@lovable.dev/cloud-auth-js 1.1.3-dev.16 → 1.1.3-dev.17

package/README.md

@@ -1,6 +1,6 @@
 # @lovable.dev/cloud-auth-js
 
-OAuth authentication library for Lovable projects.
+Legacy OAuth broker library for Lovable projects.
 
 ## Installation
 
@@ -10,49 +10,6 @@ npm install @lovable.dev/cloud-auth-js
 
 ## Usage
 
-### Better Auth
-
-Client setup:
-
-```typescript
-import { newAuthClient } from "@lovable.dev/cloud-auth-js";
-
-export const authClient = newAuthClient();
-export const { signIn, signOut } = authClient;
-```
-
-TanStack Start route setup:
-
-```typescript
-import { createFileRoute } from "@tanstack/react-router";
-import { registerAuthRoutes } from "@lovable.dev/cloud-auth-js/server";
-
-export const Route = createFileRoute("/api/auth/$")(registerAuthRoutes());
-```
-
-Sign in with the Lovable OAuth provider:
-
-```typescript
-await authClient.signInWithLovable({
-  // Redirects here after successful authentication.
-  callbackURL: "/account",
-});
-```
-
-`signInWithLovable` uses redirect mode outside an iframe and popup mode in live preview. Pass `mode: "redirect"` or `mode: "popup"` to force a flow.
-
-Server env vars:
-
-| Name                           | Description                                  |
-| ------------------------------ | -------------------------------------------- |
-| `LOVABLE_TENANT_ID`            | Lovable tenant ID.                           |
-| `LOVABLE_OAUTH_CLIENT_ID`      | Lovable OAuth client ID.                     |
-| `LOVABLE_OAUTH_CLIENT_SECRET`  | Lovable OAuth client secret.                 |
-| `LOVABLE_AUTH_SECRET`          | Secret used to sign auth cookies and tokens. |
-| `LOVABLE_AUTH_TRUSTED_ORIGINS` | Comma-separated trusted origins.             |
-
-### Legacy OAuth broker
-
 ```typescript
 import { createLovableAuth } from "@lovable.dev/cloud-auth-js";
 import { supabase } from "./supabase/client";
@@ -75,7 +32,7 @@ if (result.error) {
 await supabase.auth.setSession(result.tokens);
 ```
 
-## Legacy API
+## API
 
 ### `createLovableAuth(config?)`
 
@@ -86,7 +43,7 @@ Creates a Lovable auth instance.
 | Option                  | Type       | Default                         | Description                           |
 | ----------------------- | ---------- | ------------------------------- | ------------------------------------- |
 | `oauthBrokerUrl`        | `string`   | `"/~oauth/initiate"`            | OAuth broker initiate URL             |
-| `supportedOAuthOrigins` | `string[]` | `["https://oauth.lovable.app"]` | Allowed origins for OAuth postMessage |
+| `supportedOAuthOrigins` | `string[]` | `["https://oauth.lovable.app", "https://lovable.dev"]` | Allowed origins for OAuth postMessage |
 
 ### `signInWithOAuth(provider, options?)`
 
@@ -96,7 +53,7 @@ Initiates OAuth sign-in flow.
 
 | Parameter              | Type                     | Description                                                |
 | ---------------------- | ------------------------ | ---------------------------------------------------------- |
-| `provider`             | `"google" \| "apple"`    | OAuth provider                                             |
+| `provider`             | `"google" \| "apple" \| "microsoft" \| "lovable"` | OAuth provider                                             |
 | `options.redirect_uri` | `string`                 | Custom redirect URI (defaults to `window.location.origin`) |
 | `options.extraParams`  | `Record<string, string>` | Additional params to send to the OAuth broker              |
 

package/dist/index.cjs

@@ -20,8 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
-  createLovableAuth: () => createLovableAuth,
-  newAuthClient: () => newAuthClient
+  createLovableAuth: () => createLovableAuth
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -195,432 +194,11 @@ function createAuth(config = {}) {
   };
 }
 
-// src/client.ts
-var import_plugins = require("better-auth/client/plugins");
-var import_react = require("better-auth/react");
-var DEFAULT_PROVIDER_ID = "lovable";
-var POPUP_NAME = "lovable-oauth";
-var POPUP_CHECK_INTERVAL_MS2 = 500;
-var DEFAULT_POPUP_TIMEOUT_MS = 12e4;
-var POPUP_MESSAGE_TYPE = "lovable:better-auth-popup-complete";
-var POPUP_START_PATH = "lovable-popup/start";
-var POPUP_COMPLETE_PATH = "lovable-popup/complete";
-var SESSION_EVENT_TYPE = "lovable-auth:session";
-function isLivePreview() {
-  if (typeof window === "undefined")
-    return false;
-  try {
-    return window.self !== window.top;
-  } catch {
-    return true;
-  }
-}
-function resolveSignInMode(mode) {
-  if (mode === "popup" || mode === "redirect")
-    return mode;
-  return isLivePreview() ? "popup" : "redirect";
-}
-function resolveBaseURL(configured) {
-  if (typeof window === "undefined")
-    return configured;
-  return window.location.origin;
-}
-function resolveAuthBasePath(configured) {
-  const basePath = typeof configured === "string" && configured ? configured : "/api/auth";
-  return `/${basePath.replace(/^\/+|\/+$/g, "")}`;
-}
-function resolveCallbackURL(callbackURL) {
-  if (typeof window === "undefined")
-    return callbackURL;
-  if (!callbackURL)
-    return window.location.href;
-  try {
-    return new URL(callbackURL, window.location.href).toString();
-  } catch {
-    return callbackURL;
-  }
-}
-function generatePopupId() {
-  if (typeof crypto !== "undefined" && "randomUUID" in crypto)
-    return crypto.randomUUID();
-  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
-}
-function resolveSameOriginCallbackURL(callbackURL) {
-  const resolved = resolveCallbackURL(callbackURL);
-  if (typeof window === "undefined" || !resolved)
-    return resolved ?? null;
-  try {
-    const url = new URL(resolved);
-    if (url.origin !== window.location.origin)
-      return null;
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
-function buildPopupCompleteURL(baseURL, basePath, popupId, returnTo) {
-  if (typeof window === "undefined")
-    return null;
-  try {
-    const url = new URL(`${basePath}/${POPUP_COMPLETE_PATH}`, baseURL ?? window.location.origin);
-    url.searchParams.set("popupId", popupId);
-    if (returnTo)
-      url.searchParams.set("returnTo", returnTo);
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
-function buildPopupStartURL(baseURL, basePath, providerId, options, callbackURL, errorCallbackURL, newUserCallbackURL) {
-  if (typeof window === "undefined")
-    return null;
-  try {
-    const url = new URL(`${basePath}/${POPUP_START_PATH}`, baseURL ?? window.location.origin);
-    url.searchParams.set("providerId", providerId);
-    url.searchParams.set("callbackURL", callbackURL);
-    url.searchParams.set("errorCallbackURL", errorCallbackURL);
-    url.searchParams.set("newUserCallbackURL", newUserCallbackURL);
-    if (options.requestSignUp !== void 0)
-      url.searchParams.set("requestSignUp", String(options.requestSignUp));
-    for (const scope of options.scopes ?? []) {
-      url.searchParams.append("scope", scope);
-    }
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
-function notifySessionChanged(client, session) {
-  const store = client.$store;
-  store?.notify?.("$sessionSignal");
-  if (typeof window === "undefined" || typeof CustomEvent === "undefined")
-    return;
-  window.dispatchEvent(new CustomEvent(SESSION_EVENT_TYPE, { detail: { session } }));
-}
-async function getSessionAfterPopupComplete(client, fallback) {
-  const session = await client.getSession?.();
-  const data = session?.data ?? fallback ?? null;
-  notifySessionChanged(client, data);
-  return data;
-}
-function toError(error, fallback) {
-  if (error instanceof Error)
-    return error;
-  if (error && typeof error === "object" && "message" in error) {
-    const message = error.message;
-    if (typeof message === "string" && message)
-      return new Error(message);
-  }
-  if (typeof error === "string" && error)
-    return new Error(error);
-  return new Error(fallback);
-}
-function getRedirectUrl(data) {
-  if (!data || typeof data !== "object")
-    return null;
-  const fields = data;
-  for (const key of ["url", "redirectURL", "redirectUrl"]) {
-    const value = fields[key];
-    if (typeof value === "string" && value)
-      return value;
-  }
-  return null;
-}
-function getPopupFeatures(configuredFeatures) {
-  if (configuredFeatures)
-    return configuredFeatures;
-  const width = 520;
-  const height = 720;
-  const left = typeof window === "undefined" ? 0 : window.screenX + (window.outerWidth - width) / 2;
-  const top = typeof window === "undefined" ? 0 : window.screenY + (window.outerHeight - height) / 2;
-  return `popup=yes,width=${width},height=${height},left=${left},top=${top}`;
-}
-function openSyncPopup(features) {
-  if (typeof window === "undefined")
-    return null;
-  try {
-    return window.open("about:blank", POPUP_NAME, features);
-  } catch {
-    return null;
-  }
-}
-function navigatePopup(popup, url) {
-  try {
-    popup.location.href = url;
-    return true;
-  } catch {
-    return false;
-  }
-}
-function popupReturnedToOpenerOrigin(popup) {
-  if (typeof window === "undefined")
-    return false;
-  try {
-    const href = popup.location.href;
-    if (!href || href === "about:blank")
-      return false;
-    return new URL(href).origin === window.location.origin;
-  } catch {
-    return false;
-  }
-}
-async function waitForPopupSession(client, popup, timeoutMs) {
-  const startedAt = Date.now();
-  return new Promise((resolve, reject) => {
-    const interval = setInterval(async () => {
-      if (popup.closed) {
-        clearInterval(interval);
-        reject(new Error("Sign in was cancelled"));
-        return;
-      }
-      if (Date.now() - startedAt > timeoutMs) {
-        clearInterval(interval);
-        popup.close();
-        reject(new Error("OAuth timed out waiting for session"));
-        return;
-      }
-      if (popupReturnedToOpenerOrigin(popup)) {
-        clearInterval(interval);
-        try {
-          const session = await client.getSession?.();
-          popup.close();
-          resolve(session?.data ?? null);
-        } catch (error) {
-          popup.close();
-          reject(toError(error, "Failed to read session after popup completed"));
-        }
-        return;
-      }
-      try {
-        const session = await client.getSession?.();
-        if (session?.data) {
-          clearInterval(interval);
-          popup.close();
-          resolve(session.data);
-        }
-      } catch {
-        return;
-      }
-    }, POPUP_CHECK_INTERVAL_MS2);
-  });
-}
-function isPopupMessageData(data) {
-  return Boolean(data && typeof data === "object" && data.type === POPUP_MESSAGE_TYPE);
-}
-async function waitForPopupMessage(client, popup, popupId, timeoutMs) {
-  const startedAt = Date.now();
-  return new Promise((resolve, reject) => {
-    let interval;
-    let timeout;
-    const cleanup = () => {
-      window.removeEventListener("message", onMessage);
-      if (interval)
-        clearInterval(interval);
-      if (timeout)
-        clearTimeout(timeout);
-    };
-    const onMessage = (event) => {
-      if (event.origin !== window.location.origin)
-        return;
-      if (event.source && event.source !== popup)
-        return;
-      if (!isPopupMessageData(event.data) || event.data.popupId !== popupId)
-        return;
-      cleanup();
-      popup.close();
-      if (event.data.error) {
-        reject(new Error(event.data.error));
-        return;
-      }
-      client.getSession?.().then((session) => session?.data ?? event.data.session ?? null).then((session) => {
-        notifySessionChanged(client, session);
-        resolve(session);
-      }).catch((error) => {
-        reject(toError(error, "Failed to read session after popup completed"));
-      });
-    };
-    window.addEventListener("message", onMessage);
-    interval = setInterval(() => {
-      if (popup.closed) {
-        cleanup();
-        getSessionAfterPopupComplete(client, null).then((session) => {
-          if (session) {
-            resolve(session);
-            return;
-          }
-          reject(new Error("Sign in was cancelled"));
-        }).catch(() => {
-          reject(new Error("Sign in was cancelled"));
-        });
-      }
-    }, POPUP_CHECK_INTERVAL_MS2);
-    timeout = setTimeout(
-      () => {
-        cleanup();
-        popup.close();
-        reject(new Error("OAuth timed out waiting for popup message"));
-      },
-      Math.max(0, timeoutMs - (Date.now() - startedAt))
-    );
-  });
-}
-function newAuthClient(options = {}) {
-  const {
-    providerId = DEFAULT_PROVIDER_ID,
-    signInMode = "auto",
-    popupFeatures,
-    popupTimeoutMs = DEFAULT_POPUP_TIMEOUT_MS,
-    ...betterAuthOptions
-  } = options;
-  const baseURL = resolveBaseURL(betterAuthOptions.baseURL);
-  const basePath = resolveAuthBasePath(betterAuthOptions.basePath);
-  const client = (0, import_react.createAuthClient)({
-    ...betterAuthOptions,
-    baseURL,
-    plugins: [(0, import_plugins.genericOAuthClient)(), ...betterAuthOptions.plugins ?? []]
-  });
-  const oauthClient = client;
-  const signInWithLovable = async (signInOptions = {}) => {
-    const mode = resolveSignInMode(signInOptions.mode ?? signInMode);
-    const usePopupMessage = mode === "popup" && isLivePreview();
-    if (mode === "popup" && typeof window === "undefined") {
-      return {
-        data: null,
-        error: new Error("Popup sign in requires a browser"),
-        mode
-      };
-    }
-    const features = getPopupFeatures(signInOptions.popupFeatures ?? popupFeatures);
-    const popup = mode === "popup" ? openSyncPopup(features) : null;
-    if (mode === "popup" && !popup) {
-      return { data: null, error: new Error("Popup was blocked"), mode };
-    }
-    const popupId = usePopupMessage ? generatePopupId() : void 0;
-    const callbackURL = popupId ? resolveSameOriginCallbackURL(signInOptions.callbackURL) : resolveCallbackURL(signInOptions.callbackURL);
-    const errorCallbackURL = popupId && signInOptions.errorCallbackURL ? resolveSameOriginCallbackURL(signInOptions.errorCallbackURL) : resolveCallbackURL(signInOptions.errorCallbackURL) ?? callbackURL;
-    const newUserCallbackURL = popupId && signInOptions.newUserCallbackURL ? resolveSameOriginCallbackURL(signInOptions.newUserCallbackURL) : resolveCallbackURL(signInOptions.newUserCallbackURL) ?? callbackURL;
-    if (popupId && (!callbackURL || !errorCallbackURL || !newUserCallbackURL)) {
-      popup?.close();
-      return {
-        data: null,
-        error: new Error("Iframe popup sign in requires same-origin callback URLs"),
-        mode
-      };
-    }
-    if (popupId && callbackURL && errorCallbackURL && newUserCallbackURL && popup) {
-      const popupCallbackURL = buildPopupCompleteURL(baseURL, basePath, popupId, callbackURL);
-      const popupErrorCallbackURL = buildPopupCompleteURL(baseURL, basePath, popupId, errorCallbackURL);
-      const popupNewUserCallbackURL = buildPopupCompleteURL(baseURL, basePath, popupId, newUserCallbackURL);
-      const popupStartURL = popupCallbackURL && popupErrorCallbackURL && popupNewUserCallbackURL ? buildPopupStartURL(
-        baseURL,
-        basePath,
-        providerId,
-        signInOptions,
-        popupCallbackURL,
-        popupErrorCallbackURL,
-        popupNewUserCallbackURL
-      ) : null;
-      if (!popupStartURL) {
-        popup.close();
-        return {
-          data: null,
-          error: new Error("Failed to build iframe popup sign-in URL"),
-          mode
-        };
-      }
-      if (!navigatePopup(popup, popupStartURL)) {
-        popup.close();
-        return {
-          data: null,
-          error: new Error("Failed to navigate popup"),
-          mode
-        };
-      }
-      try {
-        const timeoutMs = signInOptions.popupTimeoutMs ?? popupTimeoutMs;
-        const session = await waitForPopupMessage(oauthClient, popup, popupId, timeoutMs);
-        return { data: session, error: null, mode };
-      } catch (error) {
-        return { data: null, error: toError(error, "Sign in failed"), mode };
-      }
-    }
-    const result = await oauthClient.signIn.oauth2({
-      providerId,
-      callbackURL,
-      errorCallbackURL: signInOptions.errorCallbackURL,
-      newUserCallbackURL: signInOptions.newUserCallbackURL,
-      scopes: signInOptions.scopes,
-      requestSignUp: signInOptions.requestSignUp,
-      disableRedirect: mode === "popup"
-    });
-    if (result.error) {
-      popup?.close();
-      return {
-        data: null,
-        error: toError(result.error, "Sign in failed"),
-        mode
-      };
-    }
-    if (mode === "redirect") {
-      return { data: result.data ?? null, error: null, mode };
-    }
-    const redirectUrl = getRedirectUrl(result.data);
-    if (!redirectUrl || !popup) {
-      popup?.close();
-      return {
-        data: null,
-        error: new Error("No OAuth redirect URL received"),
-        mode
-      };
-    }
-    if (!navigatePopup(popup, redirectUrl)) {
-      popup.close();
-      return {
-        data: null,
-        error: new Error("Failed to navigate popup"),
-        mode
-      };
-    }
-    try {
-      const timeoutMs = signInOptions.popupTimeoutMs ?? popupTimeoutMs;
-      const session = await waitForPopupSession(oauthClient, popup, timeoutMs);
-      return { data: session, error: null, mode };
-    } catch (error) {
-      return { data: null, error: toError(error, "Sign in failed"), mode };
-    }
-  };
-  return new Proxy(client, {
-    get(target, prop, receiver) {
-      if (prop === "signInWithLovable")
-        return signInWithLovable;
-      return Reflect.get(target, prop, receiver);
-    },
-    getOwnPropertyDescriptor(target, prop) {
-      if (prop === "signInWithLovable") {
-        return {
-          configurable: true,
-          enumerable: true,
-          value: signInWithLovable,
-          writable: false
-        };
-      }
-      return Reflect.getOwnPropertyDescriptor(target, prop);
-    },
-    has(target, prop) {
-      return prop === "signInWithLovable" || Reflect.has(target, prop);
-    },
-    ownKeys(target) {
-      return [.../* @__PURE__ */ new Set([...Reflect.ownKeys(target), "signInWithLovable"])];
-    }
-  });
-}
-
 // src/index.ts
 function createLovableAuth(config = {}) {
   return createAuth(config);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createLovableAuth,
-  newAuthClient
+  createLovableAuth
 });

package/dist/index.d.cts

@@ -1,5 +1,3 @@
-import { createAuthClient } from 'better-auth/react';
-
 type OAuthProvider = "google" | "apple" | "microsoft" | "lovable";
 interface LovableAuthConfig {
     oauthBrokerUrl?: string;
@@ -30,54 +28,6 @@ interface LovableAuth {
     signInWithOAuth: (provider: OAuthProvider, opts?: SignInWithOAuthOptions) => Promise<SignInWithOAuthResult>;
 }
 
-type LovableAuthSignInMode = "auto" | "redirect" | "popup";
-type BetterAuthClientOptions = NonNullable<Parameters<typeof createAuthClient>[0]>;
-type NewAuthClientOptions = BetterAuthClientOptions & {
-    providerId?: string;
-    signInMode?: LovableAuthSignInMode;
-    popupFeatures?: string;
-    popupTimeoutMs?: number;
-};
-interface SignInWithLovableOptions {
-    callbackURL?: string;
-    errorCallbackURL?: string;
-    newUserCallbackURL?: string;
-    scopes?: string[];
-    requestSignUp?: boolean;
-    mode?: LovableAuthSignInMode;
-    popupFeatures?: string;
-    popupTimeoutMs?: number;
-}
-type BetterAuthResult<T = unknown> = {
-    data: T;
-    error: null;
-    mode: Exclude<LovableAuthSignInMode, "auto">;
-} | {
-    data: null;
-    error: Error;
-    mode: Exclude<LovableAuthSignInMode, "auto">;
-};
-type OAuth2Client = {
-    signIn: {
-        oauth2: (body: Record<string, unknown>) => Promise<{
-            data?: unknown;
-            error?: unknown;
-        }>;
-        [key: string]: unknown;
-    };
-    getSession?: () => Promise<{
-        data?: unknown;
-        error?: unknown;
-    }>;
-};
-interface LovableBetterAuthClient extends OAuth2Client {
-    signInWithLovable: (options?: SignInWithLovableOptions) => Promise<BetterAuthResult>;
-    signOut?: (...args: unknown[]) => unknown;
-    useSession?: unknown;
-    [key: string]: unknown;
-}
-declare function newAuthClient(options?: NewAuthClientOptions): LovableBetterAuthClient;
-
 declare function createLovableAuth(config?: LovableAuthConfig): LovableAuth;
 
-export { type BetterAuthClientOptions, type BetterAuthResult, type LovableAuth, type LovableAuthConfig, type LovableAuthSignInMode, type LovableBetterAuthClient, type NewAuthClientOptions, type OAuthProvider, type OAuthTokens, type SignInWithLovableOptions, type SignInWithOAuthOptions, type SignInWithOAuthResult, createLovableAuth, newAuthClient };
+export { type LovableAuth, type LovableAuthConfig, type OAuthProvider, type OAuthTokens, type SignInWithOAuthOptions, type SignInWithOAuthResult, createLovableAuth };

package/dist/index.d.ts

@@ -1,5 +1,3 @@
-import { createAuthClient } from 'better-auth/react';
-
 type OAuthProvider = "google" | "apple" | "microsoft" | "lovable";
 interface LovableAuthConfig {
     oauthBrokerUrl?: string;
@@ -30,54 +28,6 @@ interface LovableAuth {
     signInWithOAuth: (provider: OAuthProvider, opts?: SignInWithOAuthOptions) => Promise<SignInWithOAuthResult>;
 }
 
-type LovableAuthSignInMode = "auto" | "redirect" | "popup";
-type BetterAuthClientOptions = NonNullable<Parameters<typeof createAuthClient>[0]>;
-type NewAuthClientOptions = BetterAuthClientOptions & {
-    providerId?: string;
-    signInMode?: LovableAuthSignInMode;
-    popupFeatures?: string;
-    popupTimeoutMs?: number;
-};
-interface SignInWithLovableOptions {
-    callbackURL?: string;
-    errorCallbackURL?: string;
-    newUserCallbackURL?: string;
-    scopes?: string[];
-    requestSignUp?: boolean;
-    mode?: LovableAuthSignInMode;
-    popupFeatures?: string;
-    popupTimeoutMs?: number;
-}
-type BetterAuthResult<T = unknown> = {
-    data: T;
-    error: null;
-    mode: Exclude<LovableAuthSignInMode, "auto">;
-} | {
-    data: null;
-    error: Error;
-    mode: Exclude<LovableAuthSignInMode, "auto">;
-};
-type OAuth2Client = {
-    signIn: {
-        oauth2: (body: Record<string, unknown>) => Promise<{
-            data?: unknown;
-            error?: unknown;
-        }>;
-        [key: string]: unknown;
-    };
-    getSession?: () => Promise<{
-        data?: unknown;
-        error?: unknown;
-    }>;
-};
-interface LovableBetterAuthClient extends OAuth2Client {
-    signInWithLovable: (options?: SignInWithLovableOptions) => Promise<BetterAuthResult>;
-    signOut?: (...args: unknown[]) => unknown;
-    useSession?: unknown;
-    [key: string]: unknown;
-}
-declare function newAuthClient(options?: NewAuthClientOptions): LovableBetterAuthClient;
-
 declare function createLovableAuth(config?: LovableAuthConfig): LovableAuth;
 
-export { type BetterAuthClientOptions, type BetterAuthResult, type LovableAuth, type LovableAuthConfig, type LovableAuthSignInMode, type LovableBetterAuthClient, type NewAuthClientOptions, type OAuthProvider, type OAuthTokens, type SignInWithLovableOptions, type SignInWithOAuthOptions, type SignInWithOAuthResult, createLovableAuth, newAuthClient };
+export { type LovableAuth, type LovableAuthConfig, type OAuthProvider, type OAuthTokens, type SignInWithOAuthOptions, type SignInWithOAuthResult, createLovableAuth };