@base44-preview/sdk 0.8.48-pr.282.3c9bac2 → 0.8.48-pr.282.520fd69

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, isEmbeddedTab, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, isEmbeddedTab, isFramed, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -58,13 +58,19 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    const embedOtt = takeEmbedTokenFromUrl();
+    // Always taken off the URL, even outside a frame: a one-time token must not
+    // be left in the address bar, in history, or in a shared link.
+    const urlOtt = takeEmbedTokenFromUrl();
+    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
+    // back to the app's own login, which works there and cannot work in a frame.
+    const embedOtt = isFramed() ? urlOtt : null;
     if (embedOtt) {
         markEmbeddedTab();
     }
     const embedded = Boolean(embedOtt) || isEmbeddedTab();
-    // In a frame the passed token is the OTT itself or a stale stored one, not this session.
-    const token = embedded ? undefined : config.token;
+    // The passed token is the OTT itself whenever one came in on the URL, and a
+    // stale stored one in a frame. Neither of those is this session.
+    const token = urlOtt !== null || embedded ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -150,12 +156,25 @@ export function createClient(config) {
         userAuthModule.setToken(newToken, saveToStorage);
         socket === null || socket === void 0 ? void 0 : socket.reconnect();
     };
-    // Settles once the exchanged session is applied (memory only); at once otherwise.
+    // Settles once the exchanged session is applied (memory only); at once
+    // otherwise. Never rejects: every request waits on it, so a failure here
+    // must not turn into a rejection on each of them.
     const authReady = embedOtt
-        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+            .then((sessionToken) => {
+            var _a;
             if (sessionToken) {
                 applyToken(sessionToken, false);
+                return;
             }
+            // The app is about to run anonymous. Say why, once, instead of
+            // leaving only the 401s that follow.
+            const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
+            console.error(error.message);
+            (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        })
+            .catch((e) => {
+            console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
     if (embedOtt) {

package/dist/modules/auth.js

@@ -189,6 +189,10 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         setToken(token, saveToStorage = true) {
             if (!token)
                 return;
+            // An embedded session belongs to the frame the platform minted it for.
+            // Persisting it would let it outlive that frame and be picked up as the
+            // identity on a later top-level visit, so storage is refused outright.
+            const persist = saveToStorage && !options.embedded;
             // Same reasoning as in `logout`: the identity changes here, so anything
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
@@ -198,9 +202,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             // Save token to localStorage if requested
-            if (saveToStorage &&
-                typeof window !== "undefined" &&
-                window.localStorage) {
+            if (persist && typeof window !== "undefined" && window.localStorage) {
                 try {
                     window.localStorage.setItem("base44_access_token", token);
                     // Set "token" that is set by the built-in SDK of platform version 2

package/dist/utils/embed-session.d.ts

@@ -18,6 +18,14 @@ export declare const EMBED_TOKEN_PARAM = "ott";
  * @internal
  */
 export declare function takeEmbedTokenFromUrl(): string | null;
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export declare function isFramed(): boolean;
 /**
  * Whether this tab previously redeemed an embed token. Counts only inside a
  * frame: a top-level tab that once carried a token must fall back to the
@@ -42,8 +50,9 @@ export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }
 }): Promise<string | null>;
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */

package/dist/utils/embed-session.js

@@ -27,19 +27,43 @@ export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
         return null;
     }
+    let ott = null;
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
+        ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
         url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
-        return ott;
     }
     catch (e) {
+        // The token was read but the URL could not be rewritten (history blocked,
+        // a sandboxed frame, replaceState rate-limited). Return it anyway: it is
+        // this load's identity, and dropping it here would leave `?ott=` on the
+        // URL for getAccessToken to hand back as if it were a session token.
         console.error("Error retrieving embed token from URL:", e);
-        return null;
+    }
+    return ott;
+}
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export function isFramed() {
+    if (typeof window === "undefined") {
+        return false;
+    }
+    try {
+        return window.self !== window.top;
+    }
+    catch (_a) {
+        // Reaching the top window can be refused outright; if we cannot see it,
+        // we are certainly not it.
+        return true;
     }
 }
 /**
@@ -56,8 +80,7 @@ export function isEmbeddedTab() {
     // A cross-site frame is third-party storage, which some browsers block
     // outright — every access can throw, and the marker is then unavailable.
     try {
-        return (window.self !== window.top &&
-            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
+        return isFramed() && window.sessionStorage.getItem(EMBED_TAB_KEY) === "1";
     }
     catch (_a) {
         return false;
@@ -108,8 +131,9 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
 }
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */
@@ -131,7 +155,7 @@ export function showEmbedSessionEnded() {
     title.textContent = "Session ended";
     title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
     const body = document.createElement("p");
-    body.textContent = "Refresh the page to continue.";
+    body.textContent = "Reload this page in your browser to start a new session.";
     body.style.cssText = "margin:0;color:#475569;";
     const card = document.createElement("div");
     card.append(title, body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.3c9bac2",
+  "version": "0.8.48-pr.282.520fd69",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",