@hexclave/tanstack-start 1.0.3 → 1.0.6

package/dist/esm/lib/{stack-app → hexclave-app}/apps/implementations/client-app-impl.js

@@ -4,7 +4,7 @@ import React, { useCallback, useMemo } from "react";
 import { HexclaveClientInterface, KnownErrors } from "@hexclave/shared";
 import { suspend, suspendIfSsr, use } from "@hexclave/shared/dist/utils/react";
 import { deepPlainEquals, omit } from "@hexclave/shared/dist/utils/objects";
-import { createUrlIfValid, isRelative } from "@hexclave/shared/dist/utils/urls";
+import { createUrlIfValid, getRelativePart, isRelative } from "@hexclave/shared/dist/utils/urls";
 import { Result } from "@hexclave/shared/dist/utils/results";
 import { deindent, mergeScopeStrings } from "@hexclave/shared/dist/utils/strings";
 import { isBrowserLike } from "@hexclave/shared/dist/utils/env";
@@ -12,13 +12,13 @@ import * as tanstackStartServerContext from "@hexclave/tanstack-start/tanstack-s
 import { clientVersion, createCache, createCacheBySession, createEmptyTokenStore, getAnalyticsBaseUrl, getDefaultExtraRequestHeaders, getDefaultProjectId, getDefaultPublishableClientKey, getUrls, resolveApiUrls, resolveConstructorOptions, useAsyncCache } from "./common.js";
 import { getTrustedParentDomain, validateRedirectUrl } from "@hexclave/shared/dist/utils/redirect-urls";
 import { decodeBase32, decodeBase64, encodeBase32, encodeBase64 } from "@hexclave/shared/dist/utils/bytes";
-import { stackAppInternalsSymbol } from "../../common.js";
+import { hexclaveAppInternalsSymbol } from "../../common.js";
 import { adminProjectCreateOptionsToCrud } from "../../projects/index.js";
-import { WebAuthnError, startAuthentication, startRegistration } from "@simplewebauthn/browser";
 import { InternalSession } from "@hexclave/shared/dist/sessions";
+import { Store, storeLock } from "@hexclave/shared/dist/utils/stores";
+import { WebAuthnError, startAuthentication, startRegistration } from "@simplewebauthn/browser";
 import { parseJson } from "@hexclave/shared/dist/utils/json";
 import { DependenciesMap } from "@hexclave/shared/dist/utils/maps";
-import { Store, storeLock } from "@hexclave/shared/dist/utils/stores";
 import { BotChallengeExecutionFailedError, BotChallengeUserCancelledError, withBotChallengeFlow } from "@hexclave/shared/dist/utils/turnstile-flow";
 import { generateUuid } from "@hexclave/shared/dist/utils/uuids";
 import * as TanStackRouter from "@tanstack/react-router";
@@ -26,7 +26,7 @@ import * as cookie from "cookie";
 import { constructRedirectUrl } from "../../../../utils/url.js";
 import { callOAuthCallback, getNewOAuthProviderOrScopeUrl } from "../../../auth.js";
 import { createBrowserCookieHelper, createCookieHelper, createPlaceholderCookieHelper, deleteCookie, deleteCookieClient, getCookieClient, isSecure, saveVerifierAndState, setOrDeleteCookie, setOrDeleteCookieClient } from "../../../cookie.js";
-import { envVars } from "../../../env.js";
+import { envVars } from "../../../../generated/env.js";
 import { apiKeyCreationOptionsToCrud } from "../../api-keys/index.js";
 import { contactChannelCreateOptionsToCrud, contactChannelUpdateOptionsToCrud } from "../../contact-channels/index.js";
 import { teamCreateOptionsToCrud, teamUpdateOptionsToCrud } from "../../teams/index.js";
@@ -38,7 +38,7 @@ import { subscribeSessionRefresh } from "./session-refresh-subscription.js";
 import { SessionRecorder, analyticsOptionsFromJson, analyticsOptionsToJson } from "./session-replay.js";
 import { mountDevTool } from "../../../../dev-tool/index.js";
 
-//#region src/lib/stack-app/apps/implementations/client-app-impl.ts
+//#region src/lib/hexclave-app/apps/implementations/client-app-impl.ts
 const prefetchedCrossDomainHandoffTtlMs = 3300 * 1e3;
 const nestedCrossDomainAuthQueryParams = {
 	refreshTokenId: "stack_nested_cross_domain_auth_refresh_token_id",
@@ -104,7 +104,7 @@ function getTanStackStartRequestHeader(name) {
 async function getServerRequestHost() {
 	return getTanStackStartRequestHeader("host");
 }
-var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
+var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	static {
 		this.LazyStackAdminAppImpl = { value: void 0 };
 	}
@@ -375,7 +375,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		this._sessionsByTokenStoreAndSessionKey = /* @__PURE__ */ new WeakMap();
 		this._botChallengeSiteKeysWarned = false;
 		const resolvedOptions = resolveConstructorOptions(options);
-		if (!_StackClientAppImplIncomplete.LazyStackAdminAppImpl.value) throw new HexclaveAssertionError("Admin app implementation not initialized. Did you import the _StackClientApp from stack-app/apps/implementations/index.ts? You can't import it directly from ./apps/implementations/client-app-impl.ts as that causes a circular dependency (see the comment at _LazyStackAdminAppImpl for more details).");
+		if (!_HexclaveClientAppImplIncomplete.LazyStackAdminAppImpl.value) throw new HexclaveAssertionError("Admin app implementation not initialized. Did you import the _HexclaveClientApp from hexclave-app/apps/implementations/index.ts? You can't import it directly from ./apps/implementations/client-app-impl.ts as that causes a circular dependency (see the comment at _LazyHexclaveAdminAppImpl for more details).");
 		this._options = resolvedOptions;
 		this._extraOptions = extraOptions;
 		const projectId = resolvedOptions.projectId ?? getDefaultProjectId();
@@ -436,7 +436,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			});
 			this._eventTracker.start();
 		}
-		if (isBrowserLike() && this._isOAuthCallbackUrlHosted() && this._currentUrlLooksLikeStackOAuthCallback()) this._trackPendingAuthResolution(async () => {
+		if (isBrowserLike() && (this._isOAuthCallbackUrlHosted() || this._currentUrlLooksLikeNestedCrossDomainOAuthCallback()) && this._currentUrlLooksLikeHexclaveOAuthCallback()) this._trackPendingAuthResolution(async () => {
 			if (isBrowserLike()) await this.callOAuthCallback({ dontWarnAboutMissingQueryParams: true });
 		});
 		if (isBrowserLike()) this._trackPendingAuthResolution(async () => {
@@ -484,12 +484,17 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		const currentUrl = new URL(window.location.href);
 		return currentUrl.searchParams.has("code") && currentUrl.searchParams.has("state") || currentUrl.searchParams.has("errorCode") && currentUrl.searchParams.has("message");
 	}
-	_currentUrlLooksLikeStackOAuthCallback() {
+	_currentUrlLooksLikeHexclaveOAuthCallback() {
 		if (typeof window === "undefined") return false;
 		const currentUrl = new URL(window.location.href);
 		const state = currentUrl.searchParams.get("state");
 		if (!currentUrl.searchParams.has("code") || state == null) return false;
-		return getCookieClient(`stack-oauth-outer-${state}`) != null;
+		return getCookieClient(`stack-oauth-outer-${state}`) != null || currentUrl.searchParams.has(nestedCrossDomainAuthQueryParams.refreshTokenId);
+	}
+	_currentUrlLooksLikeNestedCrossDomainOAuthCallback() {
+		if (typeof window === "undefined") return false;
+		const currentUrl = new URL(window.location.href);
+		return currentUrl.searchParams.has("code") && currentUrl.searchParams.has("state") && currentUrl.searchParams.has(nestedCrossDomainAuthQueryParams.refreshTokenId);
 	}
 	_getOAuthCallbackRedirectUri() {
 		if (!this._isOAuthCallbackUrlHosted()) return this.urls.oauthCallback;
@@ -498,15 +503,15 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		for (const param of oauthCallbackResponseQueryParams) currentUrl.searchParams.delete(param);
 		return currentUrl.toString();
 	}
-	async _getCurrentRefreshTokenIdIfSignedIn(options) {
-		const tokens = await (await this._getSession(options?.overrideTokenStoreInit, options)).getOrFetchLikelyValidTokens(0, null);
+	async _fetchCurrentRefreshTokenIdIfSignedIn(options) {
+		const tokens = await (await this._getSession(options?.overrideTokenStoreInit, options)).fetchNewTokens();
 		if (tokens?.refreshToken == null) return null;
 		return tokens.accessToken.payload.refresh_token_id;
 	}
 	async _addNestedCrossDomainAuthParamsToRedirectUrl(options) {
 		const targetUrl = new URL(options.url, options.currentUrl);
 		if (targetUrl.origin === options.currentUrl.origin) return options.url;
-		const refreshTokenId = await this._getCurrentRefreshTokenIdIfSignedIn({
+		const refreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({
 			awaitPendingAuthResolutions: options.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: options.overrideTokenStoreInit
 		});
@@ -537,7 +542,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			const afterCallbackRedirectUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.afterCallbackRedirectUrl);
 			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : new URL(afterCallbackRedirectUrlString, redirectUriUrl);
 			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
-			if (await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
 			await this._redirectTo({
 				url: await this._createCrossDomainAuthRedirectUrl({
 					redirectUri: redirectUriUrl.toString(),
@@ -550,7 +555,9 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			});
 			return true;
 		}
-		if (await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) === refreshTokenId) return false;
+		const currentRefreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
+		if (currentRefreshTokenId === refreshTokenId) return false;
+		if (currentRefreshTokenId != null) (await this._getSession(void 0, { awaitPendingAuthResolutions: false })).markInvalid();
 		const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
 		if (callbackUrlString == null) throw new HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
 		if (isRelative(callbackUrlString)) throw new Error("Nested cross-domain auth callback URL must be absolute.");
@@ -559,20 +566,11 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		const afterCallbackRedirectUrl = new URL(currentUrl);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
 		afterCallbackRedirectUrl.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
-		const { state: newState, codeChallenge: newCodeChallenge } = await this._getNestedCrossDomainAuthParamsForRedirect();
-		const nestedRedirectUri = new URL(this._getOAuthCallbackRedirectUri(), currentUrl);
-		nestedRedirectUri.searchParams.delete(nestedCrossDomainAuthQueryParams.refreshTokenId);
-		nestedRedirectUri.searchParams.delete(nestedCrossDomainAuthQueryParams.callbackUrl);
-		for (const param of [
-			"after_auth_return_to",
-			crossDomainAuthQueryParams.marker,
-			crossDomainAuthQueryParams.state,
-			crossDomainAuthQueryParams.codeChallenge,
-			crossDomainAuthQueryParams.afterCallbackRedirectUrl
-		]) {
-			const value = currentUrl.searchParams.get(param);
-			if (value != null && !nestedRedirectUri.searchParams.has(param)) nestedRedirectUri.searchParams.set(param, value);
-		}
+		const nestedHandoffSourceUrl = new URL(currentUrl);
+		nestedHandoffSourceUrl.searchParams.delete(crossDomainAuthQueryParams.state);
+		nestedHandoffSourceUrl.searchParams.delete(crossDomainAuthQueryParams.codeChallenge);
+		const { state: newState, codeChallenge: newCodeChallenge } = await this._getCrossDomainHandoffParamsForRedirect(nestedHandoffSourceUrl);
+		const nestedRedirectUri = new URL(currentUrl);
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.refreshTokenId, refreshTokenId);
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.redirectUri, nestedRedirectUri.toString());
 		callbackUrl.searchParams.set(nestedCrossDomainAuthQueryParams.state, newState);
@@ -585,9 +583,6 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		});
 		return true;
 	}
-	async _getNestedCrossDomainAuthParamsForRedirect() {
-		return await saveVerifierAndState();
-	}
 	/**
 	* Cloudflare workers does not allow use of randomness on the global scope (on which the Stack app is probably
 	* initialized). For that reason, we generate the unique identifier lazily when it is first needed instead of in the
@@ -715,6 +710,13 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			accessToken
 		};
 	}
+	_getCurrentBrowserCookieTokenStoreValue(old) {
+		const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
+		return {
+			refreshToken: tokens.refreshToken,
+			accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null)
+		};
+	}
 	get _accessTokenCookieName() {
 		return `hexclave-access`;
 	}
@@ -819,19 +821,12 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 	_getBrowserCookieTokenStore() {
 		if (!isBrowserLike()) throw new Error("Cannot use cookie token store on the server!");
 		if (this._storedBrowserCookieTokenStore === null) {
-			const getCurrentValue = (old) => {
-				const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
-				return {
-					refreshToken: tokens.refreshToken,
-					accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null)
-				};
-			};
-			this._storedBrowserCookieTokenStore = new Store(getCurrentValue(null));
+			this._storedBrowserCookieTokenStore = new Store(this._getCurrentBrowserCookieTokenStoreValue(null));
 			let hasSucceededInWriting = true;
 			setInterval(() => {
 				if (hasSucceededInWriting) {
 					const oldValue = this._storedBrowserCookieTokenStore.get();
-					const currentValue = getCurrentValue(oldValue);
+					const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
 					if (!deepPlainEquals(currentValue, oldValue)) this._storedBrowserCookieTokenStore.set(currentValue);
 				}
 			}, 100);
@@ -857,6 +852,10 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 					else throw e;
 				}
 			});
+		} else {
+			const oldValue = this._storedBrowserCookieTokenStore.get();
+			const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
+			if (!deepPlainEquals(currentValue, oldValue)) this._storedBrowserCookieTokenStore.set(currentValue);
 		}
 		return this._storedBrowserCookieTokenStore;
 	}
@@ -954,17 +953,17 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			accessToken: tokenObj.accessToken
 		});
 		session.onAccessTokenChange((newAccessToken) => {
-			tokenStore.update((old) => ({
+			tokenStore.update((old) => InternalSession.calculateSessionKey(old) === sessionKey ? {
 				...old,
 				accessToken: newAccessToken?.token ?? null
-			}));
+			} : old);
 		});
 		session.onInvalidate(() => {
-			tokenStore.update((old) => ({
+			tokenStore.update((old) => InternalSession.calculateSessionKey(old) === sessionKey ? {
 				...old,
 				accessToken: null,
 				refreshToken: null
-			}));
+			} : old);
 		});
 		let sessionsBySessionKey = this._sessionsByTokenStoreAndSessionKey.get(tokenStore) ?? /* @__PURE__ */ new Map();
 		this._sessionsByTokenStoreAndSessionKey.set(tokenStore, sessionsBySessionKey);
@@ -1896,7 +1895,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		};
 	}
 	_getOwnedAdminApp(forProjectId, session) {
-		if (!this._ownedAdminApps.has([session, forProjectId])) this._ownedAdminApps.set([session, forProjectId], new _StackClientAppImplIncomplete.LazyStackAdminAppImpl.value({
+		if (!this._ownedAdminApps.has([session, forProjectId])) this._ownedAdminApps.set([session, forProjectId], new _HexclaveClientAppImplIncomplete.LazyStackAdminAppImpl.value({
 			baseUrl: this._interface.options.getBaseUrl(),
 			projectId: forProjectId,
 			tokenStore: null,
@@ -1913,17 +1912,17 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 	}
 	_getBotChallengeSiteKeys() {
 		if (!isBrowserLike()) return null;
-		const visibleSiteKey = envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY;
+		const visibleSiteKey = envVars.HEXCLAVE_BOT_CHALLENGE_SITE_KEY;
 		if (!visibleSiteKey) {
 			if (!this._botChallengeSiteKeysWarned) {
 				this._botChallengeSiteKeysWarned = true;
-				console.warn("[stack-auth] NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
+				console.warn("[stack-auth] HEXCLAVE_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
 			}
 			return null;
 		}
 		return {
 			visibleSiteKey,
-			invisibleSiteKey: envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey
+			invisibleSiteKey: envVars.HEXCLAVE_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey
 		};
 	}
 	_getBotChallengeFlowFailure(error) {
@@ -2045,6 +2044,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 	}
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
+		await session.fetchNewTokens();
 		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@@ -2154,6 +2154,8 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		return await this._redirectToHandler("signUp", options);
 	}
 	async redirectToSignOut(options) {
+		const configuredSignOutTarget = this._urlOptions.signOut ?? this._urlOptions.default;
+		if (typeof configuredSignOutTarget !== "string" && configuredSignOutTarget?.type === "hosted") return await this.signOut();
 		return await this._redirectToHandler("signOut", options);
 	}
 	async redirectToEmailVerification(options) {
@@ -2641,7 +2643,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 		if (this._currentUrlLooksLikeOAuthCallback()) this._ensurePersistentTokenStore();
 		let oauthCallbackRedirectUri = this._getOAuthCallbackRedirectUri();
 		const currentUrl = new URL(window.location.href);
-		if (currentUrl.searchParams.get(crossDomainAuthQueryParams.marker) === "1") {
+		if (currentUrl.searchParams.get(crossDomainAuthQueryParams.marker) === "1" || currentUrl.searchParams.has(nestedCrossDomainAuthQueryParams.refreshTokenId)) {
 			currentUrl.searchParams.delete("code");
 			currentUrl.searchParams.delete("state");
 			oauthCallbackRedirectUri = currentUrl.toString();
@@ -2691,9 +2693,27 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 				url: options.redirectUrl,
 				replace: true
 			});
-			else await this.redirectToAfterSignOut();
+			else await this._redirectToDefaultAfterSignOut();
 		});
 	}
+	async _redirectToDefaultAfterSignOut() {
+		if (this._urlOptions.afterSignOut != null) {
+			await this.redirectToAfterSignOut({ replace: true });
+			return;
+		}
+		if (this._urlOptions.home != null) {
+			await this.redirectToHome({ replace: true });
+			return;
+		}
+		if (this._urlOptions.default?.type === "hosted" && typeof window !== "undefined") {
+			await this._redirectTo({
+				url: getRelativePart(new URL(window.location.href)),
+				replace: true
+			});
+			return;
+		}
+		await this.redirectToAfterSignOut({ replace: true });
+	}
 	async signOut(options) {
 		const user = await this.getUser({ tokenStore: options?.tokenStore ?? void 0 });
 		if (user) await user.signOut({ redirectUrl: options?.redirectUrl });
@@ -2784,7 +2804,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 	async _refreshOwnedProjects(session) {
 		await this._ownedProjectsCache.refresh([session]);
 	}
-	static get [stackAppInternalsSymbol]() {
+	static get [hexclaveAppInternalsSymbol]() {
 		return { fromClientJson: (json) => {
 			const providedCheckString = JSON.stringify(omit(json, []));
 			const existing = allClientApps.get(json.uniqueIdentifier);
@@ -2797,7 +2817,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 				return clientApp;
 			}
 			const { analytics, ...restJson } = omit(json, ["uniqueIdentifier"]);
-			return new _StackClientAppImplIncomplete({
+			return new _HexclaveClientAppImplIncomplete({
 				...restJson,
 				analytics: analyticsOptionsFromJson(analytics)
 			}, {
@@ -2806,7 +2826,7 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 			});
 		} };
 	}
-	get [stackAppInternalsSymbol]() {
+	get [hexclaveAppInternalsSymbol]() {
 		return {
 			toClientJson: () => {
 				if (typeof this._redirectMethod !== "string") throw new HexclaveAssertionError("Cannot serialize to JSON from an application with a non-string redirect method");
@@ -2864,5 +2884,5 @@ var _StackClientAppImplIncomplete = class _StackClientAppImplIncomplete {
 };
 
 //#endregion
-export { _StackClientAppImplIncomplete };
+export { _HexclaveClientAppImplIncomplete };
 //# sourceMappingURL=client-app-impl.js.map