@base44-preview/sdk 0.8.48-pr.282.8affbe6 → 0.8.48-pr.282.a87ae54

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, isEmbeddedTab, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, isEmbeddedTab, isFramed, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -55,41 +55,22 @@ import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
  */
 export function createClient(config) {
     var _a, _b, _c, _d;
-    const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
+    const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    const inBrowser = typeof window !== "undefined";
-    // A host platform embeds the app with a one-time token on the iframe URL.
-    // It comes off the URL here, before any other code can read it; the
-    // exchange that turns it into a session runs once the modules exist.
-    const embedOtt = inBrowser ? takeEmbedTokenFromUrl() : null;
-    const embedded = embedOtt !== null || (inBrowser && isEmbeddedTab());
+    // Always taken off the URL, even outside a frame: a one-time token must not
+    // be left in the address bar, in history, or in a shared link.
+    const urlOtt = takeEmbedTokenFromUrl();
+    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
+    // back to the app's own login, which works there and cannot work in a frame.
+    const embedOtt = isFramed() ? urlOtt : null;
     if (embedOtt) {
         markEmbeddedTab();
     }
-    // What an app passes as `token` is whatever getAccessToken() returned as the
-    // page loaded. In an embedded frame that is the one-time token itself, or a
-    // token an earlier visitor left in storage; neither is this session.
-    const configToken = embedded ? undefined : token;
-    let currentToken = configToken !== null && configToken !== void 0 ? configToken : null;
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        // null (not undefined): an embedded frame's only identity is the one the
-        // platform minted, so the socket must not fall back to a stored token.
-        token: embedded ? null : configToken,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({
-                config: socketConfig,
-            });
-        }
-        return socket;
-    };
+    const embedded = Boolean(embedOtt) || isEmbeddedTab();
+    // The passed token is the OTT itself whenever one came in on the URL, and a
+    // stale stored one in a frame. Neither of those is this session.
+    const token = urlOtt !== null || embedded ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -103,19 +84,19 @@ export function createClient(config) {
     const axiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers,
-        token: configToken,
+        token,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const functionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers: functionHeaders,
-        token: configToken,
+        token,
         interceptResponses: false,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const serviceRoleHeaders = {
         ...headers,
-        ...(configToken ? { "on-behalf-of": `Bearer ${configToken}` } : {}),
+        ...(token ? { "on-behalf-of": `Bearer ${token}` } : {}),
     };
     const serviceRoleAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
@@ -141,53 +122,79 @@ export function createClient(config) {
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
-        token: configToken,
+        token,
         embedded,
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // An embedded load skips this: its session comes from the exchange below,
-    // and a token an earlier visitor left in storage must not become it.
-    if (inBrowser && !embedded) {
-        const accessToken = configToken || getAccessToken();
+    // Skipped in a frame: the session comes from the exchange below.
+    if (typeof window !== "undefined" && !embedded) {
+        const accessToken = token || getAccessToken();
         if (accessToken) {
-            currentToken = accessToken;
             userAuthModule.setToken(accessToken);
         }
     }
-    // The one answer every module reads. Follows setToken and logout; outside an
-    // embedded frame it still falls back to storage, so a login in another tab is
-    // picked up on the next connection, as before.
-    const getToken = () => {
-        if (userAuthModule.hasToken()) {
-            return currentToken;
+    // Live token for every module; outside a frame it still falls back to storage.
+    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({ config: socketConfig });
         }
-        return embedded || !inBrowser ? null : getAccessToken();
+        return socket;
     };
     const applyToken = (newToken, saveToStorage) => {
         userAuthModule.setToken(newToken, saveToStorage);
-        currentToken = newToken;
-        socketConfig.token = newToken;
-        if (socket) {
-            socket.updateConfig({ token: newToken });
-        }
+        socket === null || socket === void 0 ? void 0 : socket.reconnect();
     };
-    // Resolves once the embedded session is in hand (or known not to be coming);
-    // immediately for every other client. The exchanged token is applied without
-    // persisting it: the session must not outlive the frame it was minted for.
+    // Settles once the exchanged session is applied (memory only); at once
+    // otherwise. Never rejects: every request waits on it, so a failure here
+    // must not turn into a rejection on each of them.
     const authReady = embedOtt
-        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+            .then((sessionToken) => {
+            var _a;
             if (sessionToken) {
                 applyToken(sessionToken, false);
+                return;
             }
+            // The app is about to run anonymous. Say why, once, instead of
+            // leaving only the 401s that follow.
+            const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
+            console.error(error.message);
+            (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        })
+            .catch((e) => {
+            console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
+    // Everything that can wait for the session does. `aiGateway.connection()`
+    // and the agents connect URLs cannot: they hand back a value, not a promise,
+    // and a value read now would stay wrong after the session arrives. They warn
+    // instead of failing quietly.
+    let warnedEarlyRead = false;
+    const getTokenNow = () => {
+        const sessionToken = getToken();
+        if (sessionToken === null && embedOtt && !warnedEarlyRead) {
+            warnedEarlyRead = true;
+            console.warn("Base44: read a token before the embedded session was ready, so it is " +
+                "empty. Await a call such as base44.auth.me() before building a " +
+                "client or a URL that keeps the token.");
+        }
+        return sessionToken;
+    };
     if (embedOtt) {
-        // Requests issued while the exchange is in flight wait for it and carry the
-        // session it produces. Registered after createAxiosClient's interceptors,
-        // so it runs first and the anonymous-visitor header sees the Authorization.
+        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
+        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;
@@ -205,7 +212,10 @@ export function createClient(config) {
         // URL needs an absolute host, so fall back to the page origin.
         host: resolveActorsHost(serverUrl, typeof window !== "undefined" ? (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin : undefined),
         functionsVersion,
-        getAuthToken: getToken,
+        getAuthToken: async () => {
+            await authReady;
+            return getToken();
+        },
         mintConnectionToken: async (actorName, room, connectionId) => {
             await authReady;
             const authToken = getToken();
@@ -233,6 +243,7 @@ export function createClient(config) {
         connectors: createUserConnectorsModule(axiosClient, appId),
         auth: userAuthModule,
         functions: createFunctionsModule(functionsAxiosClient, appId, {
+            waitForAuth: () => authReady,
             getAuthHeaders: () => {
                 const headers = {};
                 const sessionToken = getToken();
@@ -248,9 +259,13 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            getToken,
+            getToken: getTokenNow,
+        }),
+        aiGateway: createAiGatewayModule({
+            serverUrl,
+            getToken: getTokenNow,
+            appId,
         }),
-        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -336,6 +351,7 @@ export function createClient(config) {
             serverUrl,
             functionsVersion,
             platformHeaders: optionalHeaders,
+            waitForAuth: () => authReady,
         }),
         /**
          * Sets a new authentication token for all subsequent requests.

package/dist/modules/actors.d.ts

@@ -12,7 +12,7 @@ interface ActorsConfig {
     /** Current user access token, if authenticated. Rides the WS query on the
      * proxy-fallback path so the platform proxy can authenticate the connection;
      * anonymous connects omit it. */
-    getAuthToken(): string | null | undefined;
+    getAuthToken(): string | null | undefined | Promise<string | null | undefined>;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;

package/dist/modules/actors.js

@@ -83,7 +83,7 @@ class Connection {
                 }
             }
             // Rebuilt per attempt so a login/logout is picked up on reconnect.
-            return buildProxyActorUrl(config.host, actorName, instanceId, this.id, config.appId, config.getAuthToken(), config.functionsVersion);
+            return buildProxyActorUrl(config.host, actorName, instanceId, this.id, config.appId, await config.getAuthToken(), config.functionsVersion);
         };
         const ws = new ReconnectingWebSocket(urlProvider);
         this.ws = ws;

package/dist/modules/auth.js

@@ -82,10 +82,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // Tracked here rather than read off `axios.defaults` so the answer stays tied
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
-    let hasAccessToken = Boolean(options.token);
+    let accessToken = options.token || null;
     return {
         hasToken() {
-            return hasAccessToken;
+            return accessToken !== null;
+        },
+        getToken() {
+            return accessToken;
         },
         isEmbedded() {
             return Boolean(options.embedded);
@@ -161,7 +164,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = false;
+            accessToken = null;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -186,18 +189,20 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         setToken(token, saveToStorage = true) {
             if (!token)
                 return;
+            // An embedded session belongs to the frame the platform minted it for.
+            // Persisting it would let it outlive that frame and be picked up as the
+            // identity on a later top-level visit, so storage is refused outright.
+            const persist = saveToStorage && !options.embedded;
             // Same reasoning as in `logout`: the identity changes here, so anything
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = true;
+            accessToken = token;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             // Save token to localStorage if requested
-            if (saveToStorage &&
-                typeof window !== "undefined" &&
-                window.localStorage) {
+            if (persist && typeof window !== "undefined" && window.localStorage) {
                 try {
                     window.localStorage.setItem("base44_access_token", token);
                     // Set "token" that is set by the built-in SDK of platform version 2

package/dist/modules/auth.types.d.ts

@@ -560,4 +560,9 @@ export interface InternalAuthModule extends AuthModule {
      * could not succeed without a session, not to decide that one is valid.
      */
     hasToken(): boolean;
+    /**
+     * The access token currently set on the client, or `null` when there is none.
+     * Follows {@linkcode AuthModule.setToken | setToken} and {@linkcode AuthModule.logout | logout}.
+     */
+    getToken(): string | null;
 }

package/dist/modules/functions.js

@@ -65,8 +65,12 @@ export function createFunctionsModule(axios, appId, config) {
         },
         // Fetch a backend function endpoint directly.
         async fetch(path, init = {}) {
+            var _a;
             const normalizedPath = path.startsWith("/") ? path : `/${path}`;
             const primaryPath = `/functions${normalizedPath}`;
+            // Headers are read after this: a session still being negotiated must be
+            // in hand before the Authorization is built, not after.
+            await ((_a = config === null || config === void 0 ? void 0 : config.waitForAuth) === null || _a === void 0 ? void 0 : _a.call(config));
             const headers = toHeaders(init.headers);
             const requestInit = {
                 ...init,

package/dist/modules/functions.types.d.ts

@@ -29,6 +29,12 @@ export type FunctionsFetchInit = RequestInit;
 export interface FunctionsModuleConfig {
     getAuthHeaders?: () => Record<string, string>;
     baseURL?: string;
+    /**
+     * Resolves once the client's session is settled. `fetch` builds its headers
+     * by hand rather than through axios, so without this it would miss the gate
+     * every other request goes through.
+     */
+    waitForAuth?: () => Promise<void>;
 }
 /**
  * Functions module for invoking custom backend functions.

package/dist/utils/embed-session.d.ts

@@ -18,6 +18,14 @@ export declare const EMBED_TOKEN_PARAM = "ott";
  * @internal
  */
 export declare function takeEmbedTokenFromUrl(): string | null;
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export declare function isFramed(): boolean;
 /**
  * Whether this tab previously redeemed an embed token. Counts only inside a
  * frame: a top-level tab that once carried a token must fall back to the
@@ -42,8 +50,9 @@ export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }
 }): Promise<string | null>;
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */

package/dist/utils/embed-session.js

@@ -27,19 +27,43 @@ export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
         return null;
     }
+    let ott = null;
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
+        ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
         url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
-        return ott;
     }
     catch (e) {
+        // The token was read but the URL could not be rewritten (history blocked,
+        // a sandboxed frame, replaceState rate-limited). Return it anyway: it is
+        // this load's identity, and dropping it here would leave `?ott=` on the
+        // URL for getAccessToken to hand back as if it were a session token.
         console.error("Error retrieving embed token from URL:", e);
-        return null;
+    }
+    return ott;
+}
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export function isFramed() {
+    if (typeof window === "undefined") {
+        return false;
+    }
+    try {
+        return window.self !== window.top;
+    }
+    catch (_a) {
+        // Reaching the top window can be refused outright; if we cannot see it,
+        // we are certainly not it.
+        return true;
     }
 }
 /**
@@ -56,8 +80,7 @@ export function isEmbeddedTab() {
     // A cross-site frame is third-party storage, which some browsers block
     // outright — every access can throw, and the marker is then unavailable.
     try {
-        return (window.self !== window.top &&
-            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
+        return isFramed() && window.sessionStorage.getItem(EMBED_TAB_KEY) === "1";
     }
     catch (_a) {
         return false;
@@ -108,8 +131,9 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
 }
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */
@@ -131,7 +155,7 @@ export function showEmbedSessionEnded() {
     title.textContent = "Session ended";
     title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
     const body = document.createElement("p");
-    body.textContent = "Refresh the page to continue.";
+    body.textContent = "Reload this page in your browser to start a new session.";
     body.style.cssText = "margin:0;color:#475569;";
     const card = document.createElement("div");
     card.append(title, body);

package/dist/utils/fetch-with-auth.d.ts

@@ -33,11 +33,13 @@ export interface FetchWithAuthInit extends RequestInit {
  * has none, so nothing is sent.
  * @internal
  */
-export declare function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, }: {
+export declare function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, waitForAuth, }: {
     axios: AxiosInstance;
     serviceRoleAxios: AxiosInstance;
     appId: string;
     serverUrl: string;
     functionsVersion?: string;
     platformHeaders?: Record<string, string>;
+    /** Resolves once the client's session is settled. */
+    waitForAuth?: () => Promise<void>;
 }): (path: string, init?: FetchWithAuthInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -21,7 +21,7 @@
  * has none, so nothing is sent.
  * @internal
  */
-export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, }) {
+export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, waitForAuth, }) {
     const inherited = new Headers(platformHeaders);
     const bearer = (client) => {
         const header = client.defaults.headers.common["Authorization"];
@@ -31,6 +31,9 @@ export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl,
     };
     return async function fetchWithAuth(path, init = {}) {
         assertOwnOriginPath(path);
+        // The Authorization below is read off the axios defaults, which a session
+        // still being negotiated has not written yet.
+        await (waitForAuth === null || waitForAuth === void 0 ? void 0 : waitForAuth());
         const { fetch: transport = fetch, ...requestInit } = init;
         const headers = new Headers(init.headers);
         // A caller-supplied value always wins, so a route can hand the callee a

package/dist/utils/socket-utils.d.ts

@@ -4,9 +4,8 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** `undefined` means unknown — the socket looks in storage; `null` means
-     * known to be anonymous, so storage is never consulted. */
-    token?: string | null;
+    /** Asked on every connect, so the socket always carries the current session. */
+    getToken: () => string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;
@@ -42,7 +41,7 @@ export declare function RoomsSocket({ config }: {
         leave: (room: string) => void;
     }>;
     subscribeToRoom: (room: TSocketRoom, handlers: Partial<{ [k in TEvent]: THandler<k>; }>) => () => void;
-    updateConfig: (config: Partial<RoomsSocketConfig>) => void;
+    reconnect: () => void;
     updateModel: (room: string, data: any) => Promise<void>;
     disconnect: () => void;
 };

package/dist/utils/socket-utils.js

@@ -1,5 +1,4 @@
 import { io } from "socket.io-client";
-import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
@@ -7,7 +6,7 @@ function initializeSocket(config, handlers) {
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
+    const resolvedToken = config.getToken();
     const query = {
         app_id: config.appId,
         token: resolvedToken,
@@ -41,7 +40,6 @@ function initializeSocket(config, handlers) {
     return socket;
 }
 export function RoomsSocket({ config }) {
-    let currentConfig = { ...config };
     const roomsToListeners = {};
     const pendingRoomLeaves = {};
     const handlers = {
@@ -83,13 +81,10 @@ export function RoomsSocket({ config }) {
             socket.disconnect();
         }
     }
-    function updateConfig(config) {
+    /** Drops the connection and opens a new one with the current token. */
+    function reconnect() {
         cleanup();
-        currentConfig = {
-            ...currentConfig,
-            ...config,
-        };
-        socket = initializeSocket(currentConfig, handlers);
+        socket = initializeSocket(config, handlers);
     }
     function joinRoom(room) {
         socket.emit("join", room);
@@ -162,7 +157,7 @@ export function RoomsSocket({ config }) {
     return {
         socket,
         subscribeToRoom,
-        updateConfig,
+        reconnect,
         updateModel,
         disconnect,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.8affbe6",
+  "version": "0.8.48-pr.282.a87ae54",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",