@ada-support/embed2 1.14.15 → 1.14.16

package/dist/npm-entry/common/helpers/messaging-auth-state.d.ts

@@ -1,5 +1,6 @@
 import type { AdaCluster } from "common/types";
 export interface MessagingAuthState {
+    ownerChatterToken?: string;
     messagingToken: string;
     messagingTokenExpiresAt: number;
     sessionRefreshToken: string;
@@ -13,10 +14,12 @@ export declare function buildMessagingAuthStateStorageKey({ handle, cluster, dom
     domain?: string;
 }): typeof MESSAGING_AUTH_STATE_STORAGE_KEY | null;
 export declare function parseMessagingAuthState(value: unknown): MessagingAuthState | null;
-export declare function readMessagingAuthStateFromStorage({ handle, cluster, domain, }: {
+export declare function bindMessagingAuthStateToChatter(state: MessagingAuthState, chatterToken: string): MessagingAuthState | null;
+export declare function readMessagingAuthStateFromStorage({ handle, cluster, domain, chatterToken, }: {
     handle: string | null | undefined;
     cluster?: AdaCluster;
     domain?: string;
+    chatterToken: string | null | undefined;
 }): MessagingAuthState | undefined;
 export declare function writeMessagingAuthStateToStorage({ handle, cluster, domain, persistence, state, }: {
     handle: string | null | undefined;
@@ -26,9 +29,10 @@ export declare function writeMessagingAuthStateToStorage({ handle, cluster, doma
     state: MessagingAuthState | null | undefined;
 }): boolean;
 export declare function clearAllMessagingAuthStatesFromStorage(): void;
-export declare function clearMessagingAuthStateFromStorage({ handle, cluster, domain, }: {
+export declare function clearMessagingAuthStateFromStorage({ handle, cluster, domain, expectedChatterToken, }: {
     handle: string | null | undefined;
     cluster?: AdaCluster;
     domain?: string;
+    expectedChatterToken?: string;
 }): void;
 export {};

package/dist/npm-entry/index.js

@@ -16125,7 +16125,7 @@ const client = new BrowserClient({
     return event;
   },
   environment: "production",
-  release: "1.14.15-6ec6245",
+  release: "1.14.16-3d56f98",
   sampleRate: 0.25,
   autoSessionTracking: false,
   // Integrations don't seem to work with Sentry: https://github.com/getsentry/sentry-javascript/issues/2541
@@ -16751,7 +16751,7 @@ function getEmbedURL(_ref) {
   } else {
     host = `http://${handle}.localhost:${ports.localhost.default}`;
   }
-  return `${host}/embed/${frameName}/${"6ec6245"}/index.html`;
+  return `${host}/embed/${frameName}/${"3d56f98"}/index.html`;
 }
 function constructQueryString(query) {
   return Object.keys(query).map(key => {
@@ -17248,6 +17248,9 @@ const ZD_MESSAGING_CHATTER_CREATED_STORAGE_KEY = "ada-embed_zd-messaging-chatter
 const CHATTER_STORAGE_KEY = (/* unused pure expression or super */ null && (CHATTER_TOKEN_STORAGE_KEY));
 ;// ./src/common/helpers/messaging-auth-state.ts
 
+function messaging_auth_state_ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function messaging_auth_state_objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? messaging_auth_state_ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : messaging_auth_state_ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+
 
 // Single static key, shared verbatim with messaging + chat and disclosed by
 // @ada-support/web-storage. Per-bot scoping is implicit in the bot-subdomain
@@ -17256,6 +17259,20 @@ const MESSAGING_AUTH_STATE_STORAGE_KEY = "messagingAuthState";
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
+function readMessagingTokenSubject(token) {
+  const payload = token.split(".")[1];
+  if (!payload || typeof globalThis.atob !== "function") {
+    return null;
+  }
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+    const claims = JSON.parse(globalThis.atob(padded));
+    return typeof claims.sub === "string" && claims.sub ? claims.sub : null;
+  } catch (error) {
+    return null;
+  }
+}
 
 // Typed @ada-support/web-storage wrapper for the chosen persistence provider, or
 // null when persistence is disabled / there is no window. The wrapper is what
@@ -17315,20 +17332,28 @@ function parseMessagingAuthState(value) {
     return null;
   }
   const {
+    ownerChatterToken,
     messagingToken,
     messagingTokenExpiresAt,
     sessionRefreshToken,
     refreshGeneration
   } = parsedValue;
-  if (typeof messagingToken !== "string" || !messagingToken || typeof messagingTokenExpiresAt !== "number" || !Number.isFinite(messagingTokenExpiresAt) || messagingTokenExpiresAt <= 0 || typeof sessionRefreshToken !== "string" || !sessionRefreshToken || typeof refreshGeneration !== "number" || !Number.isFinite(refreshGeneration)) {
+  if (ownerChatterToken !== undefined && (typeof ownerChatterToken !== "string" || !ownerChatterToken) || typeof messagingToken !== "string" || !messagingToken || typeof messagingTokenExpiresAt !== "number" || !Number.isFinite(messagingTokenExpiresAt) || messagingTokenExpiresAt <= 0 || typeof sessionRefreshToken !== "string" || !sessionRefreshToken || typeof refreshGeneration !== "number" || !Number.isInteger(refreshGeneration) || refreshGeneration < 1) {
     return null;
   }
-  return {
+  return messaging_auth_state_objectSpread(messaging_auth_state_objectSpread({}, typeof ownerChatterToken === "string" ? {
+    ownerChatterToken
+  } : {}), {}, {
     messagingToken,
     messagingTokenExpiresAt,
     sessionRefreshToken,
     refreshGeneration
-  };
+  });
+}
+function bindMessagingAuthStateToChatter(state, chatterToken) {
+  return (!state.ownerChatterToken || state.ownerChatterToken === chatterToken) && readMessagingTokenSubject(state.messagingToken) === chatterToken ? messaging_auth_state_objectSpread(messaging_auth_state_objectSpread({}, state), {}, {
+    ownerChatterToken: chatterToken
+  }) : null;
 }
 
 // Storage-blocked browsers can throw on the storage methods, so each access is
@@ -17341,21 +17366,32 @@ function safeReadMessagingAuthState(persistence) {
     return null;
   }
 }
+function readHighestMessagingAuthStateForChatter(chatterToken) {
+  return ["normal", "session"].map(persistence => safeReadMessagingAuthState(persistence)).map(candidate => candidate ? bindMessagingAuthStateToChatter(candidate, chatterToken) : null).reduce((highestState, candidate) => candidate && (!highestState || candidate.refreshGeneration > highestState.refreshGeneration) ? candidate : highestState, null);
+}
+
+// The read is owner-bound: without a current chatter token, or when no persisted
+// blob binds to it, there is no state this chatter may reuse. Binding both
+// providers before the highest-generation reduce stops a stale higher-generation
+// blob left by a previous chatter from being paired with the active session.
 function readMessagingAuthStateFromStorage(_ref3) {
   let {
     handle,
     cluster,
-    domain
+    domain,
+    chatterToken
   } = _ref3;
   if (!buildMessagingAuthStateStorageKey({
     handle,
     cluster,
     domain
-  })) {
+  }) || !chatterToken) {
     return undefined;
   }
-  const persistedAuthStates = ["normal", "session"].map(persistence => safeReadMessagingAuthState(persistence)).filter(authState => authState !== null);
-  return persistedAuthStates.reduce((highestState, authState) => !highestState || authState.refreshGeneration > highestState.refreshGeneration ? authState : highestState, undefined);
+  return readHighestMessagingAuthStateForChatter(chatterToken) ?? undefined;
+}
+function shouldPreserveExistingAuthState(existing, candidate, targetIsVerifiedOwnerless) {
+  return Boolean(existing && (existing.refreshGeneration > candidate.refreshGeneration || existing.refreshGeneration === candidate.refreshGeneration && !targetIsVerifiedOwnerless));
 }
 function writeMessagingAuthStateToStorage(_ref4) {
   let {
@@ -17375,15 +17411,21 @@ function writeMessagingAuthStateToStorage(_ref4) {
     return false;
   }
   try {
-    const existing = readMessagingAuthStateFromStorage({
-      handle,
-      cluster,
-      domain
-    });
-    if (existing && existing.refreshGeneration >= state.refreshGeneration) {
+    const {
+      ownerChatterToken
+    } = state;
+    const boundState = ownerChatterToken ? bindMessagingAuthStateToChatter(state, ownerChatterToken) : null;
+    if (!boundState) {
+      return false;
+    }
+    const comparableExisting = readHighestMessagingAuthStateForChatter(ownerChatterToken);
+    const targetExisting = safeReadMessagingAuthState(persistence);
+    const targetExistingForChatter = targetExisting ? bindMessagingAuthStateToChatter(targetExisting, ownerChatterToken) : null;
+    const targetIsVerifiedOwnerless = Boolean(targetExistingForChatter && !(targetExisting !== null && targetExisting !== void 0 && targetExisting.ownerChatterToken));
+    if (shouldPreserveExistingAuthState(comparableExisting, boundState, targetIsVerifiedOwnerless)) {
       return false;
     }
-    storage.setItem(storageKey, state);
+    storage.setItem(storageKey, boundState);
     return true;
   } catch (error) {
     return false;
@@ -17400,15 +17442,17 @@ function clearAllMessagingAuthStatesFromStorage() {
   });
 }
 
-// Removes the messaging auth state (across both persistence providers). Used when
-// a bot rotates to a new chatter. With the bot-subdomain storage origin there is a
-// single auth state per origin, so this and `clearAllMessagingAuthStatesFromStorage`
-// now clear the same key.
+// Removes the messaging auth state from both persistence providers. Used when a bot
+// rotates to a new chatter. When `expectedChatterToken` is supplied, a provider is
+// only cleared if its persisted state binds to that chatter; state that doesn't bind
+// (owned by another chatter, or ownerless with a non-matching token subject) is left
+// intact.
 function clearMessagingAuthStateFromStorage(_ref5) {
   let {
     handle,
     cluster,
-    domain
+    domain,
+    expectedChatterToken
   } = _ref5;
   if (!buildMessagingAuthStateStorageKey({
     handle,
@@ -17420,6 +17464,10 @@ function clearMessagingAuthStateFromStorage(_ref5) {
   ["normal", "session"].forEach(persistence => {
     try {
       var _getMessagingAuthStor3;
+      const persistedState = safeReadMessagingAuthState(persistence);
+      if (expectedChatterToken && (!persistedState || !bindMessagingAuthStateToChatter(persistedState, expectedChatterToken))) {
+        return;
+      }
       (_getMessagingAuthStor3 = getMessagingAuthStorage(persistence)) === null || _getMessagingAuthStor3 === void 0 ? void 0 : _getMessagingAuthStor3.removeItem(MESSAGING_AUTH_STATE_STORAGE_KEY);
     } catch (error) {
       // Storage blocked; nothing to clear.
@@ -17435,64 +17483,68 @@ function clearMessagingAuthStateFromStorage(_ref5) {
 function getValueFromStorage(key) {
   return dist/* adaLocalStorage */.BB.getItem(key) || dist/* adaSessionStorage */.ad.getItem(key);
 }
-const getInitialState = adaSettings => ({
-  adaSettings,
-  handle: adaSettings.handle,
-  styles: undefined,
-  domain: undefined,
-  cluster: undefined,
-  language: undefined,
-  greeting: undefined,
-  crossWindowPersistence: true,
-  headless: false,
-  enableProgrammaticControl: false,
-  hideMask: true,
-  metaFields: {},
-  sensitiveMetaFields: {},
-  parentElement: undefined,
-  isDrawerOpen: false,
-  drawerHasBeenOpened: false,
-  focusIsOnAda: false,
-  enabledLanguages: ["en"],
-  client: undefined,
-  isIntroShown: false,
-  wasIntroShown: false,
-  isButtonShown: false,
-  introDimensions: {},
-  unreadMessageCount: 0,
-  initialURL: undefined,
-  privateMode: false,
-  rolloutOverride: undefined,
-  chatterToken: getValueFromStorage(CHATTER_TOKEN_STORAGE_KEY) || undefined,
-  chatterCreated: getValueFromStorage(CHATTER_CREATED_STORAGE_KEY) || undefined,
-  sessionToken: getValueFromStorage(SESSION_AUTH_TOKEN_STORAGE_KEY) || undefined,
-  messagingAuthState: readMessagingAuthStateFromStorage({
+const getInitialState = adaSettings => {
+  const chatterToken = getValueFromStorage(CHATTER_TOKEN_STORAGE_KEY) || undefined;
+  return {
+    adaSettings,
     handle: adaSettings.handle,
-    cluster: adaSettings.cluster,
-    domain: adaSettings.domain
-  }),
-  zdSessionId: getValueFromStorage(ZD_SESSION_STORAGE_KEY) || undefined,
-  zdPreviousTags: getValueFromStorage(ZD_PREVIOUS_TAGS_STORAGE_KEY) || undefined,
-  zdMessagingExternalUserId: getValueFromStorage(ZD_MESSAGING_EXTERNAL_USER_ID_STORAGE_KEY) || null,
-  zdMessagingChatterCreated: getValueFromStorage(ZD_MESSAGING_CHATTER_CREATED_STORAGE_KEY) || null,
-  connections: {},
-  appConnectionState: ConnectionState.Uninitiated,
-  testMode: false,
-  embedStyles: undefined,
-  notificationsPermission: browserHasNotificationSupport ? Notification.permission : undefined,
-  browserHasNotificationSupport: browserHasNotificationSupport,
-  preload: false,
-  chatDimensions: undefined,
-  isChatWebsocketConnected: false,
-  latestCampaignKey: undefined,
-  hasChatOpenedAfterProactiveMessagesShown: false,
-  chatterInLiveChat: false,
-  wasCampaignShownButNowClosed: false,
-  proactiveCampaignHadMessages: false,
-  proactiveEngaged: false,
-  deviceToken: null,
-  showFallbackOnTimeout: true
-});
+    styles: undefined,
+    domain: undefined,
+    cluster: undefined,
+    language: undefined,
+    greeting: undefined,
+    crossWindowPersistence: true,
+    headless: false,
+    enableProgrammaticControl: false,
+    hideMask: true,
+    metaFields: {},
+    sensitiveMetaFields: {},
+    parentElement: undefined,
+    isDrawerOpen: false,
+    drawerHasBeenOpened: false,
+    focusIsOnAda: false,
+    enabledLanguages: ["en"],
+    client: undefined,
+    isIntroShown: false,
+    wasIntroShown: false,
+    isButtonShown: false,
+    introDimensions: {},
+    unreadMessageCount: 0,
+    initialURL: undefined,
+    privateMode: false,
+    rolloutOverride: undefined,
+    chatterToken,
+    chatterCreated: getValueFromStorage(CHATTER_CREATED_STORAGE_KEY) || undefined,
+    sessionToken: getValueFromStorage(SESSION_AUTH_TOKEN_STORAGE_KEY) || undefined,
+    messagingAuthState: readMessagingAuthStateFromStorage({
+      handle: adaSettings.handle,
+      cluster: adaSettings.cluster,
+      domain: adaSettings.domain,
+      chatterToken
+    }),
+    zdSessionId: getValueFromStorage(ZD_SESSION_STORAGE_KEY) || undefined,
+    zdPreviousTags: getValueFromStorage(ZD_PREVIOUS_TAGS_STORAGE_KEY) || undefined,
+    zdMessagingExternalUserId: getValueFromStorage(ZD_MESSAGING_EXTERNAL_USER_ID_STORAGE_KEY) || null,
+    zdMessagingChatterCreated: getValueFromStorage(ZD_MESSAGING_CHATTER_CREATED_STORAGE_KEY) || null,
+    connections: {},
+    appConnectionState: ConnectionState.Uninitiated,
+    testMode: false,
+    embedStyles: undefined,
+    notificationsPermission: browserHasNotificationSupport ? Notification.permission : undefined,
+    browserHasNotificationSupport: browserHasNotificationSupport,
+    preload: false,
+    chatDimensions: undefined,
+    isChatWebsocketConnected: false,
+    latestCampaignKey: undefined,
+    hasChatOpenedAfterProactiveMessagesShown: false,
+    chatterInLiveChat: false,
+    wasCampaignShownButNowClosed: false,
+    proactiveCampaignHadMessages: false,
+    proactiveEngaged: false,
+    deviceToken: null,
+    showFallbackOnTimeout: true
+  };
+};
 // EXTERNAL MODULE: ./node_modules/lodash.memoize/index.js
 var lodash_memoize = __webpack_require__(7654);
 var lodash_memoize_default = /*#__PURE__*/__webpack_require__.n(lodash_memoize);
@@ -17539,9 +17591,9 @@ async function log(message, extra, options) {
       service: "embed",
       env: "production",
       embedVersion: 2,
-      version: "1.14.15",
+      version: "1.14.16",
       isNpm: true,
-      commitHash: "6ec6245"
+      commitHash: "3d56f98"
     }))
   });
 }
@@ -20076,22 +20128,6 @@ function storeChatterEventDataInBrowser(client, payload) {
   const {
     persistence
   } = client;
-
-  // A new chatter resets refreshGeneration back to 1, so the generation guard in
-  // writeMessagingAuthStateToStorage would otherwise refuse to overwrite a previous
-  // chatter's higher-generation (now-dead) auth state — leaving the host-page copy
-  // stuck on a refresh token the backend has rotated away. Whenever the persisted
-  // chatter token does not match the incoming one — including when it is absent or in
-  // the other persistence provider, leaving the auth state orphaned — drop the stale
-  // auth state first so the new chatter's credentials persist.
-  const previousChatter = retrieveStorage(CHATTER_TOKEN_STORAGE_KEY, client, privateMode);
-  if (previousChatter !== chatter) {
-    clearMessagingAuthStateFromStorage({
-      handle: client.handle,
-      cluster,
-      domain
-    });
-  }
   setBrowserStorageItem(CHATTER_TOKEN_STORAGE_KEY, chatter, persistence);
   setBrowserStorageItem(CHATTER_CREATED_STORAGE_KEY, created, persistence);
   if (sessionToken) {
@@ -20104,23 +20140,22 @@ function storeChatterEventDataInBrowser(client, payload) {
   // embed-2's cross-origin XHR trips CORS preflight (see common/helpers/http.ts) — so
   // the chat iframe, not embed-2, is what sends `Bearer <messagingToken>`.
   const parsedAuthState = parseMessagingAuthState(messagingAuthState);
-  if (parsedAuthState) {
+  const hasChatterToken = typeof chatter === "string" && chatter.length > 0;
+  const boundAuthState = parsedAuthState && hasChatterToken ? bindMessagingAuthStateToChatter(parsedAuthState, chatter) : null;
+  if (boundAuthState) {
     writeMessagingAuthStateToStorage({
       handle: client.handle,
       cluster,
       domain,
       persistence,
-      state: parsedAuthState
+      state: boundAuthState
     });
-  } else {
-    // chat published no usable auth state for this chatter (e.g. it cleared a dead
-    // refresh token on unrecoverable invalid_refresh_token). Drop the host-side copy so
-    // a stale token can't be resurrected on reload — a null write would otherwise no-op
-    // and leave it in place.
+  } else if (hasChatterToken) {
     clearMessagingAuthStateFromStorage({
       handle: client.handle,
       cluster,
-      domain
+      domain,
+      expectedChatterToken: chatter
     });
   }
 }
@@ -20350,7 +20385,7 @@ class ChatFrame extends d {
     log("Chat frame mount", {
       handle,
       chatUrl: this.url,
-      embedVersion: "6ec6245".slice(0, 7),
+      embedVersion: "3d56f98".slice(0, 7),
       embedSettings: adaSettings
     });
 
@@ -20438,7 +20473,7 @@ class ChatFrame extends d {
     const hostPageUrlParams = new URL(window.location.href).searchParams;
     const smsToken = hostPageUrlParams.get("adaSMSToken");
     const queryParams = {
-      embedVersion: "6ec6245".slice(0, 7),
+      embedVersion: "3d56f98".slice(0, 7),
       greeting,
       language,
       skipGreeting,
@@ -22431,6 +22466,13 @@ class Container extends d {
       return;
     }
     const chatterInLiveChat = retrieveStorage(IN_LIVE_CHAT_STORAGE_KEY, assignedClient, privateMode);
+
+    // Read the chatter token fresh here, not at the top of initialize(): a
+    // CHATTER_EVENT can rotate the chatter during this method's awaits, and a
+    // stale token would owner-mismatch and clobber the newly stored auth state.
+    const {
+      chatterToken
+    } = this.props;
     try {
       await setGlobalState(Container_objectSpread(Container_objectSpread({
         client: assignedClient,
@@ -22449,7 +22491,8 @@ class Container extends d {
         messagingAuthState: readMessagingAuthStateFromStorage({
           handle: assignedClient.handle,
           cluster: cluster,
-          domain
+          domain,
+          chatterToken
         }),
         chatterInLiveChat
       }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ada-support/embed2",
-  "version": "1.14.15",
+  "version": "1.14.16",
   "description": "",
   "main": "dist/npm-entry",
   "typings": "dist/npm-entry/index-npm.d.ts",