@hexclave/next 1.0.51 → 1.0.53

package/src/lib/hexclave-app/apps/implementations/redirect-loop-breaker.ts

@@ -0,0 +1,117 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+import { HexclaveAssertionError, captureError } from "@hexclave/shared/dist/utils/errors";
+import { readSessionStorageItem, removeSessionStorageItem, writeSessionStorageItem } from "../../../../utils/session-storage";
+
+/**
+ * Last line of defense against redirect loops (most importantly in hosted components flows, where
+ * redirects bounce between the app domain and the hosted domain and a bug anywhere in the chain
+ * can bounce the user forever).
+ *
+ * Every SDK-driven redirect records a breadcrumb, and when the exact same redirect keeps repeating
+ * within a short window, the redirect throws instead of navigating. The page that initiated the
+ * redirect then renders its error state (eg. the auth page's error card), which both stops the
+ * loop and surfaces the bug loudly.
+ */
+
+// sessionStorage (not module state) because most redirect loops involve full page loads, so each
+// loop iteration runs in a fresh JS context. sessionStorage is also per-tab, which is exactly the
+// scope of a redirect loop.
+const breadcrumbsStorageKey = "hexclave-redirect-loop-breadcrumbs";
+
+// A redirect loop cycles within a few seconds per iteration even with full cross-domain page
+// loads, so a real loop reaches 5 identical redirects well within 30 seconds. A human bouncing
+// between pages (eg. toggling sign-in <-> sign-up) produces the same (from, to) pair far less
+// often, which keeps false positives implausible.
+const loopWindowMillis = 30_000;
+const maxIdenticalRedirectsPerWindow = 5;
+const maxStoredBreadcrumbs = 50;
+
+type RedirectBreadcrumb = {
+  from: string,
+  to: string,
+  /**
+   * Wall-clock milliseconds (Date.now()). Although this is used to measure elapsed time (where we
+   * would normally use performance.now()), breadcrumbs must be comparable across full page loads,
+   * and performance.now() restarts at zero on every navigation.
+   */
+  at: number,
+};
+
+function isRedirectBreadcrumb(value: unknown): value is RedirectBreadcrumb {
+  return (
+    typeof value === "object"
+    && value !== null
+    && "from" in value && typeof value.from === "string"
+    && "to" in value && typeof value.to === "string"
+    && "at" in value && typeof value.at === "number"
+  );
+}
+
+function readBreadcrumbs(): RedirectBreadcrumb[] {
+  const raw = readSessionStorageItem(breadcrumbsStorageKey);
+  if (raw == null) {
+    return [];
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    // A corrupted value (eg. written by an older SDK version) just means we lose loop protection
+    // for this one redirect; start over with a fresh list.
+    removeSessionStorageItem(breadcrumbsStorageKey);
+    return [];
+  }
+  if (!Array.isArray(parsed)) {
+    removeSessionStorageItem(breadcrumbsStorageKey);
+    return [];
+  }
+  return parsed.filter(isRedirectBreadcrumb);
+}
+
+function writeBreadcrumbs(breadcrumbs: RedirectBreadcrumb[]): void {
+  writeSessionStorageItem(breadcrumbsStorageKey, JSON.stringify(breadcrumbs));
+}
+
+/**
+ * Loop iterations usually differ only in nonce-style query params (`code`, `state`,
+ * `after_auth_return_to`, ...), so redirects are compared by origin + pathname only.
+ */
+function getComparableRedirectLocation(url: URL): string {
+  return `${url.origin}${url.pathname}`;
+}
+
+export function recordRedirectAndThrowIfLoopDetected(options: { currentUrl: URL, targetUrl: URL }): void {
+  const from = getComparableRedirectLocation(options.currentUrl);
+  const to = getComparableRedirectLocation(options.targetUrl);
+  const now = Date.now();
+
+  // Clock jumps backwards (eg. NTP sync) would make breadcrumbs appear to be from the future;
+  // treat those as expired rather than counting them towards a loop.
+  const recentBreadcrumbs = readBreadcrumbs().filter((b) => now - b.at >= 0 && now - b.at < loopWindowMillis);
+  const identicalRedirectCount = recentBreadcrumbs.filter((b) => b.from === from && b.to === to).length + 1;
+
+  if (identicalRedirectCount >= maxIdenticalRedirectsPerWindow) {
+    // Drop the matching breadcrumbs so a manual retry (eg. the user reloading and clicking sign-in
+    // again) isn't instantly blocked by the history of the loop we just broke.
+    writeBreadcrumbs(recentBreadcrumbs.filter((b) => !(b.from === from && b.to === to)));
+    const error = new HexclaveAssertionError(
+      `Redirect loop detected: the redirect ${from} -> ${to} was attempted ${identicalRedirectCount} times within ${loopWindowMillis / 1000}s, so it was blocked. This is a bug in the auth flow; the recent redirect chain is included in the error details.`,
+      {
+        from,
+        to,
+        currentUrl: options.currentUrl.toString(),
+        targetUrl: options.targetUrl.toString(),
+        recentRedirects: recentBreadcrumbs.map((b) => `${b.from} -> ${b.to}`),
+      },
+    );
+    // Also captured (not just thrown) so the loop is reported even if a caller maps the thrown
+    // error to UI without reporting it.
+    captureError("redirect-loop-detected", error);
+    throw error;
+  }
+
+  writeBreadcrumbs([...recentBreadcrumbs, { from, to, at: now }].slice(-maxStoredBreadcrumbs));
+}

package/src/lib/hexclave-app/apps/implementations/server-app-impl.ts

@@ -23,6 +23,7 @@ import { ProviderType } from "@hexclave/shared/dist/utils/oauth";
 import { runAsynchronously } from "@hexclave/shared/dist/utils/promises";
 import { suspend } from "@hexclave/shared/dist/utils/react";
 import { Result } from "@hexclave/shared/dist/utils/results";
+import { isUuid } from "@hexclave/shared/dist/utils/uuids";
 import { WebAuthnError, startRegistration } from "@simplewebauthn/browser";
 import { useMemo } from "react"; // THIS_LINE_PLATFORM react-like
 import * as yup from "yup";
@@ -90,6 +91,20 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
   ], TeamsCrud['Server']['List']>(async ([userId, orderBy, desc, cursor, limit, query]) => {
     return await this._interface.listServerTeamsPaginated({ userId, orderBy, desc, cursor, limit, query });
   });
+  private readonly _serverTeamCache = createCache<string[], TeamsCrud['Server']['Read'] | null>(async ([teamId]) => {
+    // The previous list-and-find implementation treated unknown or malformed IDs as null; preserve that behavior without making an invalid request.
+    if (!isUuid(teamId)) {
+      return null;
+    }
+    try {
+      return await this._interface.getServerTeam(teamId);
+    } catch (error) {
+      if (KnownErrors.TeamNotFound.isInstance(error)) {
+        return null;
+      }
+      throw error;
+    }
+  });
 
   protected async _refreshTeamMembership(teamId: string, userId: string) {
     await Promise.all([
@@ -700,6 +715,10 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
         throw new HexclaveAssertionError("useOrLinkConnectedAccount is not available for server users. OAuth flows must be initiated on the client side.");
       },
       selectedTeam: crud.selected_team ? app._serverTeamFromCrud(crud.selected_team) : null,
+      // Unlike the app-level getTeam/useTeam (which fetch any team by id),
+      // the user-scoped variants search the user's own team list on purpose:
+      // they must return null for teams the user is not a member of, and some
+      // callers rely on that as a membership check.
       async getTeam(teamId: string) {
         const teams = await this.listTeams();
         return teams.find((t) => t.id === teamId) ?? null;
@@ -1008,6 +1027,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
       async update(update: Partial<ServerTeamUpdateOptions>) {
         await app._interface.updateServerTeam(crud.id, serverTeamUpdateOptionsToCrud(update));
         await Promise.all([
+          app._serverTeamCache.refresh([crud.id]),
           app._serverTeamsCache.refreshWhere(() => true),
           app._serverUsersCache.refreshWhere(() => true),
         ]);
@@ -1015,6 +1035,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
       async delete() {
         await app._interface.deleteServerTeam(crud.id);
         await Promise.all([
+          app._serverTeamCache.refresh([crud.id]),
           app._serverTeamsCache.refreshWhere(() => true),
           app._serverUsersCache.refreshWhere(() => true),
         ]);
@@ -1489,6 +1510,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
 
   async createTeam(data: ServerTeamCreateOptions): Promise<ServerTeam> {
     const team = await this._interface.createServerTeam(serverTeamCreateOptionsToCrud(data));
+    await this._serverTeamCache.refresh([team.id]);
     await this._serverTeamsCache.refreshWhere(() => true);
     return this._serverTeamFromCrud(team);
   }
@@ -1528,8 +1550,11 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
       return await this._getTeamByApiKey(options.apiKey);
     } else {
       const teamId = options;
-      const teams = await this.listTeams();
-      return teams.find((t) => t.id === teamId) ?? null;
+      if (teamId == null) {
+        return null;
+      }
+      const team = Result.orThrow(await this._serverTeamCache.getOrWait([teamId], "write-only"));
+      return team == null ? null : this._serverTeamFromCrud(team);
     }
   }
 
@@ -1540,10 +1565,11 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
       return this._useTeamByApiKey(options.apiKey);
     } else {
       const teamId = options;
-      const teams = this.useTeams();
+      // "" is never a valid UUID, so the cache resolves a nullish id to null while keeping the hook call order stable.
+      const team = useAsyncCache(this._serverTeamCache, [teamId ?? ""], "serverApp.useTeam()");
       return useMemo(() => {
-        return teams.find((t) => t.id === teamId) ?? null;
-      }, [teams, teamId]);
+        return team == null ? null : this._serverTeamFromCrud(team);
+      }, [team]);
     }
   }
 

package/src/lib/hexclave-app/apps/interfaces/client-app.ts

@@ -138,6 +138,7 @@ export type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId ex
       redirectToHandler(handlerName: keyof HandlerUrls, options?: RedirectToOptions): Promise<void>,
       signInWithTokens(tokens: { accessToken: string, refreshToken: string }): Promise<void>,
       awaitPendingAuthResolutions(): Promise<void>,
+      isTrustedRedirectUrl(url: string): Promise<boolean>,
     },
   }
   & AsyncStoreProperty<"project", [], Project, false>

package/src/pushed-config-error-overlay/index.ts

@@ -372,7 +372,7 @@ export function mountPushedConfigErrorOverlay(app: StackClientApp<true>): () =>
       return;
     }
 
-    const issueMessage = issue.messages.join("\n");
+    const issueMessage = "Hexclave config " + issue.kind + ": " + issue.messages.join("\n");
     const issueKey = `${app.projectId}:${issue.kind}:${issueMessage}`;
     const issueLabel = issue.kind === "error" ? "error" : "warning";
     const issueTitle = issue.kind === "error"

package/src/utils/session-storage.ts

@@ -0,0 +1,45 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+/**
+ * Guarded sessionStorage access for resilience layers (redirect loop breaking, redirect-back state
+ * mirroring). These layers must degrade to "no stored value" when storage is unavailable, instead
+ * of breaking the auth flow they are trying to protect.
+ */
+
+export function readSessionStorageItem(key: string): string | null {
+  if (typeof window === "undefined") {
+    return null;
+  }
+  try {
+    return window.sessionStorage.getItem(key);
+  } catch {
+    // Storage can be blocked entirely (private browsing, sandboxed iframes, disabled cookies), in
+    // which case accessing window.sessionStorage throws. Treat that as "nothing stored".
+    return null;
+  }
+}
+
+export function writeSessionStorageItem(key: string, value: string): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+  try {
+    window.sessionStorage.setItem(key, value);
+  } catch {
+    // Storage can be blocked or full; see readSessionStorageItem. Values written here are only
+    // used as a fallback, so failing to persist must not fail the caller.
+  }
+}
+
+export function removeSessionStorageItem(key: string): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+  try {
+    window.sessionStorage.removeItem(key);
+  } catch {
+    // See readSessionStorageItem.
+  }
+}