@hexclave/next 1.0.0 → 1.0.2

package/dist/esm/lib/stack-app/apps/implementations/client-app-impl.js

@@ -2,12 +2,12 @@ import { HexclaveAssertionError, captureError, throwErr } from "@hexclave/shared
 import { neverResolve, runAsynchronously, wait } from "@hexclave/shared/dist/utils/promises";
 import React, { useCallback, useMemo } from "react";
 import { HexclaveClientInterface, KnownErrors } from "@hexclave/shared";
-import { createUrlIfValid, isRelative } from "@hexclave/shared/dist/utils/urls";
 import { suspend, suspendIfSsr, use } from "@hexclave/shared/dist/utils/react";
 import { deepPlainEquals, omit } from "@hexclave/shared/dist/utils/objects";
+import { createUrlIfValid, isRelative } from "@hexclave/shared/dist/utils/urls";
 import * as NextNavigationUnscrambled from "next/navigation";
-import { deindent, mergeScopeStrings } from "@hexclave/shared/dist/utils/strings";
 import { Result } from "@hexclave/shared/dist/utils/results";
+import { deindent, mergeScopeStrings } from "@hexclave/shared/dist/utils/strings";
 import { isBrowserLike } from "@hexclave/shared/dist/utils/env";
 import { clientVersion, createCache, createCacheBySession, createEmptyTokenStore, getAnalyticsBaseUrl, getDefaultExtraRequestHeaders, getDefaultProjectId, getDefaultPublishableClientKey, getUrls, resolveApiUrls, resolveConstructorOptions, useAsyncCache } from "./common.js";
 import { getTrustedParentDomain, validateRedirectUrl } from "@hexclave/shared/dist/utils/redirect-urls";
@@ -561,9 +561,22 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		const afterCallbackRedirectUrl = new URL(currentUrl);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
-		const { state: newState, codeChallenge: newCodeChallenge } = await this._getCrossDomainHandoffParamsForRedirect(currentUrl);
+		const { state: newState, codeChallenge: newCodeChallenge } = await this._getNestedCrossDomainAuthParamsForRedirect();
+		const nestedRedirectUri = new URL(this._getOAuthCallbackRedirectUri(), currentUrl);
+		nestedRedirectUri.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
+		nestedRedirectUri.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
+		for (const param of [
+			"after_auth_return_to",
+			crossDomainAuthQueryParams.marker,
+			crossDomainAuthQueryParams.state,
+			crossDomainAuthQueryParams.codeChallenge,
+			crossDomainAuthQueryParams.afterCallbackRedirectUrl
+		]) {
+			const value = currentUrl.searchParams.get(param);
+			if (value != null && !nestedRedirectUri.searchParams.has(param)) nestedRedirectUri.searchParams.set(param, value);
+		}
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.refreshTokenId, refreshTokenId);
-		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.redirectUri, new URL(this._getOAuthCallbackRedirectUri(), currentUrl).toString());
+		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.redirectUri, nestedRedirectUri.toString());
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.state, newState);
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.codeChallenge, newCodeChallenge);
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.codeChallengeMethod, "S256");
@@ -574,6 +587,9 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		});
 		return true;
 	}
+	async _getNestedCrossDomainAuthParamsForRedirect() {
+		return await saveVerifierAndState();
+	}
 	/**
 	* Cloudflare workers does not allow use of randomness on the global scope (on which the Stack app is probably
 	* initialized). For that reason, we generate the unique identifier lazily when it is first needed instead of in the