@geniee-inc/sfa-kit 1.13.0 → 1.14.0

package/GUIDE.md

@@ -18,7 +18,7 @@ The package ships built JavaScript and TypeScript declarations only. It contains
 
 ```ts
 import pkg from '@geniee-inc/sfa-kit/package.json';
-// pkg.version -> '1.10.0'
+// pkg.version -> '1.14.0'
 ```
 
 Two additional subpaths are available: `@geniee-inc/sfa-kit/signing` exposes bundle-signing utilities (`computeContentHash`, `computeSignature`, `createManifest`, `createManifestFromDirectory`) for Node.js environments, and `./package.json` exposes the manifest. Internal modules cannot be imported directly.
@@ -38,7 +38,7 @@ Every page uses `SfaLoginGate` as the outermost wrapper. It auto-detects the hos
 
 ### Props
 
-- **`apiBase`** (optional) — Overrides the default API endpoint (`https://keystone-api-staging.chikyu.mobi`).
+- **`apiBase`** (optional) — Overrides the auto-detected Keystone API endpoint. When omitted, the endpoint is resolved from a hostname: the embedding SFA/CRM host's when the page runs inside the iframe, the page's own when it runs standalone. Non-production environments (`stg.chikyu.mobi`, `dev01`-`dev09`, `devdc`, `deva0`, `dev-docker`, `dev.chikyu.local`, `localhost`, `127.0.0.1`, `[::1]`, and every Amplify host of the new frontend under `*.amplify.axiom.chikyu.mobi`: PR previews plus the `devNN.waf.` / `stg.waf.` record-detail hosts) use `https://keystone-api-staging.chikyu.mobi`; everything else (`app.chikyu.net`, any hostname not in that list) uses `https://keystone-api-production.chikyu.mobi`. Production is the fallback on purpose so a page that reaches a customer never silently talks to staging.
 - **`trustedOrigin`** (optional) — The origin of the SFA/CRM host page (e.g. `"https://app.chikyu.net"`). When provided and the page runs inside an iframe, `SfaLoginGate` uses the postMessage code-exchange flow (`POST /v1/auth/exchange`) instead of a login form. Injected automatically by Keystone's content endpoint at serve time.
 - **`defaultOrganizationId`** (optional) — The org ID to auto-select when the user's account belongs to multiple organizations. **Set this to the org that generated the page's metadata** (the org used in Step 0 schema discovery). Without this prop, multi-org accounts auto-select the first available org, which may not be the intended one. Use an env var, not a literal: `defaultOrganizationId={Number(process.env.NEXT_PUBLIC_DEFAULT_ORG_ID)}`.
 - **`objectKey`** (optional) — The object this page is built for (e.g. `"companies"`). The standalone DevToolbar shows it in the page-info tooltip and in the record ID placeholder. Pass it at **both** levels; omit it only if the page genuinely has no object.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geniee-inc/sfa-kit",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "React hooks and components for building pages that connect to GENIEE SFA/CRM data.",
   "type": "module",
   "main": "./src/index.js",

package/src/lib/auth/SfaLoginGate.js

@@ -8,10 +8,10 @@ import { DevToolbar } from './DevToolbar';
 import { parseInboundMessage, sendToHost } from './embed-protocol';
 import { exchangeCode } from './exchange-code';
 import { authenticate } from './keystone-auth';
+import { KEYSTONE_PRODUCTION_API_BASE, resolveApiBase, } from './resolve-api-base';
 import { loadSession, saveSession, clearSession, loadLastOrgId, } from './session-store';
 import { StandalonePreviewCtx } from './StandalonePreviewContext';
 import { EmbedContextValue } from './useEmbedContext';
-const DEFAULT_API_BASE = 'https://keystone-api-staging.chikyu.mobi';
 const REFRESH_BUFFER_SECONDS = 120;
 /** After this many consecutive exchange failures, stop retrying and show session_expired. */
 const MAX_CONSECUTIVE_FAILURES = 3;
@@ -62,6 +62,21 @@ function resolveTrustedOrigin(explicitOrigin) {
     }
     return undefined;
 }
+/**
+ * @description The origin this page is being served from.
+ *
+ * Used to pick the Keystone API when the page runs standalone: a preview
+ * opened directly, or a Studio page on a developer's machine, has no
+ * embedding host to judge by, so its own hostname is the only signal.
+ */
+function resolvePageOrigin() {
+    try {
+        return window.location.origin;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
 /**
  * @description Universal auth wrapper for sfa-kit pages.
  *
@@ -75,13 +90,15 @@ function resolveTrustedOrigin(explicitOrigin) {
  *   automatically from the API (auto-selected for multi-org accounts when
  *   defaultOrganizationId is set, or the first org is used by default).
  */
-export function SfaLoginGate({ apiBase = DEFAULT_API_BASE, trustedOrigin, defaultOrganizationId, objectKey, level, children, }) {
+export function SfaLoginGate({ apiBase, trustedOrigin, defaultOrganizationId, objectKey, level, children, }) {
     const shouldEmbed = isEmbedded() && (trustedOrigin != null || hasContentToken());
     const resolvedOrigin = resolveTrustedOrigin(trustedOrigin);
     if (shouldEmbed && resolvedOrigin != null) {
-        return (_jsx(EmbedFlow, { trustedOrigin: resolvedOrigin, apiBase: apiBase, children: children }));
+        // Embedded: the SFA/CRM host that framed us decides the environment.
+        return (_jsx(EmbedFlow, { trustedOrigin: resolvedOrigin, apiBase: apiBase !== null && apiBase !== void 0 ? apiBase : resolveApiBase(resolvedOrigin), children: children }));
     }
-    return (_jsx(StandaloneFlow, { apiBase: apiBase, defaultOrganizationId: defaultOrganizationId, objectKey: objectKey, level: level, children: children }));
+    // Standalone: there is no host, so the page's own origin decides.
+    return (_jsx(StandaloneFlow, { apiBase: apiBase !== null && apiBase !== void 0 ? apiBase : resolveApiBase(resolvePageOrigin()), defaultOrganizationId: defaultOrganizationId, objectKey: objectKey, level: level, children: children }));
 }
 function EmbedFlow({ trustedOrigin, apiBase, children, }) {
     const [phase, setPhase] = useState({ step: 'waiting_for_code' });
@@ -201,8 +218,19 @@ function EmbedStatus({ title, message, showReload, }) {
 // Standalone flow (login form + DevToolbar)
 // ---------------------------------------------------------------------------
 function StandaloneFlow({ apiBase, defaultOrganizationId, objectKey, level, children, }) {
-    const [session, setSession] = useState(() => loadSession());
-    const [activeBase, setActiveBase] = useState(() => { var _a; return (_a = session === null || session === void 0 ? void 0 : session.apiBase) !== null && _a !== void 0 ? _a : apiBase.replace(/\/+$/, ''); });
+    const normalizedBase = useMemo(() => apiBase.replace(/\/+$/, ''), [apiBase]);
+    const [session, setSession] = useState(() => {
+        const saved = loadSession();
+        // Discard a saved session whose apiBase does not match the current
+        // environment. Without this check a staging session could be reused
+        // when the page is opened from a production host (or vice-versa).
+        if ((saved === null || saved === void 0 ? void 0 : saved.apiBase) != null && saved.apiBase !== normalizedBase) {
+            clearSession();
+            return null;
+        }
+        return saved;
+    });
+    const [activeBase, setActiveBase] = useState(() => { var _a; return (_a = session === null || session === void 0 ? void 0 : session.apiBase) !== null && _a !== void 0 ? _a : normalizedBase; });
     const [status, setStatus] = useState('idle');
     const [error, setError] = useState(null);
     // NOTE: level を渡さない既存ページのために、objectKey の有無から補う。
@@ -308,7 +336,7 @@ function LoginForm({ defaultApiBase, defaultOrganizationId, onSubmit, status, er
             : undefined;
         onSubmit(email.trim(), password, apiBase.trim(), Number.isFinite(orgId) ? orgId : undefined);
     };
-    return (_jsx("div", { style: loginStyles.backdrop, children: _jsxs("form", { style: loginStyles.card, onSubmit: handleSubmit, children: [_jsxs("div", { style: loginStyles.logoGroup, children: [_jsx(GenieeLogoMark, {}), _jsxs("div", { style: loginStyles.logoText, children: [_jsx("span", { style: loginStyles.logoGeniee, children: "GENIEE" }), _jsx("span", { style: loginStyles.logoProduct, children: "SFA/CRM" })] })] }), error && (_jsx("div", { role: "alert", style: styles.error, children: error })), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.labelText, children: "\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9*" }), _jsx("input", { style: loginStyles.input, type: "text", value: email, onChange: e => setEmail(e.target.value), autoComplete: "email", required: true, disabled: status === 'loading' })] }), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.labelText, children: "\u30D1\u30B9\u30EF\u30FC\u30C9*" }), _jsx("input", { style: loginStyles.input, type: "password", value: password, onChange: e => setPassword(e.target.value), autoComplete: "current-password", required: true, disabled: status === 'loading' })] }), _jsx("button", { style: Object.assign(Object.assign({}, loginStyles.submitButton), { opacity: status === 'loading' ? 0.7 : 1 }), type: "submit", disabled: status === 'loading', children: status === 'loading' ? 'ログイン中...' : 'ログイン' }), _jsx("button", { type: "button", style: loginStyles.configToggle, onClick: () => setShowConfig(prev => !prev), children: showConfig ? '▾ 接続設定を隠す' : '▸ 接続設定' }), showConfig && (_jsxs("div", { style: loginStyles.configSection, children: [_jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.configLabel, children: "API Base" }), _jsx("input", { style: loginStyles.input, type: "text", value: apiBase, onChange: e => setApiBase(e.target.value), placeholder: "https://keystone-api-staging.chikyu.mobi", disabled: status === 'loading' })] }), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.configLabel, children: "Organization ID" }), _jsx("input", { style: loginStyles.input, type: "text", value: orgIdInput, onChange: e => setOrgIdInput(e.target.value), placeholder: "\u81EA\u52D5\u9078\u629E (\u7A7A\u6B04)", disabled: status === 'loading' })] })] })), _jsxs("div", { style: styles.versionFooter, children: ["@geniee-inc/sfa-kit v", SFA_KIT_VERSION] })] }) }));
+    return (_jsx("div", { style: loginStyles.backdrop, children: _jsxs("form", { style: loginStyles.card, onSubmit: handleSubmit, children: [_jsxs("div", { style: loginStyles.logoGroup, children: [_jsx(GenieeLogoMark, {}), _jsxs("div", { style: loginStyles.logoText, children: [_jsx("span", { style: loginStyles.logoGeniee, children: "GENIEE" }), _jsx("span", { style: loginStyles.logoProduct, children: "SFA/CRM" })] })] }), error && (_jsx("div", { role: "alert", style: styles.error, children: error })), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.labelText, children: "\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9*" }), _jsx("input", { style: loginStyles.input, type: "text", value: email, onChange: e => setEmail(e.target.value), autoComplete: "email", required: true, disabled: status === 'loading' })] }), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.labelText, children: "\u30D1\u30B9\u30EF\u30FC\u30C9*" }), _jsx("input", { style: loginStyles.input, type: "password", value: password, onChange: e => setPassword(e.target.value), autoComplete: "current-password", required: true, disabled: status === 'loading' })] }), _jsx("button", { style: Object.assign(Object.assign({}, loginStyles.submitButton), { opacity: status === 'loading' ? 0.7 : 1 }), type: "submit", disabled: status === 'loading', children: status === 'loading' ? 'ログイン中...' : 'ログイン' }), _jsx("button", { type: "button", style: loginStyles.configToggle, onClick: () => setShowConfig(prev => !prev), children: showConfig ? '▾ 接続設定を隠す' : '▸ 接続設定' }), showConfig && (_jsxs("div", { style: loginStyles.configSection, children: [_jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.configLabel, children: "API Base" }), _jsx("input", { style: loginStyles.input, type: "text", value: apiBase, onChange: e => setApiBase(e.target.value), placeholder: KEYSTONE_PRODUCTION_API_BASE, disabled: status === 'loading' })] }), _jsxs("label", { style: loginStyles.label, children: [_jsx("span", { style: loginStyles.configLabel, children: "Organization ID" }), _jsx("input", { style: loginStyles.input, type: "text", value: orgIdInput, onChange: e => setOrgIdInput(e.target.value), placeholder: "\u81EA\u52D5\u9078\u629E (\u7A7A\u6B04)", disabled: status === 'loading' })] })] })), _jsxs("div", { style: styles.versionFooter, children: ["@geniee-inc/sfa-kit v", SFA_KIT_VERSION] })] }) }));
 }
 // ---------------------------------------------------------------------------
 // Geniee logo mark (inline SVG)

package/src/lib/auth/resolve-api-base.d.ts

@@ -0,0 +1,19 @@
+export declare const KEYSTONE_PRODUCTION_API_BASE = "https://keystone-api-production.chikyu.mobi";
+export declare const KEYSTONE_STAGING_API_BASE = "https://keystone-api-staging.chikyu.mobi";
+/**
+ * @description Resolves the Keystone API base URL from an origin.
+ *
+ * Every non-production chikyu environment — `stg.chikyu.mobi`, the dev tier,
+ * local development, and Amplify PR previews — uses the staging Keystone API.
+ * Everything else — `app.chikyu.net`, an origin this table does not know, or
+ * no origin at all — uses production.
+ *
+ * Production is the fallback on purpose: a page that reaches a real customer
+ * must never silently talk to staging. A developer on an unrecognised host
+ * can still pass `apiBase` explicitly or type it into the standalone login form.
+ *
+ * Callers decide which origin to pass: the embedding host's origin when the
+ * page runs inside the SFA/CRM iframe, and the page's own origin when it runs
+ * standalone. A malformed origin is treated the same as no origin.
+ */
+export declare function resolveApiBase(origin: string | undefined): string;

package/src/lib/auth/resolve-api-base.js

@@ -0,0 +1,65 @@
+export const KEYSTONE_PRODUCTION_API_BASE = 'https://keystone-api-production.chikyu.mobi';
+export const KEYSTONE_STAGING_API_BASE = 'https://keystone-api-staging.chikyu.mobi';
+/** Dev-tier chikyu (legacy frontend) hosts: dev01-dev09, devdc, deva0, and the like. */
+const DEV_HOST_PATTERN = /^dev\w+\.chikyu\.mobi$/;
+/**
+ * Amplify-hosted new frontend. Covers PR previews
+ * (`pr-{id}.amplify.axiom.chikyu.mobi`, see amplify.yml) AND the dev / stg
+ * record-detail hosts that frame sfa-kit pages
+ * (`dev01.waf.amplify.axiom.chikyu.mobi`, `stg.waf.amplify.axiom.chikyu.mobi`).
+ * Keep this a suffix match: narrowing it to `pr-` would send every dev
+ * environment to production.
+ */
+const AMPLIFY_PATTERN = /\.amplify\.axiom\.chikyu\.mobi$/;
+/** Hostnames that are always a developer's own machine. */
+const LOCAL_HOSTNAMES = new Set([
+    'localhost',
+    '127.0.0.1',
+    '[::1]',
+    'dev.chikyu.local',
+    'dev-docker.chikyu.mobi',
+]);
+/** Shared pre-production chikyu environments. */
+const STAGING_HOSTNAMES = new Set(['stg.chikyu.mobi']);
+/**
+ * @description Resolves the Keystone API base URL from an origin.
+ *
+ * Every non-production chikyu environment — `stg.chikyu.mobi`, the dev tier,
+ * local development, and Amplify PR previews — uses the staging Keystone API.
+ * Everything else — `app.chikyu.net`, an origin this table does not know, or
+ * no origin at all — uses production.
+ *
+ * Production is the fallback on purpose: a page that reaches a real customer
+ * must never silently talk to staging. A developer on an unrecognised host
+ * can still pass `apiBase` explicitly or type it into the standalone login form.
+ *
+ * Callers decide which origin to pass: the embedding host's origin when the
+ * page runs inside the SFA/CRM iframe, and the page's own origin when it runs
+ * standalone. A malformed origin is treated the same as no origin.
+ */
+export function resolveApiBase(origin) {
+    const hostname = hostnameOf(origin);
+    if (hostname == null)
+        return KEYSTONE_PRODUCTION_API_BASE;
+    const isNonProduction = STAGING_HOSTNAMES.has(hostname) ||
+        LOCAL_HOSTNAMES.has(hostname) ||
+        DEV_HOST_PATTERN.test(hostname) ||
+        AMPLIFY_PATTERN.test(hostname);
+    return isNonProduction
+        ? KEYSTONE_STAGING_API_BASE
+        : KEYSTONE_PRODUCTION_API_BASE;
+}
+/** The hostname of an origin, or undefined when there is no usable origin. */
+function hostnameOf(origin) {
+    if (origin == null)
+        return undefined;
+    try {
+        // WHATWG URL preserves a trailing dot on FQDN hostnames (e.g.
+        // "stg.chikyu.mobi." stays as-is). Strip it so the allowlist and
+        // regex checks match regardless of whether the dot is present.
+        return new URL(origin).hostname.replace(/\.$/, '');
+    }
+    catch (_a) {
+        return undefined;
+    }
+}

package/src/lib/version.d.ts

@@ -1 +1 @@
-export declare const SFA_KIT_VERSION = "1.13.0";
+export declare const SFA_KIT_VERSION = "1.14.0";

package/src/lib/version.js

@@ -1,3 +1,3 @@
 // このファイルは libs/sfa-kit/scripts/sync-version.cjs が生成する。
 // 手で編集しないこと。バージョンを上げるときは libs/sfa-kit/package.json を変更する。
-export const SFA_KIT_VERSION = '1.13.0';
+export const SFA_KIT_VERSION = '1.14.0';