@dynamic-labs/sdk-react-core 0.19.0-alpha.22 → 0.19.0-alpha.24

package/CHANGELOG.md

@@ -1,4 +1,21 @@
 
+## [0.19.0-alpha.24](https://github.com/dynamic-labs/DynamicAuth/compare/v0.19.0-alpha.23...v0.19.0-alpha.24) (2023-10-24)
+
+
+### Bug Fixes
+
+* check state from message receiver is same as generated oauth state ([#3675](https://github.com/dynamic-labs/DynamicAuth/issues/3675)) ([2407b6c](https://github.com/dynamic-labs/DynamicAuth/commit/2407b6cff09985bbd5b044e44ab600540a4c69cb))
+
+## [0.19.0-alpha.23](https://github.com/dynamic-labs/DynamicAuth/compare/v0.19.0-alpha.22...v0.19.0-alpha.23) (2023-10-24)
+
+
+### Bug Fixes
+
+* better handling of CB wallet disconnect + upgrade to 3.7.2 ([#3659](https://github.com/dynamic-labs/DynamicAuth/issues/3659)) ([42a0857](https://github.com/dynamic-labs/DynamicAuth/commit/42a0857c66101cde901661e844c66ba324ff641b))
+* calculate the settings override in real time ([#3671](https://github.com/dynamic-labs/DynamicAuth/issues/3671)) ([06cf28d](https://github.com/dynamic-labs/DynamicAuth/commit/06cf28d4dc29dda21312691985ed1b903d3120cc))
+* handle rp.id edgecases for private domains due to webauthn restrictions on scoping to them ([#3658](https://github.com/dynamic-labs/DynamicAuth/issues/3658)) ([7067bc5](https://github.com/dynamic-labs/DynamicAuth/commit/7067bc5110afb8a010f13c2b2e0170faaa840995))
+* twitter origin check should also look for current window location origin ([#3676](https://github.com/dynamic-labs/DynamicAuth/issues/3676)) ([6c30989](https://github.com/dynamic-labs/DynamicAuth/commit/6c30989d4cde3516a177f6290b5376c5d4c61cbc))
+
 ## [0.19.0-alpha.22](https://github.com/dynamic-labs/DynamicAuth/compare/v0.19.0-alpha.21...v0.19.0-alpha.22) (2023-10-23)
 
 

package/package.cjs

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var version = "0.19.0-alpha.22";
+var version = "0.19.0-alpha.24";
 var dependencies = {
 	"@dynamic-labs/iconic": "0.1.34",
 	"@dynamic-labs/sdk-api": "0.0.291",

package/package.js

@@ -1,4 +1,4 @@
-var version = "0.19.0-alpha.22";
+var version = "0.19.0-alpha.24";
 var dependencies = {
 	"@dynamic-labs/iconic": "0.1.34",
 	"@dynamic-labs/sdk-api": "0.0.291",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/sdk-react-core",
-  "version": "0.19.0-alpha.22",
+  "version": "0.19.0-alpha.24",
   "repository": {
     "type": "git",
     "url": "https://github.com/dynamic-labs/DynamicAuth.git",
@@ -17,13 +17,13 @@
     "react-focus-lock": "2.9.2",
     "react-i18next": "^13.2.0",
     "yup": "0.32.11",
-    "@dynamic-labs/logger": "0.19.0-alpha.22",
-    "@dynamic-labs/multi-wallet": "0.19.0-alpha.22",
-    "@dynamic-labs/rpc-providers": "0.19.0-alpha.22",
-    "@dynamic-labs/types": "0.19.0-alpha.22",
-    "@dynamic-labs/utils": "0.19.0-alpha.22",
-    "@dynamic-labs/wallet-book": "0.19.0-alpha.22",
-    "@dynamic-labs/wallet-connector-core": "0.19.0-alpha.22",
+    "@dynamic-labs/logger": "0.19.0-alpha.24",
+    "@dynamic-labs/multi-wallet": "0.19.0-alpha.24",
+    "@dynamic-labs/rpc-providers": "0.19.0-alpha.24",
+    "@dynamic-labs/types": "0.19.0-alpha.24",
+    "@dynamic-labs/utils": "0.19.0-alpha.24",
+    "@dynamic-labs/wallet-book": "0.19.0-alpha.24",
+    "@dynamic-labs/wallet-connector-core": "0.19.0-alpha.24",
     "eventemitter3": "5.0.1"
   },
   "devDependencies": {

package/src/index.cjs

@@ -117,7 +117,6 @@ require('react-focus-lock');
 require('./lib/components/Transition/ZoomTransition/ZoomTransition.cjs');
 require('./lib/components/Transition/SlideInUpTransition/SlideInUpTransition.cjs');
 require('./lib/components/Transition/OpacityTransition/OpacityTransition.cjs');
-var useFetchProjectSettings = require('./lib/utils/hooks/useFetchProjectSettings/useFetchProjectSettings.cjs');
 require('./lib/config/ApiEndpoint.cjs');
 require('./lib/utils/hooks/useWallets/utils/verifyMagicIsSetup/verifyMagicIsSetup.cjs');
 var isSameWalletName = require('./lib/utils/functions/isSameWalletName/isSameWalletName.cjs');
@@ -292,7 +291,6 @@ Object.defineProperty(exports, 'DynamicJwtFromJSON', {
   get: function () { return sdkApi.DynamicJwtFromJSON; }
 });
 exports.ShadowDOM = ShadowDOM.ShadowDOM;
-exports.useFetchProjectSettings = useFetchProjectSettings.useFetchProjectSettings;
 exports.isSameWalletName = isSameWalletName.isSameWalletName;
 exports.MockContext = MockContext.MockContext;
 exports.MockContextProvider = MockContext.MockContextProvider;

package/src/index.d.ts

@@ -23,7 +23,7 @@ export { classNames } from './lib/utils/functions/classNames';
 export { getNetwork } from './lib/utils/functions/getNetwork';
 export * from './lib/utils/functions/walletFilters';
 export { DynamicWidgetContextProvider } from './lib/widgets/DynamicWidget/context';
-export { useFetchProjectSettings, useWalletItemActions, useAuthenticateConnectedUser, useSocialAccounts, useEmbeddedWallet, useIsLoggedIn, } from './lib/utils/hooks';
+export { useWalletItemActions, useAuthenticateConnectedUser, useSocialAccounts, useEmbeddedWallet, useIsLoggedIn, } from './lib/utils/hooks';
 export { useUserUpdateRequest } from './lib/utils/hooks';
 export { type VerifyEmailCallback, useEmailVerificationRequest, } from './lib/utils/hooks/authenticationHooks/';
 export type { UpdateUserFieldsArg } from './lib/utils/hooks/';

package/src/index.js

@@ -113,7 +113,6 @@ import 'react-focus-lock';
 import './lib/components/Transition/ZoomTransition/ZoomTransition.js';
 import './lib/components/Transition/SlideInUpTransition/SlideInUpTransition.js';
 import './lib/components/Transition/OpacityTransition/OpacityTransition.js';
-export { useFetchProjectSettings } from './lib/utils/hooks/useFetchProjectSettings/useFetchProjectSettings.js';
 import './lib/config/ApiEndpoint.js';
 import './lib/utils/hooks/useWallets/utils/verifyMagicIsSetup/verifyMagicIsSetup.js';
 export { isSameWalletName } from './lib/utils/functions/isSameWalletName/isSameWalletName.js';

package/src/lib/components/SocialSignIn/SocialSignIn.cjs

@@ -101,7 +101,8 @@ const SocialSignIn = ({ providers, onSelectProvider, isLoading, selectedProvider
                 jsxRuntime.jsx(iconic.SocialIcon, { name: getProviderAsString(provider), variant: iconThemeVariant }), isSpinning: selectedProvider === provider, iconSize: 32 }), !insideCard && fullWidth && (jsxRuntime.jsxs(Typography.Typography, { variant: 'button_primary', children: ["Connect with ", capitalize.capitalize(getProviderAsString(provider))] }))] }, getProviderAsString(provider)));
     return (jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [jsxRuntime.jsxs("div", { className: 'social-sign-in', style: {
                     '--number-of-social-grid-items': numberOfSocialGridItems,
-                }, "data-testid": testId, children: [defaultProvider && renderProviderItem(defaultProvider, true), socialProvidersToDisplayInline.map((provider) => renderProviderItem(provider, socialProvidersToDisplayInline.length < 2)), showCardButton && (jsxRuntime.jsx(IconListTile.IconListTile, { dataTestId: 'show-more-options', onClick: () => setShowCard(true), className: 'social-sign-in--tile', children: jsxRuntime.jsx(Icon.Icon, { color: 'text-primary', children: jsxRuntime.jsx(dotsHorizontal.ReactComponent, {}) }) }, 'show-more-options'))] }), jsxRuntime.jsx(OverlayCard.OverlayCard, { isOpen: showCard, onClickOverlay: closeCard, children: jsxRuntime.jsxs("div", { className: 'social-sign-in--card', children: [jsxRuntime.jsx(ModalHeader.ModalHeader, { trailing: closeButton, children: jsxRuntime.jsx(Typography.Typography, { weight: 'medium', variant: 'body_normal', color: 'primary', as: 'span', children: "Choose a social account" }) }), jsxRuntime.jsx("div", { className: 'social-sign-in--card--body', children: providers.map((provider) => renderProviderItem(provider, false, true)) })] }) })] }));
+                }, "data-testid": testId, children: [defaultProvider && renderProviderItem(defaultProvider, true), socialProvidersToDisplayInline.map((provider) => renderProviderItem(provider, socialProvidersToDisplayInline.length <
+                        4 - (defaultProvider ? 1 : 0))), showCardButton && (jsxRuntime.jsx(IconListTile.IconListTile, { dataTestId: 'show-more-options', onClick: () => setShowCard(true), className: 'social-sign-in--tile', children: jsxRuntime.jsx(Icon.Icon, { color: 'text-primary', children: jsxRuntime.jsx(dotsHorizontal.ReactComponent, {}) }) }, 'show-more-options'))] }), jsxRuntime.jsx(OverlayCard.OverlayCard, { isOpen: showCard, onClickOverlay: closeCard, children: jsxRuntime.jsxs("div", { className: 'social-sign-in--card', children: [jsxRuntime.jsx(ModalHeader.ModalHeader, { trailing: closeButton, children: jsxRuntime.jsx(Typography.Typography, { weight: 'medium', variant: 'body_normal', color: 'primary', as: 'span', children: "Choose a social account" }) }), jsxRuntime.jsx("div", { className: 'social-sign-in--card--body', children: providers.map((provider) => renderProviderItem(provider, false, true)) })] }) })] }));
 };
 
 exports.SocialSignIn = SocialSignIn;

package/src/lib/components/SocialSignIn/SocialSignIn.js

@@ -97,7 +97,8 @@ const SocialSignIn = ({ providers, onSelectProvider, isLoading, selectedProvider
                 jsx(SocialIcon, { name: getProviderAsString(provider), variant: iconThemeVariant }), isSpinning: selectedProvider === provider, iconSize: 32 }), !insideCard && fullWidth && (jsxs(Typography, { variant: 'button_primary', children: ["Connect with ", capitalize(getProviderAsString(provider))] }))] }, getProviderAsString(provider)));
     return (jsxs(Fragment, { children: [jsxs("div", { className: 'social-sign-in', style: {
                     '--number-of-social-grid-items': numberOfSocialGridItems,
-                }, "data-testid": testId, children: [defaultProvider && renderProviderItem(defaultProvider, true), socialProvidersToDisplayInline.map((provider) => renderProviderItem(provider, socialProvidersToDisplayInline.length < 2)), showCardButton && (jsx(IconListTile, { dataTestId: 'show-more-options', onClick: () => setShowCard(true), className: 'social-sign-in--tile', children: jsx(Icon, { color: 'text-primary', children: jsx(SvgDotsHorizontal, {}) }) }, 'show-more-options'))] }), jsx(OverlayCard, { isOpen: showCard, onClickOverlay: closeCard, children: jsxs("div", { className: 'social-sign-in--card', children: [jsx(ModalHeader, { trailing: closeButton, children: jsx(Typography, { weight: 'medium', variant: 'body_normal', color: 'primary', as: 'span', children: "Choose a social account" }) }), jsx("div", { className: 'social-sign-in--card--body', children: providers.map((provider) => renderProviderItem(provider, false, true)) })] }) })] }));
+                }, "data-testid": testId, children: [defaultProvider && renderProviderItem(defaultProvider, true), socialProvidersToDisplayInline.map((provider) => renderProviderItem(provider, socialProvidersToDisplayInline.length <
+                        4 - (defaultProvider ? 1 : 0))), showCardButton && (jsx(IconListTile, { dataTestId: 'show-more-options', onClick: () => setShowCard(true), className: 'social-sign-in--tile', children: jsx(Icon, { color: 'text-primary', children: jsx(SvgDotsHorizontal, {}) }) }, 'show-more-options'))] }), jsx(OverlayCard, { isOpen: showCard, onClickOverlay: closeCard, children: jsxs("div", { className: 'social-sign-in--card', children: [jsx(ModalHeader, { trailing: closeButton, children: jsx(Typography, { weight: 'medium', variant: 'body_normal', color: 'primary', as: 'span', children: "Choose a social account" }) }), jsx("div", { className: 'social-sign-in--card--body', children: providers.map((provider) => renderProviderItem(provider, false, true)) })] }) })] }));
 };
 
 export { SocialSignIn };

package/src/lib/data/api.js

@@ -1,6 +1,6 @@
 import { __awaiter } from '../../../_virtual/_tslib.js';
 import { NoAccessError, AccountExistsError, EmailVerificationError, UserHasAccountWithEmailError, DynamicError, EmailAlreadyExistsError, UsernameAlreadyExistsError, EmailProviderError, WalletUsedError, WalletNotDeployedError, ChainalysisError, GateBlockedError, SocialAccountAlreadyExistsError } from '@dynamic-labs/utils';
-import { SDKApi, Configuration, UnprocessableEntityErrorCode, ChainEnum, EmbeddedWalletProviderEnum, VerifyRequestFromJSON, WalletProviderEnum, AuthModeEnum } from '@dynamic-labs/sdk-api';
+import { UnprocessableEntityErrorCode, ChainEnum, EmbeddedWalletProviderEnum, SDKApi, Configuration, VerifyRequestFromJSON, WalletProviderEnum, AuthModeEnum } from '@dynamic-labs/sdk-api';
 import { VERSION, API_VERSION } from '../../version.js';
 import ApiEndpoint from '../config/ApiEndpoint.js';
 import { logger } from '../shared/logger.js';

package/src/lib/utils/hooks/useFetchProjectSettings/useFetchProjectSettings.cjs

@@ -31,6 +31,9 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
         removeLsSettings();
     }
     const overrideSettings = (projectSettings, overrides) => {
+        if (!projectSettings) {
+            return undefined;
+        }
         let overrideSettings = projectSettings;
         if (overrides) {
             if (overrides.views) {
@@ -65,12 +68,11 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
                 .then((response) => {
                 if (!response)
                     throw new utils.DynamicError('Settings are not defined');
-                const settingsWithOverrides = overrideSettings(response, dynamicContextProps.settings.overrides);
                 const expiry = new Date().getTime() + 60000 * 5;
                 setLsSettings({
                     environmentId,
                     expiry: expiry,
-                    settings: settingsWithOverrides,
+                    settings: response,
                 });
             })
                 .catch(() => {
@@ -81,7 +83,12 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
             });
         }
     }, [environmentId, isLoading, lsSettingsExists, maxRetries, retries]);
-    return { isLoading, projectSettings: lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, removeLsSettings };
+    const settingsWithOverride = React.useMemo(() => overrideSettings(lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, dynamicContextProps.settings.overrides), [lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, dynamicContextProps.settings.overrides]);
+    return {
+        isLoading,
+        projectSettings: settingsWithOverride,
+        removeLsSettings,
+    };
 };
 
 exports.useFetchProjectSettings = useFetchProjectSettings;

package/src/lib/utils/hooks/useFetchProjectSettings/useFetchProjectSettings.js

@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react';
+import { useState, useEffect, useMemo } from 'react';
 import { DynamicError } from '@dynamic-labs/utils';
 import { sendDynamicProps, fetchProjectSettings } from '../../../data/api.js';
 import '@dynamic-labs/sdk-api';
@@ -27,6 +27,9 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
         removeLsSettings();
     }
     const overrideSettings = (projectSettings, overrides) => {
+        if (!projectSettings) {
+            return undefined;
+        }
         let overrideSettings = projectSettings;
         if (overrides) {
             if (overrides.views) {
@@ -61,12 +64,11 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
                 .then((response) => {
                 if (!response)
                     throw new DynamicError('Settings are not defined');
-                const settingsWithOverrides = overrideSettings(response, dynamicContextProps.settings.overrides);
                 const expiry = new Date().getTime() + 60000 * 5;
                 setLsSettings({
                     environmentId,
                     expiry: expiry,
-                    settings: settingsWithOverrides,
+                    settings: response,
                 });
             })
                 .catch(() => {
@@ -77,7 +79,12 @@ const useFetchProjectSettings = ({ authToken, environmentId, maxRetries = 2, dyn
             });
         }
     }, [environmentId, isLoading, lsSettingsExists, maxRetries, retries]);
-    return { isLoading, projectSettings: lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, removeLsSettings };
+    const settingsWithOverride = useMemo(() => overrideSettings(lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, dynamicContextProps.settings.overrides), [lsSettings === null || lsSettings === void 0 ? void 0 : lsSettings.settings, dynamicContextProps.settings.overrides]);
+    return {
+        isLoading,
+        projectSettings: settingsWithOverride,
+        removeLsSettings,
+    };
 };
 
 export { useFetchProjectSettings };

package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.cjs

@@ -194,16 +194,18 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
             if (!(apiProvider === null || apiProvider === void 0 ? void 0 : apiProvider.redirectUrl)) {
                 return;
             }
-            let expectedOrigin = '';
-            try {
-                const redirectUri = new URL(apiProvider.redirectUrl);
-                expectedOrigin = redirectUri.origin;
-            }
-            catch (e) {
-                logger.logger.error('Failed to parse social provider redirect url', {
-                    error: e,
-                });
-                return;
+            let expectedOrigin = window.location.origin;
+            if (!providersWithoutWindowOpenerRefence.includes(provider)) {
+                try {
+                    const redirectUri = new URL(apiProvider.redirectUrl);
+                    expectedOrigin = redirectUri.origin;
+                }
+                catch (e) {
+                    logger.logger.error('Failed to parse social provider redirect url', {
+                        error: e,
+                    });
+                    return;
+                }
             }
             const isExpectedOrigin = event.origin === expectedOrigin;
             const isValidMessage = isAuthorizationMessage &&
@@ -219,11 +221,17 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
                 return;
             }
             clearListeners();
-            const { code, error } = message;
+            const { code, error, state: authState } = message;
             if (error && error !== 'undefined') {
                 handleError(types.SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: ${error}`);
                 return;
             }
+            // check that the state we receive from message is the same state we calculated earlier
+            // this could be an attack
+            if (state !== authState) {
+                handleError(types.SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: Invalid random state`);
+                return;
+            }
             if (!code) {
                 handleError(types.SocialOAuthErrorCode.NO_AUTH_CODE, `Failed to connect ${provider} social account: no authorization code`);
                 return;

package/src/lib/utils/hooks/useSocialAuth/useSocialAuth.js

@@ -190,16 +190,18 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
             if (!(apiProvider === null || apiProvider === void 0 ? void 0 : apiProvider.redirectUrl)) {
                 return;
             }
-            let expectedOrigin = '';
-            try {
-                const redirectUri = new URL(apiProvider.redirectUrl);
-                expectedOrigin = redirectUri.origin;
-            }
-            catch (e) {
-                logger.error('Failed to parse social provider redirect url', {
-                    error: e,
-                });
-                return;
+            let expectedOrigin = window.location.origin;
+            if (!providersWithoutWindowOpenerRefence.includes(provider)) {
+                try {
+                    const redirectUri = new URL(apiProvider.redirectUrl);
+                    expectedOrigin = redirectUri.origin;
+                }
+                catch (e) {
+                    logger.error('Failed to parse social provider redirect url', {
+                        error: e,
+                    });
+                    return;
+                }
             }
             const isExpectedOrigin = event.origin === expectedOrigin;
             const isValidMessage = isAuthorizationMessage &&
@@ -215,11 +217,17 @@ const useSocialAuth = ({ sessionTimeout, authMode, onSettled, onError, }) => {
                 return;
             }
             clearListeners();
-            const { code, error } = message;
+            const { code, error, state: authState } = message;
             if (error && error !== 'undefined') {
                 handleError(SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: ${error}`);
                 return;
             }
+            // check that the state we receive from message is the same state we calculated earlier
+            // this could be an attack
+            if (state !== authState) {
+                handleError(SocialOAuthErrorCode.OAUTH_ERROR, `Failed to connect ${provider} social account: Invalid random state`);
+                return;
+            }
             if (!code) {
                 handleError(SocialOAuthErrorCode.NO_AUTH_CODE, `Failed to connect ${provider} social account: no authorization code`);
                 return;