@helloleo/plugins 0.1.8 → 0.1.9

package/dist/index.js

@@ -12910,35 +12910,58 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 }
 function netsuiteTs() {
   return `/*
- * NetSuite OAuth client helper.
+ * NetSuite OAuth client helper (bearer-token-in-fragment).
  *
- * NetSuite uses a TWO-Integration-Record setup:
- *   1. MCP record (scope: mcp)            -- used by HelloLeo at build time
- *      to introspect the schema. Configured in Project Settings, not here.
- *   2. Runtime record (scope: rest_webservices) -- used by THIS app to sign
- *      end-users in. Credentials are stored as HelloLeo Cloud secrets on the
- *      project's Worker (env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,
- *      env.NETSUITE_CLIENT_SECRET). They never reach the browser.
+ * Two NetSuite Integration Records back this:
+ *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
+ *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
+ * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
+ * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
+ * the browser. Cookies are NOT used -- frontend \u2194 Worker are cross-site
+ * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
+ * third-party cookies in the HelloLeo preview iframe.
  *
  * Flow:
  *   1. User clicks "Sign in with NetSuite".
- *   2. Browser hits the project's Worker at /auth/netsuite/start, which
- *      redirects to NetSuite's OAuth authorise endpoint with PKCE.
- *   3. NetSuite redirects back to /auth/netsuite/callback on the Worker.
- *      The Worker exchanges the code for an access + refresh token, stores
- *      them in D1 keyed by a session id, and sets a session cookie.
- *   4. The frontend calls /api/me on the Worker to read the signed-in user.
- *   5. All NetSuite REST calls flow through the Worker so tokens stay
- *      server-side.
+ *   2. Browser navigates to the Worker /auth/netsuite/start.
+ *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
+ *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
+ *   5. Worker exchanges the code, mints a session id, then redirects to
+ *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
+ *   6. This module reads the fragment on load, stashes the sid in
+ *      sessionStorage, and sends it as Authorization: Bearer on every
+ *      Worker call.
  *
- * IMPORTANT: NEVER use a hardcoded password or sessionStorage flag as the
- * login gate -- the NetSuite OAuth flow above is the only acceptable
- * authentication for a NetSuite project.
+ * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
+ * authoritative auth state -- the only acceptable check is /api/me on the
+ * Worker. sessionStorage here is just a cache of the bearer token.
  */
 
 export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
+const TOKEN_KEY = 'nssid';
 
-export function signInWithNetSuite(returnTo: string = window.location.pathname) {
+// Capture-and-strip the #nssid=... fragment as early as possible so URLs
+// shown to the user stay clean. Runs once at module load.
+(function bootstrapTokenFromHash() {
+  if (typeof window === 'undefined') return;
+  const hash = window.location.hash.replace(/^#/, '');
+  if (!hash) return;
+  const params = new URLSearchParams(hash);
+  const sid = params.get(TOKEN_KEY);
+  if (sid) {
+    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
+    params.delete(TOKEN_KEY);
+    const remaining = params.toString();
+    const newHash = remaining ? '#' + remaining : '';
+    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+  }
+})();
+
+export function getSessionToken(): string | null {
+  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+}
+
+export function signInWithNetSuite(returnTo: string = window.location.href) {
   if (!WORKER_URL) {
     throw new Error(
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
@@ -12958,8 +12981,10 @@ export interface NetSuiteSession {
 
 export async function getNetSuiteSession(): Promise<NetSuiteSession> {
   if (!WORKER_URL) return { authenticated: false };
+  const sid = getSessionToken();
+  if (!sid) return { authenticated: false };
   const res = await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/api/me\`, {
-    credentials: 'include',
+    headers: { Authorization: 'Bearer ' + sid },
   });
   if (!res.ok) return { authenticated: false };
   const data = await res.json();
@@ -12968,12 +12993,34 @@ export async function getNetSuiteSession(): Promise<NetSuiteSession> {
 
 export async function signOutNetSuite(): Promise<void> {
   if (!WORKER_URL) return;
-  await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
-    method: 'POST',
-    credentials: 'include',
-  });
+  const sid = getSessionToken();
+  if (sid) {
+    try {
+      await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
+        method: 'POST',
+        headers: { Authorization: 'Bearer ' + sid },
+      });
+    } catch {}
+  }
+  try { sessionStorage.removeItem(TOKEN_KEY); } catch {}
   window.location.reload();
 }
+
+/**
+ * Helper for ALL other Worker calls (your dashboard endpoints, etc.).
+ * Always go through this instead of bare fetch -- it injects the bearer
+ * token and routes through the Worker so NetSuite tokens stay server-side.
+ */
+export async function workerFetch(pathOrUrl: string, init: RequestInit = {}): Promise<Response> {
+  if (!WORKER_URL) throw new Error('VITE_WORKER_URL is not set');
+  const url = pathOrUrl.startsWith('http')
+    ? pathOrUrl
+    : \`\${WORKER_URL.replace(/\\/$/, '')}\${pathOrUrl.startsWith('/') ? '' : '/'}\${pathOrUrl}\`;
+  const sid = getSessionToken();
+  const headers = new Headers(init.headers ?? {});
+  if (sid) headers.set('Authorization', 'Bearer ' + sid);
+  return fetch(url, { ...init, headers });
+}
 `;
 }
 function signInButtonTsx() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/scaffold.ts

@@ -389,35 +389,58 @@ ReactDOM.createRoot(document.getElementById('root')!).render(
 
 function netsuiteTs() {
 	return `/*
- * NetSuite OAuth client helper.
+ * NetSuite OAuth client helper (bearer-token-in-fragment).
  *
- * NetSuite uses a TWO-Integration-Record setup:
- *   1. MCP record (scope: mcp)            -- used by HelloLeo at build time
- *      to introspect the schema. Configured in Project Settings, not here.
- *   2. Runtime record (scope: rest_webservices) -- used by THIS app to sign
- *      end-users in. Credentials are stored as HelloLeo Cloud secrets on the
- *      project's Worker (env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,
- *      env.NETSUITE_CLIENT_SECRET). They never reach the browser.
+ * Two NetSuite Integration Records back this:
+ *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
+ *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
+ * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
+ * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
+ * the browser. Cookies are NOT used -- frontend ↔ Worker are cross-site
+ * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
+ * third-party cookies in the HelloLeo preview iframe.
  *
  * Flow:
  *   1. User clicks "Sign in with NetSuite".
- *   2. Browser hits the project's Worker at /auth/netsuite/start, which
- *      redirects to NetSuite's OAuth authorise endpoint with PKCE.
- *   3. NetSuite redirects back to /auth/netsuite/callback on the Worker.
- *      The Worker exchanges the code for an access + refresh token, stores
- *      them in D1 keyed by a session id, and sets a session cookie.
- *   4. The frontend calls /api/me on the Worker to read the signed-in user.
- *   5. All NetSuite REST calls flow through the Worker so tokens stay
- *      server-side.
+ *   2. Browser navigates to the Worker /auth/netsuite/start.
+ *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
+ *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
+ *   5. Worker exchanges the code, mints a session id, then redirects to
+ *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
+ *   6. This module reads the fragment on load, stashes the sid in
+ *      sessionStorage, and sends it as Authorization: Bearer on every
+ *      Worker call.
  *
- * IMPORTANT: NEVER use a hardcoded password or sessionStorage flag as the
- * login gate -- the NetSuite OAuth flow above is the only acceptable
- * authentication for a NetSuite project.
+ * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
+ * authoritative auth state -- the only acceptable check is /api/me on the
+ * Worker. sessionStorage here is just a cache of the bearer token.
  */
 
 export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
+const TOKEN_KEY = 'nssid';
+
+// Capture-and-strip the #nssid=... fragment as early as possible so URLs
+// shown to the user stay clean. Runs once at module load.
+(function bootstrapTokenFromHash() {
+  if (typeof window === 'undefined') return;
+  const hash = window.location.hash.replace(/^#/, '');
+  if (!hash) return;
+  const params = new URLSearchParams(hash);
+  const sid = params.get(TOKEN_KEY);
+  if (sid) {
+    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
+    params.delete(TOKEN_KEY);
+    const remaining = params.toString();
+    const newHash = remaining ? '#' + remaining : '';
+    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+  }
+})();
+
+export function getSessionToken(): string | null {
+  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+}
 
-export function signInWithNetSuite(returnTo: string = window.location.pathname) {
+export function signInWithNetSuite(returnTo: string = window.location.href) {
   if (!WORKER_URL) {
     throw new Error(
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
@@ -437,8 +460,10 @@ export interface NetSuiteSession {
 
 export async function getNetSuiteSession(): Promise<NetSuiteSession> {
   if (!WORKER_URL) return { authenticated: false };
+  const sid = getSessionToken();
+  if (!sid) return { authenticated: false };
   const res = await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/api/me\`, {
-    credentials: 'include',
+    headers: { Authorization: 'Bearer ' + sid },
   });
   if (!res.ok) return { authenticated: false };
   const data = await res.json();
@@ -447,12 +472,34 @@ export async function getNetSuiteSession(): Promise<NetSuiteSession> {
 
 export async function signOutNetSuite(): Promise<void> {
   if (!WORKER_URL) return;
-  await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
-    method: 'POST',
-    credentials: 'include',
-  });
+  const sid = getSessionToken();
+  if (sid) {
+    try {
+      await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
+        method: 'POST',
+        headers: { Authorization: 'Bearer ' + sid },
+      });
+    } catch {}
+  }
+  try { sessionStorage.removeItem(TOKEN_KEY); } catch {}
   window.location.reload();
 }
+
+/**
+ * Helper for ALL other Worker calls (your dashboard endpoints, etc.).
+ * Always go through this instead of bare fetch -- it injects the bearer
+ * token and routes through the Worker so NetSuite tokens stay server-side.
+ */
+export async function workerFetch(pathOrUrl: string, init: RequestInit = {}): Promise<Response> {
+  if (!WORKER_URL) throw new Error('VITE_WORKER_URL is not set');
+  const url = pathOrUrl.startsWith('http')
+    ? pathOrUrl
+    : \`\${WORKER_URL.replace(/\\/$/, '')}\${pathOrUrl.startsWith('/') ? '' : '/'}\${pathOrUrl}\`;
+  const sid = getSessionToken();
+  const headers = new Headers(init.headers ?? {});
+  if (sid) headers.set('Authorization', 'Bearer ' + sid);
+  return fetch(url, { ...init, headers });
+}
 `;
 }