{"version":3,"file":"respond-to-invalid-session-token.mjs","sources":["../../../../src/helpers/respond-to-invalid-session-token.ts"],"sourcesContent":["import {Request, Response} from 'express';\nimport {Shopify} from '@shopify/shopify-api';\n\nimport {RETRY_INVALID_SESSION_HEADER} from '../const';\n\nimport {getSessionTokenHeader} from './get-session-token';\nimport {renderAppBridge} from './render-app-bridge';\n\ninterface RespondToInvalidSessionTokenParams {\n  api: Shopify;\n  req: Request;\n  res: Response;\n  message: string;\n  retryRequest?: boolean;\n}\n\n/**\n * Responds to a request whose session token is missing, stale, or unverifiable.\n *\n * - Document requests (no Authorization header, e.g. an embedded page load)\n *   get the App Bridge bounce so the browser fetches a fresh token and reloads.\n * - Fetch requests (Authorization header present) get a 401. The\n *   `X-Shopify-Retry-Invalid-Session-Request` header is added only when a retry\n *   would help (`retryRequest`), so App Bridge refetches with a new token;\n *   it is omitted when re-auth is required (e.g. a revoked access token).\n */\nexport function respondToInvalidSessionToken({\n  api,\n  req,\n  res,\n  message,\n  retryRequest = false,\n}: RespondToInvalidSessionTokenParams): void {\n  const isDocumentRequest = !getSessionTokenHeader(req);\n\n  if (isDocumentRequest) {\n    renderAppBridge(api, req, res);\n    return;\n  }\n\n  if (retryRequest) {\n    res.set(RETRY_INVALID_SESSION_HEADER, '1');\n  }\n  res.status(401).send(message);\n}\n"],"names":[],"mappings":";;;;AAgBA;;;;;;;;;AASG;AACG,SAAU,4BAA4B,CAAC,EAC3C,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,EACP,YAAY,GAAG,KAAK,GACe,EAAA;AACnC,IAAA,MAAM,iBAAiB,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC;IAErD,IAAI,iBAAiB,EAAE;AACrB,QAAA,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;QAC9B;IACF;IAEA,IAAI,YAAY,EAAE;AAChB,QAAA,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC;IAC5C;IACA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAC/B;;;;"}