@ankhorage/studio 0.11.10 → 0.11.11

package/dist/host/layout/templates/auth/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/callback.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,UAkI7F"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/callback.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,UA4I7F"}

package/dist/host/layout/templates/auth/callback.js

@@ -24,10 +24,20 @@ let activeCallbackCompletion: ActiveCallbackCompletion | null = null;
 
 function completeOAuthCallbackOnce(callbackUrl: string) {
   if (!activeCallbackCompletion || activeCallbackCompletion.callbackUrl !== callbackUrl) {
-    activeCallbackCompletion = {
+    const completion: ActiveCallbackCompletion = {
       callbackUrl,
       promise: completeOAuthCallback(callbackUrl),
     };
+    activeCallbackCompletion = completion;
+    void completion.promise
+      .finally(() => {
+        if (activeCallbackCompletion === completion) {
+          activeCallbackCompletion = null;
+        }
+      })
+      .catch(() => {
+        // The original promise remains the callback screen's error boundary.
+      });
   }
   return activeCallbackCompletion.promise;
 }

package/dist/host/layout/templates/auth/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,UAAU,uBAAuB,CAAC,IAAsD;IAC5F,MAAM,YAAY,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAElG,OAAO;;;;;;;;yBAQgB,YAAY;8BACP,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoH7C,CAAC;AACF,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,UAAU,uBAAuB,CAAC,IAAsD;IAC5F,MAAM,YAAY,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAElG,OAAO;;;;;;;;yBAQgB,YAAY;8BACP,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8H7C,CAAC;AACF,CAAC"}

package/dist/host/layout/templates/auth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG5E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,UAoU9D"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG5E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,UA2W9D"}

package/dist/host/layout/templates/auth/oauth.js

@@ -4,7 +4,6 @@ export function getAuthOAuthRuntimeTs(args) {
     const providers = JSON.stringify(args.providers);
     return `import type {
   AuthOAuthCompletionResult,
-  AuthOAuthProviderId,
   AuthOAuthTransportCancellationReason,
 } from '@ankhorage/contracts/auth';
 import * as Linking from 'expo-linking';
@@ -18,7 +17,8 @@ import {
 } from './session';
 
 const OAUTH_CALLBACK_ROUTE = '${callbackRoute}';
-const OAUTH_TRANSPORT_ATTEMPT_KEY = 'ankh.auth.oauth.transport.v1';
+const OAUTH_TRANSPORT_ATTEMPT_KEY = 'ankh.auth.oauth.transport.v2';
+const LEGACY_OAUTH_TRANSPORT_ATTEMPT_KEY = 'ankh.auth.oauth.transport.v1';
 const GENERATED_OAUTH_PROVIDERS = ${providers} as const;
 
 export const generatedOAuthProviderItems = GENERATED_OAUTH_PROVIDERS.map((provider) => ({
@@ -33,9 +33,8 @@ export type GeneratedOAuthTransportOutcome =
   | { status: 'error'; message: string; recoverable: boolean };
 
 interface StoredTransportAttempt {
+  version: 1;
   attemptId: string;
-  provider: AuthOAuthProviderId;
-  redirectUri: string;
 }
 
 let activeAuthorization: Promise<GeneratedOAuthTransportOutcome> | null = null;
@@ -97,9 +96,8 @@ async function runOAuthAuthorization(
 
   try {
     await writeTransportAttempt({
+      version: 1,
       attemptId: started.data.attemptId,
-      provider: started.data.provider,
-      redirectUri: started.data.redirectUri,
     });
   } catch {
     await cancelOAuthAttempt(started.data.attemptId, 'user_cancelled');
@@ -198,6 +196,9 @@ export async function completeOAuthCallback(
 
   const attempt = await readTransportAttempt();
   if (!attempt) {
+    if (getStoredAuthSession() && isCanonicalOAuthCallback(callbackUrl)) {
+      return { status: 'authenticated' };
+    }
     return {
       status: 'error',
       message: 'The OAuth authorization attempt was not found or has expired.',
@@ -205,10 +206,20 @@ export async function completeOAuthCallback(
     };
   }
 
-  const completed = await oauth.completeAuthorization({
-    attemptId: attempt.attemptId,
-    response: { type: 'callback', url: callbackUrl },
-  });
+  let completed: AuthOAuthCompletionResult;
+  try {
+    completed = await oauth.completeAuthorization({
+      attemptId: attempt.attemptId,
+      response: { type: 'callback', url: callbackUrl },
+    });
+  } catch {
+    await clearTransportAttempt();
+    return {
+      status: 'error',
+      message: 'The OAuth callback could not be completed.',
+      recoverable: true,
+    };
+  }
   await clearTransportAttempt();
 
   if (
@@ -240,6 +251,23 @@ function resolveOAuthRedirectUri(): string {
   return Linking.createURL(callbackPath);
 }
 
+function isCanonicalOAuthCallback(callbackUrl: string): boolean {
+  try {
+    const delivered = new URL(callbackUrl);
+    const expected = new URL(resolveOAuthRedirectUri());
+    return (
+      delivered.protocol === expected.protocol &&
+      delivered.username === expected.username &&
+      delivered.password === expected.password &&
+      delivered.host === expected.host &&
+      delivered.pathname === expected.pathname &&
+      delivered.hash.length === 0
+    );
+  } catch {
+    return false;
+  }
+}
+
 function getBrowserLocation(): object | null {
   const location = Reflect.get(globalThis, 'location');
   return typeof location === 'object' && location !== null ? location : null;
@@ -284,35 +312,46 @@ async function cancelOAuthAttempt(
 }
 
 async function writeTransportAttempt(attempt: StoredTransportAttempt): Promise<void> {
+  await clearLegacyTransportAttempt();
   await authSessionStorage.setItem(OAUTH_TRANSPORT_ATTEMPT_KEY, JSON.stringify(attempt));
 }
 
 async function readTransportAttempt(): Promise<StoredTransportAttempt | null> {
   const raw = await authSessionStorage.getItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
-  if (!raw) return null;
+  if (!raw) {
+    await clearLegacyTransportAttempt();
+    return null;
+  }
   try {
     const value: unknown = JSON.parse(raw);
-    if (!isRecord(value)) return null;
-    const attemptId = Reflect.get(value, 'attemptId');
-    const provider = Reflect.get(value, 'provider');
-    const redirectUri = Reflect.get(value, 'redirectUri');
-    const configuredProvider =
-      typeof provider === 'string'
-        ? GENERATED_OAUTH_PROVIDERS.find((entry) => entry.id === provider)
-        : undefined;
-    return typeof attemptId === 'string' &&
-      configuredProvider !== undefined &&
-      typeof redirectUri === 'string'
-      ? { attemptId, provider: configuredProvider.id, redirectUri }
-      : null;
+    if (isRecord(value)) {
+      const version = Reflect.get(value, 'version');
+      const attemptId = Reflect.get(value, 'attemptId');
+      if (version === 1 && typeof attemptId === 'string' && attemptId.trim().length > 0) {
+        return { version, attemptId };
+      }
+    }
   } catch {
-    return null;
+    // Invalid transport state is cleaned below without exposing its contents.
   }
+  await clearTransportAttempt();
+  return null;
 }
 
 async function clearTransportAttempt(): Promise<void> {
+  await Promise.all([
+    safeRemoveTransportItem(OAUTH_TRANSPORT_ATTEMPT_KEY),
+    safeRemoveTransportItem(LEGACY_OAUTH_TRANSPORT_ATTEMPT_KEY),
+  ]);
+}
+
+async function clearLegacyTransportAttempt(): Promise<void> {
+  await safeRemoveTransportItem(LEGACY_OAUTH_TRANSPORT_ATTEMPT_KEY);
+}
+
+async function safeRemoveTransportItem(key: string): Promise<void> {
   try {
-    await authSessionStorage.removeItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
+    await authSessionStorage.removeItem(key);
   } catch {
     // Cleanup failures are intentionally not surfaced with persisted state.
   }

package/dist/host/layout/templates/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEjD,OAAO;;;;;;;;;;;;;;;gCAeuB,aAAa;;oCAET,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8S5C,CAAC;AACF,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEjD,OAAO;;;;;;;;;;;;;;gCAcuB,aAAa;;;oCAGT,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqV5C,CAAC;AACF,CAAC"}

package/dist/host/orchestrator/templates.js

@@ -3,7 +3,7 @@ import { EXPO_SDK_54_ANIMATION_COMPATIBILITY } from './expoSdk54AnimationCompati
 const EXPO_MODULES_CORE_VERSION = '~3.0.30';
 const CONTRACTS_VERSION = '^4.0.0';
 const RUNTIME_VERSION = '^0.3.0';
-const SUPABASE_AUTH_VERSION = '^1.0.0';
+const SUPABASE_AUTH_VERSION = '^1.1.2';
 const ZORA_VERSION = '^2.9.0';
 const EXPO_SECURE_STORE_VERSION = '~15.0.8';
 const EXPO_WEB_BROWSER_VERSION = '~15.0.11';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/studio",
-  "version": "0.11.10",
+  "version": "0.11.11",
   "description": "Studio authoring package for Ankhorage apps",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/studio#readme",
@@ -237,7 +237,7 @@
     "@ankhorage/orchestrator-module-expo-localization": "^0.1.5",
     "@ankhorage/react-native-reanimated-dnd-web": "^0.3.2",
     "@ankhorage/runtime": "^0.3.0",
-    "@ankhorage/supabase-auth": "^1.1.1",
+    "@ankhorage/supabase-auth": "^1.1.2",
     "@ankhorage/supabase-vault": "^0.2.4",
     "@ankhorage/templates": "^3.0.0",
     "@ankhorage/zora": "^2.9.1",