@base44-preview/sdk 0.8.48-pr.282.c69fdcd → 0.8.48-pr.283.2de4c8a

package/dist/utils/embed-session.d.ts

@@ -1,50 +0,0 @@
-/**
- * Sessions for apps embedded in a host platform.
- *
- * The platform's server mints a one-time token for one of its users and puts
- * it on the iframe URL as `?ott=`. The client takes it off the URL as it is
- * created, trades it for an app-user session through the OAuth token-exchange
- * grant (RFC 8693), and keeps the result in memory only — never in storage — so
- * the session lives and dies with the frame.
- *
- * @internal
- */
-/** The query parameter a host platform puts the one-time token on. @internal */
-export declare const EMBED_TOKEN_PARAM = "ott";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
- *
- * @internal
- */
-export declare function takeEmbedTokenFromUrl(): string | null;
-/**
- * Whether this tab previously redeemed an embed token. Counts only inside a
- * frame: a top-level tab that once carried a token must fall back to the
- * regular login, or it could never sign in again.
- *
- * @internal
- */
-export declare function isEmbeddedTab(): boolean;
-/** @internal */
-export declare function markEmbeddedTab(): void;
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
-export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }: {
-    serverUrl: string;
-    appId: string;
-    ott: string;
-    fetchImpl?: typeof fetch;
-}): Promise<string | null>;
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
- *
- * @internal
- */
-export declare function showEmbedSessionEnded(): void;

package/dist/utils/embed-session.js

@@ -1,140 +0,0 @@
-/**
- * Sessions for apps embedded in a host platform.
- *
- * The platform's server mints a one-time token for one of its users and puts
- * it on the iframe URL as `?ott=`. The client takes it off the URL as it is
- * created, trades it for an app-user session through the OAuth token-exchange
- * grant (RFC 8693), and keeps the result in memory only — never in storage — so
- * the session lives and dies with the frame.
- *
- * @internal
- */
-/** The query parameter a host platform puts the one-time token on. @internal */
-export const EMBED_TOKEN_PARAM = "ott";
-const EMBED_TAB_KEY = "base44_embed_session";
-const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
-const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
-const RATE_LIMITED = 429;
-const RATE_LIMIT_RETRY_MS = 1000;
-const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
- *
- * @internal
- */
-export function takeEmbedTokenFromUrl() {
-    if (typeof window === "undefined" || !window.location) {
-        return null;
-    }
-    try {
-        const url = new URL(window.location.href);
-        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
-        if (!ott) {
-            return null;
-        }
-        url.searchParams.delete(EMBED_TOKEN_PARAM);
-        window.history.replaceState(window.history.state, "", url.toString());
-        return ott;
-    }
-    catch (e) {
-        console.error("Error retrieving embed token from URL:", e);
-        return null;
-    }
-}
-/**
- * Whether this tab previously redeemed an embed token. Counts only inside a
- * frame: a top-level tab that once carried a token must fall back to the
- * regular login, or it could never sign in again.
- *
- * @internal
- */
-export function isEmbeddedTab() {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    // A cross-site frame is third-party storage, which some browsers block
-    // outright — every access can throw, and the marker is then unavailable.
-    try {
-        return (window.self !== window.top &&
-            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
-    }
-    catch (_a) {
-        return false;
-    }
-}
-/** @internal */
-export function markEmbeddedTab() {
-    try {
-        window.sessionStorage.setItem(EMBED_TAB_KEY, "1");
-    }
-    catch (_a) {
-        /* storage blocked */
-    }
-}
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
-export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {
-    const post = () => fetchImpl(`${serverUrl}/api/apps/${appId}/auth/embed/token`, {
-        method: "POST",
-        headers: { "X-App-Id": String(appId) },
-        body: new URLSearchParams({
-            grant_type: GRANT_TYPE,
-            subject_token: ott,
-            subject_token_type: SUBJECT_TOKEN_TYPE,
-        }),
-    });
-    try {
-        let response = await post();
-        // The limiter refuses before the token is redeemed, so it is still valid.
-        if (response.status === RATE_LIMITED) {
-            await new Promise((resolve) => setTimeout(resolve, RATE_LIMIT_RETRY_MS));
-            response = await post();
-        }
-        if (!response.ok) {
-            return null;
-        }
-        const { access_token: token } = (await response.json());
-        return token || null;
-    }
-    catch (e) {
-        console.error("Embed token exchange failed:", e);
-        return null;
-    }
-}
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
- *
- * @internal
- */
-export function showEmbedSessionEnded() {
-    if (typeof document === "undefined" || !document.body) {
-        return;
-    }
-    if (document.getElementById(SESSION_ENDED_ELEMENT_ID)) {
-        return;
-    }
-    const overlay = document.createElement("div");
-    overlay.id = SESSION_ENDED_ELEMENT_ID;
-    overlay.setAttribute("role", "alert");
-    overlay.style.cssText =
-        "position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;" +
-            "justify-content:center;background:#fff;color:#0f172a;" +
-            "font-family:ui-sans-serif,system-ui,sans-serif;text-align:center;padding:2rem;";
-    const title = document.createElement("h1");
-    title.textContent = "Session ended";
-    title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
-    const body = document.createElement("p");
-    body.textContent = "Refresh the page to continue.";
-    body.style.cssText = "margin:0;color:#475569;";
-    const card = document.createElement("div");
-    card.append(title, body);
-    overlay.append(card);
-    document.body.append(overlay);
-}