Commerce Layer authentication: what you must know.

import {
  authenticate,
  makeSalesChannel,
  type Storage,
  type StorageValue,
} from "@commercelayer/js-auth"

/**
 * A valid storage must implement the `Storage` interface
 */
function memoryStorage(): Storage {
  const store: Record<string, StorageValue> = {}
  return {
    async getItem(key) {
      return store[key] ?? null
    },
    async setItem(key: string, value: StorageValue) {
      store[key] = value
    },
    async removeItem(key: string) {
      delete store[key]
    },
  }
}

const salesChannel = makeSalesChannel(
  {
    clientId: "<your_client_id>",
    scope: "<your_scope>",
    debug: true, // useful to understand what happens behind the scene
  },
  {
    storage: memoryStorage(),
  },
)

/**
 * At the beginning, you'll get a guest token
 */
const authorization1 = await salesChannel.getAuthorization()

console.log("Guest access token:", authorization1.accessToken)

/**
 * At some point, a customer logs in
 */
const customerAuth = await authenticate("password", {
  clientId: "<your_client_id>",
  scope: "<your_scope>",
  username: "<customer_email>",
  password: "<customer_password>",
})

/**
 * After customer login, set the customer token (+ optional refreshToken)
 */
await salesChannel.setCustomer({
  accessToken: customerAuth.accessToken,
  refreshToken: customerAuth.refreshToken, // optional for "remember me"
  scope: customerAuth.scope,
})

/**
 * After setting the customer, you'll get a customer token
 */
const authorization2 = await salesChannel.getAuthorization()

console.log("Customer access token:", authorization2.accessToken)

/**
 * Logout (revokes and clears storage for customer)
 */
await salesChannel.logoutCustomer()

/**
 * After logout, you'll get the previous guest token or a new one if expired
 */
const authorization3 = await salesChannel.getAuthorization()

console.log("Guest access token after logout:", authorization3.accessToken)

import {
  createCompositeStorage,
  makeIntegration,
} from "@commercelayer/js-auth"

/**
 * The `Storage` interface is fully-compatible with the `unstorage` library.
 */

import { createStorage } from "unstorage"
import memoryDriver from "unstorage/drivers/memory"
import redisDriver from "unstorage/drivers/redis"

const memoryStorage = createStorage({
  driver: memoryDriver(),
})

const redisStorage = createStorage({
  driver: redisDriver({
    url: "<your_redis_connection_string>",
  }),
})

const compositeStorage = createCompositeStorage([
  memoryStorage,
  redisStorage,
])

const integration = makeIntegration(
  {
    clientId: "<your_client_id>",
    clientSecret: "<your_client_secret>",
    debug: true,
  },
  {
    storage: compositeStorage,
  },
)

/**
 * If you already requested an access token before,
 * now you'll probably get it from memory or Redis if not expired.
 * Otherwise, a new one will be requested.
 */
const authorization1 = await integration.getAuthorization()

console.log("Integration access token #1:", authorization1.accessToken)

/**
 * Subsequent calls will return the cached token from memory storage.
 */
const authorization2 = await integration.getAuthorization()

console.log("Integration access token #2:", authorization2.accessToken)

/**
 * Revoke the current integration authorization.
 * This will remove the authorization from memory and storage, and revoke the access token.
 */
await integration.revokeAuthorization()