@base44-preview/sdk 0.8.48-pr.282.3c9bac2 → 0.8.48-pr.282.8443e7d

package/dist/client.js

@@ -58,13 +58,38 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
+    const inBrowser = typeof window !== "undefined";
+    // A host platform embeds the app with a one-time token on the iframe URL.
+    // It comes off the URL here, before any other code can read it; the
+    // exchange that turns it into a session runs once the modules exist.
     const embedOtt = takeEmbedTokenFromUrl();
     if (embedOtt) {
         markEmbeddedTab();
     }
     const embedded = Boolean(embedOtt) || isEmbeddedTab();
-    // In a frame the passed token is the OTT itself or a stale stored one, not this session.
+    // What an app passes as `token` is whatever getAccessToken() returned as the
+    // page loaded. In an embedded frame that is the one-time token itself, or a
+    // token an earlier visitor left in storage; neither is this session.
     const token = embedded ? undefined : config.token;
+    let currentToken = token !== null && token !== void 0 ? token : null;
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        // null (not undefined): an embedded frame's only identity is the one the
+        // platform minted, so the socket must not fall back to a stored token.
+        token: embedded ? null : token,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({
+                config: socketConfig,
+            });
+        }
+        return socket;
+    };
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -123,34 +148,35 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // Skipped in a frame: the session comes from the exchange below.
-    if (typeof window !== "undefined" && !embedded) {
+    // An embedded load skips this: its session comes from the exchange below,
+    // and a token an earlier visitor left in storage must not become it.
+    if (inBrowser && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
+            currentToken = accessToken;
             userAuthModule.setToken(accessToken);
         }
     }
-    // Live token for every module; outside a frame it still falls back to storage.
-    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        getToken,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({ config: socketConfig });
+    // The one answer every module reads. Follows setToken and logout; outside an
+    // embedded frame it still falls back to storage, so a login in another tab is
+    // picked up on the next connection, as before.
+    const getToken = () => {
+        if (userAuthModule.hasToken()) {
+            return currentToken;
         }
-        return socket;
+        return embedded ? null : getAccessToken();
     };
     const applyToken = (newToken, saveToStorage) => {
         userAuthModule.setToken(newToken, saveToStorage);
-        socket === null || socket === void 0 ? void 0 : socket.reconnect();
+        currentToken = newToken;
+        socketConfig.token = newToken;
+        if (socket) {
+            socket.updateConfig({ token: newToken });
+        }
     };
-    // Settles once the exchanged session is applied (memory only); at once otherwise.
+    // Resolves once the embedded session is in hand (or known not to be coming);
+    // immediately for every other client. The exchanged token is applied without
+    // persisting it: the session must not outlive the frame it was minted for.
     const authReady = embedOtt
         ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
             if (sessionToken) {
@@ -159,8 +185,9 @@ export function createClient(config) {
         })
         : Promise.resolve();
     if (embedOtt) {
-        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
-        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
+        // Requests issued while the exchange is in flight wait for it and carry the
+        // session it produces. Registered after createAxiosClient's interceptors,
+        // so it runs first and the anonymous-visitor header sees the Authorization.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;

package/dist/modules/auth.js

@@ -82,13 +82,10 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // Tracked here rather than read off `axios.defaults` so the answer stays tied
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
-    let accessToken = options.token || null;
+    let hasAccessToken = Boolean(options.token);
     return {
         hasToken() {
-            return accessToken !== null;
-        },
-        getToken() {
-            return accessToken;
+            return hasAccessToken;
         },
         isEmbedded() {
             return Boolean(options.embedded);
@@ -164,7 +161,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            accessToken = null;
+            hasAccessToken = false;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -193,7 +190,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            accessToken = token;
+            hasAccessToken = true;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;

package/dist/modules/auth.types.d.ts

@@ -560,9 +560,4 @@ export interface InternalAuthModule extends AuthModule {
      * could not succeed without a session, not to decide that one is valid.
      */
     hasToken(): boolean;
-    /**
-     * The access token currently set on the client, or `null` when there is none.
-     * Follows {@linkcode AuthModule.setToken | setToken} and {@linkcode AuthModule.logout | logout}.
-     */
-    getToken(): string | null;
 }

package/dist/utils/socket-utils.d.ts

@@ -4,8 +4,9 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** Asked on every connect, so the socket always carries the current session. */
-    getToken: () => string | null;
+    /** `undefined` means unknown — the socket looks in storage; `null` means
+     * known to be anonymous, so storage is never consulted. */
+    token?: string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;
@@ -41,7 +42,7 @@ export declare function RoomsSocket({ config }: {
         leave: (room: string) => void;
     }>;
     subscribeToRoom: (room: TSocketRoom, handlers: Partial<{ [k in TEvent]: THandler<k>; }>) => () => void;
-    reconnect: () => void;
+    updateConfig: (config: Partial<RoomsSocketConfig>) => void;
     updateModel: (room: string, data: any) => Promise<void>;
     disconnect: () => void;
 };

package/dist/utils/socket-utils.js

@@ -1,4 +1,5 @@
 import { io } from "socket.io-client";
+import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
@@ -6,7 +7,7 @@ function initializeSocket(config, handlers) {
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = config.getToken();
+    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
     const query = {
         app_id: config.appId,
         token: resolvedToken,
@@ -40,6 +41,7 @@ function initializeSocket(config, handlers) {
     return socket;
 }
 export function RoomsSocket({ config }) {
+    let currentConfig = { ...config };
     const roomsToListeners = {};
     const pendingRoomLeaves = {};
     const handlers = {
@@ -81,10 +83,13 @@ export function RoomsSocket({ config }) {
             socket.disconnect();
         }
     }
-    /** Drops the connection and opens a new one with the current token. */
-    function reconnect() {
+    function updateConfig(config) {
         cleanup();
-        socket = initializeSocket(config, handlers);
+        currentConfig = {
+            ...currentConfig,
+            ...config,
+        };
+        socket = initializeSocket(currentConfig, handlers);
     }
     function joinRoom(room) {
         socket.emit("join", room);
@@ -157,7 +162,7 @@ export function RoomsSocket({ config }) {
     return {
         socket,
         subscribeToRoom,
-        reconnect,
+        updateConfig,
         updateModel,
         disconnect,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.3c9bac2",
+  "version": "0.8.48-pr.282.8443e7d",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",