@sanity/sdk 3.3.0 → 3.4.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/sdk",
-  "version": "3.3.0",
+  "version": "3.4.0-rc.0",
   "private": false,
   "description": "Sanity SDK",
   "keywords": [

package/src/auth/authStore.test.ts

@@ -339,6 +339,24 @@ describe('authStore', () => {
       expect(options.authMethod).toBe('localstorage')
     })
 
+    it('only exposes oauth options when the resolved mode is oauth', () => {
+      const oauth = {
+        clientId: 'client-abc',
+        redirectUri: 'https://app.example.com/callback',
+        organizationId: 'org123',
+      }
+      vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(null)
+      vi.mocked(getTokenFromStorage).mockReturnValue(null)
+
+      // studio takes precedence over oauth, so oauth options must be dropped
+      instance = createSanityInstance({projectId: 'p', dataset: 'd', studio: {}, auth: {oauth}})
+      expect(authStore.getInitialState(instance, null).options.oauth).toBeUndefined()
+      instance.dispose()
+
+      instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {oauth}})
+      expect(authStore.getInitialState(instance, null).options.oauth).toEqual(oauth)
+    })
+
     it('logs auth initialized in logged out state when no token available', () => {
       instance = createSanityInstance({
         projectId: 'p',

package/src/auth/authStore.ts

@@ -191,7 +191,10 @@ export const authStore = defineStore<AuthStoreState>({
         storageKey: result.storageKey,
         storageArea: result.storageArea,
         authMethod: result.authMethod,
-        oauth: authConfig.oauth,
+        // Only expose oauth options when the oauth strategy is actually in use,
+        // so mode-gated actions (logout, handleAuthCallback) stay consistent
+        // with the resolved mode (e.g. `studio` takes precedence over `oauth`).
+        oauth: mode === 'oauth' ? authConfig.oauth : undefined,
       },
     }
   },

package/src/auth/handleAuthCallback.test.ts

@@ -5,6 +5,7 @@ import {createSanityInstance, type SanityInstance} from '../store/createSanityIn
 import {AuthStateType} from './authStateType'
 import {getAuthState} from './authStore'
 import {handleAuthCallback} from './handleAuthCallback'
+import {handleOAuthCallback} from './oauth/oauthActions'
 import {subscribeToStateAndFetchCurrentUser} from './subscribeToStateAndFetchCurrentUser'
 import {subscribeToStorageEventsAndSetToken} from './subscribeToStorageEventsAndSetToken'
 import {getAuthCode, getTokenFromLocation, getTokenFromStorage} from './utils'
@@ -22,6 +23,11 @@ vi.mock('./utils', async (importOriginal) => {
 vi.mock('./subscribeToStateAndFetchCurrentUser')
 vi.mock('./subscribeToStorageEventsAndSetToken')
 
+vi.mock('./oauth/oauthActions', async (importOriginal) => {
+  const original = await importOriginal<typeof import('./oauth/oauthActions')>()
+  return {...original, handleOAuthCallback: vi.fn()}
+})
+
 // Mock logger to prevent actual logging during tests
 vi.mock('../utils/logger', async (importOriginal) => {
   const original = await importOriginal<typeof import('../utils/logger')>()
@@ -277,4 +283,31 @@ describe('handleCallback', () => {
     // Verify logger was called
     expect(createLogger).toHaveBeenCalled()
   })
+
+  it('delegates to handleOAuthCallback in OAuth mode', async () => {
+    const clientFactory = vi.fn()
+    vi.mocked(getTokenFromStorage).mockReturnValue(null)
+    vi.mocked(handleOAuthCallback).mockResolvedValue('https://app.example.com/callback')
+
+    instance = createSanityInstance({
+      projectId: 'p',
+      dataset: 'd',
+      auth: {
+        clientFactory,
+        oauth: {
+          clientId: 'client-abc',
+          redirectUri: 'https://app.example.com/callback',
+          organizationId: 'org123',
+        },
+      },
+    })
+
+    const href = 'https://app.example.com/callback?code=abc&state=xyz'
+    const result = await handleAuthCallback(instance, href)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(handleOAuthCallback).toHaveBeenCalledWith(instance, href)
+    expect(getAuthCode).not.toHaveBeenCalled()
+    expect(clientFactory).not.toHaveBeenCalled()
+  })
 })

package/src/auth/handleAuthCallback.ts

@@ -3,6 +3,7 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore, type AuthStoreState, type DashboardContext} from './authStore'
+import {handleOAuthCallback} from './oauth/oauthActions'
 import {
   createLoggedInAuthState,
   getAuthCode,
@@ -12,6 +13,10 @@ import {
 } from './utils'
 
 /**
+ * Handles the auth redirect callback. In OAuth mode this delegates to
+ * {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
+ * long-lived token.
+ *
  * @public
  */
 export const handleAuthCallback = bindActionGlobally(
@@ -19,7 +24,7 @@ export const handleAuthCallback = bindActionGlobally(
   async ({state, instance}, locationHref: string = getDefaultLocation()) => {
     const logger = getAuthLogger(instance)
 
-    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey} =
+    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth} =
       state.get().options
 
     // If a token is provided, no need to handle callback
@@ -28,6 +33,11 @@ export const handleAuthCallback = bindActionGlobally(
       return false
     }
 
+    if (oauth) {
+      logger.debug('OAuth mode - delegating to handleOAuthCallback')
+      return handleOAuthCallback(instance, locationHref)
+    }
+
     // Don't handle the callback if already in flight.
     const {authState} = state.get()
     if (authState.type === AuthStateType.LOGGING_IN && authState.isExchangingToken) {

package/src/auth/logout.test.ts

@@ -169,7 +169,7 @@ describe('logout', () => {
     expect(removeItem).toHaveBeenCalledWith('__sanity_auth_token')
   })
 
-  it('clears the OAuth tokens from the store on logout', async () => {
+  it('revokes OAuth tokens instead of calling /auth/logout in OAuth mode', async () => {
     const oauthTokens: OAuthTokens = {
       accessToken: 'oauth-access',
       tokenType: 'bearer',
@@ -204,8 +204,16 @@ describe('logout', () => {
     // Boots logged in with the persisted OAuth tokens exposed on the store.
     expect(getOAuthTokensState(instance).getCurrent()).toMatchObject({accessToken: 'oauth-access'})
 
+    const first = logout(instance)
+    // Session is marked as destroying so a concurrent call is a no-op
+    expect(getAuthState(instance).getCurrent()).toMatchObject({isDestroyingSession: true})
     await logout(instance)
+    await first
 
+    expect(mockRequest).toHaveBeenCalledTimes(1)
+    expect(mockRequest).toHaveBeenCalledWith(
+      expect.objectContaining({url: '/auth/oauth/revoke', tag: 'oauth.revoke'}),
+    )
     expect(getOAuthTokensState(instance).getCurrent()).toBeNull()
     expect(getAuthState(instance).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
     expect(map.get(OAUTH_TOKENS_KEY)).toBeUndefined()

package/src/auth/logout.ts

@@ -3,14 +3,22 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
+import {revokeOAuthTokens} from './oauth/oauthActions'
 
 /**
+ * Logs the current user out. In OAuth mode this revokes the OAuth tokens
+ * instead of calling the legacy `/auth/logout` endpoint; revocation is
+ * best-effort, so the OAuth path resolves even if the revoke request fails,
+ * whereas the legacy path rejects when `/auth/logout` fails. Local state and
+ * storage are cleared in both cases.
+ *
  * @public
  */
 export const logout = bindActionGlobally(authStore, async ({state, instance}) => {
   const logger = getAuthLogger(instance)
 
-  const {clientFactory, apiHost, providedToken, storageArea, storageKey} = state.get().options
+  const {clientFactory, apiHost, providedToken, storageArea, storageKey, oauth} =
+    state.get().options
 
   // If a token is statically provided, logout does nothing
   if (providedToken) {
@@ -25,6 +33,15 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.debug('Skipping logout - already in progress')
     return
   }
+
+  if (oauth) {
+    logger.debug('OAuth mode - revoking tokens instead of calling /auth/logout')
+    state.set('loggingOut', {
+      authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: true},
+    })
+    await revokeOAuthTokens(instance)
+    return
+  }
   const token = authState.type === AuthStateType.LOGGED_IN && authState.token
 
   try {

package/src/auth/oauth/oauthActions.test.ts

@@ -9,6 +9,7 @@ import {subscribeToStateAndFetchCurrentUser} from '../subscribeToStateAndFetchCu
 import {
   getOAuthTokensState,
   handleOAuthCallback,
+  OAUTH_RETURN_TO_KEY,
   OAUTH_STATE_KEY,
   OAUTH_VERIFIER_KEY,
   refreshOAuthTokens,
@@ -42,6 +43,11 @@ const oauthConfig = {
   organizationId: 'org123',
 }
 
+const oauthConfigNoOrg = {
+  clientId: 'client-abc',
+  redirectUri: 'https://app.example.com/callback',
+}
+
 const seededTokens: OAuthTokens = {
   accessToken: 'stored-access',
   tokenType: 'bearer',
@@ -93,6 +99,7 @@ interface SetupOptions {
   sessionSeed?: Record<string, string>
   initialLocationHref?: string
   withOAuthConfig?: boolean
+  oauthConfig?: {clientId: string; redirectUri: string; organizationId?: string}
   apiHost?: string
 }
 
@@ -111,7 +118,7 @@ function setup(options: SetupOptions = {}) {
       storageArea,
       initialLocationHref: options.initialLocationHref ?? 'https://app.example.com/',
       ...(options.apiHost && {apiHost: options.apiHost}),
-      ...(options.withOAuthConfig === false ? {} : {oauth: oauthConfig}),
+      ...(options.withOAuthConfig === false ? {} : {oauth: options.oauthConfig ?? oauthConfig}),
     },
   })
 
@@ -156,6 +163,39 @@ describe('startOAuthAuthorization', () => {
     expect(url.searchParams.getAll('resource')).toEqual(['urn:io.sanity:organization:org123'])
   })
 
+  it('stashes the current location to return to, keeping app params intact', async () => {
+    const href = 'https://app.example.com/documents/abc?state=draft&code=x#h'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe(href)
+  })
+
+  it('strips stale OAuth params from the stashed location when already on the callback route', async () => {
+    const href = 'https://app.example.com/callback?x=1&code=old&state=old'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
+  })
+
+  it('omits the resource param when no organizationId is configured', async () => {
+    const assign = vi.fn()
+    vi.stubGlobal('window', {location: {assign}})
+    setup({initialLocationHref: 'https://app.example.com/', oauthConfig: oauthConfigNoOrg})
+
+    await startOAuthAuthorization(instance!)
+
+    const url = new URL(assign.mock.calls[0][0])
+    expect(url.searchParams.has('resource')).toBe(false)
+  })
+
   it('throws when OAuth is not configured', async () => {
     setup({withOAuthConfig: false})
     await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
@@ -203,6 +243,75 @@ describe('handleOAuthCallback', () => {
     })
   })
 
+  it('returns the stashed same-origin location after a successful exchange', async () => {
+    const returnTo = 'https://app.example.com/documents/abc?x=1'
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: returnTo,
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(returnTo)
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('ignores a stashed location on a different origin', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://evil.example.com/',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('ignores a stashed location that is not a URL', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'not a url',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('does not restore the stashed location on a state mismatch', async () => {
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'different',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('does not restore the stashed location on an ?error= callback', async () => {
+    const {session} = setup({sessionSeed: {[OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep'}})
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
   it('does not perform a second exchange on a duplicate concurrent invocation', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)
@@ -221,6 +330,31 @@ describe('handleOAuthCallback', () => {
     expect(await first).toBe('https://app.example.com/callback')
   })
 
+  it('does not clobber LOGGED_IN when called again with a stale callback URL', async () => {
+    const {request} = setup({
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    // Artifacts are now cleared; a repeat with the same URL fails state validation.
+    // Seed fresh artifacts as if a re-authorization started in this tab: the
+    // ignored stale callback must not wipe them.
+    sessionStorage.setItem(OAUTH_STATE_KEY, 'state-next')
+    sessionStorage.setItem(OAUTH_VERIFIER_KEY, 'verifier-next')
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: 'new-access',
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+    expect(sessionStorage.getItem(OAUTH_VERIFIER_KEY)).toBe('verifier-next')
+  })
+
   it('surfaces an ?error= callback as ERROR without exchanging', async () => {
     const {request} = setup()
 
@@ -234,6 +368,25 @@ describe('handleOAuthCallback', () => {
     expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
   })
 
+  it('ignores an ?error= callback when a session is already established', async () => {
+    setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-next', [OAUTH_VERIFIER_KEY]: 'verifier-next'},
+    })
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: seededTokens.accessToken,
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+  })
+
   it('surfaces an ?error= callback without a description', async () => {
     setup()
     await handleOAuthCallback(instance!, 'https://app.example.com/callback?error=access_denied')
@@ -269,6 +422,18 @@ describe('handleOAuthCallback', () => {
     expect(request).not.toHaveBeenCalled()
   })
 
+  it('omits the resource param when no organizationId is configured', async () => {
+    const {request} = setup({
+      oauthConfig: oauthConfigNoOrg,
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    await handleOAuthCallback(instance!, callbackHref)
+
+    const body = parseBody(request.mock.calls[0][0].body)
+    expect(body.has('resource')).toBe(false)
+  })
+
   it('sets ERROR when the token exchange fails', async () => {
     const request = vi.fn().mockRejectedValue(new Error('boom'))
     const {session} = setup({
@@ -303,6 +468,18 @@ describe('refreshOAuthTokens', () => {
     expect(readStored(storageArea)).toMatchObject({accessToken: 'new-access'})
   })
 
+  it('omits the resource param when no organizationId is configured', async () => {
+    const {request} = setup({
+      oauthConfig: oauthConfigNoOrg,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await refreshOAuthTokens(instance!)
+
+    const body = parseBody(request.mock.calls[0][0].body)
+    expect(body.has('resource')).toBe(false)
+  })
+
   it('shares a single in-flight request across concurrent callers', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)