@hexclave/next 1.0.123 → 1.0.126

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -18,7 +18,6 @@ let _hexclave_shared_dist_utils_redirect_urls = require("@hexclave/shared/dist/u
 let _hexclave_shared_dist_utils_bytes = require("@hexclave/shared/dist/utils/bytes");
 let ______common_js = require("../../common.js");
 let ______projects_index_js = require("../../projects/index.js");
-let _hexclave_shared_dist_sessions = require("@hexclave/shared/dist/sessions");
 let _hexclave_shared_dist_utils_stores = require("@hexclave/shared/dist/utils/stores");
 let __redirect_page_urls_js = require("./redirect-page-urls.js");
 let _hexclave_shared_dist_utils_browser_action_snippets = require("@hexclave/shared/dist/utils/browser-action-snippets");
@@ -42,6 +41,7 @@ let ______teams_index_js = require("../../teams/index.js");
 let ______url_targets_js = require("../../url-targets.js");
 let ______users_index_js = require("../../users/index.js");
 let __event_tracker_js = require("./event-tracker.js");
+let __external_token_store_session_adapter_js = require("./external-token-store-session-adapter.js");
 let __redirect_back_state_js = require("./redirect-back-state.js");
 let __redirect_loop_breaker_js = require("./redirect-loop-breaker.js");
 let __session_refresh_subscription_js = require("./session-refresh-subscription.js");
@@ -150,6 +150,9 @@ function throwSetupError(error) {
 	(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
 	throw error;
 }
+function createAnalyticsAppDisabledOnProjectError() {
+	return /* @__PURE__ */ new Error("initAnalytics() was called, but the Analytics app is not enabled on this Hexclave project, so the backend rejects all analytics uploads. Enable the Analytics app in the Hexclave dashboard (or in hexclave.config.ts), or remove the initAnalytics() call if this is intentional.");
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -310,6 +313,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._uniqueIdentifier = void 0;
 		this._sessionRecorder = null;
 		this._eventTracker = null;
+		this._initAnalyticsCalled = false;
+		this._analyticsAppDisabledOnProject = false;
 		this._pendingSignOut = null;
 		this.__DEMO_ENABLE_SLIGHT_FETCH_DELAY = false;
 		this._ownedAdminApps = new _hexclave_shared_dist_utils_maps.DependenciesMap();
@@ -516,6 +521,10 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				}
 			});
 		}
+		this._externalTokenStoreSessionAdapter = new __external_token_store_session_adapter_js.ExternalTokenStoreSessionAdapter((sessionOptions) => this._interface.createSession(sessionOptions), async (providerId, token) => {
+			const exchange = await this._interface.exchangeExternalAuthToken(providerId, token);
+			return _hexclave_shared_dist_utils_results.Result.orThrow(exchange).accessToken;
+		});
 		this._tokenStoreInit = resolvedOptions.tokenStore;
 		this._redirectMethod = resolvedOptions.redirectMethod || ((0, _hexclave_shared_dist_utils_env.isBrowserLike)() ? "window" : "none");
 		this._redirectMethod = resolvedOptions.redirectMethod || "nextjs";
@@ -540,22 +549,22 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			})) return await this._getSession();
 			return (await this.getUser({ or: "anonymous" }))._internalSession;
 		};
-		const analyticsEnabled = this._analyticsOptions?.enabled !== false;
+		const recordsAnalytics = this._getAnalyticsDisabledReason() == null && (0, _hexclave_shared_dist_utils_env.isBrowserLike)();
 		const sessionReplayOptions = (0, __session_replay_js.getSessionReplayOptions)(this._analyticsOptions);
-		if (analyticsEnabled && (0, _hexclave_shared_dist_utils_env.isBrowserLike)() && this._hasPersistentTokenStore() && sessionReplayOptions.enabled) {
+		if (recordsAnalytics && sessionReplayOptions.enabled) {
 			this._sessionRecorder = new __session_replay_js.SessionRecorder({
 				projectId: this.projectId,
 				sendBatch: async (body, opts) => {
-					return await this._interface.sendSessionReplayBatch(body, await getAnalyticsSession(), opts);
+					return this._handleAnalyticsUploadResult(await this._interface.sendSessionReplayBatch(body, await getAnalyticsSession(), opts));
 				}
 			}, sessionReplayOptions);
 			this._sessionRecorder.start();
 		}
-		if (analyticsEnabled && (0, _hexclave_shared_dist_utils_env.isBrowserLike)() && this._hasPersistentTokenStore()) {
+		if (recordsAnalytics) {
 			this._eventTracker = new __event_tracker_js.EventTracker({
 				projectId: this.projectId,
 				sendBatch: async (body, opts) => {
-					return await this._interface.sendAnalyticsEventBatch(body, await getAnalyticsSession(), opts);
+					return this._handleAnalyticsUploadResult(await this._interface.sendAnalyticsEventBatch(body, await getAnalyticsSession(), opts));
 				}
 			});
 			this._eventTracker.start();
@@ -1130,6 +1139,9 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			case "memory": return this._memoryTokenStore;
 			default:
 				if (tokenStoreInit === null) return (0, __common_js.createEmptyTokenStore)();
+				else if (typeof tokenStoreInit === "object" && (0, __external_token_store_session_adapter_js.isExternalTokenStore)(tokenStoreInit)) return this._externalTokenStoreSessionAdapter.getOrCreateTokenStore(tokenStoreInit, (store, previousSessionKey) => {
+					this._sessionsByTokenStoreAndSessionKey.get(store)?.get(previousSessionKey)?.suggestAccessTokenExpired();
+				});
 				else if (typeof tokenStoreInit === "object" && "headers" in tokenStoreInit) {
 					if (this._requestTokenStores.has(tokenStoreInit)) return this._requestTokenStores.get(tokenStoreInit);
 					const authorizationHeader = getHeaderValueFromRequestLikeHeaders(tokenStoreInit.headers, "authorization");
@@ -1176,27 +1188,27 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		const cookieHelper = (0, _________cookie_js.createBrowserCookieHelper)();
 		return this._getOrCreateTokenStore(cookieHelper, overrideTokenStoreInit);
 	}
+	_getSessionKeyForTokenStore(tokenStore, tokenObj) {
+		return this._externalTokenStoreSessionAdapter.getSessionKey(tokenStore, tokenObj);
+	}
 	/**
 	* @param overrideTokenObj The tokens to build the session for, if they haven't been written to the token store yet
 	*                         (so we can warm a sign-in's session before the token store publishes it).
 	*/
 	_getSessionFromTokenStore(tokenStore, overrideTokenObj) {
 		const tokenObj = overrideTokenObj ?? tokenStore.get();
-		const sessionKey = _hexclave_shared_dist_sessions.InternalSession.calculateSessionKey(tokenObj);
+		const sessionKey = this._getSessionKeyForTokenStore(tokenStore, tokenObj);
 		const existing = sessionKey ? this._sessionsByTokenStoreAndSessionKey.get(tokenStore)?.get(sessionKey) : null;
 		if (existing) return existing;
-		const session = this._interface.createSession({
-			refreshToken: tokenObj.refreshToken,
-			accessToken: tokenObj.accessToken
-		});
+		const session = this._externalTokenStoreSessionAdapter.createSessionForTokenStore(tokenStore, tokenObj, sessionKey);
 		session.onAccessTokenChange((newAccessToken) => {
-			tokenStore.update((old) => _hexclave_shared_dist_sessions.InternalSession.calculateSessionKey(old) === sessionKey ? {
+			tokenStore.update((old) => this._getSessionKeyForTokenStore(tokenStore, old) === sessionKey ? {
 				...old,
 				accessToken: newAccessToken?.token ?? null
 			} : old);
 		});
 		session.onInvalidate(() => {
-			tokenStore.update((old) => _hexclave_shared_dist_sessions.InternalSession.calculateSessionKey(old) === sessionKey ? {
+			tokenStore.update((old) => this._getSessionKeyForTokenStore(tokenStore, old) === sessionKey ? {
 				...old,
 				accessToken: null,
 				refreshToken: null
@@ -1227,6 +1239,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async _signInToAccountWithTokens(tokens) {
 		if (!("accessToken" in tokens) || !("refreshToken" in tokens)) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Invalid tokens object; can't sign in with this", { tokens });
+		if (this.isExternalAuthApp()) throw new Error("This app authenticates through an external provider and cannot sign in with Hexclave tokens. Sign in through the provider instead.");
 		const attemptId = ++this._signInAttemptCounter;
 		const tokenStore = this._getOrCreateTokenStore(await this._createCookieHelper());
 		const session = this._getSessionFromTokenStore(tokenStore, tokens);
@@ -1620,6 +1633,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			emailAuthEnabled: crud.auth_with_email,
 			otpAuthEnabled: crud.otp_auth_enabled,
 			oauthProviders: crud.oauth_providers,
+			externalAuthProviders: crud.external_auth_providers,
 			passkeyAuthEnabled: crud.passkey_auth_enabled,
 			isMultiFactorRequired: crud.requires_totp_mfa,
 			isAnonymous: crud.is_anonymous,
@@ -2582,6 +2596,37 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		}
 		return crud && this._currentUserFromCrud(crud, session);
 	}
+	isExternalAuthApp() {
+		return typeof this._tokenStoreInit === "object" && this._tokenStoreInit != null && (0, __external_token_store_session_adapter_js.isExternalTokenStore)(this._tokenStoreInit);
+	}
+	initAnalytics() {
+		this._initAnalyticsCalled = true;
+		const disabledReason = this._getAnalyticsDisabledReason();
+		if (disabledReason != null) throw new Error(`initAnalytics() was called, but this Hexclave app will not record analytics because ${disabledReason}. Remove the initAnalytics() call if this is intentional.`);
+		if (this._analyticsAppDisabledOnProject) throw createAnalyticsAppDisabledOnProjectError();
+		if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)() && this._eventTracker == null) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("initAnalytics() was called in the browser and _getAnalyticsDisabledReason() returned null, but the constructor did not start the event tracker. The two must agree on when analytics are recorded.");
+	}
+	/**
+	* Returns why this app will never record analytics, or null if it records them whenever it runs in a browser. The
+	* constructor and initAnalytics() both use this, so that the conditions under which analytics start and the
+	* conditions under which initAnalytics() throws can't drift apart.
+	*
+	* Whether the Analytics app is enabled on the project is not part of this, as the client only learns that once the
+	* backend rejects an upload; see _handleAnalyticsUploadResult.
+	*/
+	_getAnalyticsDisabledReason() {
+		if (this._analyticsOptions?.enabled === false) return "the `analytics.enabled` constructor option is set to false";
+		if (this._options.automaticSideEffects === false) return "the `automaticSideEffects` constructor option is set to false, which also disables analytics";
+		if (!this._hasPersistentTokenStore()) return "the `tokenStore` constructor option is null; analytics require a persistent token store such as \"cookie\" (or \"nextjs-cookie\" in Next.js)";
+		return null;
+	}
+	_handleAnalyticsUploadResult(result) {
+		if (result.status === "error" && (0, __session_replay_js.isAnalyticsNotEnabledError)(result.error) && !this._analyticsAppDisabledOnProject) {
+			this._analyticsAppDisabledOnProject = true;
+			if (this._initAnalyticsCalled) (0, _hexclave_shared_dist_utils_errors.captureError)("initAnalytics", createAnalyticsAppDisabledOnProjectError());
+		}
+		return result;
+	}
 	useUser(options) {
 		if (options?.or === "anonymous" && options.includeRestricted === false) throw new Error("Cannot use { or: 'anonymous' } with { includeRestricted: false }. Anonymous users implicitly include restricted users.");
 		this._ensurePersistentTokenStore(options?.tokenStore);
@@ -2631,6 +2676,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			primaryEmail: accessToken.payload.email,
 			displayName: accessToken.payload.name,
 			primaryEmailVerified: accessToken.payload.email_verified,
+			selectedTeamId: accessToken.payload.selected_team_id,
 			isAnonymous,
 			isMultiFactorRequired: accessToken.payload.requires_totp_mfa,
 			isRestricted: accessToken.payload.is_restricted,
@@ -2640,11 +2686,14 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _getPartialUserFromConvex(ctx) {
 		const auth = await ctx.auth.getUserIdentity();
 		if (!auth) return null;
+		const selectedTeamId = auth.selected_team_id ?? null;
+		if (selectedTeamId !== null && typeof selectedTeamId !== "string") throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Expected the Convex selected_team_id claim to be a string or null.");
 		return {
 			id: auth.subject,
 			displayName: auth.name ?? null,
 			primaryEmail: auth.email ?? null,
 			primaryEmailVerified: auth.email_verified,
+			selectedTeamId,
 			isAnonymous: auth.is_anonymous,
 			isMultiFactorRequired: auth.requires_totp_mfa,
 			isRestricted: auth.is_restricted,
@@ -2995,6 +3044,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		const previousSignOut = this._pendingSignOut;
 		const signOutOperation = (async () => {
 			await previousSignOut;
+			const externalTokenStore = this._externalTokenStoreSessionAdapter.getExternalTokenStoreForSession(session);
+			if (externalTokenStore != null) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError(`Cannot sign out an externally authenticated session through Hexclave. Sign out through the ${externalTokenStore.providerId} provider instead.`);
 			await this._interface.signOut(session);
 			if (options?.redirectUrl) await this._redirectTo({
 				url: options.redirectUrl,
@@ -3148,6 +3199,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		return {
 			toClientJson: () => {
 				if (typeof this._redirectMethod !== "string") throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Cannot serialize to JSON from an application with a non-string redirect method");
+				if (typeof this._tokenStoreInit === "object" && this._tokenStoreInit != null && (0, __external_token_store_session_adapter_js.isExternalTokenStore)(this._tokenStoreInit)) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Cannot serialize an app with an external token store because its callbacks are not serializable. Construct this app in the client runtime instead.");
 				const publishableClientKey = "publishableClientKey" in this._interface.options ? this._interface.options.publishableClientKey : void 0;
 				return {
 					baseUrl: this._options.baseUrl,