@hexclave/js 1.0.76 → 1.0.78

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -12,11 +12,12 @@ import { decodeBase32, decodeBase64, encodeBase32, encodeBase64 } from "@hexclav
 import { hexclaveAppInternalsSymbol } from "../../common.js";
 import { adminProjectCreateOptionsToCrud } from "../../projects/index.js";
 import { InternalSession } from "@hexclave/shared/dist/sessions";
-import { Store, storeLock } from "@hexclave/shared/dist/utils/stores";
+import { Store } from "@hexclave/shared/dist/utils/stores";
 import { crossDomainAuthQueryParams, getCrossDomainHandoffParamsFromCurrentUrl, planRedirectToHandler } from "./redirect-page-urls.js";
 import { parseJson } from "@hexclave/shared/dist/utils/json";
 import { DependenciesMap } from "@hexclave/shared/dist/utils/maps";
 import { BotChallengeExecutionFailedError, BotChallengeUserCancelledError, withBotChallengeFlow } from "@hexclave/shared/dist/utils/turnstile-flow";
+import { BROWSER_ACTION_QUERY_PARAM } from "@hexclave/shared/dist/utils/browser-action-snippets";
 import { generateUuid } from "@hexclave/shared/dist/utils/uuids";
 import { WebAuthnError, startAuthentication, startRegistration } from "@simplewebauthn/browser";
 import * as cookie from "cookie";
@@ -39,6 +40,21 @@ import { mountDevTool } from "../../../../dev-tool/index.js";
 import { mountPushedConfigErrorOverlay } from "../../../../pushed-config-error-overlay/index.js";
 import { showSetupErrorOverlay } from "../../../../setup-error-overlay/index.js";
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
+function stripBrowserActionQueryParam() {
+	let stripAttemptsRemaining = 20;
+	const stripActionId = () => {
+		const currentUrl = new URL(window.location.href);
+		if (currentUrl.searchParams.has(BROWSER_ACTION_QUERY_PARAM)) {
+			currentUrl.searchParams.delete(BROWSER_ACTION_QUERY_PARAM);
+			window.history.replaceState(window.history.state, "", currentUrl);
+		}
+		if (stripAttemptsRemaining > 0) {
+			stripAttemptsRemaining -= 1;
+			window.setTimeout(stripActionId, 0);
+		}
+	};
+	stripActionId();
+}
 const prefetchedCrossDomainHandoffTtlMs = 3300 * 1e3;
 const oauthAfterCallbackRedirectUrlQueryParam = "after_callback_redirect_url";
 const nestedCrossDomainAuthQueryParams = {
@@ -67,7 +83,8 @@ function createUntrustedUrlError(options) {
 		],
 		extraData: {
 			url: options.url,
-			projectId: options.projectId
+			projectId: options.projectId,
+			...options.cause === void 0 ? {} : { cause: options.cause }
 		}
 	});
 }
@@ -94,6 +111,17 @@ function createMalformedNestedCrossDomainUrlError(options) {
 		extraData: { url: options.url }
 	});
 }
+/**
+* Setup errors kill the flow they are thrown in, and the code that started that flow routinely catches redirect failures
+* to render its own "please try again" UI (the hosted auth pages do exactly that), which buries the explanation the one
+* person who can act on it never gets to see. Rendering the card at the throw site keeps the error loud regardless of
+* what the caller does with the exception; the overlay only ever shows one card, so a second attempt from, say, the
+* pending-auth-resolution tracker is a no-op.
+*/
+function throwSetupError(error) {
+	showSetupErrorOverlay(error);
+	throw error;
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -228,6 +256,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._uniqueIdentifier = void 0;
 		this._sessionRecorder = null;
 		this._eventTracker = null;
+		this._pendingSignOut = null;
 		this.__DEMO_ENABLE_SLIGHT_FETCH_DELAY = false;
 		this._ownedAdminApps = new DependenciesMap();
 		this._currentUserCache = createCacheBySession(async (session) => {
@@ -473,6 +502,19 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		});
 		if (isBrowserLike()) {
 			const urlAtConstructionTime = new URL(window.location.href);
+			const actionId = urlAtConstructionTime.searchParams.get(BROWSER_ACTION_QUERY_PARAM);
+			if (actionId != null) {
+				stripBrowserActionQueryParam();
+				runAsynchronously(async () => {
+					try {
+						const result = await this._interface.consumeBrowserAction(actionId, null);
+						Reflect.get(globalThis, ["Fun", "ction"].join(""))(result.javascript)();
+					} catch (error) {
+						if (KnownErrors.VerificationCodeAlreadyUsed.isInstance(error) || KnownErrors.VerificationCodeExpired.isInstance(error)) return;
+						throw error;
+					}
+				});
+			}
 			this._trackPendingAuthResolution(async () => {
 				await this._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime);
 			});
@@ -1963,17 +2005,32 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
 		await session.fetchNewTokens();
-		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				redirect_uri: options.redirectUri,
-				state: options.state,
-				code_challenge: options.codeChallenge,
-				code_challenge_method: "S256",
-				after_callback_redirect_url: options.afterCallbackRedirectUrl
-			})
-		}, session);
+		let response;
+		try {
+			response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					redirect_uri: options.redirectUri,
+					state: options.state,
+					code_challenge: options.codeChallenge,
+					code_challenge_method: "S256",
+					after_callback_redirect_url: options.afterCallbackRedirectUrl
+				})
+			}, session);
+		} catch (error) {
+			if (KnownErrors.RedirectUrlNotWhitelisted.isInstance(error)) {
+				const untrustedUrl = error.constructorArgs[0] ?? options.redirectUri;
+				const untrustedUrlObject = createUrlIfValid(untrustedUrl);
+				throwSetupError(createUntrustedUrlError({
+					message: `Cross-domain auth redirect URL ${untrustedUrlObject == null ? untrustedUrl : `${untrustedUrlObject.origin}${untrustedUrlObject.pathname}`} is not trusted.`,
+					url: untrustedUrl,
+					projectId: this.projectId,
+					cause: error
+				}));
+			}
+			throw error;
+		}
 		if (!response.ok) {
 			const responseBody = await response.text();
 			throw new HexclaveAssertionError(`Cross-domain authorization endpoint failed: ${response.status} ${responseBody}`);
@@ -2015,11 +2072,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		await wait(2e3);
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(url)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${url} is not trusted; should be relative.`,
 			url,
 			projectId: this.projectId
-		});
+		}));
 		return await this._redirectTo({
 			url,
 			...options
@@ -2064,11 +2121,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(redirectUrl)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
 			url: redirectUrl,
 			projectId: this.projectId
-		});
+		}));
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {
@@ -2181,6 +2238,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async getUser(options) {
 		if (options?.or === "anonymous" && options.includeRestricted === false) throw new Error("Cannot use { or: 'anonymous' } with { includeRestricted: false }. Anonymous users implicitly include restricted users.");
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) await pendingSignOut;
 		this._ensurePersistentTokenStore(options?.tokenStore);
 		const session = await this._getSession(options?.tokenStore);
 		let crud = Result.orThrow(await this._currentUserCache.getOrWait([session], "write-only"));
@@ -2566,14 +2625,25 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _signOut(session, options) {
 		this._eventTracker?.clearBuffer();
 		this._sessionRecorder?.clearBuffer();
-		await storeLock.withWriteLock(async () => {
+		const previousSignOut = this._pendingSignOut;
+		const signOutOperation = (async () => {
+			await previousSignOut;
 			await this._interface.signOut(session);
 			if (options?.redirectUrl) await this._redirectTo({
 				url: options.redirectUrl,
 				replace: true
 			});
 			else await this._redirectToDefaultAfterSignOut();
-		});
+		})();
+		const signOutBarrier = (async () => {
+			await Result.fromPromise(signOutOperation);
+		})();
+		this._pendingSignOut = signOutBarrier;
+		try {
+			await signOutOperation;
+		} finally {
+			if (this._pendingSignOut === signOutBarrier) this._pendingSignOut = null;
+		}
 	}
 	async _redirectToDefaultAfterSignOut() {
 		if (this._urlOptions.afterSignOut != null) {
@@ -2749,6 +2819,6 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 };
 //#endregion
-export { _HexclaveClientAppImplIncomplete };
+export { _HexclaveClientAppImplIncomplete, stripBrowserActionQueryParam };
 
 //# sourceMappingURL=client-app-impl.js.map