@hexclave/next 1.0.71 → 1.0.72

package/dist/{quetzal-translations-BT1HrUsA.d.ts.map → quetzal-translations-XeH3zQ9l.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"quetzal-translations-BT1HrUsA.d.ts","names":[],"sources":["../src/generated/quetzal-translations.ts"],"mappings":";cAUa,WAAA,EAAW,GAAA;AAAA,cAqTX,cAAA,EAAc,GAAA,mIAAA,GAAA,66qBAAA,GAAA,usnBAAA,GAAA,iyrBAAA,GAAA,g+qBAAA,GAAA,8srBAAA,GAAA,2trBAAA,GAAA,41pBAAA,GAAA,m3eAAA,GAAA,oreAAA,GAAA,swpBAAA,GAAA,+0qBAAA,GAAA,8wbAAA,GAAA"}
+{"version":3,"file":"quetzal-translations-XeH3zQ9l.d.ts","names":[],"sources":["../src/generated/quetzal-translations.ts"],"mappings":";cAUa,WAAA,EAAW,GAAA;AAAA,cAqTX,cAAA,EAAc,GAAA,mIAAA,GAAA,66qBAAA,GAAA,usnBAAA,GAAA,iyrBAAA,GAAA,g+qBAAA,GAAA,8srBAAA,GAAA,2trBAAA,GAAA,41pBAAA,GAAA,m3eAAA,GAAA,oreAAA,GAAA,swpBAAA,GAAA,+0qBAAA,GAAA,8wbAAA,GAAA"}

package/dist/{translation-provider-C1wy92m_.d.ts → translation-provider-WOaZXqAz.d.ts}

@@ -1,4 +1,4 @@
-import { n as quetzalLocales } from "./quetzal-translations-BT1HrUsA.js";
+import { n as quetzalLocales } from "./quetzal-translations-XeH3zQ9l.js";
 
 //#region src/providers/translation-provider.d.ts
 declare function TranslationProvider({
@@ -12,4 +12,4 @@ declare function TranslationProvider({
 }): import("react/jsx-runtime").JSX.Element;
 //#endregion
 export { TranslationProvider as t };
-//# sourceMappingURL=translation-provider-C1wy92m_.d.ts.map
+//# sourceMappingURL=translation-provider-WOaZXqAz.d.ts.map

package/dist/{translation-provider-C1wy92m_.d.ts.map → translation-provider-WOaZXqAz.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"translation-provider-C1wy92m_.d.ts","names":[],"sources":["../src/providers/translation-provider.tsx"],"mappings":";;;iBAQgB,mBAAA;EAAsB,IAAA;EAAM,oBAAA;EAAsB;AAAA;EAChE,IAAA,EAAM,UAAA,QAAkB,cAAA,CAAe,GAAA;EACvC,oBAAA,GAAuB,MAAA;EACvB,QAAA,EAAU,KAAA,CAAM,SAAA;AAAA,gCACjB,GAAA,CAAA,OAAA"}
+{"version":3,"file":"translation-provider-WOaZXqAz.d.ts","names":[],"sources":["../src/providers/translation-provider.tsx"],"mappings":";;;iBAQgB,mBAAA;EAAsB,IAAA;EAAM,oBAAA;EAAsB;AAAA;EAChE,IAAA,EAAM,UAAA,QAAkB,cAAA,CAAe,GAAA;EACvC,oBAAA,GAAuB,MAAA;EACvB,QAAA,EAAU,KAAA,CAAM,SAAA;AAAA,gCACjB,GAAA,CAAA,OAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@hexclave/next",
-  "version": "1.0.71",
+  "version": "1.0.72",
   "repository": "https://github.com/hexclave/hexclave",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -74,9 +74,9 @@
     "tailwindcss-animate": "^1.0.7",
     "rrweb": "^1.1.3",
     "yup": "^1.7.1",
-    "@hexclave/sc": "1.0.71",
-    "@hexclave/shared": "1.0.71",
-    "@hexclave/ui": "1.0.71"
+    "@hexclave/sc": "1.0.72",
+    "@hexclave/shared": "1.0.72",
+    "@hexclave/ui": "1.0.72"
   },
   "peerDependencies": {
     "@types/react": ">=18.0.0",

package/src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts

@@ -535,7 +535,7 @@ describe("StackClientApp cross-domain auth", () => {
     }
 
     const errorUrl = new URL(redirectedUrl);
-    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-stack-auth.com`);
+    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-hexclave.com`);
     expect(errorUrl.pathname).toBe("/handler/error");
     expect(errorUrl.searchParams.get("errorCode")).toBe("SIGN_UP_REJECTED");
     expect(errorUrl.searchParams.get("message")).toBe("Your sign up was rejected by an administrator's sign-up rule.");
@@ -715,7 +715,7 @@ describe("StackClientApp cross-domain auth", () => {
     redirectBackUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
     redirectBackUrl.searchParams.set("hexclave_cross_domain_after_callback_redirect_url", handoffAfterCallbackRedirect);
 
-    const arrivalUrl = new URL(`https://${projectId}.built-with-stack-auth.com/handler/sign-in`);
+    const arrivalUrl = new URL(`https://${projectId}.built-with-hexclave.com/handler/sign-in`);
     arrivalUrl.searchParams.set("after_auth_return_to", redirectBackUrl.toString());
     arrivalUrl.searchParams.set("hexclave_cross_domain_state", handoffState);
     arrivalUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
@@ -754,7 +754,7 @@ describe("StackClientApp cross-domain auth", () => {
         .mockResolvedValue(crossDomainAuthorizeRedirect);
 
       // All redirect-back query params were dropped before the after-sign-in redirect.
-      windowMock.location.href = `https://${projectId}.built-with-stack-auth.com/handler/sign-in`;
+      windowMock.location.href = `https://${projectId}.built-with-hexclave.com/handler/sign-in`;
 
       const redirectUrl = await clientApp[hexclaveAppInternalsSymbol].getRedirectToHandlerUrl("afterSignIn");
 

package/src/lib/hexclave-app/apps/implementations/client-app-impl.ts

@@ -61,6 +61,7 @@ import { EditableTeamMemberProfile, ReceivedTeamInvitation, SentTeamInvitation,
 import { buildCliAuthConfirmUrl, getHostedHandlerUrl, isHostedHandlerUrlForProject, resolveHandlerUrls } from "../../url-targets";
 import { augmentUrlWithPersistedRedirectBackState, saveRedirectBackStateFromUrl } from "./redirect-back-state";
 import { recordRedirectAndThrowIfLoopDetected } from "./redirect-loop-breaker";
+import { scopePasskeyAuthenticationToHostname, scopePasskeyRegistrationToHostname } from "../../passkey-rp-id";
 import { ActiveSession, Auth, BaseUser, CurrentUser, InternalUserExtra, OAuthProvider, ProjectCurrentUser, SyncedPartialUser, TokenPartialUser, UserExtra, UserUpdateOptions, userUpdateOptionsToCrud, withUserDestructureGuard } from "../../users";
 import { StackClientApp, StackClientAppConstructorOptions, StackClientAppJson } from "../interfaces/client-app";
 import { _HexclaveAdminAppImplIncomplete } from "./admin-app-impl";
@@ -2446,12 +2447,11 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rp.id !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rp.id}`);
-        }
-
-        options_json.rp.id = hostname;
+        // Passkeys intentionally stay scoped to the hostname where they were
+        // registered. In particular, passkeys created on the legacy hosted
+        // components domain continue to work there but are not carried over to
+        // a replacement hosted domain.
+        scopePasskeyRegistrationToHostname(options_json, hostname);
 
         let attResp;
         try {
@@ -3771,11 +3771,10 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rpId !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rpId}`);
-        }
-        options_json.rpId = window.location.hostname;
+        // Keep authentication scoped to the current hostname. This deliberately
+        // does not add cross-domain compatibility for passkeys created on a
+        // previous hosted components domain.
+        scopePasskeyAuthenticationToHostname(options_json, window.location.hostname);
 
         const authentication_response = await startAuthentication({ optionsJSON: options_json });
         return await this._interface.signInWithPasskey({ authentication_response, code }, session);

package/src/lib/hexclave-app/apps/implementations/server-app-impl.ts

@@ -36,6 +36,7 @@ import { Customer, CustomerProductsList, CustomerProductsRequestOptions, InlineP
 import { DataVaultStore } from "../../data-vault";
 import { EmailDeliveryInfo, SendEmailOptions } from "../../email";
 import { NotificationCategory } from "../../notification-categories";
+import { scopePasskeyRegistrationToHostname } from "../../passkey-rp-id";
 import { AdminProjectPermissionDefinition, AdminTeamPermission, AdminTeamPermissionDefinition } from "../../permissions";
 import { EditableTeamMemberProfile, ReceivedTeamInvitation, SentTeamInvitation, ServerListTeamsOptions, ServerListUsersOptions, ServerTeam, ServerTeamCreateOptions, ServerTeamUpdateOptions, ServerTeamUser, Team, serverTeamCreateOptionsToCrud, serverTeamUpdateOptionsToCrud } from "../../teams";
 import { ProjectCurrentServerUser, ServerOAuthProvider, ServerUser, ServerUserCreateOptions, ServerUserUpdateOptions, serverUserCreateOptionsToCrud, serverUserUpdateOptionsToCrud, withUserDestructureGuard } from "../../users";
@@ -896,7 +897,6 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
         return providers.find((p) => p.id === id) ?? null;
       },
       async registerPasskey(options?: { hostname?: string }): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>> {
-        // TODO remove duplicated code between this and the function in client-app-impl.ts
         const hostname = options?.hostname || (await app._getCurrentUrl())?.hostname;
         if (!hostname) {
           throw new HexclaveAssertionError("hostname must be provided if the Stack App does not have a redirect method");
@@ -911,12 +911,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
 
         const { options_json, code } = initiationResult.data;
 
-        // HACK: Override the rpID to be the actual domain
-        if (options_json.rp.id !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
-          throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rp.id}`);
-        }
-
-        options_json.rp.id = hostname;
+        scopePasskeyRegistrationToHostname(options_json, hostname);
 
         let attResp;
         try {

package/src/lib/hexclave-app/passkey-rp-id.test.ts

@@ -0,0 +1,43 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+import { describe, expect, it } from "vitest";
+import { scopePasskeyAuthenticationToHostname, scopePasskeyRegistrationToHostname } from "./passkey-rp-id";
+
+const passkeyRpIdSentinel = "THIS_VALUE_WILL_BE_REPLACED.example.com";
+
+describe.each([
+  "project-id.built-with-hexclave.com",
+  "project-id.built-with-stack-auth.com",
+])("passkeys on %s", (hostname) => {
+  it("scopes registration to the current hostname", () => {
+    const options = { rp: { id: passkeyRpIdSentinel } };
+
+    scopePasskeyRegistrationToHostname(options, hostname);
+
+    expect(options.rp.id).toBe(hostname);
+  });
+
+  it("scopes authentication to the current hostname", () => {
+    const options = { rpId: passkeyRpIdSentinel };
+
+    scopePasskeyAuthenticationToHostname(options, hostname);
+
+    expect(options.rpId).toBe(hostname);
+  });
+});
+
+it("rejects registration options without the server sentinel", () => {
+  expect(() => scopePasskeyRegistrationToHostname(
+    { rp: { id: "unexpected.example.com" } },
+    "project-id.built-with-hexclave.com",
+  )).toThrow("Expected returned RP ID from server to equal sentinel");
+});
+
+it("rejects authentication options without the server sentinel", () => {
+  expect(() => scopePasskeyAuthenticationToHostname(
+    { rpId: "unexpected.example.com" },
+    "project-id.built-with-hexclave.com",
+  )).toThrow("Expected returned RP ID from server to equal sentinel");
+});

package/src/lib/hexclave-app/passkey-rp-id.ts

@@ -0,0 +1,27 @@
+
+//===========================================
+// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
+//===========================================
+import { HexclaveAssertionError } from "@hexclave/shared/dist/utils/errors";
+
+const passkeyRpIdSentinel = "THIS_VALUE_WILL_BE_REPLACED.example.com";
+
+export function scopePasskeyRegistrationToHostname(
+  options: { rp: { id?: string } },
+  hostname: string,
+): void {
+  if (options.rp.id !== passkeyRpIdSentinel) {
+    throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options.rp.id}`);
+  }
+  options.rp.id = hostname;
+}
+
+export function scopePasskeyAuthenticationToHostname(
+  options: { rpId?: string },
+  hostname: string,
+): void {
+  if (options.rpId !== passkeyRpIdSentinel) {
+    throw new HexclaveAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options.rpId}`);
+  }
+  options.rpId = hostname;
+}