@sanity/sdk 3.2.0 → 3.3.0-rc.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { D as getAuthLogger, E as REQUEST_TAG_PREFIX, O as configureLogging$1, S as AuthStateType, T as DEFAULT_BASE, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, k as createLogger, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-BI4D8HhJ.js";
+import { D as getAuthLogger, E as REQUEST_TAG_PREFIX, O as configureLogging$1, S as AuthStateType, T as DEFAULT_BASE, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, k as createLogger, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-QDrJNTM4.js";
 import { c as isReleasePerspective, d as isMediaLibraryResource, i as bindActionGlobally, l as isCanvasResource, n as bindActionByResource, o as defineStore, r as bindActionByResourceAndPerspective, t as createStateSourceAction, u as isDatasetResource } from "./createStateSourceAction-DdAhEfnZ.js";
-import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-BcRmCiYi.js";
+import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-CIhX5ppJ.js";
 import { r as omitProperty, t as isDeepEqual } from "./object-CxXlSVg7.js";
 import { n as setCleanupTimeout } from "./setCleanupTimeout-BiM6q1KF.js";
 import { t as _defineProperty } from "./defineProperty-Bho9Ngsi.js";
@@ -303,101 +303,6 @@ function observeOrganizationVerificationState(instance, projectIds) {
 	}), distinctUntilChanged((prev, curr) => prev.error === curr.error));
 }
 /**
-* @public
-*/
-const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
-	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey } = state.get().options;
-	if (providedToken) return logger.debug("Skipping auth callback - token already provided"), !1;
-	let { authState } = state.get();
-	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping auth callback - token exchange already in progress"), !1;
-	let cleanedUrl = getCleanedUrl(locationHref), tokenFromUrl = getTokenFromLocation(locationHref);
-	if (tokenFromUrl) return logger.info("Auth token found in URL, logging in"), state.set("setTokenFromUrl", { authState: createLoggedInAuthState(tokenFromUrl, null) }), cleanedUrl;
-	let authCode = getAuthCode(callbackUrl, locationHref);
-	if (!authCode) return logger.debug("No auth code found in callback URL"), !1;
-	let parsedUrl = new URL(locationHref), dashboardContext = {};
-	try {
-		let contextParam = parsedUrl.searchParams.get("_context");
-		if (contextParam) {
-			let parsedContext = JSON.parse(contextParam);
-			parsedContext && typeof parsedContext == "object" && (delete parsedContext.sid, dashboardContext = parsedContext, logger.debug("Dashboard context parsed from callback URL", { hasDashboardContext: !0 }));
-		}
-	} catch (err) {
-		logger.warn("Failed to parse dashboard context from callback URL", { error: err });
-	}
-	logger.info("Exchanging auth code for token"), state.set("exchangeSessionForToken", {
-		authState: {
-			type: "logging-in",
-			isExchangingToken: !0
-		},
-		dashboardContext
-	});
-	try {
-		let client = clientFactory({
-			apiVersion: DEFAULT_API_VERSION,
-			requestTagPrefix: REQUEST_TAG_PREFIX,
-			useProjectHostname: !1,
-			useCdn: !1,
-			...apiHost && { apiHost }
-		});
-		logger.debug("Fetching token from auth endpoint");
-		let { token } = await client.request({
-			method: "GET",
-			url: "/auth/fetch",
-			query: { sid: authCode },
-			tag: "fetch-token"
-		});
-		return logger.info("Auth token obtained successfully, user logged in"), storageArea?.setItem(storageKey, JSON.stringify({ token })), state.set("setToken", { authState: createLoggedInAuthState(token, null) }), cleanedUrl;
-	} catch (error) {
-		return logger.error("Failed to exchange auth code for token", { error }), state.set("exchangeSessionForTokenError", { authState: {
-			type: "error",
-			error
-		} }), cleanedUrl;
-	}
-}), logout = bindActionGlobally(authStore, async ({ state, instance }) => {
-	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey } = state.get().options;
-	if (providedToken) {
-		logger.debug("Skipping logout - token is statically provided");
-		return;
-	}
-	let { authState } = state.get();
-	if (authState.type === "logged-out" && authState.isDestroyingSession) {
-		logger.debug("Skipping logout - already in progress");
-		return;
-	}
-	let token = authState.type === "logged-in" && authState.token;
-	try {
-		if (token) {
-			logger.info("Logging out user"), state.set("loggingOut", { authState: {
-				type: "logged-out",
-				isDestroyingSession: !0
-			} });
-			let client = clientFactory({
-				token,
-				requestTagPrefix: REQUEST_TAG_PREFIX,
-				apiVersion: DEFAULT_API_VERSION,
-				...apiHost && { apiHost },
-				useProjectHostname: !1,
-				useCdn: !1
-			});
-			logger.debug("Calling logout endpoint"), await client.request({
-				url: "/auth/logout",
-				method: "POST",
-				tag: "logout"
-			});
-		} else logger.debug("No token to logout - already logged out");
-	} catch (error) {
-		throw logger.error("Logout request failed", { error }), error;
-	} finally {
-		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", {
-			authState: {
-				type: "logged-out",
-				isDestroyingSession: !1
-			},
-			oauthTokens: void 0
-		}), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
-	}
-});
-/**
 * Encodes a byte array as a base64url string (RFC 4648 §5) with no padding,
 * as required for PKCE `code_verifier`/`code_challenge` values.
 *
@@ -440,7 +345,23 @@ async function generateCodeChallenge(codeVerifier) {
 	return base64UrlEncode(new Uint8Array(digest));
 }
 /** sessionStorage key for the PKCE `code_verifier`. */
-const OAUTH_VERIFIER_KEY = "__sanity_oauth_verifier", OAUTH_STATE_KEY = "__sanity_oauth_state";
+const OAUTH_VERIFIER_KEY = "__sanity_oauth_verifier", OAUTH_STATE_KEY = "__sanity_oauth_state", OAUTH_RETURN_TO_KEY = "__sanity_oauth_return_to", OAUTH_CALLBACK_PARAMS = [
+	"code",
+	"state",
+	"error",
+	"error_description"
+];
+/** Strips the OAuth callback params from a URL. */
+function stripOAuthParams(href) {
+	let url = new URL(href, DEFAULT_BASE);
+	for (let param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param);
+	return url.toString();
+}
+/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
+function isCallbackRoute(href, redirectUri) {
+	let current = new URL(href, DEFAULT_BASE), redirect = new URL(redirectUri, DEFAULT_BASE);
+	return current.origin === redirect.origin && current.pathname === redirect.pathname;
+}
 /** Builds the RFC 8707 resource indicator for an organisation. */
 function getResourceIndicator(organizationId) {
 	return `urn:io.sanity:organization:${organizationId}`;
@@ -498,37 +419,26 @@ function toOAuthTokens(response) {
 const startOAuthAuthorization = bindActionGlobally(authStore, async ({ state, instance }) => {
 	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), codeVerifier = generateCodeVerifier(), oauthState = generateState(), codeChallenge = await generateCodeChallenge(codeVerifier), session = typeof sessionStorage < "u" ? sessionStorage : void 0;
 	session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier), session?.setItem(OAUTH_STATE_KEY, oauthState);
+	let currentHref = getDefaultLocation();
+	if (currentHref !== "http://localhost") {
+		let returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri) ? stripOAuthParams(currentHref) : currentHref;
+		session?.setItem(OAUTH_RETURN_TO_KEY, returnTo);
+	}
 	let authorizeUrl = new URL("/v1/auth/oauth/authorize", options.apiHost ?? "https://api.sanity.io");
 	authorizeUrl.searchParams.set("response_type", "code"), authorizeUrl.searchParams.set("client_id", options.oauth.clientId), authorizeUrl.searchParams.set("redirect_uri", options.oauth.redirectUri), authorizeUrl.searchParams.set("state", oauthState), authorizeUrl.searchParams.set("code_challenge", codeChallenge), authorizeUrl.searchParams.set("code_challenge_method", "S256"), authorizeUrl.searchParams.append("resource", getResourceIndicator(options.oauth.organizationId)), logger.info("Starting OAuth authorization"), typeof window < "u" && typeof window.location?.assign == "function" && window.location.assign(authorizeUrl.toString());
 }), handleOAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
 	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), { authState } = state.get();
 	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping OAuth callback - token exchange already in progress"), !1;
-	let callbackUrl = new URL(locationHref, DEFAULT_BASE), code = callbackUrl.searchParams.get("code"), returnedState = callbackUrl.searchParams.get("state"), error = callbackUrl.searchParams.get("error"), errorDescription = callbackUrl.searchParams.get("error_description"), session = typeof sessionStorage < "u" ? sessionStorage : void 0, cleanedUrlObj = new URL(locationHref, DEFAULT_BASE);
-	for (let param of [
-		"code",
-		"state",
-		"error",
-		"error_description"
-	]) cleanedUrlObj.searchParams.delete(param);
-	let cleanedUrl = cleanedUrlObj.toString();
-	if (error) return logger.warn("OAuth callback returned an error", {
-		error,
-		errorDescription
-	}), clearOAuthArtifacts(session), state.set("oauthCallbackError", { authState: {
+	let callbackUrl = new URL(locationHref, DEFAULT_BASE), code = callbackUrl.searchParams.get("code"), returnedState = callbackUrl.searchParams.get("state"), error = callbackUrl.searchParams.get("error"), errorDescription = callbackUrl.searchParams.get("error_description"), session = typeof sessionStorage < "u" ? sessionStorage : void 0, cleanedUrl = stripOAuthParams(locationHref), rejectCallback = (name, message) => authState.type === "logged-in" ? (logger.warn(`${message} — ignoring callback, session already established`), cleanedUrl) : (logger.error(`${message} — rejecting callback`), clearOAuthArtifacts(session), state.set(name, { authState: {
 		type: "error",
-		error: Error(errorDescription ? `${error}: ${errorDescription}` : error)
-	} }), cleanedUrl;
+		error: Error(message)
+	} }), cleanedUrl);
+	if (error) return rejectCallback("oauthCallbackError", errorDescription ? `${error}: ${errorDescription}` : error);
 	if (!code) return logger.debug("No OAuth code found in callback URL"), !1;
 	let storedState = session?.getItem("__sanity_oauth_state") ?? null;
-	if (!returnedState || !storedState || returnedState !== storedState) return logger.error("OAuth state mismatch — rejecting callback"), clearOAuthArtifacts(session), state.set("oauthStateMismatch", { authState: {
-		type: "error",
-		error: /* @__PURE__ */ Error("OAuth state mismatch")
-	} }), cleanedUrl;
+	if (!returnedState || !storedState || returnedState !== storedState) return rejectCallback("oauthStateMismatch", "OAuth state mismatch");
 	let codeVerifier = session?.getItem("__sanity_oauth_verifier") ?? null;
-	if (!codeVerifier) return logger.error("OAuth code verifier missing — cannot exchange code"), clearOAuthArtifacts(session), state.set("oauthVerifierMissing", { authState: {
-		type: "error",
-		error: /* @__PURE__ */ Error("OAuth code verifier missing")
-	} }), cleanedUrl;
+	if (!codeVerifier) return rejectCallback("oauthVerifierMissing", "OAuth code verifier missing");
 	logger.info("Exchanging OAuth code for tokens"), state.set("oauthExchange", { authState: {
 		type: "logging-in",
 		isExchangingToken: !0
@@ -548,10 +458,12 @@ const startOAuthAuthorization = bindActionGlobally(authStore, async ({ state, in
 			body: params.toString(),
 			tag: "oauth.token"
 		}));
-		return options.storageArea?.setItem(options.storageKey, serializeTokens(tokens)), clearOAuthArtifacts(session), logger.info("OAuth tokens obtained, user logged in"), state.set("oauthLoggedIn", {
+		options.storageArea?.setItem(options.storageKey, serializeTokens(tokens));
+		let returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri);
+		return clearOAuthArtifacts(session), logger.info("OAuth tokens obtained, user logged in"), state.set("oauthLoggedIn", {
 			authState: createLoggedInAuthState(tokens.accessToken, null),
 			oauthTokens: tokens
-		}), cleanedUrl;
+		}), returnTo ?? cleanedUrl;
 	} catch (exchangeError) {
 		return logger.error("Failed to exchange OAuth code for tokens", { error: exchangeError }), clearOAuthArtifacts(session), state.set("oauthExchangeError", { authState: {
 			type: "error",
@@ -653,8 +565,129 @@ const revokeOAuthTokens = bindActionGlobally(authStore, async ({ state, instance
 }), getOAuthTokensState = bindActionGlobally(authStore, createStateSourceAction(({ state }) => state.oauthTokens ?? null));
 /** Removes the transient PKCE artifacts from session storage. */
 function clearOAuthArtifacts(session) {
-	session?.removeItem(OAUTH_VERIFIER_KEY), session?.removeItem(OAUTH_STATE_KEY);
+	session?.removeItem(OAUTH_VERIFIER_KEY), session?.removeItem(OAUTH_STATE_KEY), session?.removeItem(OAUTH_RETURN_TO_KEY);
 }
+/**
+* Reads the stashed pre-authorize location, only honouring it when it shares
+* the registered redirect URI's origin so a tampered value cannot redirect
+* off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
+*/
+function getSameOriginReturnTo(session, redirectUri) {
+	let returnTo = session?.getItem("__sanity_oauth_return_to") ?? null;
+	if (!returnTo) return null;
+	try {
+		return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Handles the auth redirect callback. In OAuth mode this delegates to
+* {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
+* long-lived token.
+*
+* @public
+*/
+const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
+	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth } = state.get().options;
+	if (providedToken) return logger.debug("Skipping auth callback - token already provided"), !1;
+	if (oauth) return logger.debug("OAuth mode - delegating to handleOAuthCallback"), handleOAuthCallback(instance, locationHref);
+	let { authState } = state.get();
+	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping auth callback - token exchange already in progress"), !1;
+	let cleanedUrl = getCleanedUrl(locationHref), tokenFromUrl = getTokenFromLocation(locationHref);
+	if (tokenFromUrl) return logger.info("Auth token found in URL, logging in"), state.set("setTokenFromUrl", { authState: createLoggedInAuthState(tokenFromUrl, null) }), cleanedUrl;
+	let authCode = getAuthCode(callbackUrl, locationHref);
+	if (!authCode) return logger.debug("No auth code found in callback URL"), !1;
+	let parsedUrl = new URL(locationHref), dashboardContext = {};
+	try {
+		let contextParam = parsedUrl.searchParams.get("_context");
+		if (contextParam) {
+			let parsedContext = JSON.parse(contextParam);
+			parsedContext && typeof parsedContext == "object" && (delete parsedContext.sid, dashboardContext = parsedContext, logger.debug("Dashboard context parsed from callback URL", { hasDashboardContext: !0 }));
+		}
+	} catch (err) {
+		logger.warn("Failed to parse dashboard context from callback URL", { error: err });
+	}
+	logger.info("Exchanging auth code for token"), state.set("exchangeSessionForToken", {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !0
+		},
+		dashboardContext
+	});
+	try {
+		let client = clientFactory({
+			apiVersion: DEFAULT_API_VERSION,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			useProjectHostname: !1,
+			useCdn: !1,
+			...apiHost && { apiHost }
+		});
+		logger.debug("Fetching token from auth endpoint");
+		let { token } = await client.request({
+			method: "GET",
+			url: "/auth/fetch",
+			query: { sid: authCode },
+			tag: "fetch-token"
+		});
+		return logger.info("Auth token obtained successfully, user logged in"), storageArea?.setItem(storageKey, JSON.stringify({ token })), state.set("setToken", { authState: createLoggedInAuthState(token, null) }), cleanedUrl;
+	} catch (error) {
+		return logger.error("Failed to exchange auth code for token", { error }), state.set("exchangeSessionForTokenError", { authState: {
+			type: "error",
+			error
+		} }), cleanedUrl;
+	}
+}), logout = bindActionGlobally(authStore, async ({ state, instance }) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey, oauth } = state.get().options;
+	if (providedToken) {
+		logger.debug("Skipping logout - token is statically provided");
+		return;
+	}
+	let { authState } = state.get();
+	if (authState.type === "logged-out" && authState.isDestroyingSession) {
+		logger.debug("Skipping logout - already in progress");
+		return;
+	}
+	if (oauth) {
+		logger.debug("OAuth mode - revoking tokens instead of calling /auth/logout"), state.set("loggingOut", { authState: {
+			type: "logged-out",
+			isDestroyingSession: !0
+		} }), await revokeOAuthTokens(instance);
+		return;
+	}
+	let token = authState.type === "logged-in" && authState.token;
+	try {
+		if (token) {
+			logger.info("Logging out user"), state.set("loggingOut", { authState: {
+				type: "logged-out",
+				isDestroyingSession: !0
+			} });
+			let client = clientFactory({
+				token,
+				requestTagPrefix: REQUEST_TAG_PREFIX,
+				apiVersion: DEFAULT_API_VERSION,
+				...apiHost && { apiHost },
+				useProjectHostname: !1,
+				useCdn: !1
+			});
+			logger.debug("Calling logout endpoint"), await client.request({
+				url: "/auth/logout",
+				method: "POST",
+				tag: "logout"
+			});
+		} else logger.debug("No token to logout - already logged out");
+	} catch (error) {
+		throw logger.error("Logout request failed", { error }), error;
+	} finally {
+		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", {
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			},
+			oauthTokens: void 0
+		}), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
+	}
+});
 function weaken(node) {
 	return Array.isArray(node) ? node.map(weaken) : node && typeof node == "object" ? "_ref" in node ? {
 		...node,