@mdbase-dev/connect 0.1.0-beta.82 → 0.1.0-beta.84

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-2NXwGD96iZvxt5iZ6vfV4ZTuoY3PG7RMPOn+wmXEq+K+i06SN/u0vdHtOUb+Mj2p
+sha384-l1syvCOespqx2xGAwlKWRSmphqrCw5zoEJLrsvcdCqadK8gQTQcTZJuGTJ7NtIZm

package/dist/connect.d.ts

@@ -58,8 +58,5 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     defaultApplicationOrigin(): string;
     private pendingKey;
     private storagePrefix;
-    private connectionsKey;
-    private connectionIds;
-    private addConnectionId;
     private emitConnections;
 }

package/dist/connect.js

@@ -3,10 +3,12 @@ import { abortableDelay } from "./async.js";
 import { randomBase64Url } from "./base64.js";
 import { ApplicationIdentityStoreError, IndexedDbApplicationIdentityStore, MemoryApplicationIdentityStore, applicationIdentity, applicationInstallationId, signApplicationAuthorization } from "./application-identity.js";
 import { MdbaseConnection } from "./connection.js";
+import { addConnectionId, connectionIds, removeConnectionId } from "./connection-index.js";
 import { authorizationAbort, declarationIdFromFamilyIdentity } from "./connect-authorization-helpers.js";
 import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
+import { prepareAuthorizationWindow, publishPopupAuthorizationCompletion, waitForPopupAuthorization } from "./popup-authorization.js";
 import { uniqueOperations } from "./operation-helpers.js";
 import { pendingMutationsUseKey, pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
@@ -146,37 +148,28 @@ export class MdbaseConnectInternals {
         }
     }
     async authorize(options = {}) {
-        return withRequestBudget(options, this.timeouts.requestMs, (budget) => this.authorizeWithinBudget({ ...options, signal: budget.signal, timeoutMs: null }));
+        const authorizationTimeout = options.presentation === "popup"
+            ? 10 * 60 * 1_000
+            : this.timeouts.requestMs;
+        return withRequestBudget(options, authorizationTimeout, (budget) => this.authorizeWithinBudget({ ...options, signal: budget.signal, timeoutMs: null }));
     }
     async authorizeWithinBudget(options) {
-        if (typeof location === "undefined" && !this.navigate && !options.openVerification) {
-            throw connectError("browser_required", "Authorization navigation requires a browser environment.");
-        }
         const portableDeclared = typeof this.manifest !== "string"
             && this.manifest.distribution === "portable";
-        const popup = portableDeclared
-            && !options.openVerification
-            && !this.navigate
-            && typeof window !== "undefined"
-            ? window.open("", "mdbase-connect-authorization", "popup,width=620,height=760")
-            : null;
-        let application;
-        try {
-            application = await this.registerWithinBudget(options.signal);
-        }
-        catch (error) {
-            popup?.close();
-            throw error;
-        }
+        const { application, popup } = await prepareAuthorizationWindow({
+            options,
+            portableDeclared,
+            navigate: this.navigate,
+            register: (signal) => this.registerWithinBudget(signal)
+        });
         if (application.distribution === "portable") {
             if (options.openVerification)
                 popup?.close();
             return this.authorizePortable(application, options, options.openVerification ? null : popup);
         }
-        popup?.close();
-        return this.authorizeWeb(application, options);
+        return this.authorizeWeb(application, options, popup);
     }
-    async authorizeWeb(application, options) {
+    async authorizeWeb(application, options, popup) {
         const { verifier, challenge } = await createPkce();
         const state = randomBase64Url(24);
         const authorizationId = crypto.randomUUID();
@@ -231,7 +224,8 @@ export class MdbaseConnectInternals {
             keyHandle,
             authorizationId,
             applicationAgreementPublicKey: grantKey.agreementPublicKey,
-            applicationSigningPublicKey: grantKey.signingPublicKey
+            applicationSigningPublicKey: grantKey.signingPublicKey,
+            ...(options.presentation === "popup" && popup ? { presentation: "popup" } : {})
         };
         this.storage.setItem(this.pendingKey(state), JSON.stringify(pending));
         try {
@@ -260,6 +254,20 @@ export class MdbaseConnectInternals {
                 || body.expires_in <= 0) {
                 throw connectError("invalid_device_authorization_response", "The authorization service returned an invalid authorization response.");
             }
+            if (options.presentation === "popup" && popup) {
+                popup.location.href = body.authorization_uri;
+                return await waitForPopupAuthorization({
+                    storage: this.storage,
+                    storagePrefix: this.storagePrefix(),
+                    state,
+                    pending,
+                    popup,
+                    signal: options.signal,
+                    keyStore: this.keyStore,
+                    connection: (collectionId) => this.connection(collectionId)
+                });
+            }
+            popup?.close();
             if (this.navigate)
                 await this.navigate(body.authorization_uri);
             else if (typeof location !== "undefined")
@@ -270,6 +278,7 @@ export class MdbaseConnectInternals {
             return { kind: "redirecting" };
         }
         catch (error) {
+            popup?.close();
             this.storage.removeItem(this.pendingKey(state));
             await this.keyStore.delete(keyHandle);
             if (options.signal?.aborted) {
@@ -477,10 +486,19 @@ export class MdbaseConnectInternals {
         if (!state) {
             return Promise.reject(connectError("invalid_callback", "Authorization callback is missing its state."));
         }
+        const pending = parseStored(this.storage.getItem(this.pendingKey(state)));
+        const popupAttempt = pending?.presentation === "popup";
         const existing = this.completionPromises.get(state);
         if (existing)
             return existing;
-        const completion = this.performAuthorizationCompletion(callbackUrl, state, signal);
+        const completion = publishPopupAuthorizationCompletion({
+            storage: this.storage,
+            storagePrefix: this.storagePrefix(),
+            state,
+            pending,
+            popupAttempt,
+            completion: this.performAuthorizationCompletion(callbackUrl, state, signal)
+        });
         const shared = completion.finally(() => {
             if (this.completionPromises.get(state) === shared)
                 this.completionPromises.delete(state);
@@ -556,7 +574,7 @@ export class MdbaseConnectInternals {
     }
     connections() {
         const connections = [];
-        for (const collectionId of this.connectionIds()) {
+        for (const collectionId of connectionIds(this.storage, this.storagePrefix())) {
             const info = this.connection(collectionId)?.info();
             if (info)
                 connections.push(info);
@@ -599,7 +617,7 @@ export class MdbaseConnectInternals {
             void this.keyStore.delete(previous.keyHandle).catch(() => undefined);
         }
         this.storage.setItem(this.tokenKey(collectionId), JSON.stringify(token));
-        this.addConnectionId(collectionId);
+        addConnectionId(this.storage, this.storagePrefix(), collectionId);
         this.invalidatedConnections.delete(collectionId);
         this.connectionCache.delete(collectionId);
         this.emitConnections();
@@ -643,10 +661,7 @@ export class MdbaseConnectInternals {
         for (const transport of ["web_push", "fcm"]) {
             this.storage.removeItem(this.notificationKey(collectionId, transport));
         }
-        this.storage.setItem(this.connectionsKey(), JSON.stringify({
-            version: 1,
-            collectionIds: this.connectionIds().filter((id) => id !== collectionId)
-        }));
+        removeConnectionId(this.storage, this.storagePrefix(), collectionId);
         this.connectionCache.delete(collectionId);
         this.emitConnections();
     }
@@ -671,22 +686,6 @@ export class MdbaseConnectInternals {
     storagePrefix() {
         return `mdbase-connect:${this.serverUrl}:${this.manifestSource}`;
     }
-    connectionsKey() {
-        return `${this.storagePrefix()}:connections`;
-    }
-    connectionIds() {
-        const index = parseStored(this.storage.getItem(this.connectionsKey()));
-        return index?.version === 1 && Array.isArray(index.collectionIds)
-            && index.collectionIds.every((collectionId) => typeof collectionId === "string")
-            ? index.collectionIds
-            : [];
-    }
-    addConnectionId(collectionId) {
-        this.storage.setItem(this.connectionsKey(), JSON.stringify({
-            version: 1,
-            collectionIds: [...new Set([...this.connectionIds(), collectionId])]
-        }));
-    }
     emitConnections() {
         const connections = this.connections();
         for (const listener of this.listeners)

package/dist/connection-index.d.ts

@@ -0,0 +1,3 @@
+export declare function connectionIds(storage: Storage, storagePrefix: string): string[];
+export declare function addConnectionId(storage: Storage, storagePrefix: string, collectionId: string): void;
+export declare function removeConnectionId(storage: Storage, storagePrefix: string, collectionId: string): void;

package/dist/connection-index.js

@@ -0,0 +1,20 @@
+import { parseStored } from "./runtime-utils.js";
+export function connectionIds(storage, storagePrefix) {
+    const index = parseStored(storage.getItem(`${storagePrefix}:connections`));
+    return index?.version === 1 && Array.isArray(index.collectionIds)
+        && index.collectionIds.every((collectionId) => typeof collectionId === "string")
+        ? index.collectionIds
+        : [];
+}
+export function addConnectionId(storage, storagePrefix, collectionId) {
+    writeConnectionIds(storage, storagePrefix, [...connectionIds(storage, storagePrefix), collectionId]);
+}
+export function removeConnectionId(storage, storagePrefix, collectionId) {
+    writeConnectionIds(storage, storagePrefix, connectionIds(storage, storagePrefix).filter((id) => id !== collectionId));
+}
+function writeConnectionIds(storage, storagePrefix, ids) {
+    storage.setItem(`${storagePrefix}:connections`, JSON.stringify({
+        version: 1,
+        collectionIds: [...new Set(ids)]
+    }));
+}

package/dist/connection-transport.js

@@ -12,6 +12,7 @@ import { sendAuthoritySyncRequest } from "./authority-sync-request.js";
 import { freshEncryptedRequest } from "./fresh-encrypted-request.js";
 import { isExplicitConnectorBusyResponse, retryExplicitConnectorBusy } from "./transient-retry.js";
 import { probeLoopbackAccess, tokenSupportsDirectAccess } from "./direct-access.js";
+import { decodeHostedOperationResponse } from "./hosted-operation-response.js";
 export class ConnectionTransport {
     serverUrl;
     storage;
@@ -192,17 +193,19 @@ export class ConnectionTransport {
             clearPending: (requestId) => this.clearPendingMutation(requestId),
             retry: (pending, knownRejected) => this.performOperationWithinBudget(operation, input, options, pending, freshReadRetried, connectorBusyRetries + 1, knownRejected)
         });
-        let body;
+        let decoded;
         try {
-            body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned a response that is not valid JSON.");
+            decoded = await decodeHostedOperationResponse(response, token.authority !== undefined);
         }
         catch (cause) {
             if (attempt.pendingMutation)
                 throw unknownMutationOutcome(attempt.requestId, cause);
-            throw connectError("invalid_operation_response", "The collection authority returned a response that is not valid JSON.", { cause });
+            throw cause;
         }
+        const body = decoded.body;
         if (!response.ok) {
-            const error = apiError(body, "operation_failed", "Collection operation failed.", response.status);
+            const error = decoded.httpError
+                ?? apiError(body, "operation_failed", "Collection operation failed.", response.status);
             const recovery = await retryBusy(error);
             if (recovery.retried)
                 return recovery.result;

package/dist/connection.d.ts

@@ -17,6 +17,8 @@ export type MdbaseAuthorizationTarget = {
 };
 export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
     operations?: CollectionOperation[];
+    /** Keep a web application loaded while Connect owns the approval ceremony. */
+    presentation?: "redirect" | "popup";
     /** Choose any compatible collection, or require one exact collection. */
     target?: MdbaseAuthorizationTarget;
     /** App-local location to restore after the authorization callback. */
@@ -28,6 +30,7 @@ export interface MdbaseAuthorizeOptions extends ConnectRequestOptions {
 }
 export interface MdbaseConnectionAuthorizeOptions extends ConnectRequestOptions {
     operations?: CollectionOperation[];
+    presentation?: "redirect" | "popup";
     returnTo?: string;
     onDeviceCode?: (authorization: MdbaseDeviceAuthorization) => void;
     openVerification?: (authorization: MdbaseDeviceAuthorization) => void | Promise<void>;

package/dist/hosted-operation-response.d.ts

@@ -0,0 +1,5 @@
+import { type MdbaseConnectError } from "./errors.js";
+export declare function decodeHostedOperationResponse(response: Response, hosted: boolean): Promise<{
+    body: any;
+    httpError?: MdbaseConnectError;
+}>;

package/dist/hosted-operation-response.js

@@ -0,0 +1,26 @@
+import { connectError, serverConnectError } from "./errors.js";
+import { decodeJsonResponse } from "./runtime-utils.js";
+export async function decodeHostedOperationResponse(response, hosted) {
+    try {
+        return {
+            body: await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned a response that is not valid JSON.")
+        };
+    }
+    catch (cause) {
+        if (!response.ok && hosted && isDefinitiveHostedHttpRejection(response.status)) {
+            return {
+                body: undefined,
+                httpError: serverConnectError("operation_failed", "Collection operation failed.", {
+                    status: response.status,
+                    operationOutcome: "rejected"
+                })
+            };
+        }
+        throw connectError("invalid_operation_response", "The collection authority returned a response that is not valid JSON.", { cause });
+    }
+}
+function isDefinitiveHostedHttpRejection(status) {
+    return status >= 400
+        && status < 500
+        && ![408, 425, 429].includes(status);
+}

package/dist/internal-types.d.ts

@@ -24,7 +24,20 @@ export interface StoredAuthorization {
     authorizationId?: string;
     applicationAgreementPublicKey?: string;
     applicationSigningPublicKey?: string;
+    presentation?: "popup";
 }
+export type StoredAuthorizationCompletion = {
+    version: 1;
+    status: "connected";
+    collectionId: string;
+    returnTo?: string;
+} | {
+    version: 1;
+    status: "failed";
+    code: string;
+    message: string;
+    returnTo?: string;
+};
 export interface StoredToken {
     version: 1;
     accessToken: string;

package/dist/popup-authorization.d.ts

@@ -0,0 +1,31 @@
+import type { JsonObject } from "@mdbase-dev/connect-protocol";
+import type { MdbaseAuthorizeOptions, MdbaseAuthorizationOutcome, MdbaseAuthorizationResult, MdbaseConnection } from "./connection.js";
+import type { GrantKeyStore } from "./crypto.js";
+import type { Application, StoredAuthorization } from "./internal-types.js";
+export declare function prepareAuthorizationWindow(input: {
+    options: MdbaseAuthorizeOptions;
+    portableDeclared: boolean;
+    navigate?: (url: string) => void | Promise<void>;
+    register(signal: AbortSignal): Promise<Application>;
+}): Promise<{
+    application: Application;
+    popup: Window | null;
+}>;
+export declare function waitForPopupAuthorization<Frontmatter extends JsonObject>(input: {
+    storage: Storage;
+    storagePrefix: string;
+    state: string;
+    pending: StoredAuthorization;
+    popup: Window;
+    signal: AbortSignal;
+    keyStore: GrantKeyStore;
+    connection(collectionId: string): MdbaseConnection<Frontmatter> | null;
+}): Promise<MdbaseAuthorizationOutcome<Frontmatter>>;
+export declare function publishPopupAuthorizationCompletion<Frontmatter extends JsonObject>(input: {
+    storage: Storage;
+    storagePrefix: string;
+    state: string;
+    pending: StoredAuthorization | null;
+    popupAttempt: boolean;
+    completion: Promise<MdbaseAuthorizationResult<Frontmatter>>;
+}): Promise<MdbaseAuthorizationResult<Frontmatter>>;

package/dist/popup-authorization.js

@@ -0,0 +1,100 @@
+import { abortableDelay } from "./async.js";
+import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
+import { parseStored } from "./runtime-utils.js";
+export async function prepareAuthorizationWindow(input) {
+    if (typeof location === "undefined" && !input.navigate && !input.options.openVerification) {
+        throw connectError("browser_required", "Authorization navigation requires a browser environment.");
+    }
+    const popupRequested = input.options.presentation === "popup" || input.portableDeclared;
+    const popup = popupRequested
+        && !input.options.openVerification
+        && !input.navigate
+        && typeof window !== "undefined"
+        ? window.open("", "mdbase-connect-authorization", "popup,width=620,height=760")
+        : null;
+    try {
+        return {
+            application: await input.register(input.options.signal),
+            popup
+        };
+    }
+    catch (error) {
+        popup?.close();
+        throw error;
+    }
+}
+export async function waitForPopupAuthorization(input) {
+    const completionKey = authorizationCompletionKey(input.storagePrefix, input.state);
+    try {
+        while (true) {
+            const completion = parseStored(input.storage.getItem(completionKey));
+            if (completion?.version === 1) {
+                input.storage.removeItem(completionKey);
+                if (completion.status === "failed") {
+                    throw serverConnectError(completion.code, completion.message, {
+                        details: completion.returnTo ? { return_to: completion.returnTo } : undefined
+                    });
+                }
+                const connection = input.connection(completion.collectionId);
+                if (!connection) {
+                    throw connectError("invalid_callback", "Authorization completed without a usable saved connection.");
+                }
+                return {
+                    kind: "connected",
+                    connection,
+                    ...(completion.returnTo ? { returnTo: completion.returnTo } : {})
+                };
+            }
+            // Cross-origin opener isolation may report a live Connect window as
+            // closed. Shared callback state, abort, or the request budget owns exit.
+            await abortableDelay(200, input.signal);
+        }
+    }
+    finally {
+        input.popup.close();
+        input.storage.removeItem(completionKey);
+        const pendingKey = `${input.storagePrefix}:pending:${input.state}`;
+        const outstanding = parseStored(input.storage.getItem(pendingKey));
+        if (outstanding?.state === input.state) {
+            input.storage.removeItem(pendingKey);
+            if (input.pending.keyHandle)
+                await input.keyStore.delete(input.pending.keyHandle);
+        }
+    }
+}
+export function publishPopupAuthorizationCompletion(input) {
+    return input.completion.then((result) => {
+        if (input.popupAttempt)
+            writeCompletion(input, {
+                version: 1,
+                status: "connected",
+                collectionId: result.connection.collectionId,
+                ...(result.returnTo ? { returnTo: result.returnTo } : {})
+            });
+        if (input.popupAttempt)
+            closeCallbackWindow();
+        return result;
+    }).catch((error) => {
+        if (input.popupAttempt)
+            writeCompletion(input, {
+                version: 1,
+                status: "failed",
+                code: error instanceof MdbaseConnectError ? error.code : "invalid_callback",
+                message: error instanceof Error ? error.message : "Authorization could not be completed.",
+                ...(input.pending?.returnTo ? { returnTo: input.pending.returnTo } : {})
+            });
+        if (input.popupAttempt)
+            closeCallbackWindow();
+        throw error;
+    });
+}
+function writeCompletion(input, completion) {
+    input.storage.setItem(authorizationCompletionKey(input.storagePrefix, input.state), JSON.stringify(completion));
+}
+function authorizationCompletionKey(storagePrefix, state) {
+    return `${storagePrefix}:completion:${state}`;
+}
+function closeCallbackWindow() {
+    if (typeof window !== "undefined" && typeof window.close === "function")
+        window.close();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.82",
+  "version": "0.1.0-beta.84",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.82"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.84"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",