@hexclave/js 1.0.74 → 1.0.76

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -40,6 +40,7 @@ let __session_replay_js = require("./session-replay.js");
 let ____________clickmap_index_js = require("../../../../clickmap/index.js");
 let ____________dev_tool_index_js = require("../../../../dev-tool/index.js");
 let ____________pushed_config_error_overlay_index_js = require("../../../../pushed-config-error-overlay/index.js");
+let ____________setup_error_overlay_index_js = require("../../../../setup-error-overlay/index.js");
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
 const prefetchedCrossDomainHandoffTtlMs = 3300 * 1e3;
 const oauthAfterCallbackRedirectUrlQueryParam = "after_callback_redirect_url";
@@ -52,6 +53,50 @@ const nestedCrossDomainAuthQueryParams = {
 	codeChallengeMethod: "code_challenge_method",
 	afterCallbackRedirectUrl: oauthAfterCallbackRedirectUrlQueryParam
 };
+/**
+* An auth flow can only ever send the user to a URL that the project trusts, so an untrusted one means the flow is dead
+* until someone changes the project's configuration. Describe the problem in terms of that configuration rather than in
+* terms of the flow's internals, which nobody outside this file knows about.
+*/
+function createUntrustedUrlError(options) {
+	const origin = (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(options.url)?.origin ?? options.url;
+	return new _hexclave_shared_dist_utils_errors.HexclaveSetupError({
+		title: "A domain in your authentication flow is not one of your project's trusted domains",
+		message: options.message,
+		howToFix: [
+			`If ${origin} is yours, add it to your project's trusted domains in the Hexclave dashboard, under Domains.`,
+			"Protocol, domain and port must all match a trusted domain exactly; a wildcard like https://*.example.com matches only one subdomain level.",
+			`If ${origin} is not yours, do not add it \u2014 somebody may be trying to redirect your users' credentials to it.`
+		],
+		extraData: {
+			url: options.url,
+			projectId: options.projectId
+		}
+	});
+}
+function createUntrustedNestedCrossDomainUrlError(options) {
+	return createUntrustedUrlError({
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not trusted.`,
+		url: options.url,
+		projectId: options.projectId
+	});
+}
+/**
+* A URL that the auth flow cannot even parse is just as fatal as an untrusted one, and just as much a configuration
+* problem: something in the developer's setup put a relative or malformed value where an absolute URL belongs.
+*/
+function createMalformedNestedCrossDomainUrlError(options) {
+	return new _hexclave_shared_dist_utils_errors.HexclaveSetupError({
+		title: "A URL in your authentication flow is not a valid absolute URL",
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not a valid absolute URL.`,
+		howToFix: [
+			"Handler URLs and after-auth redirect URLs must be absolute, including their protocol, like https://example.com/handler/oauth-callback.",
+			"Check the handler URLs configured for your project and the redirect URLs you pass to Hexclave's sign-in and sign-up methods.",
+			"If none of those look wrong, check whether a proxy or rewrite in front of your app is rewriting the authentication flow's query parameters."
+		],
+		extraData: { url: options.url }
+	});
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -457,6 +502,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				await callback();
 			} catch (error) {
 				(0, _hexclave_shared_dist_utils_errors.captureError)("pending-auth-resolution-failed", error);
+				(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
 			}
 		})();
 		this._pendingAuthResolutionPromises.push(promise);
@@ -573,13 +619,35 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				codeChallenge
 			});
 			if ((currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.codeChallengeMethod) ?? "S256") !== "S256") throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Nested cross-domain auth only supports S256 PKCE");
-			if ((0, _hexclave_shared_dist_utils_urls.isRelative)(redirectUri)) throw new Error("Nested cross-domain auth redirect URI must be absolute.");
-			const redirectUriUrl = new URL(redirectUri);
-			if (!await this._isTrusted(redirectUriUrl.toString())) throw new Error(`Nested cross-domain auth redirect URI ${redirectUri} is not trusted.`);
+			const validateHandoffOwnership = async () => {
+				if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			};
+			const setupErrorIfHandoffIsOwned = async (setupError) => {
+				await validateHandoffOwnership();
+				return setupError;
+			};
+			const redirectUriUrl = (0, _hexclave_shared_dist_utils_urls.isRelative)(redirectUri) ? null : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(redirectUri);
+			if (redirectUriUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri
+			}));
+			if (!await this._isTrusted(redirectUriUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri,
+				projectId: this.projectId
+			}));
 			const afterCallbackRedirectUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.afterCallbackRedirectUrl);
-			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : new URL(afterCallbackRedirectUrlString, redirectUriUrl);
-			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
-			if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(afterCallbackRedirectUrlString, redirectUriUrl);
+			if (afterCallbackRedirectUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? ""
+			}));
+			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? afterCallbackRedirectUrl.toString(),
+				projectId: this.projectId
+			}));
+			await validateHandoffOwnership();
 			await this._redirectTo({
 				url: await this._createCrossDomainAuthRedirectUrl({
 					redirectUri: redirectUriUrl.toString(),
@@ -597,9 +665,16 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		if (currentRefreshTokenId != null) (await this._getSession(void 0, { awaitPendingAuthResolutions: false })).markInvalid();
 		const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
 		if (callbackUrlString == null) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
-		if ((0, _hexclave_shared_dist_utils_urls.isRelative)(callbackUrlString)) throw new Error("Nested cross-domain auth callback URL must be absolute.");
-		const callbackUrl = new URL(callbackUrlString);
-		if (!await this._isTrusted(callbackUrl.toString())) throw new Error(`Nested cross-domain auth callback URL ${callbackUrlString} is not trusted.`);
+		const callbackUrl = (0, _hexclave_shared_dist_utils_urls.isRelative)(callbackUrlString) ? null : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(callbackUrlString);
+		if (callbackUrl == null) throw createMalformedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString
+		});
+		if (!await this._isTrusted(callbackUrl.toString())) throw createUntrustedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString,
+			projectId: this.projectId
+		});
 		const afterCallbackRedirectUrl = new URL(currentUrl);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
@@ -1943,7 +2018,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		await (0, _hexclave_shared_dist_utils_promises.wait)(2e3);
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw new Error(`Redirect URL ${url} is not trusted; should be relative.`);
+		if (!await this._isTrusted(url)) throw createUntrustedUrlError({
+			message: `Redirect URL ${url} is not trusted; should be relative.`,
+			url,
+			projectId: this.projectId
+		});
 		return await this._redirectTo({
 			url,
 			...options
@@ -1988,7 +2067,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw new Error(`Redirect URL ${redirectUrl} is not trusted; should be relative.`);
+		if (!await this._isTrusted(redirectUrl)) throw createUntrustedUrlError({
+			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
+			url: redirectUrl,
+			projectId: this.projectId
+		});
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {