@hexclave/js 1.0.71 → 1.0.72

package/dist/lib/hexclave-app/passkey-rp-id.test.js

@@ -0,0 +1,25 @@
+let vitest = require("vitest");
+let __passkey_rp_id_js = require("./passkey-rp-id.js");
+//#region src/lib/hexclave-app/passkey-rp-id.test.ts
+const passkeyRpIdSentinel = "THIS_VALUE_WILL_BE_REPLACED.example.com";
+vitest.describe.each(["project-id.built-with-hexclave.com", "project-id.built-with-stack-auth.com"])("passkeys on %s", (hostname) => {
+	(0, vitest.it)("scopes registration to the current hostname", () => {
+		const options = { rp: { id: passkeyRpIdSentinel } };
+		(0, __passkey_rp_id_js.scopePasskeyRegistrationToHostname)(options, hostname);
+		(0, vitest.expect)(options.rp.id).toBe(hostname);
+	});
+	(0, vitest.it)("scopes authentication to the current hostname", () => {
+		const options = { rpId: passkeyRpIdSentinel };
+		(0, __passkey_rp_id_js.scopePasskeyAuthenticationToHostname)(options, hostname);
+		(0, vitest.expect)(options.rpId).toBe(hostname);
+	});
+});
+(0, vitest.it)("rejects registration options without the server sentinel", () => {
+	(0, vitest.expect)(() => (0, __passkey_rp_id_js.scopePasskeyRegistrationToHostname)({ rp: { id: "unexpected.example.com" } }, "project-id.built-with-hexclave.com")).toThrow("Expected returned RP ID from server to equal sentinel");
+});
+(0, vitest.it)("rejects authentication options without the server sentinel", () => {
+	(0, vitest.expect)(() => (0, __passkey_rp_id_js.scopePasskeyAuthenticationToHostname)({ rpId: "unexpected.example.com" }, "project-id.built-with-hexclave.com")).toThrow("Expected returned RP ID from server to equal sentinel");
+});
+//#endregion
+
+//# sourceMappingURL=passkey-rp-id.test.js.map

package/dist/lib/hexclave-app/passkey-rp-id.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-rp-id.test.js","names":["describe"],"sources":["../../../src/lib/hexclave-app/passkey-rp-id.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { scopePasskeyAuthenticationToHostname, scopePasskeyRegistrationToHostname } from \"./passkey-rp-id\";\n\nconst passkeyRpIdSentinel = \"THIS_VALUE_WILL_BE_REPLACED.example.com\";\n\ndescribe.each([\n  \"project-id.built-with-hexclave.com\",\n  \"project-id.built-with-stack-auth.com\",\n])(\"passkeys on %s\", (hostname) => {\n  it(\"scopes registration to the current hostname\", () => {\n    const options = { rp: { id: passkeyRpIdSentinel } };\n\n    scopePasskeyRegistrationToHostname(options, hostname);\n\n    expect(options.rp.id).toBe(hostname);\n  });\n\n  it(\"scopes authentication to the current hostname\", () => {\n    const options = { rpId: passkeyRpIdSentinel };\n\n    scopePasskeyAuthenticationToHostname(options, hostname);\n\n    expect(options.rpId).toBe(hostname);\n  });\n});\n\nit(\"rejects registration options without the server sentinel\", () => {\n  expect(() => scopePasskeyRegistrationToHostname(\n    { rp: { id: \"unexpected.example.com\" } },\n    \"project-id.built-with-hexclave.com\",\n  )).toThrow(\"Expected returned RP ID from server to equal sentinel\");\n});\n\nit(\"rejects authentication options without the server sentinel\", () => {\n  expect(() => scopePasskeyAuthenticationToHostname(\n    { rpId: \"unexpected.example.com\" },\n    \"project-id.built-with-hexclave.com\",\n  )).toThrow(\"Expected returned RP ID from server to equal sentinel\");\n});\n"],"mappings":";;;AAOA,MAAM,sBAAsB;AAE5BA,OAAAA,SAAS,KAAK,CACZ,sCACA,sCACF,CAAC,CAAC,CAAC,mBAAmB,aAAa;CACjC,CAAA,GAAA,OAAA,GAAA,CAAG,qDAAqD;EACtD,MAAM,UAAU,EAAE,IAAI,EAAE,IAAI,oBAAoB,EAAE;EAElD,CAAA,GAAA,mBAAA,mCAAA,CAAmC,SAAS,QAAQ;EAEpD,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,GAAG,EAAE,CAAC,CAAC,KAAK,QAAQ;CACrC,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,uDAAuD;EACxD,MAAM,UAAU,EAAE,MAAM,oBAAoB;EAE5C,CAAA,GAAA,mBAAA,qCAAA,CAAqC,SAAS,QAAQ;EAEtD,CAAA,GAAA,OAAA,OAAA,CAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,QAAQ;CACpC,CAAC;AACH,CAAC;eAEE,kEAAkE;CACnE,CAAA,GAAA,OAAA,OAAA,QAAA,GAAA,mBAAA,mCAAA,CACE,EAAE,IAAI,EAAE,IAAI,yBAAyB,EAAE,GACvC,oCACF,CAAC,CAAC,CAAC,QAAQ,uDAAuD;AACpE,CAAC;eAEE,oEAAoE;CACrE,CAAA,GAAA,OAAA,OAAA,QAAA,GAAA,mBAAA,qCAAA,CACE,EAAE,MAAM,yBAAyB,GACjC,oCACF,CAAC,CAAC,CAAC,QAAQ,uDAAuD;AACpE,CAAC"}

package/dist/pushed-config-error-overlay/index.js

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let _hexclave_shared_dist_utils_promises = require("@hexclave/shared/dist/utils/promises");
-let _hexclave_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
 let ___in_page_ui_dom_js = require("../in-page-ui/dom.js");
 let ___in_page_ui_base_styles_js = require("../in-page-ui/base-styles.js");
 let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+let _hexclave_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
 let ___generated_env_js = require("../generated/env.js");
 //#region src/pushed-config-error-overlay/index.ts
 const GLOBAL_INSTANCE_KEY = "__hexclave-pushed-config-error-overlay";

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@hexclave/js",
-  "version": "1.0.71",
+  "version": "1.0.72",
   "repository": "https://github.com/hexclave/hexclave",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -65,7 +65,7 @@
     "qrcode": "^1.5.4",
     "rrweb": "^1.1.3",
     "yup": "^1.7.1",
-    "@hexclave/shared": "1.0.71"
+    "@hexclave/shared": "1.0.72"
   },
   "devDependencies": {
     "@quetzallabs/i18n": "^0.1.19",

package/src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts

@@ -535,7 +535,7 @@ describe("StackClientApp cross-domain auth", () => {
     }
 
     const errorUrl = new URL(redirectedUrl);
-    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-stack-auth.com`);
+    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);
     expect(errorUrl.pathname).toBe("/handler/error");
     expect(errorUrl.searchParams.get("errorCode")).toBe("SIGN_UP_REJECTED");
     expect(errorUrl.searchParams.get("message")).toBe("Your sign up was rejected by an administrator's sign-up rule.");
@@ -715,7 +715,7 @@ describe("StackClientApp cross-domain auth", () => {
     redirectBackUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
     redirectBackUrl.searchParams.set("hexclave_cross_domain_after_callback_redirect_url", handoffAfterCallbackRedirect);
 
-    const arrivalUrl = new URL(`https://${projectId}.built-with-stack-auth.com/handler/sign-in`);
+    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);
     arrivalUrl.searchParams.set("after_auth_return_to", redirectBackUrl.toString());
     arrivalUrl.searchParams.set("hexclave_cross_domain_state", handoffState);
     arrivalUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
@@ -754,7 +754,7 @@ describe("StackClientApp cross-domain auth", () => {
         .mockResolvedValue(crossDomainAuthorizeRedirect);
 
       // All redirect-back query params were dropped before the after-sign-in redirect.
-      windowMock.location.href = `https://${projectId}.built-with-stack-auth.com/handler/sign-in`;
+      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;
 
       const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("afterSignIn");
 

package/src/lib/hexclave-app/apps/implementations/client-app-impl.ts

@@ -59,6 +59,7 @@ import { EditableTeamMemberProfile, ReceivedTeamInvitation, SentTeamInvitation,
 import { buildCliAuthConfirmUrl, getHostedHandlerUrl, isHostedHandlerUrlForProject, resolveHandlerUrls } from "../../url-targets";
 import { augmentUrlWithPersistedRedirectBackState, saveRedirectBackStateFromUrl } from "./redirect-back-state";
 import { recordRedirectAndThrowIfLoopDetected } from "./redirect-loop-breaker";
+import { scopePasskeyAuthenticationToHostname, scopePasskeyRegistrationToHostname } from "../../passkey-rp-id";
 import { ActiveSession, Auth, BaseUser, CurrentUser, InternalUserExtra, OAuthProvider, ProjectCurrentUser, SyncedPartialUser, TokenPartialUser, UserExtra, UserUpdateOptions, userUpdateOptionsToCrud, withUserDestructureGuard } from "../../users";
 import { StackClientApp, StackClientAppConstructorOptions, StackClientAppJson } from "../interfaces/client-app";
 import { _HexclaveAdminAppImplIncomplete } from "./admin-app-impl";
@@ -2233,12 +2234,11 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rp.id !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rp.id}`);
-        }
-
-        options_json.rp.id = hostname;
+        // Passkeys intentionally stay scoped to the hostname where they were
+        // registered. In particular, passkeys created on the legacy hosted
+        // components domain continue to work there but are not carried over to
+        // a replacement hosted domain.
+        scopePasskeyRegistrationToHostname(options_json, hostname);
 
         let attResp;
         try {
@@ -3425,11 +3425,10 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rpId !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rpId}`);
-        }
-        options_json.rpId = window.location.hostname;
+        // Keep authentication scoped to the current hostname. This deliberately
+        // does not add cross-domain compatibility for passkeys created on a
+        // previous hosted components domain.
+        scopePasskeyAuthenticationToHostname(options_json, window.location.hostname);
 
         const authentication_response = await startAuthentication({ optionsJSON: options_json });
         return await this._interface.signInWithPasskey({ authentication_response, code }, session);

package/src/lib/hexclave-app/apps/implementations/server-app-impl.ts

@@ -35,6 +35,7 @@ import { Customer, CustomerProductsList, CustomerProductsRequestOptions, InlineP
 import { DataVaultStore } from "../../data-vault";
 import { EmailDeliveryInfo, SendEmailOptions } from "../../email";
 import { NotificationCategory } from "../../notification-categories";
+import { scopePasskeyRegistrationToHostname } from "../../passkey-rp-id";
 import { AdminProjectPermissionDefinition, AdminTeamPermission, AdminTeamPermissionDefinition } from "../../permissions";
 import { EditableTeamMemberProfile, ReceivedTeamInvitation, SentTeamInvitation, ServerListTeamsOptions, ServerListUsersOptions, ServerTeam, ServerTeamCreateOptions, ServerTeamUpdateOptions, ServerTeamUser, Team, serverTeamCreateOptionsToCrud, serverTeamUpdateOptionsToCrud } from "../../teams";
 import { ProjectCurrentServerUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, ServerUserUpdateOptions, serverUserCreateOptionsToCrud, serverUserUpdateOptionsToCrud, withUserDestructureGuard } from "../../users";
@@ -780,7 +781,6 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
         return providers.find((p) => p.id === id) ?? null;
       },
       async registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>> {
-        // TODO remove duplicated code between this and the function in client-app-impl.ts
         const hostname = options?.hostname || (await app._getCurrentUrl())?.hostname;
         if (!hostname) {
           throw new HexclaveAssertionError("hostname must be provided if the Stack App does not have a redirect method");
@@ -795,12 +795,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rp.id !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rp.id}`);
-        }
-
-        options_json.rp.id = hostname;
+        scopePasskeyRegistrationToHostname(options_json, hostname);
 
         let attResp;
         try {

package/src/lib/hexclave-app/passkey-rp-id.test.ts

@@ -0,0 +1,43 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+import { describe, expect, it } from "vitest";
+import { scopePasskeyAuthenticationToHostname, scopePasskeyRegistrationToHostname } from "./passkey-rp-id";
+
+const passkeyRpIdSentinel = "THIS_VALUE_WILL_BE_REPLACED.example.com";
+
+describe.each([
+  "project-id.built-with-hexclave.com",
+  "project-id.built-with-stack-auth.com",
+])("passkeys on %s", (hostname) => {
+  it("scopes registration to the current hostname", () => {
+    const options = { rp: { id: passkeyRpIdSentinel } };
+
+    scopePasskeyRegistrationToHostname(options, hostname);
+
+    expect(options.rp.id).toBe(hostname);
+  });
+
+  it("scopes authentication to the current hostname", () => {
+    const options = { rpId: passkeyRpIdSentinel };
+
+    scopePasskeyAuthenticationToHostname(options, hostname);
+
+    expect(options.rpId).toBe(hostname);
+  });
+});
+
+it("rejects registration options without the server sentinel", () => {
+  expect(() => scopePasskeyRegistrationToHostname(
+    { rp: { id: "unexpected.example.com" } },
+    "project-id.built-with-hexclave.com",
+  )).toThrow("Expected returned RP ID from server to equal sentinel");
+});
+
+it("rejects authentication options without the server sentinel", () => {
+  expect(() => scopePasskeyAuthenticationToHostname(
+    { rpId: "unexpected.example.com" },
+    "project-id.built-with-hexclave.com",
+  )).toThrow("Expected returned RP ID from server to equal sentinel");
+});

package/src/lib/hexclave-app/passkey-rp-id.ts

@@ -0,0 +1,27 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+import { HexclaveAssertionError } from "@hexclave/shared/dist/utils/errors";
+
+const passkeyRpIdSentinel = "THIS_VALUE_WILL_BE_REPLACED.example.com";
+
+export function scopePasskeyRegistrationToHostname(
+  options: { rp: { id?: string } },
+  hostname: string,
+): void {
+  if (options.rp.id !== passkeyRpIdSentinel) {
+    throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options.rp.id}`);
+  }
+  options.rp.id = hostname;
+}
+
+export function scopePasskeyAuthenticationToHostname(
+  options: { rpId?: string },
+  hostname: string,
+): void {
+  if (options.rpId !== passkeyRpIdSentinel) {
+    throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options.rpId}`);
+  }
+  options.rpId = hostname;
+}