// TanStack Start

import "@tanstack/react-start/server-only";
import { createServerAuth } from "@monarcode/session-kit/server";
import { z } from "zod";

const API = "https://api.example.com";

const userSchema = z.object({ id: z.number(), firstName: z.string() });
const tokens = z.object({ accessToken: z.string(), refreshToken: z.string() });

export const serverAuth = createServerAuth({
  name: "app",
  user: userSchema,
  secret: process.env.SESSION_SECRET!,
  refresh: async ({ refreshToken, signal }) => {
    const response = await fetch(`${API}/auth/refresh`, {
      method: "POST",
      signal,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ refreshToken }),
    });
    // The backend rejected the refresh token: sign out.
    if (response.status === 401) return null;
    if (!response.ok) throw new Error(`Refresh failed (${response.status})`);
    return tokens.parse(await response.json());
  },
});

/** Signs in with your backend, from the server. */
export async function login(username: string, password: string) {
  const response = await fetch(`${API}/auth/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ username, password }),
  });
  const body: unknown = await response.json().catch(() => null);
  if (!response.ok) {
    // The backend says why, such as wrong credentials, in `message`.
    const failure = z.object({ message: z.string() }).safeParse(body);
    throw new Error(
      failure.success
        ? failure.data.message
        : `Sign-in failed (${response.status})`,
    );
  }
  return { ...tokens.parse(body), user: userSchema.parse(body) };
}

import { startJar } from "@monarcode/session-kit/tanstack-start/server";
import { createServerFn } from "@tanstack/react-start";
import { z } from "zod";

import { login, serverAuth } from "./server";

export const getSessionFn = createServerFn().handler(() =>
  serverAuth.getSession(startJar()),
);

export const signInFn = createServerFn({ method: "POST" })
  .validator(z.object({ username: z.string(), password: z.string() }))
  .handler(async ({ data }) =>
    serverAuth.signIn(startJar(), await login(data.username, data.password)),
  );

export const signOutFn = createServerFn({ method: "POST" }).handler(() =>
  serverAuth.signOut(startJar()),
);

import { startJar } from "@monarcode/session-kit/tanstack-start/server";
import {
  createCsrfMiddleware,
  createMiddleware,
  createStart,
} from "@tanstack/react-start";

import { serverAuth } from "./auth/server";

const sessionMiddleware = createMiddleware({ type: "request" }).server(
  async ({ next }) => {
    // A failed refresh shows up when a route reads the session.
    await serverAuth.refreshIfDue(startJar()).catch(() => {});
    return next();
  },
);

export const startInstance = createStart(() => ({
  requestMiddleware: [
    createCsrfMiddleware({
      filter: ({ handlerType }) => handlerType === "serverFn",
    }),
    sessionMiddleware,
  ],
}));

import { createMirrorAuth } from "@monarcode/session-kit";

import { getSessionFn, signInFn, signOutFn } from "./functions";

export function createAppAuth() {
  return createMirrorAuth({
    name: "app",
    session: null, // filled by loadSession, then by hydration
    revalidate: () => getSessionFn(),
    signIn: (data: { username: string; password: string }) =>
      signInFn({ data }),
    signOut: () => signOutFn(),
  });
}

export type AppAuth = ReturnType<typeof createAppAuth>;

import { connectAuth } from "@monarcode/session-kit/tanstack-router";
import { sessionHydration } from "@monarcode/session-kit/tanstack-start";
import { createRouter } from "@tanstack/react-router";

import { createAppAuth } from "./auth/client";
import { routeTree } from "./routeTree.gen";

export function getRouter() {
  const auth = createAppAuth();
  const router = createRouter({
    routeTree,
    context: { auth },
    ...sessionHydration(auth),
  });
  connectAuth(router);
  return router;
}

declare module "@tanstack/react-router" {
  interface Register {
    router: ReturnType<typeof getRouter>;
  }
}

import { loadSession } from "@monarcode/session-kit/tanstack-start";
import { createRootRouteWithContext, Outlet } from "@tanstack/react-router";

import type { AppAuth } from "../auth/client";

export const Route = createRootRouteWithContext<{ auth: AppAuth }>()({
  beforeLoad: ({ context }) => loadSession(context.auth),
  component: Outlet,
});

import {
  requireSession,
  SessionOutlet,
} from "@monarcode/session-kit/tanstack-router";
import { createFileRoute } from "@tanstack/react-router";

export const Route = createFileRoute("/_authenticated")({
  beforeLoad: ({ context, location }) =>
    requireSession(context.auth, { location, loginPath: "/login" }),
  component: () => <SessionOutlet pending={<p>Loading…</p>} />,
});

import type { AppAuth } from "./auth/client";

export async function signIn(
  auth: AppAuth,
  username: string,
  password: string,
) {
  try {
    await auth.signIn({ username, password });
  } catch (error) {
    // An AuthError; its cause is what signInFn threw.
    console.warn(error);
  }
}

import { startJar } from "@monarcode/session-kit/tanstack-start/server";
import { createServerFn } from "@tanstack/react-start";
import { z } from "zod";

import { serverAuth } from "./auth/server";

export const getOrdersFn = createServerFn().handler(async () => {
  const credentials = await serverAuth.credentials.get(startJar());
  if (!credentials) throw new Error("Sign in first");
  const response = await fetch("https://api.example.com/orders", {
    headers: { Authorization: `Bearer ${credentials.accessToken}` },
  });
  if (!response.ok) throw new Error(`Orders failed (${response.status})`);
  return z.array(z.object({ id: z.number() })).parse(await response.json());
});