refactor(client): centralize connection credentials

Author: dvcolomban

packages/devframe/src/client/connection.ts

@@ -120,60 +120,44 @@ export function getDevframeConnection(): DevframeConnection | undefined {
 export async function setupDevframeConnection(
   options: SetupDevframeConnectionOptions = {},
 ): Promise<DevframeConnection> {
-  const isolateConnection = options.isolateConnection === true
-  function resolveAuthToken(authToken: string | undefined): string | undefined {
-    if (isolateConnection)
-      return authToken
-    return readStoredAuthToken(authToken)
-  }
-  function finishConnectionSetup(connection: DevframeConnection): DevframeConnection {
-    if (!isolateConnection)
-      storeConnection(connection)
-    return connection
-  }
-  if (options.connection) {
-    const connection = withAuthToken(
-      options.connection,
-      resolveAuthToken(
-        options.authToken
-        ?? options.connection.authToken
-        ?? options.connection.connectionMeta.authToken,
-      ),
-    )
-    return finishConnectionSetup(connection)
-  }
+  const connection = await resolveDevframeConnection(options)
+  const authToken = options.authToken ?? connection.authToken ?? connection.connectionMeta.authToken
+  const resolvedConnection = withAuthToken(
+    connection,
+    options.isolateConnection ? authToken : readStoredAuthToken(authToken),
+  )
+  if (options.isolateConnection)
+    return resolvedConnection
+
+  storeConnection(resolvedConnection)
+  return resolvedConnection
+}
+
+async function resolveDevframeConnection(
+  options: SetupDevframeConnectionOptions,
+): Promise<DevframeConnection> {
+  if (options.connection)
+    return options.connection
 
   const bases = Array.isArray(options.baseURL)
     ? options.baseURL
     : [options.baseURL ?? './']
 
   if (options.connectionMeta) {
-    const connection: DevframeConnection = {
+    return {
       connectionMeta: options.connectionMeta,
       /**
        * Preserve the established connectionMeta behavior: an explicitly
        * supplied descriptor resolves from the caller's explicit base.
        */
       metaBaseUrl: resolveMetaBaseUrl(bases[0] ?? './'),
-      authToken: resolveAuthToken(
-        options.authToken ?? options.connectionMeta.authToken,
-      ),
+      authToken: options.connectionMeta.authToken,
     }
-    return finishConnectionSetup(connection)
   }
 
-  const existing = isolateConnection ? undefined : getDevframeConnection()
-  if (existing) {
-    const connection = withAuthToken(
-      existing,
-      resolveAuthToken(
-        options.authToken
-        ?? existing.authToken
-        ?? existing.connectionMeta.authToken,
-      ),
-    )
-    return finishConnectionSetup(connection)
-  }
+  const existing = options.isolateConnection ? undefined : getDevframeConnection()
+  if (existing)
+    return existing
 
   const errors: Error[] = []
   for (const base of bases) {
@@ -186,7 +170,7 @@ export async function setupDevframeConnection(
 
       const connectionMeta = await response.json() as ConnectionMeta
       const loadedFrom = response.url || metaUrl
-      const connection: DevframeConnection = {
+      return {
         connectionMeta,
         /**
          * A served `baseUrl` re-points relative resolution (RPC dump shards,
@@ -196,11 +180,8 @@ export async function setupDevframeConnection(
         metaBaseUrl: connectionMeta.baseUrl
           ? new URL(connectionMeta.baseUrl, loadedFrom).href
           : loadedFrom,
-        authToken: resolveAuthToken(
-          options.authToken ?? connectionMeta.authToken,
-        ),
+        authToken: connectionMeta.authToken,
       }
-      return finishConnectionSetup(connection)
     }
     catch (error) {
       errors.push(error as Error)

packages/devframe/src/client/rpc.ts

@@ -327,10 +327,20 @@ export function resolveClientTransport(
   throw new Error('[devframe] This server advertises no RPC transport (backend "none"), so there is nothing to connect to. Enable the WebSocket or SSE endpoint on the server, or use its static/MCP surfaces instead.')
 }
 
+function createAuthChannel(isolateConnection = false): BroadcastChannel | undefined {
+  if (isolateConnection)
+    return undefined
+
+  try {
+    /** Channel name kept for cross-tab interop with the Vite DevTools auth page. */
+    return new BroadcastChannel('devframe-auth')
+  }
+  catch {}
+}
+
 export async function getDevframeRpcClient(
   options: DevframeRpcClientOptions = {},
 ): Promise<DevframeRpcClient> {
-  const isolateConnection = options.isolateConnection === true
   // Default to a relative base: the SPA owns its mount path at runtime, so
   // connection meta and dump shards live alongside `index.html`. An embedded
   // surface inside a host page must pass an explicit `baseURL` - its
@@ -426,13 +436,13 @@ export async function getDevframeRpcClient(
           wsOptions: options.wsOptions,
         })
 
-  // Channel name kept for cross-tab interop with the Vite DevTools auth page.
-  let authChannel: BroadcastChannel | undefined
-  try {
-    if (!isolateConnection)
-      authChannel = new BroadcastChannel('devframe-auth')
+  const authChannel = createAuthChannel(options.isolateConnection)
+
+  function updateAuthToken(token: string): void {
+    connection = { ...connection, authToken: token }
+    if (!options.isolateConnection)
+      storeAuthToken(token)
   }
-  catch {}
 
   // Gate outbound calls behind the auth bootstrap below. Without it, a
   // caller's first RPC calls, fired the moment `connectDevframe()` resolves,
@@ -487,19 +497,14 @@ export async function getDevframeRpcClient(
     ensureTrusted: mode.ensureTrusted,
     requestTrust: mode.requestTrust,
     requestTrustWithToken: async (token: string) => {
-      if (!isolateConnection)
-        storeAuthToken(token)
-      connection = { ...connection, authToken: token }
+      updateAuthToken(token)
       return mode.requestTrustWithToken(token)
     },
     requestTrustWithCode: async (code: string) => {
       const token = await mode.requestTrustWithCode(code)
       if (!token)
         return false
-      /** Shared mode also persists the issued token for sibling tabs. */
-      if (!isolateConnection)
-        storeAuthToken(token)
-      connection = { ...connection, authToken: token }
+      updateAuthToken(token)
       try {
         authChannel?.postMessage({ type: 'auth-update', authToken: token })
       }