@base44-preview/sdk 0.8.35-pr.212.23f3cb2 → 0.8.35-pr.212.36b2685

package/dist/client.js

@@ -12,7 +12,7 @@ import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
-import { createRealtimeModule, pushUserTokenToActiveSockets } from "./modules/realtime.js";
+import { createRealtimeModule } from "./modules/realtime.js";
 /**
  * Creates a Base44 client.
  *
@@ -124,21 +124,6 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
     });
-    // Current user session token (axios defaults are the single source of truth —
-    // createClient({token}) and every setToken() land there). Used for in-band
-    // realtime auth; read lazily so refreshes are always picked up.
-    const getUserToken = () => {
-        var _a;
-        const h = (_a = axiosClient.defaults.headers.common) === null || _a === void 0 ? void 0 : _a["Authorization"];
-        return typeof h === "string" && h.startsWith("Bearer ") ? h.slice(7) : null;
-    };
-    // Login / token refresh must reach long-lived realtime sockets too, so the
-    // handler-side credential never goes stale mid-connection.
-    const originalSetToken = userAuthModule.setToken.bind(userAuthModule);
-    userAuthModule.setToken = (newToken, saveToStorage) => {
-        originalSetToken(newToken, saveToStorage);
-        pushUserTokenToActiveSockets(newToken);
-    };
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
@@ -189,22 +174,13 @@ export function createClient(config) {
         realtime: createRealtimeModule({
             appId,
             dispatcherWsUrl: resolvedDispatcherWsUrl,
-            getUserToken,
             getToken: async (handlerName, instanceId, connId) => {
                 // axiosClient interceptors unwrap response.data, so the result is the body directly.
                 // conn_id rides inside the signed token (not a WS query param) so it survives
                 // proxies that strip params; the dispatcher forwards it as the handler's conn.id.
                 // Base44-Functions-Version rides along (like function calls) so live apps get
                 // tokens for the *published* realtime script and previews get the draft.
-                const data = await axiosClient.post(`/apps/${appId}/realtime-token`, {
-                    handler_name: handlerName,
-                    instance_id: instanceId,
-                    conn_id: connId,
-                    // Declares "an __auth message follows right after connect" — the
-                    // handler delays handleConnect until it arrives (signed into the
-                    // token so old SDKs, which never send __auth, are never waited on).
-                    supports_inband_auth: getUserToken() != null,
-                }, functionsVersion
+                const data = await axiosClient.post(`/apps/${appId}/realtime-token`, { handler_name: handlerName, instance_id: instanceId, conn_id: connId }, functionsVersion
                     ? { headers: { "Base44-Functions-Version": functionsVersion } }
                     : undefined);
                 return data.token;

package/dist/modules/realtime.d.ts

@@ -1,13 +1,6 @@
-/** Push a (new) user session token to every open realtime socket — called on
- *  login/refresh so long-lived connections keep a valid credential server-side. */
-export declare function pushUserTokenToActiveSockets(token: string): void;
 export declare function createRealtimeModule(config: {
     appId: string;
     getToken(handlerName: string, instanceId: string, connId: string): Promise<string>;
-    /** Current user session token, if signed in. Sent in-band ({type:"__auth"})
-     *  right after every socket open — never in the URL — so the handler can act
-     *  as this user (createUserClient / RLS). */
-    getUserToken?: () => string | null;
     dispatcherWsUrl: string;
 }): Record<string, RealtimeHandler>;
 /** Handle for an active realtime subscription. */

package/dist/modules/realtime.js

@@ -4,19 +4,6 @@ const activeSockets = new Map();
 function socketKey(handlerName, instanceId) {
     return `${handlerName}:${instanceId}`;
 }
-/** Push a (new) user session token to every open realtime socket — called on
- *  login/refresh so long-lived connections keep a valid credential server-side. */
-export function pushUserTokenToActiveSockets(token) {
-    if (!token)
-        return;
-    const payload = JSON.stringify({ type: "__auth", token });
-    for (const ws of activeSockets.values()) {
-        try {
-            ws.send(payload);
-        }
-        catch ( /* not open — the open handler will send */_a) { /* not open — the open handler will send */ }
-    }
-}
 export function createRealtimeModule(config) {
     return new Proxy({}, {
         get(_, handlerName) {
@@ -41,21 +28,6 @@ export function createRealtimeModule(config) {
                         query: () => config.getToken(handlerName, instanceId, connId).then((token) => ({ token })),
                     });
                     activeSockets.set(key, ws);
-                    // In-band credential delivery (Supabase-style): the user token rides the
-                    // open socket, never the URL. Sent on every open (incl. reconnects); the
-                    // server may also nudge with {type:"__auth_required"} (e.g. just before
-                    // the held token expires) and we answer with the current one.
-                    const sendAuth = () => {
-                        var _a;
-                        const t = (_a = config.getUserToken) === null || _a === void 0 ? void 0 : _a.call(config);
-                        if (t) {
-                            try {
-                                ws.send(JSON.stringify({ type: "__auth", token: t }));
-                            }
-                            catch ( /* not open */_b) { /* not open */ }
-                        }
-                    };
-                    ws.addEventListener("open", sendAuth);
                     // Heartbeat / half-open detection. PartySocket only reconnects on a
                     // browser close/error event, so a silently-dead connection (TCP alive,
                     // no data — common behind proxies/LBs) hangs until the OS idle timeout
@@ -77,14 +49,9 @@ export function createRealtimeModule(config) {
                         catch (_a) {
                             return; // ignore malformed
                         }
-                        // Swallow platform messages — never surface them to the app.
-                        const msgType = data && typeof data === "object" ? data.type : undefined;
-                        if (msgType === "__pong")
+                        // Swallow heartbeat acks — never surface them to the app.
+                        if (data && typeof data === "object" && data.type === "__pong")
                             return;
-                        if (msgType === "__auth_required") {
-                            sendAuth();
-                            return;
-                        }
                         callback(data);
                     });
                     const heartbeat = setInterval(() => {

package/dist/realtime-handler.d.ts

@@ -68,19 +68,5 @@ export declare abstract class RealtimeHandler<Incoming = unknown, Outgoing = unk
     protected stopLoop(): Promise<void>;
     protected get instanceId(): string;
     protected get storage(): Storage;
-    /**
-     * SDK client acting **as the connected user** — every entity call respects
-     * the app's row-level security, evaluated as that user at call time. The
-     * default wherever a `conn` is in scope (connect/message/close).
-     *
-     * Throws if the connection carries no user credential (anonymous visitor,
-     * signed-out session, or an app SDK that predates in-band auth).
-     */
-    protected createUserClient(conn: Conn): Base44Client;
-    /**
-     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
-     * (tick, alarm, onStart). Inside handleMessage/handleConnect prefer
-     * `createUserClient(conn)`.
-     */
     protected createServiceClient(): Base44Client;
 }

package/dist/realtime-handler.js

@@ -56,23 +56,6 @@ export class RealtimeHandler {
     get storage() {
         throw new Error("RealtimeHandler.storage is only available inside a deployed handler");
     }
-    /**
-     * SDK client acting **as the connected user** — every entity call respects
-     * the app's row-level security, evaluated as that user at call time. The
-     * default wherever a `conn` is in scope (connect/message/close).
-     *
-     * Throws if the connection carries no user credential (anonymous visitor,
-     * signed-out session, or an app SDK that predates in-band auth).
-     */
-    createUserClient(conn) {
-        void conn;
-        throw new Error("RealtimeHandler.createUserClient() is only available inside a deployed handler");
-    }
-    /**
-     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
-     * (tick, alarm, onStart). Inside handleMessage/handleConnect prefer
-     * `createUserClient(conn)`.
-     */
     createServiceClient() {
         throw new Error("RealtimeHandler.createServiceClient() is only available inside a deployed handler");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.35-pr.212.23f3cb2",
+  "version": "0.8.35-pr.212.36b2685",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",