@hexclave/next 1.0.73 → 1.0.74

package/dist/esm/components-page/oauth-callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-callback.js","names":[],"sources":["../../../src/components-page/oauth-callback.tsx"],"sourcesContent":["'use client';\n\n\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n\nimport { KnownError } from \"@hexclave/shared\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { runAsynchronously } from \"@hexclave/shared/dist/utils/promises\";\nimport { Spinner, cn } from \"@hexclave/ui\";\nimport { useEffect, useRef, useState } from \"react\";\nimport { useStackApp } from \"..\";\nimport { MaybeFullPage } from \"../components/elements/maybe-full-page\";\nimport { StyledLink } from \"../components/link\";\nimport { hexclaveAppInternalsSymbol } from \"../lib/hexclave-app/common\";\nimport { useTranslation } from \"../lib/translations\";\nimport { ErrorPage } from \"./error-page\";\n\nexport function OAuthCallback({ fullPage }: { fullPage?: boolean }) {\n  const { t } = useTranslation();\n  const app = useStackApp();\n  const called = useRef(false);\n  const [showRedirectLink, setShowRedirectLink] = useState(false);\n  const [errorSearchParams, setErrorSearchParams] = useState<Record<string, string> | null>(null);\n\n  useEffect(() => runAsynchronously(async () => {\n    if (called.current) return;\n    called.current = true;\n    try {\n      // The startup handler in StackClientApp's constructor may have already consumed the\n      // one-time OAuth params (code + state cookie) via a microtask that fires before this\n      // macrotask-scheduled useEffect. Await its completion so we don't race: if it succeeds\n      // it will redirect and this page tears down; if it fails we fall through below.\n      await app[hexclaveAppInternalsSymbol].awaitPendingAuthResolutions();\n      const hasRedirected = await app.callOAuthCallback();\n      if (!hasRedirected) {\n        await app.redirectToSignIn({ noRedirectBack: true });\n      }\n    } catch (e) {\n      if (KnownError.isKnownError(e)) {\n        setErrorSearchParams({\n          errorCode: e.errorCode,\n          message: e.message,\n          details: JSON.stringify(e.details ?? {}),\n        });\n        return;\n      }\n      captureError(\"<OAuthCallback />\", e);\n      setErrorSearchParams({});\n    }\n  }), [app]);\n\n  useEffect(() => {\n    setTimeout(() => setShowRedirectLink(true), 3000);\n  }, []);\n\n  if (errorSearchParams != null) {\n    return <ErrorPage searchParams={errorSearchParams} fullPage={fullPage} />;\n  }\n\n  return (\n    <MaybeFullPage\n      fullPage={fullPage ?? false}\n      containerClassName=\"flex items-center justify-center\"\n    >\n      <div\n        className={cn(\n          \"text-center justify-center items-center stack-scope flex flex-col gap-4 max-w-[380px]\",\n          fullPage ? \"p-4\" : \"p-0\"\n        )}\n      >\n        <div className=\"flex flex-col justify-center items-center gap-4\">\n          <Spinner size={20} />\n        </div>\n        {showRedirectLink ? <p>{t('If you are not redirected automatically, ')}<StyledLink\n          className=\"whitespace-nowrap\"\n          href=\"#\"\n          onClick={(e) => {\n            e.preventDefault();\n            runAsynchronously(app.redirectToHome());\n          }}\n        >{t(\"click here\")}</StyledLink></p> : null}\n      </div>\n    </MaybeFullPage>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,SAAgB,cAAc,EAAE,YAAoC;CAClE,MAAM,EAAE,MAAM,eAAe;CAC7B,MAAM,MAAM,YAAY;CACxB,MAAM,SAAS,OAAO,KAAK;CAC3B,MAAM,CAAC,kBAAkB,uBAAuB,SAAS,KAAK;CAC9D,MAAM,CAAC,mBAAmB,wBAAwB,SAAwC,IAAI;CAE9F,gBAAgB,kBAAkB,YAAY;EAC5C,IAAI,OAAO,SAAS;EACpB,OAAO,UAAU;EACjB,IAAI;GAKF,MAAM,IAAI,2BAA2B,CAAC,4BAA4B;GAElE,IAAI,CAAC,MADuB,IAAI,kBAAkB,GAEhD,MAAM,IAAI,iBAAiB,EAAE,gBAAgB,KAAK,CAAC;EAEvD,SAAS,GAAG;GACV,IAAI,WAAW,aAAa,CAAC,GAAG;IAC9B,qBAAqB;KACnB,WAAW,EAAE;KACb,SAAS,EAAE;KACX,SAAS,KAAK,UAAU,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD;GACF;GACA,aAAa,qBAAqB,CAAC;GACnC,qBAAqB,CAAC,CAAC;EACzB;CACF,CAAC,GAAG,CAAC,GAAG,CAAC;CAET,gBAAgB;EACd,iBAAiB,oBAAoB,IAAI,GAAG,GAAI;CAClD,GAAG,CAAC,CAAC;CAEL,IAAI,qBAAqB,MACvB,OAAO,oBAAC,WAAD;EAAW,cAAc;EAA6B;CAAW,CAAA;CAG1E,OACE,oBAAC,eAAD;EACE,UAAU,YAAY;EACtB,oBAAmB;YAEnB,qBAAC,OAAD;GACE,WAAW,GACT,yFACA,WAAW,QAAQ,KACrB;aAJF,CAME,oBAAC,OAAD;IAAK,WAAU;cACb,oBAAC,SAAD,EAAS,MAAM,GAAK,CAAA;GACjB,CAAA,GACJ,mBAAmB,qBAAC,KAAD,EAAA,UAAA,CAAI,EAAE,2CAA2C,GAAE,oBAAC,YAAD;IACrE,WAAU;IACV,MAAK;IACL,UAAU,MAAM;KACd,EAAE,eAAe;KACjB,kBAAkB,IAAI,eAAe,CAAC;IACxC;cACA,EAAE,YAAY;GAAc,CAAA,CAAI,EAAA,CAAA,IAAI,IACnC;;CACQ,CAAA;AAEnB"}
+{"version":3,"file":"oauth-callback.js","names":[],"sources":["../../../src/components-page/oauth-callback.tsx"],"sourcesContent":["'use client';\n\n\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n\nimport { KnownError } from \"@hexclave/shared\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { runAsynchronously } from \"@hexclave/shared/dist/utils/promises\";\nimport { Spinner, cn } from \"@hexclave/ui\";\nimport { useEffect, useRef, useState } from \"react\";\nimport { useStackApp } from \"..\";\nimport { MaybeFullPage } from \"../components/elements/maybe-full-page\";\nimport { hexclaveAppInternalsSymbol } from \"../lib/hexclave-app/common\";\nimport { ErrorPage } from \"./error-page\";\n\nexport function OAuthCallback({ fullPage }: { fullPage?: boolean }) {\n  const app = useStackApp();\n  const called = useRef(false);\n  const [errorSearchParams, setErrorSearchParams] = useState<Record<string, string> | null>(null);\n\n  useEffect(() => runAsynchronously(async () => {\n    if (called.current) return;\n    called.current = true;\n    try {\n      // The startup handler in StackClientApp's constructor may have already consumed the\n      // one-time OAuth params (code + state cookie) via a microtask that fires before this\n      // macrotask-scheduled useEffect. Await its completion so we don't race: if it succeeds\n      // it will redirect and this page tears down; if it fails we fall through below.\n      await app[hexclaveAppInternalsSymbol].awaitPendingAuthResolutions();\n      const hasRedirected = await app.callOAuthCallback();\n      if (!hasRedirected) {\n        await app.redirectToSignIn({ noRedirectBack: true });\n      }\n    } catch (e) {\n      if (KnownError.isKnownError(e)) {\n        setErrorSearchParams({\n          errorCode: e.errorCode,\n          message: e.message,\n          details: JSON.stringify(e.details ?? {}),\n        });\n        return;\n      }\n      captureError(\"<OAuthCallback />\", e);\n      setErrorSearchParams({});\n    }\n  }), [app]);\n\n  if (errorSearchParams != null) {\n    return <ErrorPage searchParams={errorSearchParams} fullPage={fullPage} />;\n  }\n\n  return (\n    <MaybeFullPage\n      fullPage={fullPage ?? false}\n      containerClassName=\"flex items-center justify-center\"\n    >\n      <div\n        className={cn(\n          \"text-center justify-center items-center stack-scope flex flex-col gap-4 max-w-[380px]\",\n          fullPage ? \"p-4\" : \"p-0\"\n        )}\n      >\n        <div className=\"flex flex-col justify-center items-center gap-4\">\n          <Spinner size={20} />\n        </div>\n      </div>\n    </MaybeFullPage>\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,SAAgB,cAAc,EAAE,YAAoC;CAClE,MAAM,MAAM,YAAY;CACxB,MAAM,SAAS,OAAO,KAAK;CAC3B,MAAM,CAAC,mBAAmB,wBAAwB,SAAwC,IAAI;CAE9F,gBAAgB,kBAAkB,YAAY;EAC5C,IAAI,OAAO,SAAS;EACpB,OAAO,UAAU;EACjB,IAAI;GAKF,MAAM,IAAI,2BAA2B,CAAC,4BAA4B;GAElE,IAAI,CAAC,MADuB,IAAI,kBAAkB,GAEhD,MAAM,IAAI,iBAAiB,EAAE,gBAAgB,KAAK,CAAC;EAEvD,SAAS,GAAG;GACV,IAAI,WAAW,aAAa,CAAC,GAAG;IAC9B,qBAAqB;KACnB,WAAW,EAAE;KACb,SAAS,EAAE;KACX,SAAS,KAAK,UAAU,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD;GACF;GACA,aAAa,qBAAqB,CAAC;GACnC,qBAAqB,CAAC,CAAC;EACzB;CACF,CAAC,GAAG,CAAC,GAAG,CAAC;CAET,IAAI,qBAAqB,MACvB,OAAO,oBAAC,WAAD;EAAW,cAAc;EAA6B;CAAW,CAAA;CAG1E,OACE,oBAAC,eAAD;EACE,UAAU,YAAY;EACtB,oBAAmB;YAEnB,oBAAC,OAAD;GACE,WAAW,GACT,yFACA,WAAW,QAAQ,KACrB;aAEA,oBAAC,OAAD;IAAK,WAAU;cACb,oBAAC,SAAD,EAAS,MAAM,GAAK,CAAA;GACjB,CAAA;EACF,CAAA;CACQ,CAAA;AAEnB"}

package/dist/esm/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/lib/auth.ts"],"mappings":";;;;iBAWsB,6BAAA,CACpB,KAAA,EAAO,uBAAA,EACP,OAAA;EACE,QAAA;EACA,WAAA;EACA,gBAAA;EACA,aAAA;AAAA,GAEF,OAAA,EAAS,eAAA,GACR,OAAA;AAAA,iBA4JmB,iBAAA,CACpB,KAAA,EAAO,uBAAA,EACP,WAAA,UACA,OAAA;EACE,+BAAA;AAAA,IACD,OAAA"}
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/lib/auth.ts"],"mappings":";;;;iBAWsB,6BAAA,CACpB,KAAA,EAAO,uBAAA,EACP,OAAA;EACE,QAAA;EACA,WAAA;EACA,gBAAA;EACA,aAAA;AAAA,GAEF,OAAA,EAAS,eAAA,GACR,OAAA;AAAA,iBA8JmB,iBAAA,CACpB,KAAA,EAAO,uBAAA,EACP,WAAA,UACA,OAAA;EACE,+BAAA;AAAA,IACD,OAAA"}

package/dist/esm/lib/auth.js

@@ -11,7 +11,7 @@ async function getNewOAuthProviderOrScopeUrl(iface, options, session) {
 		provider: options.provider,
 		redirectUrl: constructRedirectUrl(options.redirectUrl, "redirectUrl"),
 		errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, "errorRedirectUrl"),
-		afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, "afterCallbackRedirectUrl"),
+		afterCallbackRedirectUrl: window.location.href,
 		codeChallenge,
 		state,
 		type: "link",

package/dist/esm/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, KnownErrors, HexclaveClientInterface } from \"@hexclave/shared\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveAssertionError, throwErr } from \"@hexclave/shared/dist/utils/errors\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { deindent } from \"@hexclave/shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\nexport async function getNewOAuthProviderOrScopeUrl(\n  iface: HexclaveClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n): Promise<string> {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  return await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\ntype OAuthCallbackConsumptionResult =\n  | {\n    type: \"oauth-response\",\n    originalUrl: URL,\n    codeVerifier: string,\n    state: string,\n  }\n  | {\n    type: \"known-error\",\n    error: KnownError,\n  };\n\nconst oauthErrorParams = [\"error\", \"error_description\", \"errorCode\", \"message\", \"details\"] as const;\n\nfunction removeOAuthErrorParamsFromHistory(originalUrl: URL): void {\n  const newUrl = new URL(originalUrl);\n  for (const param of oauthErrorParams) {\n    newUrl.searchParams.delete(param);\n  }\n  window.history.replaceState({}, \"\", newUrl.toString());\n}\n\nfunction getProviderOAuthErrorFromUrl(originalUrl: URL): KnownError | null {\n  const providerError = originalUrl.searchParams.get(\"error\");\n  const providerErrorDescription = originalUrl.searchParams.get(\"error_description\");\n  if (providerError == null && providerErrorDescription == null) {\n    return null;\n  }\n\n  switch (providerError) {\n    case \"access_denied\":\n    case \"consent_required\": {\n      return new KnownErrors.OAuthProviderAccessDenied();\n    }\n    case \"server_error\":\n    case \"temporarily_unavailable\":\n    default: {\n      return new KnownErrors.OAuthProviderTemporarilyUnavailable();\n    }\n  }\n}\n\nfunction consumeOAuthCallbackQueryParams(options?: {\n  dontWarnAboutMissingQueryParams?: boolean,\n}): OAuthCallbackConsumptionResult | null {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  const knownErrorCode = originalUrl.searchParams.get(\"errorCode\");\n  const knownErrorMessage = originalUrl.searchParams.get(\"message\");\n  if (knownErrorCode && knownErrorMessage) {\n    const details = originalUrl.searchParams.get(\"details\");\n    let detailsJson = {};\n    if (details) {\n      try {\n        detailsJson = JSON.parse(details);\n      } catch (error) {\n        throw new HexclaveAssertionError(\"OAuth callback returned malformed known-error details\", {\n          details,\n          cause: error,\n        });\n      }\n    }\n\n    removeOAuthErrorParamsFromHistory(originalUrl);\n\n    return {\n      type: \"known-error\",\n      error: KnownError.fromJson({\n        code: knownErrorCode,\n        message: knownErrorMessage,\n        details: detailsJson,\n      }),\n    };\n  }\n\n  const providerOAuthError = getProviderOAuthErrorFromUrl(originalUrl);\n  if (providerOAuthError != null && !requiredParams.every(param => originalUrl.searchParams.has(param))) {\n    removeOAuthErrorParamsFromHistory(originalUrl);\n    return {\n      type: \"known-error\",\n      error: providerOAuthError,\n    };\n  }\n\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      if (!options?.dontWarnAboutMissingQueryParams) {\n        console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      }\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Hexclave found an outer OAuth callback state in the query parameters, but not in cookies.\n\n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Hexclave.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    type: \"oauth-response\",\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: HexclaveClientInterface,\n  redirectUrl: string,\n  options?: {\n    dontWarnAboutMissingQueryParams?: boolean,\n  },\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams(options);\n  if (!consumed) return Result.ok(undefined);\n  if (consumed.type === \"known-error\") {\n    throw consumed.error;\n  }\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new HexclaveAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;AAWA,eAAsB,8BACpB,OACA,SAMA,SACiB;CACjB,MAAM,EAAE,eAAe,UAAU,MAAM,qBAAqB;CAC5D,OAAO,MAAM,MAAM,YAAY;EAC7B,UAAU,QAAQ;EAClB,aAAa,qBAAqB,QAAQ,aAAa,aAAa;EACpE,kBAAkB,qBAAqB,QAAQ,kBAAkB,kBAAkB;EACnF,0BAA0B,qBAAqB,OAAO,SAAS,MAAM,0BAA0B;EAC/F;EACA;EACA,MAAM;EACN;EACA,eAAe,QAAQ;CACzB,CAAC;AACH;AAmBA,MAAM,mBAAmB;CAAC;CAAS;CAAqB;CAAa;CAAW;AAAS;AAEzF,SAAS,kCAAkC,aAAwB;CACjE,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,KAAK,MAAM,SAAS,kBAClB,OAAO,aAAa,OAAO,KAAK;CAElC,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AACvD;AAEA,SAAS,6BAA6B,aAAqC;CACzE,MAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO;CAC1D,MAAM,2BAA2B,YAAY,aAAa,IAAI,mBAAmB;CACjF,IAAI,iBAAiB,QAAQ,4BAA4B,MACvD,OAAO;CAGT,QAAQ,eAAR;EACE,KAAK;EACL,KAAK,oBACH,OAAO,IAAI,YAAY,0BAA0B;EAInD,SACE,OAAO,IAAI,YAAY,oCAAoC;CAE/D;AACF;AAEA,SAAS,gCAAgC,SAEC;CACxC,MAAM,iBAAiB,CAAC,QAAQ,OAAO;CACvC,MAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;CAChD,MAAM,iBAAiB,YAAY,aAAa,IAAI,WAAW;CAC/D,MAAM,oBAAoB,YAAY,aAAa,IAAI,SAAS;CAChE,IAAI,kBAAkB,mBAAmB;EACvC,MAAM,UAAU,YAAY,aAAa,IAAI,SAAS;EACtD,IAAI,cAAc,CAAC;EACnB,IAAI,SACF,IAAI;GACF,cAAc,KAAK,MAAM,OAAO;EAClC,SAAS,OAAO;GACd,MAAM,IAAI,uBAAuB,yDAAyD;IACxF;IACA,OAAO;GACT,CAAC;EACH;EAGF,kCAAkC,WAAW;EAE7C,OAAO;GACL,MAAM;GACN,OAAO,WAAW,SAAS;IACzB,MAAM;IACN,SAAS;IACT,SAAS;GACX,CAAC;EACH;CACF;CAEA,MAAM,qBAAqB,6BAA6B,WAAW;CACnE,IAAI,sBAAsB,QAAQ,CAAC,eAAe,OAAM,UAAS,YAAY,aAAa,IAAI,KAAK,CAAC,GAAG;EACrG,kCAAkC,WAAW;EAC7C,OAAO;GACL,MAAM;GACN,OAAO;EACT;CACF;CAEA,KAAK,MAAM,SAAS,gBAClB,IAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;EACxC,IAAI,CAAC,SAAS,iCACZ,QAAQ,qBAAK,IAAI,MAAM,uDAAuD,MAAM,0EAA0E,CAAC;EAEjK,OAAO;CACT;CAGF,MAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,KAAK,SAAS,uDAAuD;CAC/H,MAAM,eAAe,8BAA8B,aAAa;CAEhE,IAAI,CAAC,cAAc;EAGjB,QAAQ,KAAK,QAAQ;;;;;;;;;;;KAWpB;EACD,OAAO;CACT;CAGA,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,KAAK,MAAM,SAAS,gBAClB,OAAO,aAAa,OAAO,KAAK;CASlC,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;CAErD,OAAO;EACL,MAAM;EACN;EACA,cAAc,aAAa;EAC3B,OAAO;CACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA,SAGA;CAIA,MAAM,WAAW,gCAAgC,OAAO;CACxD,IAAI,CAAC,UAAU,OAAO,OAAO,GAAG,KAAA,CAAS;CACzC,IAAI,SAAS,SAAS,eACpB,MAAM,SAAS;CAMjB,IAAI;EACF,OAAO,OAAO,GAAG,MAAM,MAAM,kBAAkB;GAC7C,aAAa,SAAS,YAAY;GAClC,aAAa,qBAAqB,aAAa,aAAa;GAC5D,cAAc,SAAS;GACvB,OAAO,SAAS;EAClB,CAAC,CAAC;CACJ,SAAS,GAAG;EACV,IAAI,WAAW,aAAa,CAAC,GAC3B,MAAM;EAER,MAAM,IAAI,uBAAuB,6DAA6D,EAAE,OAAO,EAAE,CAAC;CAC5G;AACF"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, KnownErrors, HexclaveClientInterface } from \"@hexclave/shared\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport { HexclaveAssertionError, throwErr } from \"@hexclave/shared/dist/utils/errors\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { deindent } from \"@hexclave/shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\nexport async function getNewOAuthProviderOrScopeUrl(\n  iface: HexclaveClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n): Promise<string> {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  return await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    // Unlike callback URLs, this is the final user-facing location and may legitimately use a\n    // fragment for an account-settings tab. Preserve it exactly.\n    afterCallbackRedirectUrl: window.location.href,\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\ntype OAuthCallbackConsumptionResult =\n  | {\n    type: \"oauth-response\",\n    originalUrl: URL,\n    codeVerifier: string,\n    state: string,\n  }\n  | {\n    type: \"known-error\",\n    error: KnownError,\n  };\n\nconst oauthErrorParams = [\"error\", \"error_description\", \"errorCode\", \"message\", \"details\"] as const;\n\nfunction removeOAuthErrorParamsFromHistory(originalUrl: URL): void {\n  const newUrl = new URL(originalUrl);\n  for (const param of oauthErrorParams) {\n    newUrl.searchParams.delete(param);\n  }\n  window.history.replaceState({}, \"\", newUrl.toString());\n}\n\nfunction getProviderOAuthErrorFromUrl(originalUrl: URL): KnownError | null {\n  const providerError = originalUrl.searchParams.get(\"error\");\n  const providerErrorDescription = originalUrl.searchParams.get(\"error_description\");\n  if (providerError == null && providerErrorDescription == null) {\n    return null;\n  }\n\n  switch (providerError) {\n    case \"access_denied\":\n    case \"consent_required\": {\n      return new KnownErrors.OAuthProviderAccessDenied();\n    }\n    case \"server_error\":\n    case \"temporarily_unavailable\":\n    default: {\n      return new KnownErrors.OAuthProviderTemporarilyUnavailable();\n    }\n  }\n}\n\nfunction consumeOAuthCallbackQueryParams(options?: {\n  dontWarnAboutMissingQueryParams?: boolean,\n}): OAuthCallbackConsumptionResult | null {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  const knownErrorCode = originalUrl.searchParams.get(\"errorCode\");\n  const knownErrorMessage = originalUrl.searchParams.get(\"message\");\n  if (knownErrorCode && knownErrorMessage) {\n    const details = originalUrl.searchParams.get(\"details\");\n    let detailsJson = {};\n    if (details) {\n      try {\n        detailsJson = JSON.parse(details);\n      } catch (error) {\n        throw new HexclaveAssertionError(\"OAuth callback returned malformed known-error details\", {\n          details,\n          cause: error,\n        });\n      }\n    }\n\n    removeOAuthErrorParamsFromHistory(originalUrl);\n\n    return {\n      type: \"known-error\",\n      error: KnownError.fromJson({\n        code: knownErrorCode,\n        message: knownErrorMessage,\n        details: detailsJson,\n      }),\n    };\n  }\n\n  const providerOAuthError = getProviderOAuthErrorFromUrl(originalUrl);\n  if (providerOAuthError != null && !requiredParams.every(param => originalUrl.searchParams.has(param))) {\n    removeOAuthErrorParamsFromHistory(originalUrl);\n    return {\n      type: \"known-error\",\n      error: providerOAuthError,\n    };\n  }\n\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      if (!options?.dontWarnAboutMissingQueryParams) {\n        console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      }\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Hexclave found an outer OAuth callback state in the query parameters, but not in cookies.\n\n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Hexclave.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    type: \"oauth-response\",\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: HexclaveClientInterface,\n  redirectUrl: string,\n  options?: {\n    dontWarnAboutMissingQueryParams?: boolean,\n  },\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams(options);\n  if (!consumed) return Result.ok(undefined);\n  if (consumed.type === \"known-error\") {\n    throw consumed.error;\n  }\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new HexclaveAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;AAWA,eAAsB,8BACpB,OACA,SAMA,SACiB;CACjB,MAAM,EAAE,eAAe,UAAU,MAAM,qBAAqB;CAC5D,OAAO,MAAM,MAAM,YAAY;EAC7B,UAAU,QAAQ;EAClB,aAAa,qBAAqB,QAAQ,aAAa,aAAa;EACpE,kBAAkB,qBAAqB,QAAQ,kBAAkB,kBAAkB;EAGnF,0BAA0B,OAAO,SAAS;EAC1C;EACA;EACA,MAAM;EACN;EACA,eAAe,QAAQ;CACzB,CAAC;AACH;AAmBA,MAAM,mBAAmB;CAAC;CAAS;CAAqB;CAAa;CAAW;AAAS;AAEzF,SAAS,kCAAkC,aAAwB;CACjE,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,KAAK,MAAM,SAAS,kBAClB,OAAO,aAAa,OAAO,KAAK;CAElC,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AACvD;AAEA,SAAS,6BAA6B,aAAqC;CACzE,MAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO;CAC1D,MAAM,2BAA2B,YAAY,aAAa,IAAI,mBAAmB;CACjF,IAAI,iBAAiB,QAAQ,4BAA4B,MACvD,OAAO;CAGT,QAAQ,eAAR;EACE,KAAK;EACL,KAAK,oBACH,OAAO,IAAI,YAAY,0BAA0B;EAInD,SACE,OAAO,IAAI,YAAY,oCAAoC;CAE/D;AACF;AAEA,SAAS,gCAAgC,SAEC;CACxC,MAAM,iBAAiB,CAAC,QAAQ,OAAO;CACvC,MAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;CAChD,MAAM,iBAAiB,YAAY,aAAa,IAAI,WAAW;CAC/D,MAAM,oBAAoB,YAAY,aAAa,IAAI,SAAS;CAChE,IAAI,kBAAkB,mBAAmB;EACvC,MAAM,UAAU,YAAY,aAAa,IAAI,SAAS;EACtD,IAAI,cAAc,CAAC;EACnB,IAAI,SACF,IAAI;GACF,cAAc,KAAK,MAAM,OAAO;EAClC,SAAS,OAAO;GACd,MAAM,IAAI,uBAAuB,yDAAyD;IACxF;IACA,OAAO;GACT,CAAC;EACH;EAGF,kCAAkC,WAAW;EAE7C,OAAO;GACL,MAAM;GACN,OAAO,WAAW,SAAS;IACzB,MAAM;IACN,SAAS;IACT,SAAS;GACX,CAAC;EACH;CACF;CAEA,MAAM,qBAAqB,6BAA6B,WAAW;CACnE,IAAI,sBAAsB,QAAQ,CAAC,eAAe,OAAM,UAAS,YAAY,aAAa,IAAI,KAAK,CAAC,GAAG;EACrG,kCAAkC,WAAW;EAC7C,OAAO;GACL,MAAM;GACN,OAAO;EACT;CACF;CAEA,KAAK,MAAM,SAAS,gBAClB,IAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;EACxC,IAAI,CAAC,SAAS,iCACZ,QAAQ,qBAAK,IAAI,MAAM,uDAAuD,MAAM,0EAA0E,CAAC;EAEjK,OAAO;CACT;CAGF,MAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,KAAK,SAAS,uDAAuD;CAC/H,MAAM,eAAe,8BAA8B,aAAa;CAEhE,IAAI,CAAC,cAAc;EAGjB,QAAQ,KAAK,QAAQ;;;;;;;;;;;KAWpB;EACD,OAAO;CACT;CAGA,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,KAAK,MAAM,SAAS,gBAClB,OAAO,aAAa,OAAO,KAAK;CASlC,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;CAErD,OAAO;EACL,MAAM;EACN;EACA,cAAc,aAAa;EAC3B,OAAO;CACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA,SAGA;CAIA,MAAM,WAAW,gCAAgC,OAAO;CACxD,IAAI,CAAC,UAAU,OAAO,OAAO,GAAG,KAAA,CAAS;CACzC,IAAI,SAAS,SAAS,eACpB,MAAM,SAAS;CAMjB,IAAI;EACF,OAAO,OAAO,GAAG,MAAM,MAAM,kBAAkB;GAC7C,aAAa,SAAS,YAAY;GAClC,aAAa,qBAAqB,aAAa,aAAa;GAC5D,cAAc,SAAS;GACvB,OAAO,SAAS;EAClB,CAAC,CAAC;CACJ,SAAS,GAAG;EACV,IAAI,WAAW,aAAa,CAAC,GAC3B,MAAM;EAER,MAAM,IAAI,uBAAuB,6DAA6D,EAAE,OAAO,EAAE,CAAC;CAC5G;AACF"}

package/dist/esm/lib/auth.test.js

@@ -24,7 +24,7 @@ function createTestInterface() {
 }
 describe("getNewOAuthProviderOrScopeUrl", () => {
 	it("returns the OAuth URL without performing navigation", async () => {
-		window.history.replaceState({}, "", "/account?after_auth_return_to=%2Fsettings");
+		window.history.replaceState({}, "", "/account?after_auth_return_to=%2Fsettings#connected-accounts");
 		const iface = createTestInterface();
 		const location = await getNewOAuthProviderOrScopeUrl(iface, {
 			provider: "github",
@@ -39,7 +39,7 @@ describe("getNewOAuthProviderOrScopeUrl", () => {
 		expect(`${url.origin}${url.pathname}`).toBe("https://api.example.com/api/v1/auth/oauth/authorize/github");
 		expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`
       {
-        "after_callback_redirect_url": "http://localhost:3000/account?after_auth_return_to=%2Fsettings",
+        "after_callback_redirect_url": "http://localhost:3000/account?after_auth_return_to=%2Fsettings#connected-accounts",
         "client_id": "00000000-0000-4000-8000-000000000000",
         "client_secret": "pck_test",
         "code_challenge": "<stripped code challenge>",

package/dist/esm/lib/auth.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.test.js","names":[],"sources":["../../../src/lib/auth.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { HexclaveClientInterface, KnownErrors } from \"@hexclave/shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { callOAuthCallback, getNewOAuthProviderOrScopeUrl } from \"./auth\";\n\nvi.mock(\"./cookie\", async (importOriginal) => {\n  const actual = await importOriginal<typeof import(\"./cookie\")>();\n  return {\n    ...actual,\n    saveVerifierAndState: async () => ({\n      codeChallenge: \"<stripped code challenge>\",\n      state: \"<stripped state>\",\n    }),\n  };\n});\n\nfunction createTestInterface() {\n  return new HexclaveClientInterface({\n    clientVersion: \"test\",\n    getBaseUrl: () => \"https://api.example.com\",\n    getApiUrls: () => [\"https://api.example.com\"],\n    extraRequestHeaders: {},\n    projectId: \"00000000-0000-4000-8000-000000000000\",\n    publishableClientKey: \"pck_test\",\n  });\n}\n\ndescribe(\"getNewOAuthProviderOrScopeUrl\", () => {\n  it(\"returns the OAuth URL without performing navigation\", async () => {\n    window.history.replaceState({}, \"\", \"/account?after_auth_return_to=%2Fsettings\");\n\n    const iface = createTestInterface();\n    const session = iface.createSession({ refreshToken: null, accessToken: null });\n\n    const location = await getNewOAuthProviderOrScopeUrl(\n      iface,\n      {\n        provider: \"github\",\n        redirectUrl: \"/handler/oauth-callback\",\n        errorRedirectUrl: \"/handler/error\",\n        providerScope: \"repo user\",\n      },\n      session,\n    );\n\n    const url = new URL(location);\n    expect(`${url.origin}${url.pathname}`).toBe(\"https://api.example.com/api/v1/auth/oauth/authorize/github\");\n    expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`\n      {\n        \"after_callback_redirect_url\": \"http://localhost:3000/account?after_auth_return_to=%2Fsettings\",\n        \"client_id\": \"00000000-0000-4000-8000-000000000000\",\n        \"client_secret\": \"pck_test\",\n        \"code_challenge\": \"<stripped code challenge>\",\n        \"code_challenge_method\": \"S256\",\n        \"error_redirect_url\": \"http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings\",\n        \"grant_type\": \"authorization_code\",\n        \"provider_scope\": \"repo user\",\n        \"redirect_uri\": \"http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings\",\n        \"response_type\": \"code\",\n        \"scope\": \"legacy\",\n        \"state\": \"<stripped state>\",\n        \"type\": \"link\",\n      }\n    `);\n  });\n});\n\ndescribe(\"callOAuthCallback\", () => {\n  it(\"turns provider access denial callback params into a known error\", async () => {\n    window.history.replaceState({}, \"\", \"/handler/oauth-callback?error=access_denied&error_description=User+cancelled\");\n\n    await expect(callOAuthCallback(createTestInterface(), \"/handler/oauth-callback\"))\n      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderAccessDenied.isInstance(error));\n    expect(window.location.href).toBe(\"http://localhost:3000/handler/oauth-callback\");\n  });\n\n  it(\"turns generic provider error callback params into a known error\", async () => {\n    window.history.replaceState({}, \"\", \"/handler/oauth-callback?error=server_error&error_description=Provider+failed\");\n\n    await expect(callOAuthCallback(createTestInterface(), \"/handler/oauth-callback\"))\n      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderTemporarilyUnavailable.isInstance(error));\n    expect(window.location.href).toBe(\"http://localhost:3000/handler/oauth-callback\");\n  });\n});\n"],"mappings":";;;;;AAUA,GAAG,KAAK,YAAY,OAAO,mBAAmB;CAE5C,OAAO;EACL,GAAG,MAFgB,eAA0C;EAG7D,sBAAsB,aAAa;GACjC,eAAe;GACf,OAAO;EACT;CACF;AACF,CAAC;AAED,SAAS,sBAAsB;CAC7B,OAAO,IAAI,wBAAwB;EACjC,eAAe;EACf,kBAAkB;EAClB,kBAAkB,CAAC,yBAAyB;EAC5C,qBAAqB,CAAC;EACtB,WAAW;EACX,sBAAsB;CACxB,CAAC;AACH;AAEA,SAAS,uCAAuC;CAC9C,GAAG,uDAAuD,YAAY;EACpE,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,2CAA2C;EAE/E,MAAM,QAAQ,oBAAoB;EAGlC,MAAM,WAAW,MAAM,8BACrB,OACA;GACE,UAAU;GACV,aAAa;GACb,kBAAkB;GAClB,eAAe;EACjB,GATc,MAAM,cAAc;GAAE,cAAc;GAAM,aAAa;EAAK,CAUpE,CACR;EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,OAAO,GAAG,IAAI,SAAS,IAAI,UAAU,CAAC,CAAC,KAAK,4DAA4D;EACxG,OAAO,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB;;;;;;;;;;;;;;;;KAgB5E;CACH,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;CAClC,GAAG,mEAAmE,YAAY;EAChF,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,8EAA8E;EAElH,MAAM,OAAO,kBAAkB,oBAAoB,GAAG,yBAAyB,CAAC,CAAC,CAC9E,QAAQ,WAAW,UAAmB,YAAY,0BAA0B,WAAW,KAAK,CAAC;EAChG,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,KAAK,8CAA8C;CAClF,CAAC;CAED,GAAG,mEAAmE,YAAY;EAChF,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,8EAA8E;EAElH,MAAM,OAAO,kBAAkB,oBAAoB,GAAG,yBAAyB,CAAC,CAAC,CAC9E,QAAQ,WAAW,UAAmB,YAAY,oCAAoC,WAAW,KAAK,CAAC;EAC1G,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,KAAK,8CAA8C;CAClF,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.test.js","names":[],"sources":["../../../src/lib/auth.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { HexclaveClientInterface, KnownErrors } from \"@hexclave/shared\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { callOAuthCallback, getNewOAuthProviderOrScopeUrl } from \"./auth\";\n\nvi.mock(\"./cookie\", async (importOriginal) => {\n  const actual = await importOriginal<typeof import(\"./cookie\")>();\n  return {\n    ...actual,\n    saveVerifierAndState: async () => ({\n      codeChallenge: \"<stripped code challenge>\",\n      state: \"<stripped state>\",\n    }),\n  };\n});\n\nfunction createTestInterface() {\n  return new HexclaveClientInterface({\n    clientVersion: \"test\",\n    getBaseUrl: () => \"https://api.example.com\",\n    getApiUrls: () => [\"https://api.example.com\"],\n    extraRequestHeaders: {},\n    projectId: \"00000000-0000-4000-8000-000000000000\",\n    publishableClientKey: \"pck_test\",\n  });\n}\n\ndescribe(\"getNewOAuthProviderOrScopeUrl\", () => {\n  it(\"returns the OAuth URL without performing navigation\", async () => {\n    window.history.replaceState({}, \"\", \"/account?after_auth_return_to=%2Fsettings#connected-accounts\");\n\n    const iface = createTestInterface();\n    const session = iface.createSession({ refreshToken: null, accessToken: null });\n\n    const location = await getNewOAuthProviderOrScopeUrl(\n      iface,\n      {\n        provider: \"github\",\n        redirectUrl: \"/handler/oauth-callback\",\n        errorRedirectUrl: \"/handler/error\",\n        providerScope: \"repo user\",\n      },\n      session,\n    );\n\n    const url = new URL(location);\n    expect(`${url.origin}${url.pathname}`).toBe(\"https://api.example.com/api/v1/auth/oauth/authorize/github\");\n    expect(Object.fromEntries(url.searchParams.entries())).toMatchInlineSnapshot(`\n      {\n        \"after_callback_redirect_url\": \"http://localhost:3000/account?after_auth_return_to=%2Fsettings#connected-accounts\",\n        \"client_id\": \"00000000-0000-4000-8000-000000000000\",\n        \"client_secret\": \"pck_test\",\n        \"code_challenge\": \"<stripped code challenge>\",\n        \"code_challenge_method\": \"S256\",\n        \"error_redirect_url\": \"http://localhost:3000/handler/error?after_auth_return_to=%2Fsettings\",\n        \"grant_type\": \"authorization_code\",\n        \"provider_scope\": \"repo user\",\n        \"redirect_uri\": \"http://localhost:3000/handler/oauth-callback?after_auth_return_to=%2Fsettings\",\n        \"response_type\": \"code\",\n        \"scope\": \"legacy\",\n        \"state\": \"<stripped state>\",\n        \"type\": \"link\",\n      }\n    `);\n  });\n});\n\ndescribe(\"callOAuthCallback\", () => {\n  it(\"turns provider access denial callback params into a known error\", async () => {\n    window.history.replaceState({}, \"\", \"/handler/oauth-callback?error=access_denied&error_description=User+cancelled\");\n\n    await expect(callOAuthCallback(createTestInterface(), \"/handler/oauth-callback\"))\n      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderAccessDenied.isInstance(error));\n    expect(window.location.href).toBe(\"http://localhost:3000/handler/oauth-callback\");\n  });\n\n  it(\"turns generic provider error callback params into a known error\", async () => {\n    window.history.replaceState({}, \"\", \"/handler/oauth-callback?error=server_error&error_description=Provider+failed\");\n\n    await expect(callOAuthCallback(createTestInterface(), \"/handler/oauth-callback\"))\n      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderTemporarilyUnavailable.isInstance(error));\n    expect(window.location.href).toBe(\"http://localhost:3000/handler/oauth-callback\");\n  });\n});\n"],"mappings":";;;;;AAUA,GAAG,KAAK,YAAY,OAAO,mBAAmB;CAE5C,OAAO;EACL,GAAG,MAFgB,eAA0C;EAG7D,sBAAsB,aAAa;GACjC,eAAe;GACf,OAAO;EACT;CACF;AACF,CAAC;AAED,SAAS,sBAAsB;CAC7B,OAAO,IAAI,wBAAwB;EACjC,eAAe;EACf,kBAAkB;EAClB,kBAAkB,CAAC,yBAAyB;EAC5C,qBAAqB,CAAC;EACtB,WAAW;EACX,sBAAsB;CACxB,CAAC;AACH;AAEA,SAAS,uCAAuC;CAC9C,GAAG,uDAAuD,YAAY;EACpE,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,8DAA8D;EAElG,MAAM,QAAQ,oBAAoB;EAGlC,MAAM,WAAW,MAAM,8BACrB,OACA;GACE,UAAU;GACV,aAAa;GACb,kBAAkB;GAClB,eAAe;EACjB,GATc,MAAM,cAAc;GAAE,cAAc;GAAM,aAAa;EAAK,CAUpE,CACR;EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ;EAC5B,OAAO,GAAG,IAAI,SAAS,IAAI,UAAU,CAAC,CAAC,KAAK,4DAA4D;EACxG,OAAO,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB;;;;;;;;;;;;;;;;KAgB5E;CACH,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;CAClC,GAAG,mEAAmE,YAAY;EAChF,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,8EAA8E;EAElH,MAAM,OAAO,kBAAkB,oBAAoB,GAAG,yBAAyB,CAAC,CAAC,CAC9E,QAAQ,WAAW,UAAmB,YAAY,0BAA0B,WAAW,KAAK,CAAC;EAChG,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,KAAK,8CAA8C;CAClF,CAAC;CAED,GAAG,mEAAmE,YAAY;EAChF,OAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,8EAA8E;EAElH,MAAM,OAAO,kBAAkB,oBAAoB,GAAG,yBAAyB,CAAC,CAAC,CAC9E,QAAQ,WAAW,UAAmB,YAAY,oCAAoC,WAAW,KAAK,CAAC;EAC1G,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,KAAK,8CAA8C;CAClF,CAAC;AACH,CAAC"}

package/dist/esm/lib/hexclave-app/apps/implementations/admin-app-impl.d.ts

@@ -192,6 +192,7 @@ declare class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, Pro
       inheritsFrom?: import("..").StackClientApp<any, any>;
       devTool?: boolean | "auto";
       noAutomaticPrefetch?: boolean;
+      automaticSideEffects?: boolean;
       analytics?: import("./session-replay").AnalyticsOptions;
     } & {
       tokenStore: import("../../common").TokenStoreInit<HasTokenStore>;
@@ -220,6 +221,7 @@ declare class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, Pro
       inheritsFrom?: import("..").StackClientApp<any, any>;
       devTool?: boolean | "auto";
       noAutomaticPrefetch?: boolean;
+      automaticSideEffects?: boolean;
       analytics?: import("./session-replay").AnalyticsOptions;
     } & {
       tokenStore: import("../../common").TokenStoreInit<HasTokenStore>;
@@ -250,6 +252,7 @@ declare class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, Pro
     } | undefined) => Promise<void>;
     getRedirectToHandlerUrl: (handlerName: keyof import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").o, options?: import("../../common").RedirectToOptions) => Promise<string>;
     redirectToHandler: (handlerName: keyof import("@hexclave/shared/dist/handler-urls-BHt3v8Ai").o, options?: import("../../common").RedirectToOptions) => Promise<void>;
+    getRawAfterAuthReturnTo: () => string | null;
     refreshOwnedProjects: () => Promise<void>;
     signInWithTokens: (tokens: {
       accessToken: string;

package/dist/esm/lib/hexclave-app/apps/implementations/admin-app-impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-app-impl.d.ts","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/admin-app-impl.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAwCK,iBAAA,GAAoB,OAAA,CAAQ,UAAA,CAAW,sBAAA;AAAA,cAqC/B,+BAAA,kEAAiG,gCAAA,CAAiC,aAAA,EAAe,SAAA,aAAsB,aAAA,CAAc,aAAA,EAAe,SAAA;EAAA,UAC7L,UAAA,EAAY,sBAAA;EAAA,iBAEb,kBAAA;EAAA,iBAGA,eAAA;EAAA,iBAGA,qBAAA;EAAA,iBAIA,qBAAA;EAAA,iBAGA,sBAAA;EAAA,iBAGA,yBAAA;EAAA,iBAGA,sBAAA;EAAA,iBAGA,oBAAA;EAAA,iBAGA,oCAAA;EAAA,iBAGA,uCAAA;EAAA,iBAGA,eAAA;EAAA,iBAMA,aAAA;EAAA,iBAIA,kBAAA;EAAA,iBAGA,uBAAA;EAAA,iBAGA,kBAAA;EAAA,iBAGA,qCAAA;EAAA,iBAGA,qBAAA;EAAA,iBAGA,uBAAA;EAAA,iBAUA,kBAAA;cAIL,OAAA,EAAS,+BAAA,CAAgC,aAAA,EAAe,SAAA,GAAY,YAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,sBAAA;EAAA;EA2B9J,oBAAA,CAAqB,IAAA;IAAQ,aAAA;EAAA,IAA0B,cAAA;EAIvD,0BAAA,CAA2B,IAAA,EAAM,YAAA,mBAA+B,SAAA,QAAiB,OAAA,SAAgB,iBAAA;EAUjG,qBAAA,CAAsB,IAAA,EAAM,YAAA,mBAA+B,SAAA,QAAiB,OAAA,SAAgB,YAAA;EAyL5F,2BAAA,CAA4B,IAAA,EAAM,iBAAA,oBAAqC,kBAAA;EASvE,kBAAA,CAAmB,IAAA,EAAM,iBAAA,GAAoB,SAAA;EAwB9B,UAAA,IAAc,OAAA,CAAQ,YAAA;EAO5B,UAAA,IAAc,YAAA;EAQjB,YAAA,IAAgB,OAAA,CAAQ,SAAA;EAI9B,YAAA,IAAgB,SAAA;EAAA,UAKN,iCAAA,CAAkC,IAAA,EAAM,0BAAA,GAA6B,kBAAA;EAAA,UAwBrE,6BAAA,CAA8B,IAAA,EAAM,mBAAA,oBAAuC,cAAA;EAAA,UAS3E,sCAAA,CAAuC,IAAA,EAAM,gCAAA,GAAmC,uBAAA;EASpF,mBAAA,IAAuB,OAAA,CAAQ,cAAA;EAKrC,kBAAA,IAAsB,cAAA;EAOhB,oBAAA,CAAqB,OAAA,EAAS,2BAAA,GAA8B,OAAA,CAAQ,uBAAA;EAO1E,cAAA;IAAoB,EAAA;IAAY,WAAA;EAAA;EAShC,iBAAA;IAAuB,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAkB,SAAA;EAAA;EAW1E,cAAA;IAAoB,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAqC,SAAA;IAAmB,MAAA,EAAQ,IAAA;EAAA;EAYrH,YAAA,IAAgB,aAAA;EAIV,eAAA,IAAmB,OAAA;IAAU,EAAA;IAAY,WAAA;EAAA;EAQzC,kBAAA,IAAsB,OAAA;IAAU,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAkB,SAAA;EAAA;EAYnF,aAAA,IAAiB,OAAA,CAAQ,aAAA;EAKzB,cAAA,CAAe,OAAA;IAAW,EAAA;IAAY,WAAA;IAAsB,MAAA;EAAA,IAAmB,OAAA,CAAQ,uBAAA;EAUvF,oBAAA,CAAqB,UAAA,UAAoB,MAAA,WAAiB,OAAA,CAAQ,uBAAA;EAMlE,cAAA,CAAe,UAAA,WAAqB,OAAA;EAKpC,oBAAA,CAAqB,UAAA,WAAqB,OAAA,CAAQ,oBAAA;EAIlD,gBAAA,CAAiB,UAAA,UAAoB,MAAA,EAAQ,uBAAA;IAA4B,YAAA;EAAA,IAAuB,OAAA;IAAU,IAAA,EAAM,uBAAA;IAA2B,UAAA;EAAA;EAC3I,gBAAA,CAAiB,UAAA,UAAoB,MAAA,GAAS,uBAAA,GAA0B,OAAA;IAAU,IAAA,EAAM,gBAAA;IAAoB,UAAA;EAAA;EAiC5G,cAAA,CAAe,KAAA,WAAgB,OAAA,CAAQ,uBAAA;EAIvC,kBAAA,CAAmB,UAAA,UAAoB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,KAAA;IAA2C,OAAA;EAAA,IAA0B,OAAA;IAAU,aAAA;EAAA;EAWjK,mBAAA,CAAoB,UAAA,UAAoB,OAAA;IAAW,SAAA;IAAmB,MAAA;IAAiB,WAAA;EAAA,IAAyB,OAAA,CAAQ,0BAAA;EAwBxH,gBAAA,CAAiB,KAAA,WAAgB,OAAA;EAKjC,iBAAA,CAAkB,IAAA,UAAc,IAAA,aAAiB,OAAA;IAAU,OAAA;EAAA;EAK3D,eAAA,IAAmB,OAAA;IAAU,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAqC,SAAA;IAAmB,MAAA,EAAQ,IAAA;EAAA;EAY9H,8BAAA,CAA+B,IAAA,EAAM,0CAAA,GAA6C,OAAA,CAAQ,mBAAA;EAM1F,8BAAA,CAA+B,YAAA,UAAsB,IAAA,EAAM,0CAAA,GAA0C,OAAA;EAKrG,8BAAA,CAA+B,YAAA,WAAuB,OAAA;EAKtD,6BAAA,IAAiC,OAAA,CAAQ,6BAAA;EAKzC,sCAAA,CACJ,OAAA;IAAW,KAAA;IAAe,MAAA;IAAiB,KAAA;EAAA,IAC1C,OAAA;IAAU,KAAA,EAAO,6BAAA;IAAiC,UAAA;EAAA;EAQrD,4BAAA,IAAgC,6BAAA;EAO1B,iCAAA,CAAkC,IAAA,EAAM,6CAAA,GAAgD,OAAA,CAAQ,sBAAA;EAMhG,iCAAA,CAAkC,YAAA,UAAsB,IAAA,EAAM,6CAAA,GAA6C,OAAA;EAK3G,iCAAA,CAAkC,YAAA,WAAuB,OAAA;EAKzD,gCAAA,IAAoC,OAAA,CAAQ,gCAAA;EAKlD,+BAAA,IAAmC,gCAAA;EAMnC,YAAA;IAAkB,KAAA;IAAe,GAAA;EAAA;EAAA,UAKR,eAAA,IAAe,OAAA;EAAA,UAOxB,qBAAA,IAAqB,OAAA;EAAA,UAOrB,uBAAA,IAAuB,OAAA;EAAA,UAId,aAAA,IAAa,OAAA;EAAA,KAQjC,0BAAA;6CAI0B,OAAA;MACb,YAAA;MAAuB,QAAA;MAAmB,OAAA;MAAkB,EAAA;MAAa,MAAA;MAAiB,KAAA;MAAgB,KAAA;IAAA,MACrH,eAAA;yCAYgC,oBAAA;gCAGT,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;oGAktBqnsH,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA5sB7osH,aAAA,CAAc,OAAA;IAClB,cAAA;IACA,WAAA,EAAa,WAAA;EAAA,IACX,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAgC1B,eAAA,CAAgB,OAAA;IAAW,UAAA;EAAA,IAAuB,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAY9E,cAAA,IAAkB,OAAA,CAAQ,cAAA;EAY1B,yBAAA,CAA0B,OAAA;IAAW,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,+BAAA;EAc5F,uBAAA,CAAwB,OAAA;IAAW,QAAA;IAAkB,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,0BAAA;EAW5G,uBAAA,IAA2B,OAAA,CAAQ,4BAAA;EAWnC,yBAAA,CAA0B,OAAA;IAAW,QAAA;EAAA,IAAqB,OAAA;IAAU,MAAA;EAAA;EAQpE,wBAAA,CAAyB,OAAA;IAAW,cAAA;EAAA,IAA2B,OAAA;IAAU,MAAA;EAAA;EAMzE,yBAAA,CAA0B,KAAA,UAAe,WAAA,WAAsB,OAAA;EAI/D,mBAAA,CAAoB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EAOpD,mBAAA,CAAoB,EAAA,WAAa,OAAA;EAKjC,gBAAA,CAAiB,OAAA;IAAW,WAAA;IAAqB,OAAA;IAA0B,SAAA;EAAA,IAAuB,OAAA;IAAU,EAAA;EAAA;EAU5G,gBAAA,CAAiB,EAAA,UAAY,IAAA;IAAQ,WAAA;IAAsB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;EASxH,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAS9B,kBAAA,IAAsB,OAAA;EAItB,eAAA,CAAgB,QAAA,UAAkB,OAAA,QAAe,OAAA;EAIjD,gBAAA,CAAiB,QAAA,WAAmB,OAAA;IAAU,QAAA,EAAU,KAAA;EAAA;EAIxD,2BAAA,CAA4B,iBAAA,WAA4B,OAAA;IAAU,SAAA;EAAA;EAKlE,gBAAA,CAAiB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EAMjD,eAAA,CAAgB,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;EAAA,IAA+B,OAAA;EAI/I,eAAA,CAAgB,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;EAAA;EAIpG,kCAAA,CAAmC,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;IAA4B,cAAA;EAAA,IAAmD,OAAA;IAAU,IAAA;IAAc,eAAA,GAAkB,MAAA;EAAA;EAI5P,kCAAA,CAAmC,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;IAA4B,cAAA;EAAA;IAAqD,IAAA;IAAc,eAAA,GAAkB,MAAA;EAAA;EAI9O,aAAA,CAAc,EAAA;IAAe,WAAA;IAAqB,SAAA;EAAA;EAO5C,gBAAA,CAAiB,EAAA,UAAY,SAAA,WAAoB,OAAA;EAMjD,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAM9B,mBAAA,CAAoB,EAAA,UAAY,SAAA,UAAmB,OAAA,0BAAiC,OAAA;IAAU,YAAA;EAAA;EAM9F,aAAA,IAAiB,OAAA;IAAU,GAAA;EAAA;EAM3B,gCAAA,IAAoC,OAAA;IAAU,aAAA;EAAA;EAI9C,uBAAA,IAA2B,OAAA;IAAU,QAAA;IAAkB,OAAA,EAAS,KAAA;MAAQ,EAAA;MAAY,IAAA;MAAc,OAAA;MAAkB,SAAA;MAAoB,WAAA;IAAA;EAAA;EAIxI,0BAAA,CAA2B,QAAA,UAAkB,OAAA,EAAS,MAAA,yBAA+B,OAAA;EAIrF,wBAAA,CAAyB,OAAA;IAC3B,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,gBAAA;IAA0B,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA,KAChF,OAAA;EA0BE,iBAAA,CAAkB,OAAA;IACtB,IAAA;IACA,EAAA;IACA,SAAA;IACA,SAAA,EAAW,WAAA;IACX,SAAA;EAAA,IACE,OAAA;IAAU,mBAAA;EAAA;EAYR,gBAAA,CAAiB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,IAAA,GAAO,eAAA;IAAiB,YAAA;IAA2C,UAAA;EAAA,IAAwB,OAAA;IAAU,YAAA,EAAc,WAAA;IAAe,UAAA;EAAA;EAAA,QAQ5L,uBAAA;EAgOF,gBAAA,CAAiB,OAAA;IAAY,MAAA;IAAiB,YAAA;IAAuB,MAAA;IAAiB,KAAA;IAAgB,MAAA;EAAA,IAAoB,OAAA;IAAU,KAAA,EAAO,gBAAA;IAAoB,UAAA;EAAA;EAc/J,cAAA,CAAe,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAKpC,iBAAA,CAAkB,EAAA,UAAY,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,gBAAA;EAW1E,gBAAA,CAAiB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAItC,kBAAA,CAAmB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAIxC,iBAAA,CAAkB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAI7C,eAAA,CAAgB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,IAAA,GAAO,eAAA;IAAiB,YAAA;IAA2C,UAAA;EAAA;IAA0B,YAAA,EAAc,WAAA;IAAe,UAAA;EAAA;EAK/K,oBAAA,IAAwB,OAAA;IAAiB,UAAA;IAAoB,eAAA;IAA0B,iBAAA;IAA4B,eAAA;EAAA;EAIzH,oBAAA;IAA0B,UAAA;IAAoB,eAAA;IAA0B,iBAAA;IAA4B,eAAA;EAAA;EAK9F,oBAAA,CAAqB,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EAkBjE,4BAAA,CAA6B,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,8BAAA;EAInE,kBAAA,CAAmB,OAAA,GAAU,yBAAA,GAA4B,OAAA,CAAQ,wBAAA;EAgCjE,gBAAA,CAAiB,eAAA,WAA0B,OAAA,CAAQ,kBAAA;EAgBnD,uBAAA,CAAwB,eAAA,UAAyB,OAAA,GAAU,8BAAA,GAAiC,OAAA,CAAQ,6BAAA;EAwBpG,2BAAA,CAA4B,eAAA,UAAyB,OAAA,WAAkB,OAAA,CAAQ,wCAAA;EAI/E,sBAAA,CAAuB,eAAA,UAAyB,OAAA;IAAY,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA,CAAQ,4BAAA;EAoBxG,sCAAA,CACJ,UAAA;IAAc,wBAAA;EAAA,GACd,KAAA,YACC,OAAA;IACD,aAAA,EAAe,KAAA;MACb,EAAA;MACA,WAAA;MACA,YAAA;MACA,gBAAA,EAAkB,gBAAA;IAAA;IAEpB,kBAAA;EAAA;AAAA"}
+{"version":3,"file":"admin-app-impl.d.ts","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/admin-app-impl.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAwCK,iBAAA,GAAoB,OAAA,CAAQ,UAAA,CAAW,sBAAA;AAAA,cAqC/B,+BAAA,kEAAiG,gCAAA,CAAiC,aAAA,EAAe,SAAA,aAAsB,aAAA,CAAc,aAAA,EAAe,SAAA;EAAA,UAC7L,UAAA,EAAY,sBAAA;EAAA,iBAEb,kBAAA;EAAA,iBAGA,eAAA;EAAA,iBAGA,qBAAA;EAAA,iBAIA,qBAAA;EAAA,iBAGA,sBAAA;EAAA,iBAGA,yBAAA;EAAA,iBAGA,sBAAA;EAAA,iBAGA,oBAAA;EAAA,iBAGA,oCAAA;EAAA,iBAGA,uCAAA;EAAA,iBAGA,eAAA;EAAA,iBAMA,aAAA;EAAA,iBAIA,kBAAA;EAAA,iBAGA,uBAAA;EAAA,iBAGA,kBAAA;EAAA,iBAGA,qCAAA;EAAA,iBAGA,qBAAA;EAAA,iBAGA,uBAAA;EAAA,iBAUA,kBAAA;cAIL,OAAA,EAAS,+BAAA,CAAgC,aAAA,EAAe,SAAA,GAAY,YAAA;IAAiB,gBAAA;IAA2B,WAAA;IAAsB,SAAA,GAAY,sBAAA;EAAA;EA2B9J,oBAAA,CAAqB,IAAA;IAAQ,aAAA;EAAA,IAA0B,cAAA;EAIvD,0BAAA,CAA2B,IAAA,EAAM,YAAA,mBAA+B,SAAA,QAAiB,OAAA,SAAgB,iBAAA;EAUjG,qBAAA,CAAsB,IAAA,EAAM,YAAA,mBAA+B,SAAA,QAAiB,OAAA,SAAgB,YAAA;EAyL5F,2BAAA,CAA4B,IAAA,EAAM,iBAAA,oBAAqC,kBAAA;EASvE,kBAAA,CAAmB,IAAA,EAAM,iBAAA,GAAoB,SAAA;EAwB9B,UAAA,IAAc,OAAA,CAAQ,YAAA;EAO5B,UAAA,IAAc,YAAA;EAQjB,YAAA,IAAgB,OAAA,CAAQ,SAAA;EAI9B,YAAA,IAAgB,SAAA;EAAA,UAKN,iCAAA,CAAkC,IAAA,EAAM,0BAAA,GAA6B,kBAAA;EAAA,UAwBrE,6BAAA,CAA8B,IAAA,EAAM,mBAAA,oBAAuC,cAAA;EAAA,UAS3E,sCAAA,CAAuC,IAAA,EAAM,gCAAA,GAAmC,uBAAA;EASpF,mBAAA,IAAuB,OAAA,CAAQ,cAAA;EAKrC,kBAAA,IAAsB,cAAA;EAOhB,oBAAA,CAAqB,OAAA,EAAS,2BAAA,GAA8B,OAAA,CAAQ,uBAAA;EAO1E,cAAA;IAAoB,EAAA;IAAY,WAAA;EAAA;EAShC,iBAAA;IAAuB,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAkB,SAAA;EAAA;EAW1E,cAAA;IAAoB,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAqC,SAAA;IAAmB,MAAA,EAAQ,IAAA;EAAA;EAYrH,YAAA,IAAgB,aAAA;EAIV,eAAA,IAAmB,OAAA;IAAU,EAAA;IAAY,WAAA;EAAA;EAQzC,kBAAA,IAAsB,OAAA;IAAU,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAkB,SAAA;EAAA;EAYnF,aAAA,IAAiB,OAAA,CAAQ,aAAA;EAKzB,cAAA,CAAe,OAAA;IAAW,EAAA;IAAY,WAAA;IAAsB,MAAA;EAAA,IAAmB,OAAA,CAAQ,uBAAA;EAUvF,oBAAA,CAAqB,UAAA,UAAoB,MAAA,WAAiB,OAAA,CAAQ,uBAAA;EAMlE,cAAA,CAAe,UAAA,WAAqB,OAAA;EAKpC,oBAAA,CAAqB,UAAA,WAAqB,OAAA,CAAQ,oBAAA;EAIlD,gBAAA,CAAiB,UAAA,UAAoB,MAAA,EAAQ,uBAAA;IAA4B,YAAA;EAAA,IAAuB,OAAA;IAAU,IAAA,EAAM,uBAAA;IAA2B,UAAA;EAAA;EAC3I,gBAAA,CAAiB,UAAA,UAAoB,MAAA,GAAS,uBAAA,GAA0B,OAAA;IAAU,IAAA,EAAM,gBAAA;IAAoB,UAAA;EAAA;EAiC5G,cAAA,CAAe,KAAA,WAAgB,OAAA,CAAQ,uBAAA;EAIvC,kBAAA,CAAmB,UAAA,UAAoB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,KAAA;IAA2C,OAAA;EAAA,IAA0B,OAAA;IAAU,aAAA;EAAA;EAWjK,mBAAA,CAAoB,UAAA,UAAoB,OAAA;IAAW,SAAA;IAAmB,MAAA;IAAiB,WAAA;EAAA,IAAyB,OAAA,CAAQ,0BAAA;EAwBxH,gBAAA,CAAiB,KAAA,WAAgB,OAAA;EAKjC,iBAAA,CAAkB,IAAA,UAAc,IAAA,aAAiB,OAAA;IAAU,OAAA;EAAA;EAK3D,eAAA,IAAmB,OAAA;IAAU,EAAA;IAAY,WAAA;IAAqB,OAAA;IAAqC,SAAA;IAAmB,MAAA,EAAQ,IAAA;EAAA;EAY9H,8BAAA,CAA+B,IAAA,EAAM,0CAAA,GAA6C,OAAA,CAAQ,mBAAA;EAM1F,8BAAA,CAA+B,YAAA,UAAsB,IAAA,EAAM,0CAAA,GAA0C,OAAA;EAKrG,8BAAA,CAA+B,YAAA,WAAuB,OAAA;EAKtD,6BAAA,IAAiC,OAAA,CAAQ,6BAAA;EAKzC,sCAAA,CACJ,OAAA;IAAW,KAAA;IAAe,MAAA;IAAiB,KAAA;EAAA,IAC1C,OAAA;IAAU,KAAA,EAAO,6BAAA;IAAiC,UAAA;EAAA;EAQrD,4BAAA,IAAgC,6BAAA;EAO1B,iCAAA,CAAkC,IAAA,EAAM,6CAAA,GAAgD,OAAA,CAAQ,sBAAA;EAMhG,iCAAA,CAAkC,YAAA,UAAsB,IAAA,EAAM,6CAAA,GAA6C,OAAA;EAK3G,iCAAA,CAAkC,YAAA,WAAuB,OAAA;EAKzD,gCAAA,IAAoC,OAAA,CAAQ,gCAAA;EAKlD,+BAAA,IAAmC,gCAAA;EAMnC,YAAA;IAAkB,KAAA;IAAe,GAAA;EAAA;EAAA,UAKR,eAAA,IAAe,OAAA;EAAA,UAOxB,qBAAA,IAAqB,OAAA;EAAA,UAOrB,uBAAA,IAAuB,OAAA;EAAA,UAId,aAAA,IAAa,OAAA;EAAA,KAQjC,0BAAA;6CAI0B,OAAA;MACb,YAAA;MAAuB,QAAA;MAAmB,OAAA;MAAkB,EAAA;MAAa,MAAA;MAAiB,KAAA;MAAgB,KAAA;IAAA,MACrH,eAAA;yCAYgC,oBAAA;gCAGT,iBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oGAktBq/wH,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA5sB7gxH,aAAA,CAAc,OAAA;IAClB,cAAA;IACA,WAAA,EAAa,WAAA;EAAA,IACX,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAgC1B,eAAA,CAAgB,OAAA;IAAW,UAAA;EAAA,IAAuB,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAY9E,cAAA,IAAkB,OAAA,CAAQ,cAAA;EAY1B,yBAAA,CAA0B,OAAA;IAAW,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,+BAAA;EAc5F,uBAAA,CAAwB,OAAA;IAAW,QAAA;IAAkB,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,0BAAA;EAW5G,uBAAA,IAA2B,OAAA,CAAQ,4BAAA;EAWnC,yBAAA,CAA0B,OAAA;IAAW,QAAA;EAAA,IAAqB,OAAA;IAAU,MAAA;EAAA;EAQpE,wBAAA,CAAyB,OAAA;IAAW,cAAA;EAAA,IAA2B,OAAA;IAAU,MAAA;EAAA;EAMzE,yBAAA,CAA0B,KAAA,UAAe,WAAA,WAAsB,OAAA;EAI/D,mBAAA,CAAoB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EAOpD,mBAAA,CAAoB,EAAA,WAAa,OAAA;EAKjC,gBAAA,CAAiB,OAAA;IAAW,WAAA;IAAqB,OAAA;IAA0B,SAAA;EAAA,IAAuB,OAAA;IAAU,EAAA;EAAA;EAU5G,gBAAA,CAAiB,EAAA,UAAY,IAAA;IAAQ,WAAA;IAAsB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;EASxH,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAS9B,kBAAA,IAAsB,OAAA;EAItB,eAAA,CAAgB,QAAA,UAAkB,OAAA,QAAe,OAAA;EAIjD,gBAAA,CAAiB,QAAA,WAAmB,OAAA;IAAU,QAAA,EAAU,KAAA;EAAA;EAIxD,2BAAA,CAA4B,iBAAA,WAA4B,OAAA;IAAU,SAAA;EAAA;EAKlE,gBAAA,CAAiB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EAMjD,eAAA,CAAgB,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;EAAA,IAA+B,OAAA;EAI/I,eAAA,CAAgB,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;EAAA;EAIpG,kCAAA,CAAmC,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;IAA4B,cAAA;EAAA,IAAmD,OAAA;IAAU,IAAA;IAAc,eAAA,GAAkB,MAAA;EAAA;EAI5P,kCAAA,CAAmC,OAAA;IAAW,OAAA;IAAiC,cAAA;IAAyB,UAAA;IAAqB,iBAAA;IAA4B,cAAA;EAAA;IAAqD,IAAA;IAAc,eAAA,GAAkB,MAAA;EAAA;EAI9O,aAAA,CAAc,EAAA;IAAe,WAAA;IAAqB,SAAA;EAAA;EAO5C,gBAAA,CAAiB,EAAA,UAAY,SAAA,WAAoB,OAAA;EAMjD,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAM9B,mBAAA,CAAoB,EAAA,UAAY,SAAA,UAAmB,OAAA,0BAAiC,OAAA;IAAU,YAAA;EAAA;EAM9F,aAAA,IAAiB,OAAA;IAAU,GAAA;EAAA;EAM3B,gCAAA,IAAoC,OAAA;IAAU,aAAA;EAAA;EAI9C,uBAAA,IAA2B,OAAA;IAAU,QAAA;IAAkB,OAAA,EAAS,KAAA;MAAQ,EAAA;MAAY,IAAA;MAAc,OAAA;MAAkB,SAAA;MAAoB,WAAA;IAAA;EAAA;EAIxI,0BAAA,CAA2B,QAAA,UAAkB,OAAA,EAAS,MAAA,yBAA+B,OAAA;EAIrF,wBAAA,CAAyB,OAAA;IAC3B,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,gBAAA;IAA0B,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA,KAChF,OAAA;EA0BE,iBAAA,CAAkB,OAAA;IACtB,IAAA;IACA,EAAA;IACA,SAAA;IACA,SAAA,EAAW,WAAA;IACX,SAAA;EAAA,IACE,OAAA;IAAU,mBAAA;EAAA;EAYR,gBAAA,CAAiB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,IAAA,GAAO,eAAA;IAAiB,YAAA;IAA2C,UAAA;EAAA,IAAwB,OAAA;IAAU,YAAA,EAAc,WAAA;IAAe,UAAA;EAAA;EAAA,QAQ5L,uBAAA;EAgOF,gBAAA,CAAiB,OAAA;IAAY,MAAA;IAAiB,YAAA;IAAuB,MAAA;IAAiB,KAAA;IAAgB,MAAA;EAAA,IAAoB,OAAA;IAAU,KAAA,EAAO,gBAAA;IAAoB,UAAA;EAAA;EAc/J,cAAA,CAAe,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAKpC,iBAAA,CAAkB,EAAA,UAAY,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,gBAAA;EAW1E,gBAAA,CAAiB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAItC,kBAAA,CAAmB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAIxC,iBAAA,CAAkB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EAI7C,eAAA,CAAgB,MAAA;IAAU,MAAA;IAAiB,KAAA;IAAgB,IAAA,GAAO,eAAA;IAAiB,YAAA;IAA2C,UAAA;EAAA;IAA0B,YAAA,EAAc,WAAA;IAAe,UAAA;EAAA;EAK/K,oBAAA,IAAwB,OAAA;IAAiB,UAAA;IAAoB,eAAA;IAA0B,iBAAA;IAA4B,eAAA;EAAA;EAIzH,oBAAA;IAA0B,UAAA;IAAoB,eAAA;IAA0B,iBAAA;IAA4B,eAAA;EAAA;EAK9F,oBAAA,CAAqB,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EAkBjE,4BAAA,CAA6B,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,8BAAA;EAInE,kBAAA,CAAmB,OAAA,GAAU,yBAAA,GAA4B,OAAA,CAAQ,wBAAA;EAgCjE,gBAAA,CAAiB,eAAA,WAA0B,OAAA,CAAQ,kBAAA;EAgBnD,uBAAA,CAAwB,eAAA,UAAyB,OAAA,GAAU,8BAAA,GAAiC,OAAA,CAAQ,6BAAA;EAwBpG,2BAAA,CAA4B,eAAA,UAAyB,OAAA,WAAkB,OAAA,CAAQ,wCAAA;EAI/E,sBAAA,CAAuB,eAAA,UAAyB,OAAA;IAAY,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA,CAAQ,4BAAA;EAoBxG,sCAAA,CACJ,UAAA;IAAc,wBAAA;EAAA,GACd,KAAA,YACC,OAAA;IACD,aAAA,EAAe,KAAA;MACb,EAAA;MACA,WAAA;MACA,YAAA;MACA,gBAAA,EAAkB,gBAAA;IAAA;IAEpB,kBAAA;EAAA;AAAA"}

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.js

@@ -0,0 +1,102 @@
+import { describe, expect, it } from "vitest";
+import { hexclaveAppInternalsSymbol } from "../../common.js";
+import { HexclaveClientApp } from "../interfaces/client-app.js";
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts
+const baseOptions = {
+	baseUrl: "http://localhost:12345",
+	projectId: "00000000-0000-4000-8000-000000000000",
+	publishableClientKey: "stack-pk-test",
+	tokenStore: "memory",
+	redirectMethod: "none"
+};
+describe("HexclaveClientApp automatic side effects", () => {
+	it("does not inspect browser state when disabled", () => {
+		const previousWindow = Reflect.get(globalThis, "window");
+		const previousDocument = Reflect.get(globalThis, "document");
+		const hadPreviousWindow = Reflect.has(globalThis, "window");
+		const hadPreviousDocument = Reflect.has(globalThis, "document");
+		const browserGlobal = {};
+		Object.defineProperty(browserGlobal, "location", { get() {
+			throw new Error("Construction must not inspect the current URL when automatic side effects are disabled");
+		} });
+		Reflect.set(globalThis, "window", browserGlobal);
+		Object.defineProperty(globalThis, "document", {
+			configurable: true,
+			get() {
+				throw new Error("Construction must not access the document when automatic side effects are disabled");
+			}
+		});
+		try {
+			expect(() => new HexclaveClientApp({
+				...baseOptions,
+				automaticSideEffects: false
+			})).not.toThrow();
+		} finally {
+			if (hadPreviousWindow) Reflect.set(globalThis, "window", previousWindow);
+			else Reflect.deleteProperty(globalThis, "window");
+			if (hadPreviousDocument) Object.defineProperty(globalThis, "document", {
+				configurable: true,
+				value: previousDocument,
+				writable: true
+			});
+			else Reflect.deleteProperty(globalThis, "document");
+		}
+	});
+	it("does not initialize automatic side effects when disabled", () => {
+		const methodName = "_initializeAutomaticSideEffects";
+		const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);
+		let initializationCalls = 0;
+		Reflect.set(HexclaveClientApp.prototype, methodName, () => {
+			initializationCalls += 1;
+		});
+		try {
+			new HexclaveClientApp({
+				...baseOptions,
+				automaticSideEffects: false
+			});
+			expect(initializationCalls).toBe(0);
+		} finally {
+			Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);
+		}
+	});
+	it.each([void 0, true])("retains automatic initialization when automaticSideEffects is %s", (automaticSideEffects) => {
+		const methodName = "_initializeAutomaticSideEffects";
+		const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);
+		let initializationCalls = 0;
+		Reflect.set(HexclaveClientApp.prototype, methodName, () => {
+			initializationCalls += 1;
+		});
+		try {
+			new HexclaveClientApp({
+				...baseOptions,
+				automaticSideEffects
+			});
+			expect(initializationCalls).toBe(1);
+		} finally {
+			Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);
+		}
+	});
+	it("preserves the option through serialization", () => {
+		expect(new HexclaveClientApp({
+			...baseOptions,
+			automaticSideEffects: false
+		})[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);
+	});
+	it("preserves stable identity when deserializing with automatic side effects disabled", () => {
+		const json = {
+			baseUrl: baseOptions.baseUrl,
+			projectId: baseOptions.projectId,
+			publishableClientKey: baseOptions.publishableClientKey,
+			tokenStore: null,
+			redirectMethod: baseOptions.redirectMethod,
+			automaticSideEffects: false,
+			uniqueIdentifier: "00000000-0000-4000-8000-000000000001"
+		};
+		const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);
+		expect(HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json)).toBe(first);
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=client-app-impl.automatic-side-effects.test.js.map

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-app-impl.automatic-side-effects.test.js","names":[],"sources":["../../../../../../src/lib/hexclave-app/apps/implementations/client-app-impl.automatic-side-effects.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { describe, expect, it } from \"vitest\";\nimport { hexclaveAppInternalsSymbol } from \"../../common\";\nimport { HexclaveClientApp, HexclaveClientAppConstructorOptions, HexclaveClientAppJson } from \"../interfaces/client-app\";\n\nconst baseOptions = {\n  baseUrl: \"http://localhost:12345\",\n  projectId: \"00000000-0000-4000-8000-000000000000\",\n  publishableClientKey: \"stack-pk-test\",\n  tokenStore: \"memory\",\n  redirectMethod: \"none\",\n} satisfies HexclaveClientAppConstructorOptions<true, string>;\n\ndescribe(\"HexclaveClientApp automatic side effects\", () => {\n  it(\"does not inspect browser state when disabled\", () => {\n    const previousWindow = Reflect.get(globalThis, \"window\");\n    const previousDocument = Reflect.get(globalThis, \"document\");\n    const hadPreviousWindow = Reflect.has(globalThis, \"window\");\n    const hadPreviousDocument = Reflect.has(globalThis, \"document\");\n    const browserGlobal = {};\n    Object.defineProperty(browserGlobal, \"location\", {\n      get() {\n        throw new Error(\"Construction must not inspect the current URL when automatic side effects are disabled\");\n      },\n    });\n\n    Reflect.set(globalThis, \"window\", browserGlobal);\n    Object.defineProperty(globalThis, \"document\", {\n      configurable: true,\n      get() {\n        throw new Error(\"Construction must not access the document when automatic side effects are disabled\");\n      },\n    });\n\n    try {\n      expect(() => new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      })).not.toThrow();\n    } finally {\n      if (hadPreviousWindow) {\n        Reflect.set(globalThis, \"window\", previousWindow);\n      } else {\n        Reflect.deleteProperty(globalThis, \"window\");\n      }\n      if (hadPreviousDocument) {\n        Object.defineProperty(globalThis, \"document\", {\n          configurable: true,\n          value: previousDocument,\n          writable: true,\n        });\n      } else {\n        Reflect.deleteProperty(globalThis, \"document\");\n      }\n    }\n  });\n\n  it(\"does not initialize automatic side effects when disabled\", () => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects: false,\n      });\n\n      expect(initializationCalls).toBe(0);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it.each([undefined, true])(\"retains automatic initialization when automaticSideEffects is %s\", (automaticSideEffects) => {\n    const methodName = \"_initializeAutomaticSideEffects\";\n    const originalInitializer = Reflect.get(HexclaveClientApp.prototype, methodName);\n    let initializationCalls = 0;\n    Reflect.set(HexclaveClientApp.prototype, methodName, () => {\n      initializationCalls += 1;\n    });\n\n    try {\n      new HexclaveClientApp({\n        ...baseOptions,\n        automaticSideEffects,\n      });\n\n      expect(initializationCalls).toBe(1);\n    } finally {\n      Reflect.set(HexclaveClientApp.prototype, methodName, originalInitializer);\n    }\n  });\n\n  it(\"preserves the option through serialization\", () => {\n    const app = new HexclaveClientApp({\n      ...baseOptions,\n      automaticSideEffects: false,\n    });\n\n    expect(app[hexclaveAppInternalsSymbol].toClientJson().automaticSideEffects).toBe(false);\n  });\n\n  it(\"preserves stable identity when deserializing with automatic side effects disabled\", () => {\n    const json: HexclaveClientAppJson<false, string> = {\n      baseUrl: baseOptions.baseUrl,\n      projectId: baseOptions.projectId,\n      publishableClientKey: baseOptions.publishableClientKey,\n      tokenStore: null,\n      redirectMethod: baseOptions.redirectMethod,\n      automaticSideEffects: false,\n      uniqueIdentifier: \"00000000-0000-4000-8000-000000000001\",\n    };\n\n    const first = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n    const second = HexclaveClientApp[hexclaveAppInternalsSymbol].fromClientJson(json);\n\n    expect(second).toBe(first);\n  });\n});\n"],"mappings":";;;;AAQA,MAAM,cAAc;CAClB,SAAS;CACT,WAAW;CACX,sBAAsB;CACtB,YAAY;CACZ,gBAAgB;AAClB;AAEA,SAAS,kDAAkD;CACzD,GAAG,sDAAsD;EACvD,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;EACvD,MAAM,mBAAmB,QAAQ,IAAI,YAAY,UAAU;EAC3D,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;EAC1D,MAAM,sBAAsB,QAAQ,IAAI,YAAY,UAAU;EAC9D,MAAM,gBAAgB,CAAC;EACvB,OAAO,eAAe,eAAe,YAAY,EAC/C,MAAM;GACJ,MAAM,IAAI,MAAM,wFAAwF;EAC1G,EACF,CAAC;EAED,QAAQ,IAAI,YAAY,UAAU,aAAa;EAC/C,OAAO,eAAe,YAAY,YAAY;GAC5C,cAAc;GACd,MAAM;IACJ,MAAM,IAAI,MAAM,oFAAoF;GACtG;EACF,CAAC;EAED,IAAI;GACF,aAAa,IAAI,kBAAkB;IACjC,GAAG;IACH,sBAAsB;GACxB,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;EAClB,UAAU;GACR,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;QAEhD,QAAQ,eAAe,YAAY,QAAQ;GAE7C,IAAI,qBACF,OAAO,eAAe,YAAY,YAAY;IAC5C,cAAc;IACd,OAAO;IACP,UAAU;GACZ,CAAC;QAED,QAAQ,eAAe,YAAY,UAAU;EAEjD;CACF,CAAC;CAED,GAAG,kEAAkE;EACnE,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAI,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAI,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAI,kBAAkB;IACpB,GAAG;IACH,sBAAsB;GACxB,CAAC;GAED,OAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAI,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,GAAG,KAAK,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,CAAC,qEAAqE,yBAAyB;EACvH,MAAM,aAAa;EACnB,MAAM,sBAAsB,QAAQ,IAAI,kBAAkB,WAAW,UAAU;EAC/E,IAAI,sBAAsB;EAC1B,QAAQ,IAAI,kBAAkB,WAAW,kBAAkB;GACzD,uBAAuB;EACzB,CAAC;EAED,IAAI;GACF,IAAI,kBAAkB;IACpB,GAAG;IACH;GACF,CAAC;GAED,OAAO,mBAAmB,CAAC,CAAC,KAAK,CAAC;EACpC,UAAU;GACR,QAAQ,IAAI,kBAAkB,WAAW,YAAY,mBAAmB;EAC1E;CACF,CAAC;CAED,GAAG,oDAAoD;EAMrD,OAAO,IALS,kBAAkB;GAChC,GAAG;GACH,sBAAsB;EACxB,CAES,CAAC,CAAC,2BAA2B,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK;CACxF,CAAC;CAED,GAAG,2FAA2F;EAC5F,MAAM,OAA6C;GACjD,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,sBAAsB,YAAY;GAClC,YAAY;GACZ,gBAAgB,YAAY;GAC5B,sBAAsB;GACtB,kBAAkB;EACpB;EAEA,MAAM,QAAQ,kBAAkB,2BAA2B,CAAC,eAAe,IAAI;EAG/E,OAFe,kBAAkB,2BAA2B,CAAC,eAAe,IAEhE,CAAC,CAAC,CAAC,KAAK,KAAK;CAC3B,CAAC;AACH,CAAC"}

package/dist/esm/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.js

@@ -1,8 +1,9 @@
 import { describe, expect, it, vi } from "vitest";
 import { hexclaveAppInternalsSymbol } from "../../common.js";
+import { StackClientApp } from "../interfaces/client-app.js";
 import { AccessToken } from "@hexclave/shared/dist/sessions";
 import { Store } from "@hexclave/shared/dist/utils/stores";
-import { StackClientApp } from "../interfaces/client-app.js";
+import { planRedirectToHandler } from "./redirect-page-urls.js";
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts
 function createAccessTokenString(refreshTokenId) {
 	const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -51,6 +52,57 @@ function createMockDocument() {
 	};
 }
 describe("StackClientApp cross-domain auth", () => {
+	it("keeps noRedirectBack same-domain redirects free of redirect-back state", async () => {
+		expect(await planRedirectToHandler({
+			handlerName: "signIn",
+			rawHandlerUrl: "/handler/sign-in",
+			noRedirectBack: true,
+			currentUrl: new URL("https://app.example.test/settings?tab=profile"),
+			localOAuthCallbackUrl: "/handler/oauth-callback",
+			rawHomeUrl: "/home",
+			getCrossDomainHandoffParams: async () => {
+				throw new Error("Same-domain redirects must not create cross-domain handoff parameters.");
+			}
+		})).toEqual({
+			type: "redirect",
+			url: "/handler/sign-in"
+		});
+	});
+	it("returns noRedirectBack cross-domain auth to the source app home", async () => {
+		const handoffState = "no-redirect-back-state";
+		const handoffCodeChallenge = "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~";
+		const currentUrl = new URL("https://app.example.test/settings?tab=profile");
+		currentUrl.searchParams.set("hexclave_cross_domain_state", handoffState);
+		currentUrl.searchParams.set("hexclave_cross_domain_code_challenge", handoffCodeChallenge);
+		currentUrl.searchParams.set("hexclave_cross_domain_after_callback_redirect_url", "https://app.example.test/settings?tab=profile");
+		const redirectPlan = await planRedirectToHandler({
+			handlerName: "signIn",
+			rawHandlerUrl: "https://auth.example.test/handler/sign-in",
+			noRedirectBack: true,
+			currentUrl,
+			localOAuthCallbackUrl: "/handler/oauth-callback",
+			rawHomeUrl: "/home",
+			getCrossDomainHandoffParams: async () => {
+				throw new Error("Existing cross-domain handoff parameters must be reused.");
+			}
+		});
+		expect(redirectPlan.type).toBe("redirect");
+		if (redirectPlan.type !== "redirect") throw new Error("Expected noRedirectBack sign-in to produce a redirect URL.");
+		const hostedUrl = new URL(redirectPlan.url);
+		expect(hostedUrl.origin).toBe("https://auth.example.test");
+		expect(hostedUrl.pathname).toBe("/handler/sign-in");
+		expect(hostedUrl.searchParams.get("hexclave_cross_domain_after_callback_redirect_url")).toBe("https://app.example.test/home");
+		const rawSourceCallbackUrl = hostedUrl.searchParams.get("after_auth_return_to");
+		if (rawSourceCallbackUrl == null) throw new Error("Expected cross-domain noRedirectBack to include its internal source callback URL.");
+		const sourceCallbackUrl = new URL(rawSourceCallbackUrl);
+		expect(sourceCallbackUrl.origin).toBe("https://app.example.test");
+		expect(sourceCallbackUrl.pathname).toBe("/handler/oauth-callback");
+		expect(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_auth")).toBe("1");
+		expect(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_state")).toBe(handoffState);
+		expect(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_code_challenge")).toBe(handoffCodeChallenge);
+		expect(sourceCallbackUrl.searchParams.get("hexclave_cross_domain_after_callback_redirect_url")).toBe("https://app.example.test/home");
+		expect(sourceCallbackUrl.toString()).not.toContain("/settings");
+	});
 	it("exposes redirect-back-aware handler URLs for devtool previews", async () => {
 		const previousWindow = Reflect.get(globalThis, "window");
 		const hadPreviousWindow = Reflect.has(globalThis, "window");
@@ -384,6 +436,8 @@ describe("StackClientApp cross-domain auth", () => {
 		callbackUrl.searchParams.set("errorCode", "SIGN_UP_REJECTED");
 		callbackUrl.searchParams.set("message", "Your sign up was rejected by an administrator's sign-up rule.");
 		callbackUrl.searchParams.set("details", JSON.stringify({ message: "Your sign up was rejected by an administrator's sign-up rule." }));
+		callbackUrl.searchParams.set("after_auth_return_to", "/dashboard");
+		callbackUrl.searchParams.set("after_callback_redirect_url", "https://customer.example.test/settings?tab=connected-accounts");
 		let currentHref = callbackUrl.toString();
 		let redirectedUrl = "";
 		const redirectSpy = vi.spyOn(StackClientApp.prototype, "_redirectTo").mockImplementation(async (...args) => {
@@ -428,6 +482,8 @@ describe("StackClientApp cross-domain auth", () => {
 		expect(errorUrl.pathname).toBe("/handler/error");
 		expect(errorUrl.searchParams.get("errorCode")).toBe("SIGN_UP_REJECTED");
 		expect(errorUrl.searchParams.get("message")).toBe("Your sign up was rejected by an administrator's sign-up rule.");
+		expect(errorUrl.searchParams.get("after_auth_return_to")).toBe("/dashboard");
+		expect(errorUrl.searchParams.get("after_callback_redirect_url")).toBe("https://customer.example.test/settings?tab=connected-accounts");
 		expect(new URL(currentHref).searchParams.has("errorCode")).toBe(false);
 	});
 	it("uses direct sign-out instead of hosted sign-out redirects when code execution is available", async () => {