@hexclave/tanstack-start 1.0.5 → 1.0.8

package/dist/lib/hexclave-app/apps/implementations/client-app-impl.js

@@ -8,8 +8,8 @@ let _hexclave_shared = require("@hexclave/shared");
 let _hexclave_shared_dist_utils_react = require("@hexclave/shared/dist/utils/react");
 let _hexclave_shared_dist_utils_objects = require("@hexclave/shared/dist/utils/objects");
 let _hexclave_shared_dist_utils_urls = require("@hexclave/shared/dist/utils/urls");
-let _hexclave_shared_dist_utils_strings = require("@hexclave/shared/dist/utils/strings");
 let _hexclave_shared_dist_utils_results = require("@hexclave/shared/dist/utils/results");
+let _hexclave_shared_dist_utils_strings = require("@hexclave/shared/dist/utils/strings");
 let _hexclave_shared_dist_utils_env = require("@hexclave/shared/dist/utils/env");
 let _hexclave_tanstack_start_tanstack_start_server_context = require("@hexclave/tanstack-start/tanstack-start-server-context");
 _hexclave_tanstack_start_tanstack_start_server_context = require_chunk.__toESM(_hexclave_tanstack_start_tanstack_start_server_context);
@@ -18,11 +18,11 @@ let _hexclave_shared_dist_utils_redirect_urls = require("@hexclave/shared/dist/u
 let _hexclave_shared_dist_utils_bytes = require("@hexclave/shared/dist/utils/bytes");
 let ______common_js = require("../../common.js");
 let ______projects_index_js = require("../../projects/index.js");
-let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let _hexclave_shared_dist_sessions = require("@hexclave/shared/dist/sessions");
+let _hexclave_shared_dist_utils_stores = require("@hexclave/shared/dist/utils/stores");
+let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let _hexclave_shared_dist_utils_json = require("@hexclave/shared/dist/utils/json");
 let _hexclave_shared_dist_utils_maps = require("@hexclave/shared/dist/utils/maps");
-let _hexclave_shared_dist_utils_stores = require("@hexclave/shared/dist/utils/stores");
 let _hexclave_shared_dist_utils_turnstile_flow = require("@hexclave/shared/dist/utils/turnstile-flow");
 let _hexclave_shared_dist_utils_uuids = require("@hexclave/shared/dist/utils/uuids");
 let _tanstack_react_router = require("@tanstack/react-router");
@@ -32,7 +32,7 @@ cookie = require_chunk.__toESM(cookie);
 let ____________utils_url_js = require("../../../../utils/url.js");
 let _________auth_js = require("../../../auth.js");
 let _________cookie_js = require("../../../cookie.js");
-let _________env_js = require("../../../env.js");
+let ____________generated_env_js = require("../../../../generated/env.js");
 let ______api_keys_index_js = require("../../api-keys/index.js");
 let ______contact_channels_index_js = require("../../contact-channels/index.js");
 let ______teams_index_js = require("../../teams/index.js");
@@ -509,15 +509,15 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		for (const param of oauthCallbackResponseQueryParams) currentUrl.searchParams.delete(param);
 		return currentUrl.toString();
 	}
-	async _getCurrentRefreshTokenIdIfSignedIn(options) {
-		const tokens = await (await this._getSession(options?.overrideTokenStoreInit, options)).getOrFetchLikelyValidTokens(0, null);
+	async _fetchCurrentRefreshTokenIdIfSignedIn(options) {
+		const tokens = await (await this._getSession(options?.overrideTokenStoreInit, options)).fetchNewTokens();
 		if (tokens?.refreshToken == null) return null;
 		return tokens.accessToken.payload.refresh_token_id;
 	}
 	async _addNestedCrossDomainAuthParamsToRedirectUrl(options) {
 		const targetUrl = new URL(options.url, options.currentUrl);
 		if (targetUrl.origin === options.currentUrl.origin) return options.url;
-		const refreshTokenId = await this._getCurrentRefreshTokenIdIfSignedIn({
+		const refreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({
 			awaitPendingAuthResolutions: options.awaitPendingAuthResolutions,
 			overrideTokenStoreInit: options.overrideTokenStoreInit
 		});
@@ -548,7 +548,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			const afterCallbackRedirectUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.afterCallbackRedirectUrl);
 			const afterCallbackRedirectUrl = afterCallbackRedirectUrlString == null ? redirectUriUrl : new URL(afterCallbackRedirectUrlString, redirectUriUrl);
 			if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
-			if (await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
+			if (await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) !== refreshTokenId) throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
 			await this._redirectTo({
 				url: await this._createCrossDomainAuthRedirectUrl({
 					redirectUri: redirectUriUrl.toString(),
@@ -561,7 +561,9 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			});
 			return true;
 		}
-		if (await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false }) === refreshTokenId) return false;
+		const currentRefreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
+		if (currentRefreshTokenId === refreshTokenId) return false;
+		if (currentRefreshTokenId != null) (await this._getSession(void 0, { awaitPendingAuthResolutions: false })).markInvalid();
 		const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
 		if (callbackUrlString == null) throw new _hexclave_shared_dist_utils_errors.HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
 		if ((0, _hexclave_shared_dist_utils_urls.isRelative)(callbackUrlString)) throw new Error("Nested cross-domain auth callback URL must be absolute.");
@@ -714,6 +716,13 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			accessToken
 		};
 	}
+	_getCurrentBrowserCookieTokenStoreValue(old) {
+		const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
+		return {
+			refreshToken: tokens.refreshToken,
+			accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null)
+		};
+	}
 	get _accessTokenCookieName() {
 		return `hexclave-access`;
 	}
@@ -818,19 +827,12 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	_getBrowserCookieTokenStore() {
 		if (!(0, _hexclave_shared_dist_utils_env.isBrowserLike)()) throw new Error("Cannot use cookie token store on the server!");
 		if (this._storedBrowserCookieTokenStore === null) {
-			const getCurrentValue = (old) => {
-				const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
-				return {
-					refreshToken: tokens.refreshToken,
-					accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null)
-				};
-			};
-			this._storedBrowserCookieTokenStore = new _hexclave_shared_dist_utils_stores.Store(getCurrentValue(null));
+			this._storedBrowserCookieTokenStore = new _hexclave_shared_dist_utils_stores.Store(this._getCurrentBrowserCookieTokenStoreValue(null));
 			let hasSucceededInWriting = true;
 			setInterval(() => {
 				if (hasSucceededInWriting) {
 					const oldValue = this._storedBrowserCookieTokenStore.get();
-					const currentValue = getCurrentValue(oldValue);
+					const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
 					if (!(0, _hexclave_shared_dist_utils_objects.deepPlainEquals)(currentValue, oldValue)) this._storedBrowserCookieTokenStore.set(currentValue);
 				}
 			}, 100);
@@ -856,6 +858,10 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 					else throw e;
 				}
 			});
+		} else {
+			const oldValue = this._storedBrowserCookieTokenStore.get();
+			const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
+			if (!(0, _hexclave_shared_dist_utils_objects.deepPlainEquals)(currentValue, oldValue)) this._storedBrowserCookieTokenStore.set(currentValue);
 		}
 		return this._storedBrowserCookieTokenStore;
 	}
@@ -953,17 +959,17 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 			accessToken: tokenObj.accessToken
 		});
 		session.onAccessTokenChange((newAccessToken) => {
-			tokenStore.update((old) => ({
+			tokenStore.update((old) => _hexclave_shared_dist_sessions.InternalSession.calculateSessionKey(old) === sessionKey ? {
 				...old,
 				accessToken: newAccessToken?.token ?? null
-			}));
+			} : old);
 		});
 		session.onInvalidate(() => {
-			tokenStore.update((old) => ({
+			tokenStore.update((old) => _hexclave_shared_dist_sessions.InternalSession.calculateSessionKey(old) === sessionKey ? {
 				...old,
 				accessToken: null,
 				refreshToken: null
-			}));
+			} : old);
 		});
 		let sessionsBySessionKey = this._sessionsByTokenStoreAndSessionKey.get(tokenStore) ?? /* @__PURE__ */ new Map();
 		this._sessionsByTokenStoreAndSessionKey.set(tokenStore, sessionsBySessionKey);
@@ -1912,17 +1918,17 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	_getBotChallengeSiteKeys() {
 		if (!(0, _hexclave_shared_dist_utils_env.isBrowserLike)()) return null;
-		const visibleSiteKey = _________env_js.envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY;
+		const visibleSiteKey = ____________generated_env_js.envVars.HEXCLAVE_BOT_CHALLENGE_SITE_KEY;
 		if (!visibleSiteKey) {
 			if (!this._botChallengeSiteKeysWarned) {
 				this._botChallengeSiteKeysWarned = true;
-				console.warn("[stack-auth] NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
+				console.warn("[stack-auth] HEXCLAVE_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
 			}
 			return null;
 		}
 		return {
 			visibleSiteKey,
-			invisibleSiteKey: _________env_js.envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey
+			invisibleSiteKey: ____________generated_env_js.envVars.HEXCLAVE_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey
 		};
 	}
 	_getBotChallengeFlowFailure(error) {
@@ -2044,6 +2050,7 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 	}
 	async _createCrossDomainAuthRedirectUrl(options) {
 		const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
+		await session.fetchNewTokens();
 		const response = await this._interface.sendClientRequest("/auth/oauth/cross-domain/authorize", {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
@@ -2153,6 +2160,8 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 		return await this._redirectToHandler("signUp", options);
 	}
 	async redirectToSignOut(options) {
+		const configuredSignOutTarget = this._urlOptions.signOut ?? this._urlOptions.default;
+		if (typeof configuredSignOutTarget !== "string" && configuredSignOutTarget?.type === "hosted") return await this.signOut();
 		return await this._redirectToHandler("signOut", options);
 	}
 	async redirectToEmailVerification(options) {
@@ -2690,9 +2699,27 @@ var _HexclaveClientAppImplIncomplete = class _HexclaveClientAppImplIncomplete {
 				url: options.redirectUrl,
 				replace: true
 			});
-			else await this.redirectToAfterSignOut();
+			else await this._redirectToDefaultAfterSignOut();
 		});
 	}
+	async _redirectToDefaultAfterSignOut() {
+		if (this._urlOptions.afterSignOut != null) {
+			await this.redirectToAfterSignOut({ replace: true });
+			return;
+		}
+		if (this._urlOptions.home != null) {
+			await this.redirectToHome({ replace: true });
+			return;
+		}
+		if (this._urlOptions.default?.type === "hosted" && typeof window !== "undefined") {
+			await this._redirectTo({
+				url: (0, _hexclave_shared_dist_utils_urls.getRelativePart)(new URL(window.location.href)),
+				replace: true
+			});
+			return;
+		}
+		await this.redirectToAfterSignOut({ replace: true });
+	}
 	async signOut(options) {
 		const user = await this.getUser({ tokenStore: options?.tokenStore ?? void 0 });
 		if (user) await user.signOut({ redirectUrl: options?.redirectUrl });