@base44-preview/sdk 0.8.41-pr.243.98f858c → 0.8.41-pr.244.e7d6747

package/dist/client.js

@@ -5,6 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
+import { redeemSessionHandoffCode } from "./utils/session-handoff.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -118,10 +119,32 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
+    //
+    // Precedence: an explicit config token wins (legacy behavior); then a PKCE
+    // session-code handoff in the URL (base44-dev/apper#17216 §5.2) — the user
+    // just completed a login, so it outranks any stored token, mirroring how
+    // getAccessToken prefers a URL access_token over localStorage; then the
+    // legacy capture. When the server spoke legacy — including after a backend
+    // rollback — redeemSessionHandoffCode() returns null synchronously and the
+    // legacy capture below runs unchanged.
+    let tokenBootstrap = null;
     if (typeof window !== "undefined") {
-        const accessToken = token || getAccessToken();
-        if (accessToken) {
-            userAuthModule.setToken(accessToken);
+        const sessionExchange = token ? null : redeemSessionHandoffCode();
+        if (sessionExchange) {
+            tokenBootstrap = sessionExchange.then((exchangedToken) => {
+                // On exchange failure, fall back to any stored token rather than
+                // leaving auth state empty (same fallback getAccessToken applies).
+                const accessToken = exchangedToken || getAccessToken();
+                if (accessToken) {
+                    userAuthModule.setToken(accessToken);
+                }
+            });
+        }
+        else {
+            const accessToken = token || getAccessToken();
+            if (accessToken) {
+                userAuthModule.setToken(accessToken);
+            }
         }
     }
     const actorsModule = createActorsModule({
@@ -218,6 +241,13 @@ export function createClient(config) {
         // We perform this check asynchronously to not block client creation
         setTimeout(async () => {
             try {
+                // A pending session-code exchange must settle before the auth probe.
+                // Probing early would see no token, redirect to login, and abandon
+                // the in-flight exchange — minting a fresh code on every round, i.e.
+                // a login loop (the exact BUG-787 failure shape).
+                if (tokenBootstrap) {
+                    await tokenBootstrap;
+                }
                 const isAuthenticated = await userModules.auth.isAuthenticated();
                 if (!isAuthenticated) {
                     userModules.auth.redirectToLogin(window.location.href);

package/dist/modules/auth.js

@@ -1,3 +1,4 @@
+import { prepareSessionHandoffKickoff } from "../utils/session-handoff.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -104,11 +105,32 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             }
             const loginUrl = `${options.appBaseUrl}/api${authPath}?${queryParams}`;
             // When running inside an iframe, use a popup to avoid OAuth providers
-            // blocking iframe navigation.
+            // blocking iframe navigation. Popups stay on the exact legacy kickoff:
+            // they deliver the token via postMessage and never redeem a code (the
+            // backend skips the code mint when popup_origin is present).
             if (isInsideIframe()) {
                 const popupLoginUrl = `${loginUrl}&popup_origin=${encodeURIComponent(window.location.origin)}`;
                 return loginViaPopup(popupLoginUrl, redirectUrl, window.location.origin);
             }
+            // Full-page SSO redirect: offer the PKCE session-code handoff
+            // (base44-dev/apper#17216 §5.2). The backend decides per request whether
+            // to use it; a server that answers with the legacy ?access_token= —
+            // including after a backend rollback — is honored unchanged at
+            // redemption. If PKCE can't be prepared locally, kick off with the
+            // unmodified legacy URL (version=2 without a valid challenge is a 400
+            // at /login, so it's all-or-nothing).
+            if (provider === "sso") {
+                prepareSessionHandoffKickoff()
+                    .then((pkceQuery) => {
+                    window.location.href = pkceQuery
+                        ? `${loginUrl}${pkceQuery}`
+                        : loginUrl;
+                })
+                    .catch(() => {
+                    window.location.href = loginUrl;
+                });
+                return;
+            }
             // Default: full-page redirect
             window.location.href = loginUrl;
         },

package/dist/utils/session-handoff.d.ts

@@ -0,0 +1,52 @@
+/**
+ * PKCE-bound one-time session-code handoff for SSO logins
+ * (base44-dev/apper#17216 §5.2).
+ *
+ * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
+ * `code_challenge`) and the backend DECIDES per request: it only emits a
+ * `session_code` when every server-side gate holds (verified custom domain,
+ * non-private app, feature flag ON). In every other case — older backends,
+ * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
+ * delivering the legacy `?access_token=` URL param, which the SDK digests
+ * exactly as before. This is a negotiation, never a deprecation: the legacy
+ * path must keep working here forever.
+ *
+ * Fail-open rule for kickoff: never send `version=2` unless this browser can
+ * actually complete the exchange (WebCrypto, sessionStorage that persists,
+ * fetch). The server 400s a `version=2` login without a valid challenge, and
+ * an opted-in login whose verifier is lost can never redeem its code — both
+ * are avoided by simply not opting in and letting the legacy path run.
+ */
+/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
+ * verifier never leaves the browser); a login that completes in a different
+ * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
+export declare const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
+/**
+ * Prepares the PKCE opt-in for an SSO login kickoff.
+ *
+ * Generates a verifier, persists it in sessionStorage (verified by read-back —
+ * a write that doesn't stick means the exchange could never succeed), and
+ * returns the query-string suffix to append to the login URL:
+ * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
+ *
+ * Returns `null` on ANY failure or missing capability, in which case the
+ * caller must use the unmodified legacy login URL. Never throws.
+ *
+ * @internal
+ */
+export declare function prepareSessionHandoffKickoff(): Promise<string | null>;
+/**
+ * Redeems a PKCE session-code handoff from the current URL, if one is present.
+ *
+ * Returns `null` synchronously when the URL carries no handoff — including
+ * when it carries a legacy `?access_token=` (the legacy capture wins outright;
+ * this is what makes a backend rollback safe). Otherwise strips the handoff
+ * params from the URL immediately and returns a promise resolving to the
+ * exchanged access token, or `null` when the exchange fails. Never rejects,
+ * never redirects: a failed exchange leaves the app unauthenticated and lets
+ * its normal login flow take over (each retry mints a fresh code, so this
+ * self-heals rather than looping).
+ *
+ * @internal
+ */
+export declare function redeemSessionHandoffCode(): Promise<string | null> | null;

package/dist/utils/session-handoff.js

@@ -0,0 +1,184 @@
+/**
+ * PKCE-bound one-time session-code handoff for SSO logins
+ * (base44-dev/apper#17216 §5.2).
+ *
+ * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
+ * `code_challenge`) and the backend DECIDES per request: it only emits a
+ * `session_code` when every server-side gate holds (verified custom domain,
+ * non-private app, feature flag ON). In every other case — older backends,
+ * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
+ * delivering the legacy `?access_token=` URL param, which the SDK digests
+ * exactly as before. This is a negotiation, never a deprecation: the legacy
+ * path must keep working here forever.
+ *
+ * Fail-open rule for kickoff: never send `version=2` unless this browser can
+ * actually complete the exchange (WebCrypto, sessionStorage that persists,
+ * fetch). The server 400s a `version=2` login without a valid challenge, and
+ * an opted-in login whose verifier is lost can never redeem its code — both
+ * are avoided by simply not opting in and letting the legacy path run.
+ */
+/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
+ * verifier never leaves the browser); a login that completes in a different
+ * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
+export const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
+/** Server-side format for challenge/verifier: base64url of 32 bytes, 43 chars. */
+const BASE64URL_43 = /^[A-Za-z0-9_-]{43}$/;
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+ * Prepares the PKCE opt-in for an SSO login kickoff.
+ *
+ * Generates a verifier, persists it in sessionStorage (verified by read-back —
+ * a write that doesn't stick means the exchange could never succeed), and
+ * returns the query-string suffix to append to the login URL:
+ * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
+ *
+ * Returns `null` on ANY failure or missing capability, in which case the
+ * caller must use the unmodified legacy login URL. Never throws.
+ *
+ * @internal
+ */
+export async function prepareSessionHandoffKickoff() {
+    var _a;
+    try {
+        if (typeof window === "undefined")
+            return null;
+        const crypto = globalThis.crypto;
+        if (!(crypto === null || crypto === void 0 ? void 0 : crypto.getRandomValues) || !((_a = crypto.subtle) === null || _a === void 0 ? void 0 : _a.digest))
+            return null;
+        // The exchange at redemption time needs fetch; don't opt in without it.
+        if (typeof fetch !== "function")
+            return null;
+        const verifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+        const challenge = base64UrlEncode(new Uint8Array(digest));
+        // The server rejects a malformed opt-in with a 400 at /login; a malformed
+        // challenge here must therefore mean "don't opt in", never "send anyway".
+        if (!BASE64URL_43.test(challenge))
+            return null;
+        // Store last, after everything else succeeded, and verify the write took
+        // (sandboxed iframes and lockdown modes can throw OR silently drop it).
+        window.sessionStorage.setItem(PKCE_VERIFIER_STORAGE_KEY, verifier);
+        if (window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY) !== verifier) {
+            return null;
+        }
+        return `&version=2&code_challenge=${challenge}&code_challenge_method=S256`;
+    }
+    catch (_b) {
+        return null;
+    }
+}
+/**
+ * Redeems a PKCE session-code handoff from the current URL, if one is present.
+ *
+ * Returns `null` synchronously when the URL carries no handoff — including
+ * when it carries a legacy `?access_token=` (the legacy capture wins outright;
+ * this is what makes a backend rollback safe). Otherwise strips the handoff
+ * params from the URL immediately and returns a promise resolving to the
+ * exchanged access token, or `null` when the exchange fails. Never rejects,
+ * never redirects: a failed exchange leaves the app unauthenticated and lets
+ * its normal login flow take over (each retry mints a fresh code, so this
+ * self-heals rather than looping).
+ *
+ * @internal
+ */
+export function redeemSessionHandoffCode() {
+    if (typeof window === "undefined" || !window.location)
+        return null;
+    let code = null;
+    let exchangePath = null;
+    let urlParams;
+    try {
+        urlParams = new URLSearchParams(window.location.search);
+        code = urlParams.get("session_code");
+        exchangePath = urlParams.get("session_exchange_path");
+        if (!code || !exchangePath)
+            return null;
+        // A server speaking legacy is authoritative: if an access_token is in the
+        // URL (the two are never both sent by a real backend), take the legacy
+        // path and ignore the code entirely.
+        if (urlParams.get("access_token"))
+            return null;
+        // Strip the one-time params right away so the code doesn't linger in the
+        // URL/history or get re-submitted on reload. `is_new_user` stays in the
+        // URL exactly as the legacy flow leaves it.
+        urlParams.delete("session_code");
+        urlParams.delete("session_exchange_path");
+        const newUrl = `${window.location.pathname}${urlParams.toString() ? `?${urlParams.toString()}` : ""}${window.location.hash}`;
+        window.history.replaceState({}, typeof document !== "undefined" ? document.title : "", newUrl);
+    }
+    catch (e) {
+        console.error("Error reading session handoff params from URL:", e);
+        return null;
+    }
+    return exchangeSessionHandoffCode(code, exchangePath);
+}
+async function exchangeSessionHandoffCode(code, exchangePath) {
+    // The verifier is one-shot: take it out of storage no matter how the
+    // exchange ends (a failed PKCE check doesn't burn the code server-side,
+    // but a stale verifier can never match a future login's challenge).
+    let verifier = null;
+    try {
+        verifier = window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY);
+        if (verifier !== null) {
+            window.sessionStorage.removeItem(PKCE_VERIFIER_STORAGE_KEY);
+        }
+    }
+    catch (_a) {
+        verifier = null;
+    }
+    // SECURITY: the exchange path arrives via the URL, so treat it as tainted.
+    // POSTing the code + verifier to an attacker-chosen origin would hand over
+    // both halves of the PKCE proof — enforce same-origin, path-only semantics.
+    let exchangeUrl;
+    try {
+        exchangeUrl = new URL(exchangePath, window.location.origin);
+    }
+    catch (_b) {
+        console.error("Invalid session_exchange_path; skipping token exchange.");
+        return null;
+    }
+    if (exchangeUrl.origin !== window.location.origin) {
+        console.error("Cross-origin session_exchange_path rejected; skipping token exchange.");
+        return null;
+    }
+    if (typeof fetch !== "function")
+        return null;
+    try {
+        const response = await fetch(exchangeUrl.toString(), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                code,
+                ...(verifier ? { code_verifier: verifier } : {}),
+            }),
+        });
+        if (!response.ok) {
+            if (!verifier) {
+                // Named failure mode (base44-dev/apper#17216): the login completed in
+                // a different tab/window than it started in, so the per-tab PKCE
+                // verifier is gone and the server fails closed. Logging in again from
+                // this tab works.
+                console.warn("Base44 SDK: SSO login could not be completed because it finished " +
+                    "in a different browser tab than it started in (missing PKCE " +
+                    "verifier). Please log in again.");
+            }
+            else {
+                console.error(`Base44 SDK: SSO session-code exchange failed (HTTP ${response.status}).`);
+            }
+            return null;
+        }
+        const data = await response.json();
+        const accessToken = data === null || data === void 0 ? void 0 : data.access_token;
+        return typeof accessToken === "string" && accessToken ? accessToken : null;
+    }
+    catch (e) {
+        console.error("Base44 SDK: SSO session-code exchange failed:", e);
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.41-pr.243.98f858c",
+  "version": "0.8.41-pr.244.e7d6747",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",