@base44-preview/sdk 0.8.48-pr.282.8f60b80 → 0.8.48-pr.282.b3c4c1e

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, frameSession, isFramed, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -58,16 +58,34 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    // Always taken off the URL, even outside a frame: a one-time token must not
-    // be left in the address bar, in history, or in a shared link.
-    const urlOtt = takeEmbedTokenFromUrl();
-    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
-    // back to the app's own login, which works there and cannot work in a frame.
-    const embedOtt = isFramed() ? urlOtt : null;
-    const embedded = Boolean(embedOtt);
-    // The passed token is the OTT itself whenever one came in on the URL. That is
-    // not this session: it is what the exchange below trades for one.
-    const token = urlOtt !== null ? undefined : config.token;
+    const embedOtt = takeEmbedTokenFromUrl();
+    // Asked again on every use, so a session that arrives later — from the
+    // exchange, or from a login — reaches the socket and every other module.
+    // A declaration, not a const, so this block can stay above the auth module.
+    function getToken() {
+        var _a;
+        return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken());
+    }
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({
+                config: socketConfig,
+            });
+        }
+        return socket;
+    };
+    // Apps read getAccessToken() as they load and pass the result in as `token`,
+    // so on an embedded load this is the OTT: proof of an identity, not one to
+    // send as a bearer. The exchange below is what turns it into a session.
+    const token = embedOtt ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -116,14 +134,11 @@ export function createClient(config) {
         baseURL: `${serverUrl}/api`,
         headers,
     });
-    // Declared before the auth module so `onSessionChange` can reach it; the
-    // socket itself is still only built on first use, below.
-    let socket = null;
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
         token,
-        embedded,
+        embedded: Boolean(embedOtt),
         // The socket carries its token on the handshake, so an identity change
         // only reaches it by opening a new connection — or, on logout, by
         // dropping the one still running as the user who just left.
@@ -133,34 +148,17 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // Skipped in a frame: the session comes from the exchange below.
-    if (typeof window !== "undefined" && !embedded) {
+    // Not in a frame: a stored token there belongs to an earlier visitor, not to
+    // this session, which only the exchange below can produce.
+    if (typeof window !== "undefined" && !embedOtt) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
             userAuthModule.setToken(accessToken);
         }
     }
-    // Live token for every module; outside a frame it still falls back to storage.
-    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        getToken,
-    };
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({ config: socketConfig });
-        }
-        return socket;
-    };
-    // The exchange belongs to the frame, not to one client: the token is off the
-    // URL after the first `createClient`, so a second one in the same document
-    // joins the session already being negotiated rather than going anonymous.
     const session = embedOtt
-        ? frameSession(appId, () => exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }))
-        : frameSession(appId);
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+        : null;
     // Settles once the exchanged session is applied (memory only); at once
     // otherwise. Never rejects: every request waits on it, so a failure here
     // must not turn into a rejection on each of them.
@@ -182,21 +180,6 @@ export function createClient(config) {
             console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
-    // Everything that can wait for the session does. `aiGateway.connection()`
-    // and the agents connect URLs cannot: they hand back a value, not a promise,
-    // and a value read now would stay wrong after the session arrives. They warn
-    // instead of failing quietly.
-    let warnedEarlyRead = false;
-    const getTokenNow = () => {
-        const sessionToken = getToken();
-        if (sessionToken === null && session && !warnedEarlyRead) {
-            warnedEarlyRead = true;
-            console.warn("Base44: read a token before the embedded session was ready, so it is " +
-                "empty. Await a call such as base44.auth.me() before building a " +
-                "client or a URL that keeps the token.");
-        }
-        return sessionToken;
-    };
     if (session) {
         // Requests issued during the exchange wait for it. Registered after createAxiosClient's
         // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
@@ -264,13 +247,11 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            getToken: getTokenNow,
-        }),
-        aiGateway: createAiGatewayModule({
-            serverUrl,
-            getToken: getTokenNow,
-            appId,
+            // Read synchronously, unlike everything else: these build a URL rather
+            // than issue a request, so during the exchange they see no token.
+            getToken,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -318,7 +299,7 @@ export function createClient(config) {
             // The user's token, as on the user-scoped module: the only thing this is
             // read for is the `?token=` on a channel URL handed to that user, which
             // the app's service credential must never end up in.
-            getToken: getTokenNow,
+            getToken,
         }),
         aiGateway: createAiGatewayModule({
             serverUrl,

package/dist/modules/actors.d.ts

@@ -11,8 +11,9 @@ interface ActorsConfig {
     appId: string;
     /** Current user access token, if authenticated. Rides the WS query on the
      * proxy-fallback path so the platform proxy can authenticate the connection;
-     * anonymous connects omit it. */
-    getAuthToken(): string | null | undefined | Promise<string | null | undefined>;
+     * anonymous connects omit it. Awaited per dial, so a session still being
+     * exchanged is in hand before the URL is built. */
+    getAuthToken(): Promise<string | null | undefined>;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;

package/dist/utils/embed-session.d.ts

@@ -7,6 +7,12 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
+ * Taking the token off the URL is unconditional — a one-time token must not be
+ * left in the address bar, in history, or in a shared link — but it is only
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
+ *
  * The exchange endpoint is rate limited per app, and its limiter refuses before
  * the one-time token is redeemed — so a 429 leaves the token still valid and is
  * worth retrying once.
@@ -15,8 +21,6 @@
  */
 export declare const EMBED_TOKEN_PARAM = "ott";
 /** @internal */
-export declare function frameSession(appId: string, start?: () => Promise<string | null>): Promise<string | null> | null;
-/** @internal */
 export declare function takeEmbedTokenFromUrl(): string | null;
 /** @internal */
 export declare function isFramed(): boolean;

package/dist/utils/embed-session.js

@@ -7,6 +7,12 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
+ * Taking the token off the URL is unconditional — a one-time token must not be
+ * left in the address bar, in history, or in a shared link — but it is only
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
+ *
  * The exchange endpoint is rate limited per app, and its limiter refuses before
  * the one-time token is redeemed — so a 429 leaves the token still valid and is
  * worth retrying once.
@@ -20,20 +26,6 @@ const RATE_LIMITED = 429;
 const RATE_LIMIT_RETRY_MS = 1000;
 const EXCHANGE_TIMEOUT_MS = 15000;
 const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
-const FRAME_SESSIONS_KEY = "__base44EmbedSessions";
-/** @internal */
-export function frameSession(appId, start) {
-    var _a, _b;
-    var _c;
-    if (typeof window === "undefined") {
-        return start ? start() : null;
-    }
-    const sessions = ((_a = (_c = window)[FRAME_SESSIONS_KEY]) !== null && _a !== void 0 ? _a : (_c[FRAME_SESSIONS_KEY] = {}));
-    if (!sessions[appId] && start) {
-        sessions[appId] = start();
-    }
-    return (_b = sessions[appId]) !== null && _b !== void 0 ? _b : null;
-}
 /** @internal */
 export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
@@ -52,16 +44,11 @@ export function takeEmbedTokenFromUrl() {
     catch (e) {
         console.error("Error retrieving embed token from URL:", e);
     }
-    return ott;
+    return isFramed() ? ott : null;
 }
 /** @internal */
 export function isFramed() {
-    try {
-        return typeof window !== "undefined" && window.self !== window.top;
-    }
-    catch (_a) {
-        return true;
-    }
+    return typeof window !== "undefined" && window.self !== window.top;
 }
 /** @internal */
 export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.8f60b80",
+  "version": "0.8.48-pr.282.b3c4c1e",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",