@base44-preview/sdk 0.8.48-pr.282.642a57e → 0.8.48-pr.282.6cbc158

package/dist/client.js

@@ -58,12 +58,16 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    // Stripped even outside a frame, so a one-time token is never left in the
-    // address bar, in history, or in a shared link. Only redeemed inside one.
-    const strippedOtt = takeEmbedTokenFromUrl();
-    const embedOtt = isFramed() ? strippedOtt : null;
-    // In a frame the caller's token is the OTT itself, which is not a session.
-    const token = embedOtt ? undefined : config.token;
+    // Always taken off the URL, even outside a frame: a one-time token must not
+    // be left in the address bar, in history, or in a shared link.
+    const urlOtt = takeEmbedTokenFromUrl();
+    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
+    // back to the app's own login, which works there and cannot work in a frame.
+    const embedOtt = isFramed() ? urlOtt : null;
+    const embedded = Boolean(embedOtt);
+    // The passed token is the OTT itself whenever one came in on the URL. That is
+    // not this session: it is what the exchange below trades for one.
+    const token = urlOtt !== null ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -119,7 +123,7 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
         token,
-        embedded: Boolean(embedOtt),
+        embedded,
         // The socket carries its token on the handshake, so an identity change
         // only reaches it by opening a new connection — or, on logout, by
         // dropping the one still running as the user who just left.
@@ -129,16 +133,15 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // Not in a frame: a stored token there belongs to an earlier visitor, not to
-    // this session, which only the exchange below can produce.
-    if (typeof window !== "undefined" && !embedOtt) {
+    // Skipped in a frame: the session comes from the exchange below.
+    if (typeof window !== "undefined" && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
             userAuthModule.setToken(accessToken);
         }
     }
     // Live token for every module; outside a frame it still falls back to storage.
-    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken()); };
+    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
@@ -179,6 +182,21 @@ export function createClient(config) {
             console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
+    // Everything that can wait for the session does. `aiGateway.connection()`
+    // and the agents connect URLs cannot: they hand back a value, not a promise,
+    // and a value read now would stay wrong after the session arrives. They warn
+    // instead of failing quietly.
+    let warnedEarlyRead = false;
+    const getTokenNow = () => {
+        const sessionToken = getToken();
+        if (sessionToken === null && session && !warnedEarlyRead) {
+            warnedEarlyRead = true;
+            console.warn("Base44: read a token before the embedded session was ready, so it is " +
+                "empty. Await a call such as base44.auth.me() before building a " +
+                "client or a URL that keeps the token.");
+        }
+        return sessionToken;
+    };
     if (session) {
         // Requests issued during the exchange wait for it. Registered after createAxiosClient's
         // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
@@ -246,11 +264,13 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            // Read synchronously, unlike everything else: these build a URL rather
-            // than issue a request, so during the exchange they see no token.
-            getToken,
+            getToken: getTokenNow,
+        }),
+        aiGateway: createAiGatewayModule({
+            serverUrl,
+            getToken: getTokenNow,
+            appId,
         }),
-        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -298,7 +318,7 @@ export function createClient(config) {
             // The user's token, as on the user-scoped module: the only thing this is
             // read for is the `?token=` on a channel URL handed to that user, which
             // the app's service credential must never end up in.
-            getToken,
+            getToken: getTokenNow,
         }),
         aiGateway: createAiGatewayModule({
             serverUrl,

package/dist/utils/embed-session.js

@@ -56,7 +56,15 @@ export function takeEmbedTokenFromUrl() {
 }
 /** @internal */
 export function isFramed() {
-    return typeof window !== "undefined" && window.self !== window.top;
+    if (typeof window === "undefined") {
+        return false;
+    }
+    try {
+        return window.self !== window.top;
+    }
+    catch (_a) {
+        return true;
+    }
 }
 /** @internal */
 export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.642a57e",
+  "version": "0.8.48-pr.282.6cbc158",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",