Blame · server-fetch.ts

bc1b2ba	1	// SSR-side fetch helpers that forward the user's auth token to the API.
bc1b2ba	2	//
bc1b2ba	3	// Auth lives in `grove_hub_token` (issued by hub-api, JWT verified by both
bc1b2ba	4	// hub-api and the grove api with the shared JWT_SECRET). On the client it
bc1b2ba	5	// also lives in localStorage but Next.js server components can only see
bc1b2ba	6	// the cookie. Without forwarding it, every SSR fetch is anonymous, which
bc1b2ba	7	// makes private repos look like 404s to their actual owners.
bc1b2ba	8
bc1b2ba	9	import { cookies } from "next/headers";
bc1b2ba	10	import { groveApiUrl } from "./utils";
bc1b2ba	11
bc1b2ba	12	const TOKEN_COOKIE = "grove_hub_token";
bc1b2ba	13
bc1b2ba	14	/** Read the user's bearer token from cookies. Returns null if missing. */
bc1b2ba	15	export async function readAuthToken(): Promise<string \| null> {
bc1b2ba	16	const store = await cookies();
bc1b2ba	17	return store.get(TOKEN_COOKIE)?.value ?? null;
bc1b2ba	18	}
bc1b2ba	19
bc1b2ba	20	/** Build auth headers for a server-side fetch. Empty if no token. */
bc1b2ba	21	export async function authHeaders(): Promise<Record<string, string>> {
bc1b2ba	22	const token = await readAuthToken();
bc1b2ba	23	return token ? { authorization: `Bearer ${token}` } : {};
bc1b2ba	24	}
bc1b2ba	25
bc1b2ba	26	/** Fetch a Grove API path forwarding the user's auth token. Defaults to
bc1b2ba	27	* no-store so per-user data isn't cached across requests. */
bc1b2ba	28	export async function serverFetch(
bc1b2ba	29	path: string,
bc1b2ba	30	init: RequestInit = {},
bc1b2ba	31	): Promise<Response> {
bc1b2ba	32	const headers = {
bc1b2ba	33	...(init.headers ?? {}),
bc1b2ba	34	...(await authHeaders()),
bc1b2ba	35	};
bc1b2ba	36	return fetch(`${groveApiUrl}${path}`, {
bc1b2ba	37	cache: "no-store",
bc1b2ba	38	...init,
bc1b2ba	39	headers,
bc1b2ba	40	});
bc1b2ba	41	}