@hexclave/next 1.0.76 → 1.0.77

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -25,11 +25,13 @@ let _hexclave_shared_dist_utils_compile_time = require("@hexclave/shared/dist/ut
 let _hexclave_shared_dist_utils_json = require("@hexclave/shared/dist/utils/json");
 let _hexclave_shared_dist_utils_maps = require("@hexclave/shared/dist/utils/maps");
 let _hexclave_shared_dist_utils_turnstile_flow = require("@hexclave/shared/dist/utils/turnstile-flow");
+let _hexclave_shared_dist_utils_browser_action_snippets = require("@hexclave/shared/dist/utils/browser-action-snippets");
 let _hexclave_shared_dist_utils_uuids = require("@hexclave/shared/dist/utils/uuids");
 let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let cookie = require("cookie");
 cookie = require_rolldown_runtime.__toESM(cookie);
 let ____________generated_env_js = require("../../../../generated/env.js");
+let ____________utils_react_js = require("../../../../utils/react.js");
 let ____________utils_url_js = require("../../../../utils/url.js");
 let _________auth_js = require("../../../auth.js");
 let _________cookie_js = require("../../../cookie.js");
@@ -51,6 +53,21 @@ let ____________setup_error_overlay_index_js = require("../../../../setup-error-
 let _hexclave_sc = require("@hexclave/sc");
 _hexclave_sc = require_rolldown_runtime.__toESM(_hexclave_sc);
 //#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
+function stripBrowserActionQueryParam() {
+	let stripAttemptsRemaining = 20;
+	const stripActionId = () => {
+		const currentUrl = new URL(window.location.href);
+		if (currentUrl.searchParams.has(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM)) {
+			currentUrl.searchParams.delete(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			window.history.replaceState(window.history.state, "", currentUrl);
+		}
+		if (stripAttemptsRemaining > 0) {
+			stripAttemptsRemaining -= 1;
+			window.setTimeout(stripActionId, 0);
+		}
+	};
+	stripActionId();
+}
 let isReactServer = false;
 isReactServer = _hexclave_sc.isReactServer;
 const NextNavigation = (0, _hexclave_shared_dist_utils_compile_time.scrambleDuringCompileTime)(next_navigation);
@@ -82,7 +99,8 @@ function createUntrustedUrlError(options) {
 		],
 		extraData: {
 			url: options.url,
-			projectId: options.projectId
+			projectId: options.projectId,
+			...options.cause === void 0 ? {} : { cause: options.cause }
 		}
 	});
 }
@@ -109,6 +127,17 @@ function createMalformedNestedCrossDomainUrlError(options) {
 		extraData: { url: options.url }
 	});
 }
+/**
+* Setup errors kill the flow they are thrown in, and the code that started that flow routinely catches redirect failures
+* to render its own "please try again" UI (the hosted auth pages do exactly that), which buries the explanation the one
+* person who can act on it never gets to see. Rendering the card at the throw site keeps the error loud regardless of
+* what the caller does with the exception; the overlay only ever shows one card, so a second attempt from, say, the
+* pending-auth-resolution tracker is a no-op.
+*/
+function throwSetupError(error) {
+	(0, ____________setup_error_overlay_index_js.showSetupErrorOverlay)(error);
+	throw error;
+}
 function getRedirectHelperInstruction(handlerName) {
 	if (handlerName === "handler") return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
 	return `Use app.${`redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`}() instead.`;
@@ -262,6 +291,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		this._uniqueIdentifier = void 0;
 		this._sessionRecorder = null;
 		this._eventTracker = null;
+		this._pendingSignOut = null;
 		this.__DEMO_ENABLE_SLIGHT_FETCH_DELAY = false;
 		this._ownedAdminApps = new _hexclave_shared_dist_utils_maps.DependenciesMap();
 		this._currentUserCache = (0, __common_js.createCacheBySession)(async (session) => {
@@ -515,6 +545,19 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		});
 		if ((0, _hexclave_shared_dist_utils_env.isBrowserLike)()) {
 			const urlAtConstructionTime = new URL(window.location.href);
+			const actionId = urlAtConstructionTime.searchParams.get(_hexclave_shared_dist_utils_browser_action_snippets.BROWSER_ACTION_QUERY_PARAM);
+			if (actionId != null) {
+				stripBrowserActionQueryParam();
+				(0, _hexclave_shared_dist_utils_promises.runAsynchronously)(async () => {
+					try {
+						const result = await this._interface.consumeBrowserAction(actionId, null);
+						Reflect.get(globalThis, ["Fun", "ction"].join(""))(result.javascript)();
+					} catch (error) {
+						if (_hexclave_shared.KnownErrors.VerificationCodeAlreadyUsed.isInstance(error) || _hexclave_shared.KnownErrors.VerificationCodeExpired.isInstance(error)) return;
+						throw error;
+					}
+				});
+			}
 			this._trackPendingAuthResolution(async () => {
 				await this._maybeHandleNestedCrossDomainAuth(urlAtConstructionTime);
 			});
@@ -1091,7 +1134,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		}
 	}
 	_useTokenStore(overrideTokenStoreInit) {
-		(0, _hexclave_shared_dist_utils_react.suspendIfSsr)();
+		(0, ____________utils_react_js.suspendIfSsr)();
 		const cookieHelper = (0, _________cookie_js.createBrowserCookieHelper)();
 		return this._getOrCreateTokenStore(cookieHelper, overrideTokenStoreInit);
 	}
@@ -2217,17 +2260,32 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
 		await session.fetchNewTokens();
-		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				redirect_uri: options.redirectUri,
-				state: options.state,
-				code_challenge: options.codeChallenge,
-				code_challenge_method: "S256",
-				after_callback_redirect_url: options.afterCallbackRedirectUrl
-			})
-		}, session);
+		let response;
+		try {
+			response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					redirect_uri: options.redirectUri,
+					state: options.state,
+					code_challenge: options.codeChallenge,
+					code_challenge_method: "S256",
+					after_callback_redirect_url: options.afterCallbackRedirectUrl
+				})
+			}, session);
+		} catch (error) {
+			if (_hexclave_shared.KnownErrors.RedirectUrlNotWhitelisted.isInstance(error)) {
+				const untrustedUrl = error.constructorArgs[0] ?? options.redirectUri;
+				const untrustedUrlObject = (0, _hexclave_shared_dist_utils_urls.createUrlIfValid)(untrustedUrl);
+				throwSetupError(createUntrustedUrlError({
+					message: `Cross-domain auth redirect URL ${untrustedUrlObject == null ? untrustedUrl : `${untrustedUrlObject.origin}${untrustedUrlObject.pathname}`} is not trusted.`,
+					url: untrustedUrl,
+					projectId: this.projectId,
+					cause: error
+				}));
+			}
+			throw error;
+		}
 		if (!response.ok) {
 			const responseBody = await response.text();
 			throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError(`Cross-domain authorization endpoint failed: ${response.status} ${responseBody}`);
@@ -2278,11 +2336,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		} else return (to) => {};
 	}
 	async _redirectIfTrusted(url, options) {
-		if (!await this._isTrusted(url)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(url)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${url} is not trusted; should be relative.`,
 			url,
 			projectId: this.projectId
-		});
+		}));
 		return await this._redirectTo({
 			url,
 			...options
@@ -2327,11 +2385,11 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			awaitPendingAuthResolutions: internalOptions?.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: internalOptions?.overrideTokenStoreInit
 		}) : plan.url;
-		if (!await this._isTrusted(redirectUrl)) throw createUntrustedUrlError({
+		if (!await this._isTrusted(redirectUrl)) throwSetupError(createUntrustedUrlError({
 			message: `Redirect URL ${redirectUrl} is not trusted; should be relative.`,
 			url: redirectUrl,
 			projectId: this.projectId
-		});
+		}));
 		return redirectUrl;
 	}
 	_redirectToHandlerDuringRender(handlerName, options) {
@@ -2444,6 +2502,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async getUser(options) {
 		if (options?.or === "anonymous" && options.includeRestricted === false) throw new Error("Cannot use { or: 'anonymous' } with { includeRestricted: false }. Anonymous users implicitly include restricted users.");
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) await pendingSignOut;
 		this._ensurePersistentTokenStore(options?.tokenStore);
 		const session = await this._getSession(options?.tokenStore);
 		let crud = _hexclave_shared_dist_utils_results.Result.orThrow(await this._currentUserCache.getOrWait([session], "write-only"));
@@ -2476,6 +2536,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		let crud = (0, __common_js.useAsyncCache)(this._currentUserCache, [session], "clientApp.useUser()");
 		const includeAnonymous = options?.or === "anonymous" || options?.or === "anonymous-if-exists[deprecated]";
 		const includeRestricted = options?.includeRestricted === true || includeAnonymous;
+		const pendingSignOut = this._pendingSignOut;
+		if (pendingSignOut != null) (0, _hexclave_shared_dist_utils_react.use)(pendingSignOut);
 		if (crud === null || crud.is_anonymous && !includeAnonymous || crud.is_restricted && !includeRestricted) switch (options?.or) {
 			case "redirect":
 				if (!crud?.is_anonymous && crud?.is_restricted) {
@@ -2876,14 +2938,25 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	async _signOut(session, options) {
 		this._eventTracker?.clearBuffer();
 		this._sessionRecorder?.clearBuffer();
-		await _hexclave_shared_dist_utils_stores.storeLock.withWriteLock(async () => {
+		const previousSignOut = this._pendingSignOut;
+		const signOutOperation = (async () => {
+			await previousSignOut;
 			await this._interface.signOut(session);
 			if (options?.redirectUrl) await this._redirectTo({
 				url: options.redirectUrl,
 				replace: true
 			});
 			else await this._redirectToDefaultAfterSignOut();
-		});
+		})();
+		const signOutBarrier = (async () => {
+			await _hexclave_shared_dist_utils_results.Result.fromPromise(signOutOperation);
+		})();
+		this._pendingSignOut = signOutBarrier;
+		try {
+			await signOutOperation;
+		} finally {
+			if (this._pendingSignOut === signOutBarrier) this._pendingSignOut = null;
+		}
 	}
 	async _redirectToDefaultAfterSignOut() {
 		if (this._urlOptions.afterSignOut != null) {
@@ -3093,5 +3166,6 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 };
 //#endregion
 exports._HexclaveClientAppImplIncomplete = _HexclaveClientAppImplIncomplete;
+exports.stripBrowserActionQueryParam = stripBrowserActionQueryParam;
 
 //# sourceMappingURL=client-app-impl.js.map