@base44-preview/sdk 0.8.48-pr.281.97e1467 → 0.8.48-pr.282.2b05017

package/dist/client.js

@@ -5,6 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
+import { exchangeEmbedToken, isEmbeddedTab, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -57,12 +58,24 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
+    const inBrowser = typeof window !== "undefined";
+    // A host platform embeds the app with a one-time token on the iframe URL.
+    // It comes off the URL here, before any other code can read it; the
+    // exchange that turns it into a session runs once the modules exist.
+    const embedOtt = inBrowser ? takeEmbedTokenFromUrl() : null;
+    const embedded = embedOtt !== null || (inBrowser && isEmbeddedTab());
+    if (embedOtt) {
+        markEmbeddedTab();
+    }
+    let currentToken = token !== null && token !== void 0 ? token : null;
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
         transports: ["websocket"],
         appId,
-        token,
+        // null (not undefined): an embedded frame's only identity is the one the
+        // platform minted, so the socket must not fall back to a stored token.
+        token: embedded ? null : token,
     };
     let socket = null;
     const getSocket = () => {
@@ -125,26 +138,73 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
         token,
+        embedded,
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    if (typeof window !== "undefined") {
+    // An embedded load skips this: its session comes from the exchange below,
+    // and a token an earlier visitor left in storage must not become it.
+    if (inBrowser && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
+            currentToken = accessToken;
             userAuthModule.setToken(accessToken);
         }
     }
+    // The one answer every module reads. Follows setToken and logout; outside an
+    // embedded frame it still falls back to storage, so a login in another tab is
+    // picked up on the next connection, as before.
+    const getToken = () => {
+        if (userAuthModule.hasToken()) {
+            return currentToken;
+        }
+        return embedded || !inBrowser ? null : getAccessToken();
+    };
+    const applyToken = (newToken, saveToStorage) => {
+        userAuthModule.setToken(newToken, saveToStorage);
+        currentToken = newToken;
+        socketConfig.token = newToken;
+        if (socket) {
+            socket.updateConfig({ token: newToken });
+        }
+    };
+    // Resolves once the embedded session is in hand (or known not to be coming);
+    // immediately for every other client. The exchanged token is applied without
+    // persisting it: the session must not outlive the frame it was minted for.
+    const authReady = embedOtt
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
+            if (sessionToken) {
+                applyToken(sessionToken, false);
+            }
+        })
+        : Promise.resolve();
+    if (embedOtt) {
+        // Requests issued while the exchange is in flight wait for it and carry the
+        // session it produces. Registered after createAxiosClient's interceptors,
+        // so it runs first and the anonymous-visitor header sees the Authorization.
+        for (const client of [axiosClient, functionsAxiosClient]) {
+            client.interceptors.request.use(async (requestConfig) => {
+                await authReady;
+                const sessionToken = getToken();
+                if (sessionToken && !requestConfig.headers.get("Authorization")) {
+                    requestConfig.headers.set("Authorization", `Bearer ${sessionToken}`);
+                }
+                return requestConfig;
+            });
+        }
+    }
     const actorsModule = createActorsModule({
         appId,
         // serverUrl is often relative/empty (same-origin app); the proxy-fallback
         // URL needs an absolute host, so fall back to the page origin.
         host: resolveActorsHost(serverUrl, typeof window !== "undefined" ? (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin : undefined),
         functionsVersion,
-        getAuthToken: () => token || getAccessToken(),
+        getAuthToken: getToken,
         mintConnectionToken: async (actorName, room, connectionId) => {
-            const authToken = token || getAccessToken();
+            await authReady;
+            const authToken = getToken();
             return await actorsAxiosClient.post(`/apps/${appId}/actors/${encodeURIComponent(actorName)}/connection-token`, { room, connection_id: connectionId }, {
                 headers: {
                     ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
@@ -171,10 +231,9 @@ export function createClient(config) {
         functions: createFunctionsModule(functionsAxiosClient, appId, {
             getAuthHeaders: () => {
                 const headers = {};
-                // Get current token from storage or initial config
-                const currentToken = token || getAccessToken();
-                if (currentToken) {
-                    headers["Authorization"] = `Bearer ${currentToken}`;
+                const sessionToken = getToken();
+                if (sessionToken) {
+                    headers["Authorization"] = `Bearer ${sessionToken}`;
                 }
                 return headers;
             },
@@ -185,9 +244,9 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            token,
+            getToken,
         }),
-        aiGateway: createAiGatewayModule({ serverUrl, token, appId }),
+        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -232,9 +291,13 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            token,
+            getToken: () => token,
+        }),
+        aiGateway: createAiGatewayModule({
+            serverUrl,
+            getToken: () => serviceToken,
+            appId,
         }),
-        aiGateway: createAiGatewayModule({ serverUrl, token: serviceToken, appId }),
         appLogs: createAppLogsModule(serviceRoleAxiosClient, appId),
         cleanup: () => {
             if (socket) {
@@ -274,6 +337,7 @@ export function createClient(config) {
          * Sets a new authentication token for all subsequent requests.
          *
          * @param newToken - The new authentication token
+         * @param saveToStorage - Whether to also keep the token in local storage. Defaults to `true`.
          *
          * @example
          * ```typescript
@@ -285,14 +349,8 @@ export function createClient(config) {
          * base44.setToken(access_token);
          * ```
          */
-        setToken(newToken) {
-            userModules.auth.setToken(newToken);
-            if (socket) {
-                socket.updateConfig({
-                    token: newToken,
-                });
-            }
-            socketConfig.token = newToken;
+        setToken(newToken, saveToStorage = true) {
+            applyToken(newToken, saveToStorage);
         },
         /**
          * Gets the current client configuration.

package/dist/client.types.d.ts

@@ -200,8 +200,9 @@ export interface Base44Client {
      * Updates the token for both HTTP requests and WebSocket connections.
      *
      * @param newToken - The new authentication token.
+     * @param saveToStorage - Whether to also keep the token in local storage so it survives a page load. Defaults to `true`.
      */
-    setToken(newToken: string): void;
+    setToken(newToken: string, saveToStorage?: boolean): void;
     /**
      * Gets the current client configuration.
      * @internal

package/dist/modules/agents.d.ts

@@ -1,2 +1,2 @@
 import { AgentsModule, AgentsModuleConfig } from "./agents.types.js";
-export declare function createAgentsModule({ axios, getSocket, appId, serverUrl, token, }: AgentsModuleConfig): AgentsModule;
+export declare function createAgentsModule({ axios, getSocket, appId, serverUrl, getToken, }: AgentsModuleConfig): AgentsModule;

package/dist/modules/agents.js

@@ -1,5 +1,4 @@
-import { getAccessToken } from "../utils/auth-utils.js";
-export function createAgentsModule({ axios, getSocket, appId, serverUrl, token, }) {
+export function createAgentsModule({ axios, getSocket, appId, serverUrl, getToken, }) {
     const baseURL = `/apps/${appId}/agents`;
     // Track active conversations
     const currentConversations = {};
@@ -56,7 +55,7 @@ export function createAgentsModule({ axios, getSocket, appId, serverUrl, token,
     };
     const getWhatsAppConnectURL = (agentName) => {
         const baseUrl = `${serverUrl}/api/apps/${appId}/agents/${encodeURIComponent(agentName)}/whatsapp`;
-        const accessToken = token !== null && token !== void 0 ? token : getAccessToken();
+        const accessToken = getToken();
         if (accessToken) {
             return `${baseUrl}?token=${accessToken}`;
         }
@@ -67,7 +66,7 @@ export function createAgentsModule({ axios, getSocket, appId, serverUrl, token,
     };
     const getTelegramConnectURL = (agentName) => {
         const baseUrl = `${serverUrl}/api/apps/${appId}/agents/${encodeURIComponent(agentName)}/telegram`;
-        const accessToken = token !== null && token !== void 0 ? token : getAccessToken();
+        const accessToken = getToken();
         if (accessToken) {
             return `${baseUrl}?token=${accessToken}`;
         }

package/dist/modules/agents.types.d.ts

@@ -160,8 +160,8 @@ export interface AgentsModuleConfig {
     appId: string;
     /** Server URL */
     serverUrl?: string;
-    /** Authentication token */
-    token?: string;
+    /** Returns the current authentication token, if any */
+    getToken: () => string | null | undefined;
 }
 /**
  * Agents module for managing AI agent conversations.

package/dist/modules/ai-gateway.d.ts

@@ -1,2 +1,2 @@
 import { AiGatewayModule, AiGatewayModuleConfig } from "./ai-gateway.types.js";
-export declare function createAiGatewayModule({ serverUrl, token, appId, }: AiGatewayModuleConfig): AiGatewayModule;
+export declare function createAiGatewayModule({ serverUrl, getToken, appId, }: AiGatewayModuleConfig): AiGatewayModule;

package/dist/modules/ai-gateway.js

@@ -1,10 +1,9 @@
-import { getAccessToken } from "../utils/auth-utils.js";
-export function createAiGatewayModule({ serverUrl, token, appId, }) {
+export function createAiGatewayModule({ serverUrl, getToken, appId, }) {
     const connection = () => {
         var _a;
         return ({
             baseURL: `${serverUrl}/api/apps/${appId}/ai/openai/v1`,
-            token: (_a = token !== null && token !== void 0 ? token : getAccessToken()) !== null && _a !== void 0 ? _a : "",
+            token: (_a = getToken()) !== null && _a !== void 0 ? _a : "",
         });
     };
     return {

package/dist/modules/ai-gateway.types.d.ts

@@ -17,8 +17,8 @@ export interface AiGatewayConnection {
 export interface AiGatewayModuleConfig {
     /** Server URL */
     serverUrl?: string;
-    /** Authentication token */
-    token?: string;
+    /** Returns the current authentication token, if any */
+    getToken: () => string | null | undefined;
     /** Application ID */
     appId: string;
 }

package/dist/modules/auth.js

@@ -1,4 +1,5 @@
 import { resetAnalyticsSessionContext } from "./analytics.js";
+import { showEmbedSessionEnded } from "../utils/embed-session.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -86,6 +87,9 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         hasToken() {
             return hasAccessToken;
         },
+        isEmbedded() {
+            return Boolean(options.embedded);
+        },
         // Get current user information
         async me() {
             const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
@@ -109,6 +113,12 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             if (typeof window === "undefined") {
                 throw new Error("Login method can only be used in a browser environment");
             }
+            // An embedded session can only be renewed by the host platform; the
+            // login round trip cannot complete inside its frame.
+            if (options.embedded) {
+                showEmbedSessionEnded();
+                return;
+            }
             // If nextUrl is not provided, use the current URL
             const redirectUrl = nextUrl
                 ? new URL(nextUrl, window.location.origin).toString()

package/dist/modules/auth.types.d.ts

@@ -98,6 +98,11 @@ export interface AuthModuleOptions {
      * which is how the server-side SDK reports a token it never sets explicitly.
      */
     token?: string;
+    /**
+     * Whether this client runs embedded in a host platform's frame, where a
+     * session is minted by the platform and cannot be renewed by a login redirect.
+     */
+    embedded?: boolean;
 }
 /**
  * Authentication module for managing user authentication and authorization. The module automatically stores tokens in local storage when available and manages authorization headers for API requests.
@@ -179,6 +184,22 @@ export interface AuthModule {
      * ```
      */
     redirectToLogin(nextUrl: string): void;
+    /**
+     * Whether the app is running embedded in a host platform.
+     *
+     * A platform embeds an app in an iframe and signs its user in by minting a one-time token onto the frame's URL; the SDK trades it for a session as the client is created. That session is held in memory only and can be renewed only by the platform, so when it ends there is no login page to send the user to — {@linkcode AuthModule.redirectToLogin | redirectToLogin()} shows a "session ended" notice instead. Use this to render your own notice or to hide sign-in and sign-out controls that cannot work inside the frame.
+     *
+     * @returns `true` when the app was embedded by a host platform, `false` otherwise.
+     *
+     * @example
+     * ```typescript
+     * // Show your own message instead of a login screen
+     * if (!user && base44.auth.isEmbedded()) {
+     *   return <SessionEnded />;
+     * }
+     * ```
+     */
+    isEmbedded(): boolean;
     /**
      * Redirects the user to a third-party authentication provider's login page.
      *

package/dist/utils/embed-session.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Sessions for apps embedded in a host platform.
+ *
+ * The platform's server mints a one-time token for one of its users and puts
+ * it on the iframe URL as `?ott=`. The client takes it off the URL as it is
+ * created, trades it for an app-user session through the OAuth token-exchange
+ * grant (RFC 8693), and keeps the result in memory only — never in storage — so
+ * the session lives and dies with the frame.
+ *
+ * @internal
+ */
+/**
+ * Reads the one-time token off the current URL and strips it, so it is never
+ * left in the address bar, in history, or in a shared link.
+ *
+ * @internal
+ */
+export declare function takeEmbedTokenFromUrl(): string | null;
+/**
+ * Whether this tab previously redeemed an embed token. Counts only inside a
+ * frame: a top-level tab that once carried a token must fall back to the
+ * regular login, or it could never sign in again.
+ *
+ * @internal
+ */
+export declare function isEmbeddedTab(): boolean;
+/** @internal */
+export declare function markEmbeddedTab(): void;
+/**
+ * Trades a one-time embed token for an app-user session token. Resolves to
+ * `null` when the platform refuses the token; never throws.
+ *
+ * @internal
+ */
+export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }: {
+    serverUrl: string;
+    appId: string;
+    ott: string;
+    fetchImpl?: typeof fetch;
+}): Promise<string | null>;
+/**
+ * Covers the page with a plain "session ended" notice. An embedded session can
+ * only be renewed by the host platform (by reloading its own page), so this
+ * stands in for the login redirect, which cannot complete inside a frame.
+ *
+ * @internal
+ */
+export declare function showEmbedSessionEnded(): void;

package/dist/utils/embed-session.js

@@ -0,0 +1,139 @@
+/**
+ * Sessions for apps embedded in a host platform.
+ *
+ * The platform's server mints a one-time token for one of its users and puts
+ * it on the iframe URL as `?ott=`. The client takes it off the URL as it is
+ * created, trades it for an app-user session through the OAuth token-exchange
+ * grant (RFC 8693), and keeps the result in memory only — never in storage — so
+ * the session lives and dies with the frame.
+ *
+ * @internal
+ */
+const OTT_PARAM = "ott";
+const EMBED_TAB_KEY = "base44_embed_session";
+const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
+const RATE_LIMITED = 429;
+const RATE_LIMIT_RETRY_MS = 1000;
+const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
+/**
+ * Reads the one-time token off the current URL and strips it, so it is never
+ * left in the address bar, in history, or in a shared link.
+ *
+ * @internal
+ */
+export function takeEmbedTokenFromUrl() {
+    if (typeof window === "undefined" || !window.location) {
+        return null;
+    }
+    try {
+        const url = new URL(window.location.href);
+        const ott = url.searchParams.get(OTT_PARAM);
+        if (!ott) {
+            return null;
+        }
+        url.searchParams.delete(OTT_PARAM);
+        window.history.replaceState(window.history.state, "", url.toString());
+        return ott;
+    }
+    catch (e) {
+        console.error("Error retrieving embed token from URL:", e);
+        return null;
+    }
+}
+/**
+ * Whether this tab previously redeemed an embed token. Counts only inside a
+ * frame: a top-level tab that once carried a token must fall back to the
+ * regular login, or it could never sign in again.
+ *
+ * @internal
+ */
+export function isEmbeddedTab() {
+    if (typeof window === "undefined") {
+        return false;
+    }
+    // A cross-site frame is third-party storage, which some browsers block
+    // outright — every access can throw, and the marker is then unavailable.
+    try {
+        return (window.self !== window.top &&
+            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** @internal */
+export function markEmbeddedTab() {
+    try {
+        window.sessionStorage.setItem(EMBED_TAB_KEY, "1");
+    }
+    catch (_a) {
+        /* storage blocked */
+    }
+}
+/**
+ * Trades a one-time embed token for an app-user session token. Resolves to
+ * `null` when the platform refuses the token; never throws.
+ *
+ * @internal
+ */
+export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {
+    const post = () => fetchImpl(`${serverUrl}/api/apps/${appId}/auth/embed/token`, {
+        method: "POST",
+        headers: { "X-App-Id": String(appId) },
+        body: new URLSearchParams({
+            grant_type: GRANT_TYPE,
+            subject_token: ott,
+            subject_token_type: SUBJECT_TOKEN_TYPE,
+        }),
+    });
+    try {
+        let response = await post();
+        // The limiter refuses before the token is redeemed, so it is still valid.
+        if (response.status === RATE_LIMITED) {
+            await new Promise((resolve) => setTimeout(resolve, RATE_LIMIT_RETRY_MS));
+            response = await post();
+        }
+        if (!response.ok) {
+            return null;
+        }
+        const { access_token: token } = (await response.json());
+        return token || null;
+    }
+    catch (e) {
+        console.error("Embed token exchange failed:", e);
+        return null;
+    }
+}
+/**
+ * Covers the page with a plain "session ended" notice. An embedded session can
+ * only be renewed by the host platform (by reloading its own page), so this
+ * stands in for the login redirect, which cannot complete inside a frame.
+ *
+ * @internal
+ */
+export function showEmbedSessionEnded() {
+    if (typeof document === "undefined" || !document.body) {
+        return;
+    }
+    if (document.getElementById(SESSION_ENDED_ELEMENT_ID)) {
+        return;
+    }
+    const overlay = document.createElement("div");
+    overlay.id = SESSION_ENDED_ELEMENT_ID;
+    overlay.setAttribute("role", "alert");
+    overlay.style.cssText =
+        "position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;" +
+            "justify-content:center;background:#fff;color:#0f172a;" +
+            "font-family:ui-sans-serif,system-ui,sans-serif;text-align:center;padding:2rem;";
+    const title = document.createElement("h1");
+    title.textContent = "Session ended";
+    title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
+    const body = document.createElement("p");
+    body.textContent = "Refresh the page to continue.";
+    body.style.cssText = "margin:0;color:#475569;";
+    const card = document.createElement("div");
+    card.append(title, body);
+    overlay.append(card);
+    document.body.append(overlay);
+}

package/dist/utils/socket-utils.d.ts

@@ -4,7 +4,9 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    token?: string;
+    /** `undefined` means unknown — the socket looks in storage; `null` means
+     * known to be anonymous, so storage is never consulted. */
+    token?: string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;

package/dist/utils/socket-utils.js

@@ -3,12 +3,11 @@ import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
-    var _a;
     // On unauthenticated clients, send a stable anonymous visitor id on the
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = (_a = config.token) !== null && _a !== void 0 ? _a : getAccessToken();
+    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
     const query = {
         app_id: config.appId,
         token: resolvedToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.281.97e1467",
+  "version": "0.8.48-pr.282.2b05017",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",