@sanity/sdk 3.0.0-rc.0 → 3.0.0-rc.2

package/src/auth/authStore.test.ts

@@ -1,7 +1,7 @@
 import {type ClientConfig, createClient, type SanityClient} from '@sanity/client'
 import {type CurrentUser} from '@sanity/types'
 import {NEVER, type Subscription} from 'rxjs'
-import {afterEach, beforeEach, describe, it, vi} from 'vitest'
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest'
 
 import {createSanityInstance} from '../store/createSanityInstance'
 import {AuthStateType} from './authStateType'
@@ -46,6 +46,24 @@ vi.mock('./studioModeAuth', async (importOriginal) => {
 
 vi.mock('./subscribeToStateAndFetchCurrentUser')
 vi.mock('./subscribeToStorageEventsAndSetToken')
+// Mock logger to prevent actual logging during tests
+vi.mock('../utils/logger', async (importOriginal) => {
+  const original = await importOriginal<typeof import('../utils/logger')>()
+  return {
+    ...original,
+    createLogger: vi.fn(() => ({
+      info: vi.fn(),
+      debug: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+      trace: vi.fn(),
+    })),
+  }
+})
+
+// Import createLogger after mocking
+// eslint-disable-next-line import-x/first
+import {createLogger} from '../utils/logger'
 
 describe('authStore', () => {
   // Global beforeEach and afterEach for all tests
@@ -73,6 +91,35 @@ describe('authStore', () => {
       instance?.dispose()
     })
 
+    it('uses staging apiHost when __SANITY_STAGING__ is true and no explicit apiHost', () => {
+      vi.stubGlobal('__SANITY_STAGING__', true)
+
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
+
+      const {options} = authStore.getInitialState(instance, null)
+      expect(options.apiHost).toBe('https://api.sanity.work')
+
+      vi.unstubAllGlobals()
+    })
+
+    it('prefers explicit apiHost over __SANITY_STAGING__', () => {
+      vi.stubGlobal('__SANITY_STAGING__', true)
+
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+        auth: {apiHost: 'https://custom.host'},
+      })
+
+      const {options} = authStore.getInitialState(instance, null)
+      expect(options.apiHost).toBe('https://custom.host')
+
+      vi.unstubAllGlobals()
+    })
+
     it('sets initial options onto state', () => {
       const apiHost = 'test-api-host'
       const callbackUrl = '/login/callback'
@@ -85,6 +132,8 @@ describe('authStore', () => {
       const storageArea = {} as Storage
 
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {
           apiHost,
           callbackUrl,
@@ -113,6 +162,8 @@ describe('authStore', () => {
       const context = {mode: 'test', env: 'staging', orgId: 'abc'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -126,6 +177,8 @@ describe('authStore', () => {
       const expectedContext = {mode: 'test', env: 'staging', orgId: 'abc'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -138,6 +191,8 @@ describe('authStore', () => {
       const initialLocationHref = `https://example.com/?_context=invalid-json`
       const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -154,6 +209,8 @@ describe('authStore', () => {
     it('rejects array _context and falls back to standalone mode', () => {
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(['a', 'b']))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -166,6 +223,8 @@ describe('authStore', () => {
     it('rejects empty object _context and falls back to standalone mode', () => {
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify({}))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -180,6 +239,8 @@ describe('authStore', () => {
       const context = {mode: 'dashboard'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {
           token,
           initialLocationHref,
@@ -195,6 +256,8 @@ describe('authStore', () => {
       const context = {orgId: 'org1'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -207,7 +270,10 @@ describe('authStore', () => {
 
     it('sets to logged in from storage token when NOT in dashboard', () => {
       const storageToken = 'storage-token'
-      instance = createSanityInstance()
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
 
       vi.mocked(getAuthCode).mockReturnValue(null)
       vi.mocked(getTokenFromStorage).mockReturnValue(storageToken)
@@ -222,6 +288,8 @@ describe('authStore', () => {
       const context = {mode: 'dashboard'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -234,7 +302,10 @@ describe('authStore', () => {
     })
 
     it('sets the state to logged out when no token, code, or context', () => {
-      instance = createSanityInstance()
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
 
       vi.mocked(getAuthCode).mockReturnValue(null)
       vi.mocked(getTokenFromStorage).mockReturnValue(null)
@@ -256,8 +327,10 @@ describe('authStore', () => {
       vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(studioToken)
 
       instance = createSanityInstance({
-        studio: {projectId},
-        auth: {storageArea: mockStorage},
+        projectId,
+        dataset: 'd',
+        studio: {},
+        auth: {storageArea: mockStorage}, // Provide mock storage
       })
 
       const {authState, options} = authStore.getInitialState(instance, null)
@@ -266,6 +339,54 @@ describe('authStore', () => {
       expect(options.authMethod).toBe('localstorage')
     })
 
+    it('logs auth initialized in logged out state when no token available', () => {
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
+
+      vi.mocked(getAuthCode).mockReturnValue(null)
+      vi.mocked(getTokenFromStorage).mockReturnValue(null)
+      vi.mocked(getTokenFromLocation).mockReturnValue(null)
+
+      const {authState} = authStore.getInitialState(instance, null)
+      expect(authState.type).toBe(AuthStateType.LOGGED_OUT)
+      // Logger should have been called
+      expect(createLogger).toHaveBeenCalled()
+    })
+
+    it('logs when auth initialized with storage token', () => {
+      const storageToken = 'storage-token'
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
+
+      vi.mocked(getAuthCode).mockReturnValue(null)
+      vi.mocked(getTokenFromStorage).mockReturnValue(storageToken)
+      vi.mocked(getTokenFromLocation).mockReturnValue(null)
+
+      const {authState} = authStore.getInitialState(instance, null)
+      expect(authState).toMatchObject({type: AuthStateType.LOGGED_IN, token: storageToken})
+      // Logger should have been called
+      expect(createLogger).toHaveBeenCalled()
+    })
+
+    it('logs when auth initialized with logging in state', () => {
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
+
+      vi.mocked(getAuthCode).mockReturnValue('test-code')
+      vi.mocked(getTokenFromLocation).mockReturnValue(null)
+
+      const {authState} = authStore.getInitialState(instance, null)
+      expect(authState.type).toBe(AuthStateType.LOGGING_IN)
+      // Logger should have been called
+      expect(createLogger).toHaveBeenCalled()
+    })
+
     it('checks for cookie auth during initialize when studio config is provided and no studio token exists', () => {
       const projectId = 'studio-project'
       const studioStorageKey = `__studio_auth_token_${projectId}`
@@ -278,7 +399,9 @@ describe('authStore', () => {
       vi.mocked(checkForCookieAuth).mockResolvedValue(true)
 
       instance = createSanityInstance({
-        studio: {projectId},
+        projectId,
+        dataset: 'd',
+        studio: {},
         auth: {storageArea: mockStorage},
       })
 
@@ -299,6 +422,8 @@ describe('authStore', () => {
       }
 
       instance = createSanityInstance({
+        projectId: 'studio-project',
+        dataset: 'production',
         studio: {
           auth: {token: mockTokenSource},
         },
@@ -310,13 +435,15 @@ describe('authStore', () => {
       expect(getStudioTokenFromLocalStorage).not.toHaveBeenCalled()
     })
 
-    it('resolves to studio mode when studio config is provided', () => {
+    it('resolves to studio mode when studio config is provided (without studioMode flag)', () => {
       instance = createSanityInstance({
+        projectId: 'studio-project',
+        dataset: 'production',
         studio: {},
       })
 
       const {authState} = authStore.getInitialState(instance, null)
-      // Without tokenSource, falls back to localStorage discovery
+      // Without tokenSource, falls back to localStorage discovery like studioMode
       expect(authState.type).toBe(AuthStateType.LOGGED_OUT)
       expect(getStudioTokenFromLocalStorage).toHaveBeenCalled()
     })
@@ -327,6 +454,8 @@ describe('authStore', () => {
       const mockTokenSource = {subscribe: mockSubscribe}
 
       instance = createSanityInstance({
+        projectId: 'studio-project',
+        dataset: 'production',
         studio: {
           auth: {token: mockTokenSource},
         },
@@ -349,6 +478,8 @@ describe('authStore', () => {
       const mockTokenSource = {subscribe: mockSubscribe}
 
       instance = createSanityInstance({
+        projectId: 'studio-project',
+        dataset: 'production',
         studio: {
           authenticated: true,
           auth: {token: mockTokenSource},
@@ -375,6 +506,8 @@ describe('authStore', () => {
       const mockTokenSource = {subscribe: mockSubscribe}
 
       instance = createSanityInstance({
+        projectId: 'studio-project',
+        dataset: 'production',
         studio: {
           authenticated: false,
           auth: {token: mockTokenSource},
@@ -395,7 +528,10 @@ describe('authStore', () => {
       const storageToken = 'regular-storage-token'
       vi.mocked(getTokenFromStorage).mockReturnValue(storageToken)
 
-      instance = createSanityInstance()
+      instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
+      })
 
       const {authState, options} = authStore.getInitialState(instance, null)
       expect(getStudioTokenFromLocalStorage).not.toHaveBeenCalled()
@@ -407,6 +543,8 @@ describe('authStore', () => {
     it('sets to logging in if getTokenFromLocation returns a token', () => {
       const initialLocationHref = 'https://example.com/#token=hash-token'
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -461,6 +599,8 @@ describe('authStore', () => {
 
     it('subscribes to state and storage events and unsubscribes on dispose', () => {
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {storageArea: mockLocalStorage},
       })
 
@@ -485,6 +625,8 @@ describe('authStore', () => {
 
     it('does not subscribe to storage events when not using storage area', () => {
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {storageArea: undefined},
       })
 
@@ -498,6 +640,35 @@ describe('authStore', () => {
       expect(stateUnsubscribe).toHaveBeenCalled()
       expect(storageEventsUnsubscribe).not.toHaveBeenCalled()
     })
+
+    it('logs when checking for cookie auth in studio mode', async () => {
+      const projectId = 'studio-project'
+      const mockStorage = {
+        getItem: vi.fn(),
+        setItem: vi.fn(),
+        removeItem: vi.fn(),
+      } as unknown as Storage
+      vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(null)
+      vi.mocked(checkForCookieAuth).mockResolvedValue(true)
+
+      instance = createSanityInstance({
+        projectId,
+        dataset: 'd',
+        studio: {},
+        auth: {storageArea: mockStorage},
+      })
+
+      // Trigger store initialization
+      getAuthState(instance)
+
+      // Wait for async cookie check
+      await vi.waitFor(() => {
+        expect(checkForCookieAuth).toHaveBeenCalledWith(projectId, expect.any(Function))
+      })
+
+      // Logger should have been called during initialization
+      expect(createLogger).toHaveBeenCalled()
+    })
   })
 
   describe('getCurrentUserState', () => {
@@ -525,7 +696,7 @@ describe('authStore', () => {
         return NEVER.subscribe()
       })
 
-      instance = createSanityInstance()
+      instance = createSanityInstance({projectId: 'p', dataset: 'd'})
 
       const {getCurrent} = getCurrentUserState(instance)
 
@@ -534,7 +705,7 @@ describe('authStore', () => {
     })
 
     it('returns null otherwise', () => {
-      instance = createSanityInstance()
+      instance = createSanityInstance({projectId: 'p', dataset: 'd'})
       const {getCurrent} = getCurrentUserState(instance)
       expect(getCurrent()).toBe(null)
     })
@@ -550,6 +721,8 @@ describe('authStore', () => {
     it('returns the token if logged in', () => {
       const token = 'hard-coded-token'
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {token},
       })
       const tokenState = getTokenState(instance)
@@ -560,7 +733,7 @@ describe('authStore', () => {
     })
 
     it('returns null otherwise', () => {
-      instance = createSanityInstance()
+      instance = createSanityInstance({projectId: 'p', dataset: 'd'})
 
       const tokenState = getTokenState(instance)
       expect(tokenState.getCurrent()).toBe(null)
@@ -578,7 +751,7 @@ describe('authStore', () => {
     })
 
     it('returns the default login url', () => {
-      instance = createSanityInstance()
+      instance = createSanityInstance({projectId: 'p', dataset: 'd'})
 
       const loginUrlState = getLoginUrlState(instance)
       expect(loginUrlState.getCurrent()).toBe(
@@ -596,6 +769,8 @@ describe('authStore', () => {
 
     it('returns the current state in `authState`', () => {
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {token: 'hard-coded-token'},
       })
 
@@ -626,6 +801,8 @@ describe('authStore', () => {
       const context = {orgId: 'initial-org-id'}
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 
@@ -642,6 +819,8 @@ describe('authStore', () => {
       const authCode = 'test-auth-code'
 
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {
           clientFactory: () => mockClient as unknown as SanityClient,
           initialLocationHref, // Set initial context
@@ -670,6 +849,8 @@ describe('authStore', () => {
       const context = {mode: 'test'} // No orgId
       const initialLocationHref = `https://example.com/?_context=${encodeURIComponent(JSON.stringify(context))}`
       instance = createSanityInstance({
+        projectId: 'p',
+        dataset: 'd',
         auth: {initialLocationHref},
       })
 

package/src/auth/authStore.ts

@@ -5,6 +5,8 @@ import {type AuthConfig, type AuthProvider} from '../config/authConfig'
 import {bindActionGlobally} from '../store/createActionBinder'
 import {createStateSourceAction} from '../store/createStateSourceAction'
 import {defineStore} from '../store/defineStore'
+import {getStagingApiHost} from '../utils/getStagingApiHost'
+import {getAuthLogger} from './authLogger'
 import {resolveAuthMode} from './authMode'
 import {AuthStateType} from './authStateType'
 import {type AuthStrategyOptions} from './authStrategy'
@@ -101,8 +103,17 @@ export const authStore = defineStore<AuthStoreState>({
   name: 'Auth',
 
   getInitialState(instance) {
+    const logger = getAuthLogger(instance)
+
+    logger.debug('Initializing auth store', {
+      hasProvidedToken: !!instance.config.auth?.token,
+      hasCustomProviders: !!(
+        instance.config.auth?.providers && instance.config.auth.providers.length > 0
+      ),
+    })
+
     const {
-      apiHost,
+      apiHost: configApiHost,
       callbackUrl,
       providers: customProviders,
       token: providedToken,
@@ -110,6 +121,7 @@ export const authStore = defineStore<AuthStoreState>({
       initialLocationHref = getDefaultLocation(),
     } = instance.config.auth ?? {}
 
+    const apiHost = configApiHost ?? getStagingApiHost()
     const authConfig = instance.config.auth ?? {}
 
     // Build login URL (used by standalone mode, but always computed for the
@@ -132,7 +144,7 @@ export const authStore = defineStore<AuthStoreState>({
 
     const strategyOptions: AuthStrategyOptions = {
       authConfig,
-      projectId: instance.config.studio?.projectId,
+      projectId: instance.config.projectId,
       initialLocationHref,
       clientFactory,
       tokenSource: instance.config.studio?.auth?.token,
@@ -151,6 +163,12 @@ export const authStore = defineStore<AuthStoreState>({
         break
     }
 
+    logger.debug('Auth state initialized', {
+      authStateType: result.authState.type,
+      mode,
+      authMethod: result.authMethod,
+    })
+
     return {
       authState: result.authState,
       dashboardContext: result.dashboardContext,
@@ -170,10 +188,14 @@ export const authStore = defineStore<AuthStoreState>({
   },
 
   initialize(context) {
+    const logger = getAuthLogger(context.instance)
+
     const initialLocationHref =
       context.state.get().options?.initialLocationHref ?? getDefaultLocation()
     const mode = resolveAuthMode(context.instance.config, initialLocationHref)
 
+    logger.debug('Setting up auth subscriptions', {mode})
+
     let initResult
     switch (mode) {
       case 'studio':
@@ -191,7 +213,10 @@ export const authStore = defineStore<AuthStoreState>({
       tokenRefresherRunning = true
     }
 
-    return initResult.dispose
+    return () => {
+      logger.debug('Cleaning up auth subscriptions')
+      initResult.dispose()
+    }
   },
 })
 
@@ -269,27 +294,34 @@ export const getIsInDashboardState = bindActionGlobally(
  * Used internally by the Comlink token refresh.
  * @internal
  */
-export const setAuthToken = bindActionGlobally(authStore, ({state}, token: string | null) => {
-  const currentAuthState = state.get().authState
-  if (token) {
-    // Update state only if the new token is different or currently logged out
-    if (currentAuthState.type !== AuthStateType.LOGGED_IN || currentAuthState.token !== token) {
-      const currentUser =
-        currentAuthState.type === AuthStateType.LOGGED_IN ? currentAuthState.currentUser : null
-      const preservedLastTokenRefresh =
-        currentAuthState.type === AuthStateType.LOGGED_IN
-          ? currentAuthState.lastTokenRefresh
-          : undefined
-      state.set('setToken', {
-        authState: createLoggedInAuthState(token, currentUser, preservedLastTokenRefresh),
-      })
-    }
-  } else {
-    // Handle setting token to null (logging out)
-    if (currentAuthState.type !== AuthStateType.LOGGED_OUT) {
-      state.set('setToken', {
-        authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: false},
-      })
+export const setAuthToken = bindActionGlobally(
+  authStore,
+  ({state, instance}, token: string | null) => {
+    const logger = getAuthLogger(instance)
+
+    const currentAuthState = state.get().authState
+    if (token) {
+      // Update state only if the new token is different or currently logged out
+      if (currentAuthState.type !== AuthStateType.LOGGED_IN || currentAuthState.token !== token) {
+        logger.info('Setting auth token')
+        const currentUser =
+          currentAuthState.type === AuthStateType.LOGGED_IN ? currentAuthState.currentUser : null
+        const preservedLastTokenRefresh =
+          currentAuthState.type === AuthStateType.LOGGED_IN
+            ? currentAuthState.lastTokenRefresh
+            : undefined
+        state.set('setToken', {
+          authState: createLoggedInAuthState(token, currentUser, preservedLastTokenRefresh),
+        })
+      }
+    } else {
+      // Handle setting token to null (logging out)
+      if (currentAuthState.type !== AuthStateType.LOGGED_OUT) {
+        logger.info('Clearing auth token')
+        state.set('setToken', {
+          authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: false},
+        })
+      }
     }
-  }
-})
+  },
+)