			inflightRefresh.set(key, pending);
+		}
+		return pending;
+	}
+	async function getToken({ forceRefresh = false } = {}) {
+		const session = await getSession();
+		const token = normalizeStoredToken(session.token);
+		if (!token) return null;
+		const expired = isTokenExpired(token, { skewSeconds });
+		if (!forceRefresh && !expired) return token;
+		if (!token.refreshToken) {
+			if (expired || forceRefresh) {
+				tryDestroy(session);
+				return null;
+			}
+			return token;
+		}
+		try {
+			const refreshed = await refreshOnce(token);
+			session.token = refreshed;
+			await trySave(session);
+			return refreshed;
+		} catch (error) {
+			if (error instanceof ShopwaveAuthError && error.isInvalidGrant) {
+				tryDestroy(session);
+				return null;
+			}
+			throw error;
+		}
+	}
+	function loginPath(returnTo) {
+		if (!returnTo) return authPath;
+		const safe = sanitizeReturnTo(returnTo, defaultReturnTo);
+		return `${authPath}?returnTo=${encodeURIComponent(safe)}`;
+	}
+	function redirectTo(location, request) {
+		return NextResponse.redirect(new URL(location, request.url), 302);
+	}
+	function errorPage(status, message, retryHref) {
+		return new NextResponse(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in problem</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.25rem">Sign-in didn’t complete</h1><p>${escapeHtml(message)}</p><p><a href="${escapeHtml(retryHref)}">Try again</a></p></body></html>`, {
+			status,
+			headers: {
+				"Content-Type": "text/html; charset=utf-8",
+				"Cache-Control": "no-store"
+			}
+		});
+	}
+	async function authHandler(request) {
+		const url = new URL(request.url);
+		const session = await getSession();
+		const pending = session.pendingLogin;
+		const oauthError = url.searchParams.get("error");
+		if (oauthError) {
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(400, `Shopwave sign-in reported: ${url.searchParams.get("error_description") || oauthError}.`, loginPath(pending?.returnTo));
+		}
+		const code = url.searchParams.get("code");
+		if (!code) {
+			const returnTo$1 = sanitizeReturnTo(url.searchParams.get("returnTo"), defaultReturnTo);
+			const state = createState();
+			session.pendingLogin = {
+				state,
+				returnTo: returnTo$1,
+				createdAt: Date.now()
+			};
+			await session.save();
+			return NextResponse.redirect(oauth.buildLoginUrl({ state }), 302);
+		}
+		const returnedState = url.searchParams.get("state");
+		const isFresh = !!pending && Date.now() - pending.createdAt <= loginTimeoutMs;
+		const stateMatches = !!pending && !!returnedState && safeEqual(returnedState, pending.state);
+		if (requireState ? !(stateMatches && isFresh) : !!pending && !!returnedState && !stateMatches) {
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(400, "This sign-in link has expired or didn’t start from this browser. Please sign in again.", loginPath(pending?.returnTo));
+		}
+		let token;
+		try {
+			token = await oauth.exchangeCode(code);
+		} catch (error) {
+			console.error("[react-shopwave-connect] Code exchange failed:", error?.message);
+			delete session.pendingLogin;
+			await trySave(session);
+			return errorPage(error instanceof ShopwaveAuthError && error.isInvalidGrant ? 400 : 502, "We couldn’t complete sign-in with Shopwave.", loginPath(pending?.returnTo));
+		}
+		const returnTo = pending?.returnTo ?? defaultReturnTo;
+		delete session.pendingLogin;
+		session.token = token;
+		await session.save();
+		return redirectTo(returnTo, request);
+	}
+	async function logoutHandler(_request) {
+		(await getSession()).destroy();
+		return NextResponse.redirect(oauth.buildLogoutUrl(), 302);
+	}
+	async function getStatus() {
+		const token = normalizeStoredToken((await getSession()).token);
+		if (!token) return { loggedIn: false };
+		return !isTokenExpired(token) || !!token.refreshToken ? {
+			loggedIn: true,
+			expiresAt: token.expiresAt
+		} : { loggedIn: false };
+	}
+	async function isAuthenticated(request) {
+		const value = readCookie(request, cookieName);
+		if (!value) return false;
+		try {
+			const { password, ttl } = sessionOptions();
+			const token = normalizeStoredToken((await unsealData(value, {
+				password,
+				ttl
+			}))?.token);
+			return !!token && (!isTokenExpired(token) || !!token.refreshToken);
+		} catch {
+			return false;
+		}
+	}
+	const noStore = { "Cache-Control": "no-store" };
+	return {
+		oauth,
+		logoutPath,
+		loginPath,
+		getSession,
+		getStatus,
+		getToken,
+		async getAccessToken(options) {
+			return (await getToken(options))?.accessToken ?? null;
+		},
+		async getAuthorizationHeader(options) {
+			const token = await getToken(options);
+			return token ? authorizationHeader(token) : null;
+		},
+		withAuth(handler) {
+			return async (request, context) => {
+				const token = await getToken();
+				if (!token) return NextResponse.json({ error: "unauthorized" }, {
+					status: 401,
+					headers: noStore
+				});
+				return handler(request, context, {
+					accessToken: token.accessToken,
+					authorization: authorizationHeader(token),
+					token
+				});
+			};
+		},
+		isAuthenticated,
+		async protect(request, options = {}) {
+			const { pathname, search } = new URL(request.url);
+			if (pathMatches(pathname, [
+				authPath,
+				logoutPath,
+				sessionPath,
+				...options.publicPaths ?? []
+			])) return;
+			const isApi = pathMatches(pathname, options.apiPaths ?? ["/api"]);
+			if (isApi && options.allowRequestToken && readRequestToken(request)) return void 0;
+			if (await isAuthenticated(request)) return void 0;
+			if (isApi) return NextResponse.json({ error: "unauthorized" }, {
+				status: 401,
+				headers: noStore
+			});
+			return redirectTo(loginPath(pathname + search), request);
+		},
+		handlers: {
+			auth: authHandler,
+			logout: logoutHandler,
+			session: {
+				async GET() {
+					return NextResponse.json(await getStatus(), { headers: noStore });
+				},
+				async DELETE() {
+					(await getSession()).destroy();
+					return new NextResponse(null, {
+						status: 204,
+						headers: noStore
+					});
+				}
+			}
+		}
+	};
+}
+/**
+* Ready-made Next.js route handlers for the SDK's `/api/*` contract, using the
+* session from `createShopwaveAuth`. Create once (e.g. `lib/shopwave.ts`):
+*
+* ```ts
+* export const shopwave = createShopwaveApi({ auth, apiUrl: process.env.SHOPWAVE_API_SERVER_URL! });
+* ```
+*
+* then each route file is one line:
+*
+* ```ts
+* // app/api/products/route.ts
+* export const { GET, POST, PUT } = shopwave.collection("product");
+* // app/api/products/[id]/route.ts
+* export const { GET, PUT, DELETE } = shopwave.item("product");
+* // app/api/report/route.ts
+* export const { GET } = shopwave.passthrough("report");
+* ```
+*/
+function createShopwaveApi(config) {
+	if (typeof window !== "undefined") throw new Error("react-shopwave-connect/next is server-only. Import it from route handlers or server code.");
+	const { auth,...rest } = config;
+	return createShopwaveApiHandlers({
+		...rest,
+		getAuthorization: (options) => auth.getAuthorizationHeader(options)
+	});
+}
+
+//#endregion
+export { SHOPWAVE_ENTITIES, ShopwaveAuthError, authorizationHeader, createShopwaveApi, createShopwaveAuth, isExpiredTokenResponse, readRequestToken };
+//# sourceMappingURL=index.js.map