squarefi-bff-api-module 1.36.17 → 1.36.19

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { squarefi_bff_api_client } from './api';
 export * from './utils/apiClientFactory';
+export { setAccessTokenProvider, setOnTwoFactorRequired, setOnUnauthorized, type AccessTokenProvider, type ResolveTokenOptions, type TwoFactorRequiredHandler, type UnauthorizedHandler, } from './utils/accessTokenProvider';
 export * from './utils/tokensFactory';
 export * from './utils/fileStorage';
 export * from './constants';

package/dist/index.js

@@ -1,5 +1,6 @@
 export { squarefi_bff_api_client } from './api';
 export * from './utils/apiClientFactory';
+export { setAccessTokenProvider, setOnTwoFactorRequired, setOnUnauthorized, } from './utils/accessTokenProvider';
 export * from './utils/tokensFactory';
 export * from './utils/fileStorage';
 export * from './constants';

package/dist/utils/accessTokenProvider.d.ts

@@ -0,0 +1,31 @@
+export type ResolveTokenOptions = {
+    /** Force the provider to mint a fresh token, bypassing any cache (used on 401 retry). */
+    forceRefresh?: boolean;
+};
+export type AccessTokenProvider = (options?: ResolveTokenOptions) => Promise<string | null | undefined>;
+export type UnauthorizedHandler = () => void;
+export type TwoFactorRequiredHandler = () => void;
+/**
+ * Register an external source of the access token (e.g. Clerk `getToken`).
+ * When set, the API clients stop reading tokens from localStorage and delegate
+ * token acquisition (and refresh) to the provider. Pass `null` to fall back to
+ * the legacy localStorage flow.
+ */
+export declare const setAccessTokenProvider: (provider: AccessTokenProvider | null) => void;
+/**
+ * Register a callback invoked when a request is unauthorized and cannot be
+ * recovered by refreshing the token (e.g. to trigger a Clerk sign-out).
+ */
+export declare const setOnUnauthorized: (handler: UnauthorizedHandler | null) => void;
+/**
+ * Register a callback invoked when the backend rejects a request because
+ * two-factor authentication is required but not yet satisfied (HTTP 403 with a
+ * `two_factor_required` error code). The consumer typically redirects the user
+ * to the 2FA setup flow. Pass `null` to unregister.
+ */
+export declare const setOnTwoFactorRequired: (handler: TwoFactorRequiredHandler | null) => void;
+/** Whether an external token provider is active (Clerk mode). */
+export declare const isExternalAuthMode: () => boolean;
+export declare const resolveAccessToken: (options?: ResolveTokenOptions) => Promise<string | null>;
+export declare const triggerUnauthorized: () => void;
+export declare const triggerTwoFactorRequired: () => void;

package/dist/utils/accessTokenProvider.js

@@ -0,0 +1,63 @@
+import { getFromLocalStorage } from './storage';
+let accessTokenProvider = null;
+let unauthorizedHandler = null;
+let twoFactorRequiredHandler = null;
+let inFlightRefresh = null;
+/**
+ * Register an external source of the access token (e.g. Clerk `getToken`).
+ * When set, the API clients stop reading tokens from localStorage and delegate
+ * token acquisition (and refresh) to the provider. Pass `null` to fall back to
+ * the legacy localStorage flow.
+ */
+export const setAccessTokenProvider = (provider) => {
+    accessTokenProvider = provider;
+};
+/**
+ * Register a callback invoked when a request is unauthorized and cannot be
+ * recovered by refreshing the token (e.g. to trigger a Clerk sign-out).
+ */
+export const setOnUnauthorized = (handler) => {
+    unauthorizedHandler = handler;
+};
+/**
+ * Register a callback invoked when the backend rejects a request because
+ * two-factor authentication is required but not yet satisfied (HTTP 403 with a
+ * `two_factor_required` error code). The consumer typically redirects the user
+ * to the 2FA setup flow. Pass `null` to unregister.
+ */
+export const setOnTwoFactorRequired = (handler) => {
+    twoFactorRequiredHandler = handler;
+};
+/** Whether an external token provider is active (Clerk mode). */
+export const isExternalAuthMode = () => accessTokenProvider !== null;
+export const resolveAccessToken = async (options) => {
+    if (accessTokenProvider) {
+        // Coalesce concurrent force-refreshes so a burst of 401s triggers a single provider refresh.
+        if (options?.forceRefresh) {
+            if (!inFlightRefresh) {
+                const provider = accessTokenProvider;
+                inFlightRefresh = Promise.resolve()
+                    .then(() => provider(options))
+                    .then((token) => token ?? null)
+                    .catch(() => null)
+                    .finally(() => {
+                    inFlightRefresh = null;
+                });
+            }
+            return inFlightRefresh;
+        }
+        try {
+            return (await accessTokenProvider(options)) ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return getFromLocalStorage('access_token');
+};
+export const triggerUnauthorized = () => {
+    unauthorizedHandler?.();
+};
+export const triggerTwoFactorRequired = () => {
+    twoFactorRequiredHandler?.();
+};

package/dist/utils/apiClientFactory.js

@@ -3,8 +3,11 @@ import { isTMA } from '@telegram-apps/sdk-react';
 import axios from 'axios';
 import { telegramSignUpPath, telegramSignInPath, refreshTokenPath } from '../api/auth';
 import { AppEnviroment, ResponseStatus } from '../constants';
+import { isExternalAuthMode, resolveAccessToken, triggerTwoFactorRequired, triggerUnauthorized, } from './accessTokenProvider';
 import { deleteTokens, getTokens, refreshTokens } from './tokensFactory';
 // eslint-disable-next-line no-constant-condition
+// Backend signals that a still-unsatisfied 2FA requirement blocks the request with this error code.
+const TWO_FACTOR_REQUIRED_ERROR_CODE = 'two_factor_required';
 const apiV1BaseURL = process.env.API_URL ?? 'ENV variable API_URL is not defined';
 const apiV2BaseURL = process.env.API_V2_URL ?? 'ENV variable API_V2_URL is not defined';
 const apiTOTPBaseURL = process.env.API_TOTP_URL ?? 'ENV variable API_TOTP_URL is not defined';
@@ -17,8 +20,8 @@ export const createApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         baseURL,
         timeout: 60000,
     });
-    instance.interceptors.request.use((config) => {
-        const { access_token } = getTokens();
+    instance.interceptors.request.use(async (config) => {
+        const access_token = await resolveAccessToken();
         const modifiedHeaders = {
             ...config.headers,
             'x-tenant-id': tenantId,
@@ -40,11 +43,35 @@ export const createApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         if (typeof window === 'undefined') {
             return Promise.reject(error);
         }
+        if (error?.response?.status === ResponseStatus.FORBIDDEN &&
+            error?.response?.data?.code === TWO_FACTOR_REQUIRED_ERROR_CODE) {
+            triggerTwoFactorRequired();
+            return Promise.reject(error);
+        }
         if (error?.response?.status === ResponseStatus.UNAUTHORIZED &&
             !error?.response?.config.context?.bypassUnauthorizedHandler) {
             const { response, config: failedRequestConfig } = error;
-            const { refresh_token } = getTokens();
             const isRetryRequest = failedRequestConfig.context?.isRetryRequest;
+            // External auth mode (e.g. Clerk): the provider owns token refresh. Force a fresh token and
+            // retry once; sign out if there is no fresh token or the retry still fails.
+            if (isExternalAuthMode()) {
+                if (isRetryRequest) {
+                    triggerUnauthorized();
+                    return Promise.reject(error);
+                }
+                return resolveAccessToken({ forceRefresh: true }).then((freshToken) => {
+                    if (!freshToken) {
+                        triggerUnauthorized();
+                        return Promise.reject(error);
+                    }
+                    failedRequestConfig.context = {
+                        ...failedRequestConfig.context,
+                        isRetryRequest: true,
+                    };
+                    return instance(failedRequestConfig);
+                });
+            }
+            const { refresh_token } = getTokens();
             const isRefreshTokenRequest = failedRequestConfig.url?.includes(refreshTokenPath);
             const isTelegramSignInRequest = failedRequestConfig.url?.includes(telegramSignInPath);
             const isTelegramSignUpRequest = failedRequestConfig.url?.includes(telegramSignUpPath);
@@ -144,8 +171,8 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         });
         return `${fullUrl}?${searchParams.toString()}`;
     };
-    const getHeaders = (additionalHeaders) => {
-        const { access_token } = getTokens();
+    const getHeaders = async (additionalHeaders) => {
+        const access_token = await resolveAccessToken();
         const headers = {
             'Content-Type': 'application/json',
             'x-tenant-id': tenantId,
@@ -162,6 +189,9 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
             let errorMessage = `HTTP error! status: ${response.status}`;
             try {
                 const errorData = await response.json();
+                if (response.status === ResponseStatus.FORBIDDEN && errorData?.code === TWO_FACTOR_REQUIRED_ERROR_CODE) {
+                    triggerTwoFactorRequired();
+                }
                 errorMessage = errorData.message || errorData.error || errorMessage;
             }
             catch {
@@ -186,7 +216,7 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         const fullUrl = buildUrl(url, config?.params);
         const response = await fetch(fullUrl, {
             method: 'GET',
-            headers: getHeaders(config?.headers),
+            headers: await getHeaders(config?.headers),
         });
         return handleResponse(response, config?.responseType);
     };
@@ -194,7 +224,7 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         const fullUrl = buildUrl(url);
         const response = await fetch(fullUrl, {
             method: 'POST',
-            headers: getHeaders(config?.headers),
+            headers: await getHeaders(config?.headers),
             body: config?.data ? JSON.stringify(config.data) : undefined,
         });
         return handleResponse(response, config?.responseType);
@@ -203,7 +233,7 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         const fullUrl = buildUrl(url);
         const response = await fetch(fullUrl, {
             method: 'PATCH',
-            headers: getHeaders(config?.headers),
+            headers: await getHeaders(config?.headers),
             body: config?.data ? JSON.stringify(config.data) : undefined,
         });
         return handleResponse(response, config?.responseType);
@@ -212,7 +242,7 @@ export const createFetchApiClient = ({ baseURL, isBearerToken, tenantId }) => {
         const fullUrl = buildUrl(url);
         const response = await fetch(fullUrl, {
             method: 'DELETE',
-            headers: getHeaders(config?.headers),
+            headers: await getHeaders(config?.headers),
             body: config?.data ? JSON.stringify(config.data) : undefined,
         });
         return handleResponse(response, config?.responseType);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.36.17",
+  "version": "1.36.19",
   "description": "Squarefi BFF API client module",
   "type": "module",
   "main": "./dist/index.js",