Function: createWhoamiHandler()

createWhoamiHandler(options?): (request) => Promise<Response>

Create a GET handler that hydrates customer state from the httpOnly cookie.

A browser-based storefront mounts the React app after hydration with a clean auth store (XSS hardening — accessToken is never persisted to localStorage). To show the "logged in" UI without a login round-trip, the client calls GET /api/auth/whoami:

1. The endpoint reads the httpOnly cookie customerAccessToken (server-side, JS-inaccessible)
2. Forwards it as an Authorization: Bearer header to the backend GraphQL customer query
3. Returns { isAuthenticated, customer | null } to the client
4. The client calls setAuth(customer, '') — the token is NOT in the body (the cookie keeps handling per-request auth)

Security: origin validation, fetch via Bearer (the cookie never crosses the API boundary). Pass isTrustedOrigin when running behind a reverse proxy — see trustedForwardedHostValidator.

Parameters

options?

WhoamiHandlerOptions = {}

Returns

(request) => Promise<Response>

Example

// app/api/auth/whoami/route.ts
import { createWhoamiHandler } from '@doswiftly/storefront-sdk';
export const GET = createWhoamiHandler({
  apiUrl: process.env.NEXT_PUBLIC_API_URL!,
  shopSlug: process.env.NEXT_PUBLIC_SHOP_SLUG!,
});