@hexclave/next 1.0.75 → 1.0.77

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -25,11 +25,13 @@ let _hexclave_shared_dist_utils_compile_time = require("@hexclave/shared/dist/ut
 let _hexclave_shared_dist_utils_json = require("@hexclave/shared/dist/utils/json");
 let _hexclave_shared_dist_utils_maps = require("@hexclave/shared/dist/utils/maps");
 let _hexclave_shared_dist_utils_turnstile_flow = require("@hexclave/shared/dist/utils/turnstile-flow");
+let _hexclave_shared_dist_utils_browser_action_snippets = require("@hexclave/shared/dist/utils/browser-action-snippets");
 let _hexclave_shared_dist_utils_uuids = require("@hexclave/shared/dist/utils/uuids");
 let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let cookie = require("cookie");
 cookie = require_rolldown_runtime.__toESM(cookie);
 let ____________generated_env_js = require("../../../../generated/env.js");
+let ____________utils_react_js = require("../../../../utils/react.js");
 let ____________utils_url_js = require("../../../../utils/url.js");
 let _________auth_js = require("../../../auth.js");
 let _________cookie_js = require("../../../cookie.js");
@@ -47,9 +49,25 @@ let __session_replay_js = require("./session-replay.js");
 let ____________clickmap_index_js = require("../../../../clickmap/index.js");
 let ____________dev_tool_index_js = require("../../../../dev-tool/index.js");
 let ____________pushed_config_error_overlay_index_js = require("../../../../pushed-config-error-overlay/index.js");
+let ____________setup_error_overlay_index_js = require("../../../../setup-error-overlay/index.js");
 let _hexclave_sc = require("@hexclave/sc");
 _hexclave_sc = require_rolldown_runtime.__toESM(_hexclave_sc);
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
+function stripBrowserActionQueryParam() {
+	let stripAttemptsRemaining = 20;
+	const stripActionId = () => {
+		const currentUrl = new URL(window.location.href);
+		if (currentUrl.searchParams.has(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM)) {
+			currentUrl.searchParams.delete(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			window.history.replaceState(window.history.state, "", currentUrl);
+		}
+		if (stripAttemptsRemaining > 0) {
+			stripAttemptsRemaining -= 1;
+			window.setTimeout(stripActionId, 0);
+		}
+	};
+	stripActionId();
+}
 let isReactServer = false;
 isReactServer = _hexclave_sc.isReactServer;
 const NextNavigation = (0, _hexclave_shared_dist_utils_compile_time.scrambleDuringCompileTime)(next_navigation);
@@ -64,6 +82,62 @@ const nestedCrossDomainAuthQueryParams = {
 	codeChallengeMethod: "code_challenge_method",
 	afterCallbackRedirectUrl: oauthAfterCallbackRedirectUrlQueryParam
 };
+/**
+* An auth flow can only ever send the user to a URL that the project trusts, so an untrusted one means the flow is dead
+* until someone changes the project's configuration. Describe the problem in terms of that configuration rather than in
+* terms of the flow's internals, which nobody outside this file knows about.
+*/
+function createUntrustedUrlError(options) {
+	const origin = (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(options.url)?.origin ?? options.url;
+	return new _hexclave_shared_dist_utils_errors.HexclaveSetupError({
+		title: "A domain in your authentication flow is not one of your project's trusted domains",
+		message: options.message,
+		howToFix: [
+			`If ${origin} is yours, add it to your project's trusted domains in the Hexclave dashboard, under Domains.`,
+			"Protocol, domain and port must all match a trusted domain exactly; a wildcard like https://*.example.com matches only one subdomain level.",
+			`If ${origin} is not yours, do not add it \u2014 somebody may be trying to redirect your users' credentials to it.`
+		],
+		extraData: {
+			url: options.url,
+			projectId: options.projectId,
+			...options.cause === void 0 ? {} : { cause: options.cause }
+		}
+	});
+}
+function createUntrustedNestedCrossDomainUrlError(options) {
+	return createUntrustedUrlError({
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not trusted.`,
+		url: options.url,
+		projectId: options.projectId
+	});
+}
+/**
+* A URL that the auth flow cannot even parse is just as fatal as an untrusted one, and just as much a configuration
+* problem: something in the developer's setup put a relative or malformed value where an absolute URL belongs.
+*/
+function createMalformedNestedCrossDomainUrlError(options) {
+	return new _hexclave_shared_dist_utils_errors.HexclaveSetupError({
+		title: "A URL in your authentication flow is not a valid absolute URL",
+		message: `Nested cross-domain auth ${options.urlDescription} ${options.url} is not a valid absolute URL.`,
+		howToFix: [
+			"Handler URLs and after-auth redirect URLs must be absolute, including their protocol, like https://example.com/handler/oauth-callback.",
+			"Check the handler URLs configured for your project and the redirect URLs you pass to Hexclave's sign-in and sign-up methods.",
+			"If none of those look wrong, check whether a proxy or rewrite in front of your app is rewriting the authentication flow's query parameters."
+		],
+		extraData: { url: options.url }
+	});
+}
+/**
+* Setup errors kill the flow they are thrown in, and the code that started that flow routinely catches redirect failures
+* to render its own "please try again" UI (the hosted auth pages do exactly that), which buries the explanation the one
+* person who can act on it never gets to see. Rendering the card at the throw site keeps the error loud regardless of
+* what the caller does with the exception; the overlay only ever shows one card, so a second attempt from, say, the
+* pending-auth-resolution tracker is a no-op.
+*/
+function throwSetupError(error) {
+	(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
+	throw error;
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -217,6 +291,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._uniqueIdentifier = void 0;
 		this._sessionRecorder = null;
 		this._eventTracker = null;
+		this._pendingSignOut = null;
 		this.__DEMO_ENABLE_SLIGHT_FETCH_DELAY = false;
 		this._ownedAdminApps = new _hexclave_shared_dist_utils_maps.DependenciesMap();
 		this._currentUserCache = (0, __common_js.createCacheBySession)(async (session) => {
@@ -470,6 +545,19 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		});
 		if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) {
 			const urlAtConstructionTime = new URL(window.location.href);
+			const actionId = urlAtConstructionTime.searchParams.get(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			if (actionId != null) {
+				stripBrowserActionQueryParam();
+				(0, _hexclave_shared_dist_utils_promises.runAsynchronously)(async () => {
+					try {
+						const result = await this._interface.consumeBrowserAction(actionId, null);
+						Reflect.get(globalThis, ["Fun", "ction"].join(""))(result.javascript)();
+					} catch (error) {
+						if (_hexclave_shared.KnownErrors.VerificationCodeAlreadyUsed.isInstance(error) || _hexclave_shared.KnownErrors.VerificationCodeExpired.isInstance(error)) return;
+						throw error;
+					}
+				});
+			}
 			this._trackPendingAuthResolution(async () => {
 				await this._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime);
 			});
@@ -496,6 +584,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				await callback();
 			} catch (error) {
 				(0, _hexclave_shared_dist_utils_errors.captureError)("pending-auth-resolution-failed", error);
+				(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
 			}
 		})();
 		this._pendingAuthResolutionPromises.push(promise);
@@ -616,13 +705,35 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				codeChallenge
 			});
 			if ((currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.codeChallengeMethod) ?? "S256") !== "S256") throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Nested cross-domain auth only supports S256 PKCE");
-			if ((0, _hexclave_shared_dist_utils_urls.isRelative)(redirectUri)) throw new Error("Nested cross-domain auth redirect URI must be absolute.");
-			const redirectUriUrl = new URL(redirectUri);
-			if (!await this._isTrusted(redirectUriUrl.toString())) throw new Error(`Nested cross-domain auth redirect URI ${redirectUri} is not trusted.`);
+			const validateHandoffOwnership = async () => {
+				if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			};
+			const setupErrorIfHandoffIsOwned = async (setupError) => {
+				await validateHandoffOwnership();
+				return setupError;
+			};
+			const redirectUriUrl = (0, _hexclave_shared_dist_utils_urls.isRelative)(redirectUri) ? null : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(redirectUri);
+			if (redirectUriUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri
+			}));
+			if (!await this._isTrusted(redirectUriUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "redirect URI",
+				url: redirectUri,
+				projectId: this.projectId
+			}));
 			const afterCallbackRedirectUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.afterCallbackRedirectUrl);
-			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : new URL(afterCallbackRedirectUrlString, redirectUriUrl);
-			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
-			if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(afterCallbackRedirectUrlString, redirectUriUrl);
+			if (afterCallbackRedirectUrl == null) throw await setupErrorIfHandoffIsOwned(createMalformedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? ""
+			}));
+			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw await setupErrorIfHandoffIsOwned(createUntrustedNestedCrossDomainUrlError({
+				urlDescription: "after-callback redirect URL",
+				url: afterCallbackRedirectUrlString ?? afterCallbackRedirectUrl.toString(),
+				projectId: this.projectId
+			}));
+			await validateHandoffOwnership();
 			await this._redirectTo({
 				url: await this._createCrossDomainAuthRedirectUrl({
 					redirectUri: redirectUriUrl.toString(),
@@ -640,9 +751,16 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		if (currentRefreshTokenId != null) (await this._getSession(void 0, { awaitPendingAuthResolutions: false })).markInvalid();
 		const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
 		if (callbackUrlString == null) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
-		if ((0, _hexclave_shared_dist_utils_urls.isRelative)(callbackUrlString)) throw new Error("Nested cross-domain auth callback URL must be absolute.");
-		const callbackUrl = new URL(callbackUrlString);
-		if (!await this._isTrusted(callbackUrl.toString())) throw new Error(`Nested cross-domain auth callback URL ${callbackUrlString} is not trusted.`);
+		const callbackUrl = (0, _hexclave_shared_dist_utils_urls.isRelative)(callbackUrlString) ? null : (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(callbackUrlString);
+		if (callbackUrl == null) throw createMalformedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString
+		});
+		if (!await this._isTrusted(callbackUrl.toString())) throw createUntrustedNestedCrossDomainUrlError({
+			urlDescription: "callback URL",
+			url: callbackUrlString,
+			projectId: this.projectId
+		});
 		const afterCallbackRedirectUrl = new URL(currentUrl);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
@@ -1016,7 +1134,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		}
 	}
 	_useTokenStore(overrideTokenStoreInit) {
-		(0, _hexclave_shared_dist_utils_react.suspendIfSsr)();
+		(0, ____________utils_react_js.suspendIfSsr)();
 		const cookieHelper = (0, _________cookie_js.createBrowserCookieHelper)();
 		return this._getOrCreateTokenStore(cookieHelper, overrideTokenStoreInit);
 	}
@@ -2142,17 +2260,32 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
 		await session.fetchNewTokens();
-		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				redirect_uri: options.redirectUri,
-				state: options.state,
-				code_challenge: options.codeChallenge,
-				code_challenge_method: "S256",
-				after_callback_redirect_url: options.afterCallbackRedirectUrl
-			})
-		}, session);
+		let response;
+		try {
+			response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					redirect_uri: options.redirectUri,
+					state: options.state,
+					code_challenge: options.codeChallenge,
+					code_challenge_method: "S256",
+					after_callback_redirect_url: options.afterCallbackRedirectUrl
+				})
+			}, session);
+		} catch (error) {
+			if (_hexclave_shared.KnownErrors.RedirectUrlNotWhitelisted.isInstance(error)) {
+				const untrustedUrl = error.constructorArgs[0] ?? options.redirectUri;
+				const untrustedUrlObject = (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(untrustedUrl);
+				throwSetupError(createUntrustedUrlError({
+					message: `Cross-domain auth redirect URL ${untrustedUrlObject == null ? untrustedUrl : `${untrustedUrlObject.origin}${untrustedUrlObject.pathname}`} is not trusted.`,
+					url: untrustedUrl,
+					projectId: this.projectId,
+					cause: error
+				}));
+			}
+			throw error;
+		}
 		if (!response.ok) {
 			const responseBody = await response.text();
 			throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError(`Cross-domain authorization endpoint failed: ${response.status} ${responseBody}`);
@@ -2203,7 +2336,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		} else return (to) => {};
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw new Error(`Redirect URL ${url} is not trusted; should be relative.`);
+		if (!await this._isTrusted(url)) throwSetupError(createUntrustedUrlError({
+			message: `Redirect URL ${url} is not trusted; should be relative.`,
+			url,
+			projectId: this.projectId
+		}));
 		return await this._redirectTo({
 			url,
 			...options
@@ -2248,7 +2385,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw new Error(`Redirect URL ${redirectUrl} is not trusted; should be relative.`);
+		if (!await this._isTrusted(redirectUrl)) throwSetupError(createUntrustedUrlError({
+			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
+			url: redirectUrl,
+			projectId: this.projectId
+		}));
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {
@@ -2361,6 +2502,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async getUser(options) {
 		if (options?.or === "anonymous" && options.includeRestricted === false) throw new Error("Cannot use { or: 'anonymous' } with { includeRestricted: false }. Anonymous users implicitly include restricted users.");
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) await pendingSignOut;
 		this._ensurePersistentTokenStore(options?.tokenStore);
 		const session = await this._getSession(options?.tokenStore);
 		let crud = _hexclave_shared_dist_utils_results.Result.orThrow(await this._currentUserCache.getOrWait([session], "write-only"));
@@ -2393,6 +2536,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		let crud = (0, __common_js.useAsyncCache)(this._currentUserCache, [session], "clientApp.useUser()");
 		const includeAnonymous = options?.or === "anonymous" || options?.or === "anonymous-if-exists[deprecated]";
 		const includeRestricted = options?.includeRestricted === true || includeAnonymous;
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) (0, _hexclave_shared_dist_utils_react.use)(pendingSignOut);
 		if (crud === null || crud.is_anonymous && !includeAnonymous || crud.is_restricted && !includeRestricted) switch (options?.or) {
 			case "redirect":
 				if (!crud?.is_anonymous && crud?.is_restricted) {
@@ -2793,14 +2938,25 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _signOut(session, options) {
 		this._eventTracker?.clearBuffer();
 		this._sessionRecorder?.clearBuffer();
-		await _hexclave_shared_dist_utils_stores.storeLock.withWriteLock(async () => {
+		const previousSignOut = this._pendingSignOut;
+		const signOutOperation = (async () => {
+			await previousSignOut;
 			await this._interface.signOut(session);
 			if (options?.redirectUrl) await this._redirectTo({
 				url: options.redirectUrl,
 				replace: true
 			});
 			else await this._redirectToDefaultAfterSignOut();
-		});
+		})();
+		const signOutBarrier = (async () => {
+			await _hexclave_shared_dist_utils_results.Result.fromPromise(signOutOperation);
+		})();
+		this._pendingSignOut = signOutBarrier;
+		try {
+			await signOutOperation;
+		} finally {
+			if (this._pendingSignOut === signOutBarrier) this._pendingSignOut = null;
+		}
 	}
 	async _redirectToDefaultAfterSignOut() {
 		if (this._urlOptions.afterSignOut != null) {
@@ -3010,5 +3166,6 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 };
 //#endregion
 exports._HexclaveClientAppImplIncomplete = _HexclaveClientAppImplIncomplete;
+exports.stripBrowserActionQueryParam = stripBrowserActionQueryParam;
 
 //# sourceMappingURL=client-app-impl.js.map