@sanity/sdk 3.3.0-rc.0 → 3.3.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { D as getAuthLogger, E as REQUEST_TAG_PREFIX, O as configureLogging$1, S as AuthStateType, T as DEFAULT_BASE, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, k as createLogger, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-QDrJNTM4.js";
+import { D as getAuthLogger, E as REQUEST_TAG_PREFIX, O as configureLogging$1, S as AuthStateType, T as DEFAULT_BASE, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, k as createLogger, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-BI4D8HhJ.js";
 import { c as isReleasePerspective, d as isMediaLibraryResource, i as bindActionGlobally, l as isCanvasResource, n as bindActionByResource, o as defineStore, r as bindActionByResourceAndPerspective, t as createStateSourceAction, u as isDatasetResource } from "./createStateSourceAction-DdAhEfnZ.js";
-import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-CIhX5ppJ.js";
+import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-CD4aBigm.js";
 import { r as omitProperty, t as isDeepEqual } from "./object-CxXlSVg7.js";
 import { n as setCleanupTimeout } from "./setCleanupTimeout-BiM6q1KF.js";
 import { t as _defineProperty } from "./defineProperty-Bho9Ngsi.js";
@@ -303,6 +303,101 @@ function observeOrganizationVerificationState(instance, projectIds) {
 	}), distinctUntilChanged((prev, curr) => prev.error === curr.error));
 }
 /**
+* @public
+*/
+const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
+	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey } = state.get().options;
+	if (providedToken) return logger.debug("Skipping auth callback - token already provided"), !1;
+	let { authState } = state.get();
+	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping auth callback - token exchange already in progress"), !1;
+	let cleanedUrl = getCleanedUrl(locationHref), tokenFromUrl = getTokenFromLocation(locationHref);
+	if (tokenFromUrl) return logger.info("Auth token found in URL, logging in"), state.set("setTokenFromUrl", { authState: createLoggedInAuthState(tokenFromUrl, null) }), cleanedUrl;
+	let authCode = getAuthCode(callbackUrl, locationHref);
+	if (!authCode) return logger.debug("No auth code found in callback URL"), !1;
+	let parsedUrl = new URL(locationHref), dashboardContext = {};
+	try {
+		let contextParam = parsedUrl.searchParams.get("_context");
+		if (contextParam) {
+			let parsedContext = JSON.parse(contextParam);
+			parsedContext && typeof parsedContext == "object" && (delete parsedContext.sid, dashboardContext = parsedContext, logger.debug("Dashboard context parsed from callback URL", { hasDashboardContext: !0 }));
+		}
+	} catch (err) {
+		logger.warn("Failed to parse dashboard context from callback URL", { error: err });
+	}
+	logger.info("Exchanging auth code for token"), state.set("exchangeSessionForToken", {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !0
+		},
+		dashboardContext
+	});
+	try {
+		let client = clientFactory({
+			apiVersion: DEFAULT_API_VERSION,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			useProjectHostname: !1,
+			useCdn: !1,
+			...apiHost && { apiHost }
+		});
+		logger.debug("Fetching token from auth endpoint");
+		let { token } = await client.request({
+			method: "GET",
+			url: "/auth/fetch",
+			query: { sid: authCode },
+			tag: "fetch-token"
+		});
+		return logger.info("Auth token obtained successfully, user logged in"), storageArea?.setItem(storageKey, JSON.stringify({ token })), state.set("setToken", { authState: createLoggedInAuthState(token, null) }), cleanedUrl;
+	} catch (error) {
+		return logger.error("Failed to exchange auth code for token", { error }), state.set("exchangeSessionForTokenError", { authState: {
+			type: "error",
+			error
+		} }), cleanedUrl;
+	}
+}), logout = bindActionGlobally(authStore, async ({ state, instance }) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey } = state.get().options;
+	if (providedToken) {
+		logger.debug("Skipping logout - token is statically provided");
+		return;
+	}
+	let { authState } = state.get();
+	if (authState.type === "logged-out" && authState.isDestroyingSession) {
+		logger.debug("Skipping logout - already in progress");
+		return;
+	}
+	let token = authState.type === "logged-in" && authState.token;
+	try {
+		if (token) {
+			logger.info("Logging out user"), state.set("loggingOut", { authState: {
+				type: "logged-out",
+				isDestroyingSession: !0
+			} });
+			let client = clientFactory({
+				token,
+				requestTagPrefix: REQUEST_TAG_PREFIX,
+				apiVersion: DEFAULT_API_VERSION,
+				...apiHost && { apiHost },
+				useProjectHostname: !1,
+				useCdn: !1
+			});
+			logger.debug("Calling logout endpoint"), await client.request({
+				url: "/auth/logout",
+				method: "POST",
+				tag: "logout"
+			});
+		} else logger.debug("No token to logout - already logged out");
+	} catch (error) {
+		throw logger.error("Logout request failed", { error }), error;
+	} finally {
+		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", {
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			},
+			oauthTokens: void 0
+		}), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
+	}
+});
+/**
 * Encodes a byte array as a base64url string (RFC 4648 §5) with no padding,
 * as required for PKCE `code_verifier`/`code_challenge` values.
 *
@@ -345,23 +440,7 @@ async function generateCodeChallenge(codeVerifier) {
 	return base64UrlEncode(new Uint8Array(digest));
 }
 /** sessionStorage key for the PKCE `code_verifier`. */
-const OAUTH_VERIFIER_KEY = "__sanity_oauth_verifier", OAUTH_STATE_KEY = "__sanity_oauth_state", OAUTH_RETURN_TO_KEY = "__sanity_oauth_return_to", OAUTH_CALLBACK_PARAMS = [
-	"code",
-	"state",
-	"error",
-	"error_description"
-];
-/** Strips the OAuth callback params from a URL. */
-function stripOAuthParams(href) {
-	let url = new URL(href, DEFAULT_BASE);
-	for (let param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param);
-	return url.toString();
-}
-/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
-function isCallbackRoute(href, redirectUri) {
-	let current = new URL(href, DEFAULT_BASE), redirect = new URL(redirectUri, DEFAULT_BASE);
-	return current.origin === redirect.origin && current.pathname === redirect.pathname;
-}
+const OAUTH_VERIFIER_KEY = "__sanity_oauth_verifier", OAUTH_STATE_KEY = "__sanity_oauth_state";
 /** Builds the RFC 8707 resource indicator for an organisation. */
 function getResourceIndicator(organizationId) {
 	return `urn:io.sanity:organization:${organizationId}`;
@@ -419,26 +498,37 @@ function toOAuthTokens(response) {
 const startOAuthAuthorization = bindActionGlobally(authStore, async ({ state, instance }) => {
 	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), codeVerifier = generateCodeVerifier(), oauthState = generateState(), codeChallenge = await generateCodeChallenge(codeVerifier), session = typeof sessionStorage < "u" ? sessionStorage : void 0;
 	session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier), session?.setItem(OAUTH_STATE_KEY, oauthState);
-	let currentHref = getDefaultLocation();
-	if (currentHref !== "http://localhost") {
-		let returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri) ? stripOAuthParams(currentHref) : currentHref;
-		session?.setItem(OAUTH_RETURN_TO_KEY, returnTo);
-	}
 	let authorizeUrl = new URL("/v1/auth/oauth/authorize", options.apiHost ?? "https://api.sanity.io");
 	authorizeUrl.searchParams.set("response_type", "code"), authorizeUrl.searchParams.set("client_id", options.oauth.clientId), authorizeUrl.searchParams.set("redirect_uri", options.oauth.redirectUri), authorizeUrl.searchParams.set("state", oauthState), authorizeUrl.searchParams.set("code_challenge", codeChallenge), authorizeUrl.searchParams.set("code_challenge_method", "S256"), authorizeUrl.searchParams.append("resource", getResourceIndicator(options.oauth.organizationId)), logger.info("Starting OAuth authorization"), typeof window < "u" && typeof window.location?.assign == "function" && window.location.assign(authorizeUrl.toString());
 }), handleOAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
 	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), { authState } = state.get();
 	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping OAuth callback - token exchange already in progress"), !1;
-	let callbackUrl = new URL(locationHref, DEFAULT_BASE), code = callbackUrl.searchParams.get("code"), returnedState = callbackUrl.searchParams.get("state"), error = callbackUrl.searchParams.get("error"), errorDescription = callbackUrl.searchParams.get("error_description"), session = typeof sessionStorage < "u" ? sessionStorage : void 0, cleanedUrl = stripOAuthParams(locationHref), rejectCallback = (name, message) => authState.type === "logged-in" ? (logger.warn(`${message} — ignoring callback, session already established`), cleanedUrl) : (logger.error(`${message} — rejecting callback`), clearOAuthArtifacts(session), state.set(name, { authState: {
+	let callbackUrl = new URL(locationHref, DEFAULT_BASE), code = callbackUrl.searchParams.get("code"), returnedState = callbackUrl.searchParams.get("state"), error = callbackUrl.searchParams.get("error"), errorDescription = callbackUrl.searchParams.get("error_description"), session = typeof sessionStorage < "u" ? sessionStorage : void 0, cleanedUrlObj = new URL(locationHref, DEFAULT_BASE);
+	for (let param of [
+		"code",
+		"state",
+		"error",
+		"error_description"
+	]) cleanedUrlObj.searchParams.delete(param);
+	let cleanedUrl = cleanedUrlObj.toString();
+	if (error) return logger.warn("OAuth callback returned an error", {
+		error,
+		errorDescription
+	}), clearOAuthArtifacts(session), state.set("oauthCallbackError", { authState: {
 		type: "error",
-		error: Error(message)
-	} }), cleanedUrl);
-	if (error) return rejectCallback("oauthCallbackError", errorDescription ? `${error}: ${errorDescription}` : error);
+		error: Error(errorDescription ? `${error}: ${errorDescription}` : error)
+	} }), cleanedUrl;
 	if (!code) return logger.debug("No OAuth code found in callback URL"), !1;
 	let storedState = session?.getItem("__sanity_oauth_state") ?? null;
-	if (!returnedState || !storedState || returnedState !== storedState) return rejectCallback("oauthStateMismatch", "OAuth state mismatch");
+	if (!returnedState || !storedState || returnedState !== storedState) return logger.error("OAuth state mismatch — rejecting callback"), clearOAuthArtifacts(session), state.set("oauthStateMismatch", { authState: {
+		type: "error",
+		error: /* @__PURE__ */ Error("OAuth state mismatch")
+	} }), cleanedUrl;
 	let codeVerifier = session?.getItem("__sanity_oauth_verifier") ?? null;
-	if (!codeVerifier) return rejectCallback("oauthVerifierMissing", "OAuth code verifier missing");
+	if (!codeVerifier) return logger.error("OAuth code verifier missing — cannot exchange code"), clearOAuthArtifacts(session), state.set("oauthVerifierMissing", { authState: {
+		type: "error",
+		error: /* @__PURE__ */ Error("OAuth code verifier missing")
+	} }), cleanedUrl;
 	logger.info("Exchanging OAuth code for tokens"), state.set("oauthExchange", { authState: {
 		type: "logging-in",
 		isExchangingToken: !0
@@ -458,12 +548,10 @@ const startOAuthAuthorization = bindActionGlobally(authStore, async ({ state, in
 			body: params.toString(),
 			tag: "oauth.token"
 		}));
-		options.storageArea?.setItem(options.storageKey, serializeTokens(tokens));
-		let returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri);
-		return clearOAuthArtifacts(session), logger.info("OAuth tokens obtained, user logged in"), state.set("oauthLoggedIn", {
+		return options.storageArea?.setItem(options.storageKey, serializeTokens(tokens)), clearOAuthArtifacts(session), logger.info("OAuth tokens obtained, user logged in"), state.set("oauthLoggedIn", {
 			authState: createLoggedInAuthState(tokens.accessToken, null),
 			oauthTokens: tokens
-		}), returnTo ?? cleanedUrl;
+		}), cleanedUrl;
 	} catch (exchangeError) {
 		return logger.error("Failed to exchange OAuth code for tokens", { error: exchangeError }), clearOAuthArtifacts(session), state.set("oauthExchangeError", { authState: {
 			type: "error",
@@ -565,129 +653,8 @@ const revokeOAuthTokens = bindActionGlobally(authStore, async ({ state, instance
 }), getOAuthTokensState = bindActionGlobally(authStore, createStateSourceAction(({ state }) => state.oauthTokens ?? null));
 /** Removes the transient PKCE artifacts from session storage. */
 function clearOAuthArtifacts(session) {
-	session?.removeItem(OAUTH_VERIFIER_KEY), session?.removeItem(OAUTH_STATE_KEY), session?.removeItem(OAUTH_RETURN_TO_KEY);
+	session?.removeItem(OAUTH_VERIFIER_KEY), session?.removeItem(OAUTH_STATE_KEY);
 }
-/**
-* Reads the stashed pre-authorize location, only honouring it when it shares
-* the registered redirect URI's origin so a tampered value cannot redirect
-* off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
-*/
-function getSameOriginReturnTo(session, redirectUri) {
-	let returnTo = session?.getItem("__sanity_oauth_return_to") ?? null;
-	if (!returnTo) return null;
-	try {
-		return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Handles the auth redirect callback. In OAuth mode this delegates to
-* {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
-* long-lived token.
-*
-* @public
-*/
-const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
-	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth } = state.get().options;
-	if (providedToken) return logger.debug("Skipping auth callback - token already provided"), !1;
-	if (oauth) return logger.debug("OAuth mode - delegating to handleOAuthCallback"), handleOAuthCallback(instance, locationHref);
-	let { authState } = state.get();
-	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping auth callback - token exchange already in progress"), !1;
-	let cleanedUrl = getCleanedUrl(locationHref), tokenFromUrl = getTokenFromLocation(locationHref);
-	if (tokenFromUrl) return logger.info("Auth token found in URL, logging in"), state.set("setTokenFromUrl", { authState: createLoggedInAuthState(tokenFromUrl, null) }), cleanedUrl;
-	let authCode = getAuthCode(callbackUrl, locationHref);
-	if (!authCode) return logger.debug("No auth code found in callback URL"), !1;
-	let parsedUrl = new URL(locationHref), dashboardContext = {};
-	try {
-		let contextParam = parsedUrl.searchParams.get("_context");
-		if (contextParam) {
-			let parsedContext = JSON.parse(contextParam);
-			parsedContext && typeof parsedContext == "object" && (delete parsedContext.sid, dashboardContext = parsedContext, logger.debug("Dashboard context parsed from callback URL", { hasDashboardContext: !0 }));
-		}
-	} catch (err) {
-		logger.warn("Failed to parse dashboard context from callback URL", { error: err });
-	}
-	logger.info("Exchanging auth code for token"), state.set("exchangeSessionForToken", {
-		authState: {
-			type: "logging-in",
-			isExchangingToken: !0
-		},
-		dashboardContext
-	});
-	try {
-		let client = clientFactory({
-			apiVersion: DEFAULT_API_VERSION,
-			requestTagPrefix: REQUEST_TAG_PREFIX,
-			useProjectHostname: !1,
-			useCdn: !1,
-			...apiHost && { apiHost }
-		});
-		logger.debug("Fetching token from auth endpoint");
-		let { token } = await client.request({
-			method: "GET",
-			url: "/auth/fetch",
-			query: { sid: authCode },
-			tag: "fetch-token"
-		});
-		return logger.info("Auth token obtained successfully, user logged in"), storageArea?.setItem(storageKey, JSON.stringify({ token })), state.set("setToken", { authState: createLoggedInAuthState(token, null) }), cleanedUrl;
-	} catch (error) {
-		return logger.error("Failed to exchange auth code for token", { error }), state.set("exchangeSessionForTokenError", { authState: {
-			type: "error",
-			error
-		} }), cleanedUrl;
-	}
-}), logout = bindActionGlobally(authStore, async ({ state, instance }) => {
-	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey, oauth } = state.get().options;
-	if (providedToken) {
-		logger.debug("Skipping logout - token is statically provided");
-		return;
-	}
-	let { authState } = state.get();
-	if (authState.type === "logged-out" && authState.isDestroyingSession) {
-		logger.debug("Skipping logout - already in progress");
-		return;
-	}
-	if (oauth) {
-		logger.debug("OAuth mode - revoking tokens instead of calling /auth/logout"), state.set("loggingOut", { authState: {
-			type: "logged-out",
-			isDestroyingSession: !0
-		} }), await revokeOAuthTokens(instance);
-		return;
-	}
-	let token = authState.type === "logged-in" && authState.token;
-	try {
-		if (token) {
-			logger.info("Logging out user"), state.set("loggingOut", { authState: {
-				type: "logged-out",
-				isDestroyingSession: !0
-			} });
-			let client = clientFactory({
-				token,
-				requestTagPrefix: REQUEST_TAG_PREFIX,
-				apiVersion: DEFAULT_API_VERSION,
-				...apiHost && { apiHost },
-				useProjectHostname: !1,
-				useCdn: !1
-			});
-			logger.debug("Calling logout endpoint"), await client.request({
-				url: "/auth/logout",
-				method: "POST",
-				tag: "logout"
-			});
-		} else logger.debug("No token to logout - already logged out");
-	} catch (error) {
-		throw logger.error("Logout request failed", { error }), error;
-	} finally {
-		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", {
-			authState: {
-				type: "logged-out",
-				isDestroyingSession: !1
-			},
-			oauthTokens: void 0
-		}), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
-	}
-});
 function weaken(node) {
 	return Array.isArray(node) ? node.map(weaken) : node && typeof node == "object" ? "_ref" in node ? {
 		...node,