@sanity/sdk 3.3.0-rc.0 → 3.3.0-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/sdk",
-  "version": "3.3.0-rc.0",
+  "version": "3.3.0-rc.1",
   "private": false,
   "description": "Sanity SDK",
   "keywords": [

package/src/auth/oauth/oauthActions.test.ts

@@ -43,6 +43,11 @@ const oauthConfig = {
   organizationId: 'org123',
 }
 
+const oauthConfigNoOrg = {
+  clientId: 'client-abc',
+  redirectUri: 'https://app.example.com/callback',
+}
+
 const seededTokens: OAuthTokens = {
   accessToken: 'stored-access',
   tokenType: 'bearer',
@@ -94,6 +99,7 @@ interface SetupOptions {
   sessionSeed?: Record<string, string>
   initialLocationHref?: string
   withOAuthConfig?: boolean
+  oauthConfig?: {clientId: string; redirectUri: string; organizationId?: string}
   apiHost?: string
 }
 
@@ -112,7 +118,7 @@ function setup(options: SetupOptions = {}) {
       storageArea,
       initialLocationHref: options.initialLocationHref ?? 'https://app.example.com/',
       ...(options.apiHost && {apiHost: options.apiHost}),
-      ...(options.withOAuthConfig === false ? {} : {oauth: oauthConfig}),
+      ...(options.withOAuthConfig === false ? {} : {oauth: options.oauthConfig ?? oauthConfig}),
     },
   })
 
@@ -179,6 +185,17 @@ describe('startOAuthAuthorization', () => {
     expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
   })
 
+  it('omits the resource param when no organizationId is configured', async () => {
+    const assign = vi.fn()
+    vi.stubGlobal('window', {location: {assign}})
+    setup({initialLocationHref: 'https://app.example.com/', oauthConfig: oauthConfigNoOrg})
+
+    await startOAuthAuthorization(instance!)
+
+    const url = new URL(assign.mock.calls[0][0])
+    expect(url.searchParams.has('resource')).toBe(false)
+  })
+
   it('throws when OAuth is not configured', async () => {
     setup({withOAuthConfig: false})
     await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
@@ -405,6 +422,18 @@ describe('handleOAuthCallback', () => {
     expect(request).not.toHaveBeenCalled()
   })
 
+  it('omits the resource param when no organizationId is configured', async () => {
+    const {request} = setup({
+      oauthConfig: oauthConfigNoOrg,
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    await handleOAuthCallback(instance!, callbackHref)
+
+    const body = parseBody(request.mock.calls[0][0].body)
+    expect(body.has('resource')).toBe(false)
+  })
+
   it('sets ERROR when the token exchange fails', async () => {
     const request = vi.fn().mockRejectedValue(new Error('boom'))
     const {session} = setup({
@@ -439,6 +468,18 @@ describe('refreshOAuthTokens', () => {
     expect(readStored(storageArea)).toMatchObject({accessToken: 'new-access'})
   })
 
+  it('omits the resource param when no organizationId is configured', async () => {
+    const {request} = setup({
+      oauthConfig: oauthConfigNoOrg,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await refreshOAuthTokens(instance!)
+
+    const body = parseBody(request.mock.calls[0][0].body)
+    expect(body.has('resource')).toBe(false)
+  })
+
   it('shares a single in-flight request across concurrent callers', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)

package/src/auth/oauth/oauthActions.ts

@@ -48,6 +48,19 @@ function getResourceIndicator(organizationId: string): string {
   return `urn:io.sanity:organization:${organizationId}`
 }
 
+/**
+ * Appends the RFC 8707 `resource` indicator to `params` when an organisation
+ * id is configured. Without one, the request is left unscoped.
+ */
+function appendResourceIndicator(
+  params: URLSearchParams,
+  oauth: NonNullable<AuthOptions['oauth']>,
+): void {
+  if (oauth.organizationId) {
+    params.append('resource', getResourceIndicator(oauth.organizationId))
+  }
+}
+
 /**
  * Serialises tokens for storage, converting `expiresAt` to an ISO string.
  *
@@ -89,6 +102,21 @@ function createOAuthClient(options: AuthOptions): SanityClient {
   })
 }
 
+/** POSTs form-encoded params to the OAuth token endpoint. */
+function postTokenRequest(
+  client: SanityClient,
+  params: URLSearchParams,
+  tag: string,
+): Promise<TokenEndpointResponse> {
+  return client.request<TokenEndpointResponse>({
+    method: 'POST',
+    url: '/auth/oauth/token',
+    headers: {'content-type': 'application/x-www-form-urlencoded'},
+    body: params.toString(),
+    tag,
+  })
+}
+
 /** Converts a token endpoint response to the {@link OAuthTokens} shape. */
 function toOAuthTokens(response: TokenEndpointResponse): OAuthTokens {
   return {
@@ -140,7 +168,7 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
   authorizeUrl.searchParams.set('state', oauthState)
   authorizeUrl.searchParams.set('code_challenge', codeChallenge)
   authorizeUrl.searchParams.set('code_challenge_method', 'S256')
-  authorizeUrl.searchParams.append('resource', getResourceIndicator(options.oauth.organizationId))
+  appendResourceIndicator(authorizeUrl.searchParams, options.oauth)
 
   logger.info('Starting OAuth authorization')
   if (typeof window !== 'undefined' && typeof window.location?.assign === 'function') {
@@ -240,15 +268,9 @@ export const handleOAuthCallback = bindActionGlobally(
         code_verifier: codeVerifier,
         redirect_uri: options.oauth.redirectUri,
         client_id: options.oauth.clientId,
-        resource: getResourceIndicator(options.oauth.organizationId),
-      })
-      const response = await client.request<TokenEndpointResponse>({
-        method: 'POST',
-        url: '/auth/oauth/token',
-        headers: {'content-type': 'application/x-www-form-urlencoded'},
-        body: params.toString(),
-        tag: 'oauth.token',
       })
+      appendResourceIndicator(params, options.oauth)
+      const response = await postTokenRequest(client, params, 'oauth.token')
 
       const tokens = toOAuthTokens(response)
       options.storageArea?.setItem(options.storageKey, serializeTokens(tokens))
@@ -329,15 +351,9 @@ async function doRefreshOAuthTokens({
       grant_type: 'refresh_token',
       refresh_token: current.refreshToken,
       client_id: options.oauth.clientId,
-      resource: getResourceIndicator(options.oauth.organizationId),
-    })
-    const response = await client.request<TokenEndpointResponse>({
-      method: 'POST',
-      url: '/auth/oauth/token',
-      headers: {'content-type': 'application/x-www-form-urlencoded'},
-      body: params.toString(),
-      tag: 'oauth.refresh',
     })
+    appendResourceIndicator(params, options.oauth)
+    const response = await postTokenRequest(client, params, 'oauth.refresh')
 
     const tokens = toOAuthTokens(response)
     if (!tokens.refreshToken) tokens.refreshToken = current.refreshToken

package/src/config/authConfig.ts

@@ -90,8 +90,11 @@ export interface AuthConfig {
     redirectUri: string
 
     /**
-     * Organisation id used for RFC 8707 resource scoping.
+     * Organisation id used for RFC 8707 resource scoping. Optional: when
+     * omitted, the `resource` parameter is left off the authorize and token
+     * requests, so the issued tokens are not restricted to a single
+     * organisation.
      */
-    organizationId: string
+    organizationId?: string
   }
 }

package/dist/createSanityInstance-BQIqyGLX.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createSanityInstance-BQIqyGLX.d.ts","names":[],"sources":["../src/config/authConfig.ts","../src/config/sanityConfig.ts","../src/store/createSanityInstance.ts"],"mappings":";;;;;UAMiB;;;;EAIf;;;;EAKA;;;;EAKA;;;;EAKA;;;;;;;UAQe;;;;;EAKf;;;;;EAMA,iBAAiB,QAAQ,iBAAiB;;;;;;EAO1C,YAAY,mBAAmB,MAAM,mBAAmB,iBAAiB,QAAQ;;;;;EAMjF;;;;;EAMA,cAAc;;;;;;EAOd;;;;;;EAOA;EAEA;;;;IAIE;;;;;IAMA;;;;IAKA;;;;;;;;;;;UClFa;;EAEf,UAAU;IAAW,OAAO;;IAAkC;;;;;;;;;;UAU/C;;;;;;EAMf;;EAEA;;;;;;;;IAQE,QAAQ;;;;;;;UAQK,cAAc;EAC7B,YAAY;;;;;KAMF;EACV;EACA,uBAAuB;;;;;UAMR;EACf,cAAc,oBAAoB;;;;;UAMnB,cAAc,kCAAkC,4CACvD,cAAc,aAAa;EACnC,UAAU;;;;;;;EAOV,WAAW;;;;;;;;UASI,mBACf,uCACA,kCACA,4CACQ,cAAc,UAAU;EAChC;EACA,cAAc;;;;;;EAMd;;;;;;;;UASe,eACf,uCACA,kCACA,4CACQ,mBAAmB,eAAe,UAAU;EACpD;;;;;;;;;;UAWe,sBAAsB;EACrC;;;;;;UAOe,qBAAqB,eAAe;;;;EAInD,OAAO;;;;;;;;;EASP,SAAS;;;;;;;;KASC,mBAAmB,kBAAkB,uBAAuB;;;;KAK5D;EAAmB;EAAmB;;;;;KAKtC;EAAwB;;;;;KAKxB;EAAkB;;;;;iBAKd,kBAAkB,UAAU,mBAAmB,YAAY;;;;iBAO3D,uBACd,UAAU,mBACT,YAAY;;;;iBAOC,iBAAiB,UAAU,mBAAmB,YAAY;;;;;;UCtLzD;;;;;WAKN;;;;WAKA,QAAQ;;;;;EAMjB;;;;;EAMA;;;;;;EAOA,UAAU;;;;;;;;;iBAUI,qBAAqB,SAAQ,eAAoB"}