@sanity/sdk 3.4.0-rc.0 → 3.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/sdk",
-  "version": "3.4.0-rc.0",
+  "version": "3.4.0",
   "private": false,
   "description": "Sanity SDK",
   "keywords": [
@@ -55,8 +55,8 @@
     "@sanity/message-protocol": "^0.24.0",
     "@sanity/mutate": "^0.18.2",
     "@sanity/telemetry": "^1.1.0",
-    "@sanity/types": "^6.14.1",
-    "groq": "^6.13.2",
+    "@sanity/types": "^6.15.0",
+    "groq": "^6.15.0",
     "groq-js": "^2.0.0",
     "reselect": "^5.1.1",
     "rxjs": "^7.8.2",
@@ -69,12 +69,12 @@
     "@repo/package.config": "0.0.1",
     "@repo/tsconfig": "0.0.1",
     "@sanity/browserslist-config": "^1.0.5",
-    "@sanity/pkg-utils": "^13.0.0",
-    "@types/node": "^24.13.5",
+    "@sanity/pkg-utils": "^13.0.1",
+    "@types/node": "^24.13.6",
     "@vitest/coverage-v8": "^5.0.1",
     "eslint": "^10.10.0",
     "oxfmt": "^0.68.0",
-    "rolldown": "^1.2.8",
+    "rolldown": "^1.2.9",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",
     "vitest": "^5.0.1"

package/src/_exports/dashboard.ts

@@ -16,9 +16,14 @@ export type {
 export {connectMessageBus} from '../dashboard/messageBus/bus'
 export {MessageBusError} from '../dashboard/messageBus/bus'
 export type {
+  ApplicationActivity,
   ApplicationConfig,
   ApplicationConfigAppType,
+  ApplicationContext,
+  Capability,
+  CapabilityRecord,
   DashboardTopics,
+  DocumentActivity,
   EventTopic,
   EventTopicDef,
   NavigationLocation,
@@ -33,4 +38,5 @@ export type {
   Topics,
   ValueOf,
 } from '../dashboard/messageBus/topics'
+export {capabilities} from '../dashboard/messageBus/topics'
 export {type TopicData, TopicError} from '../dashboard/messageBus/topicStore'

package/src/auth/authStore.test.ts

@@ -339,24 +339,6 @@ describe('authStore', () => {
       expect(options.authMethod).toBe('localstorage')
     })
 
-    it('only exposes oauth options when the resolved mode is oauth', () => {
-      const oauth = {
-        clientId: 'client-abc',
-        redirectUri: 'https://app.example.com/callback',
-        organizationId: 'org123',
-      }
-      vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(null)
-      vi.mocked(getTokenFromStorage).mockReturnValue(null)
-
-      // studio takes precedence over oauth, so oauth options must be dropped
-      instance = createSanityInstance({projectId: 'p', dataset: 'd', studio: {}, auth: {oauth}})
-      expect(authStore.getInitialState(instance, null).options.oauth).toBeUndefined()
-      instance.dispose()
-
-      instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {oauth}})
-      expect(authStore.getInitialState(instance, null).options.oauth).toEqual(oauth)
-    })
-
     it('logs auth initialized in logged out state when no token available', () => {
       instance = createSanityInstance({
         projectId: 'p',

package/src/auth/authStore.ts

@@ -191,10 +191,7 @@ export const authStore = defineStore<AuthStoreState>({
         storageKey: result.storageKey,
         storageArea: result.storageArea,
         authMethod: result.authMethod,
-        // Only expose oauth options when the oauth strategy is actually in use,
-        // so mode-gated actions (logout, handleAuthCallback) stay consistent
-        // with the resolved mode (e.g. `studio` takes precedence over `oauth`).
-        oauth: mode === 'oauth' ? authConfig.oauth : undefined,
+        oauth: authConfig.oauth,
       },
     }
   },

package/src/auth/handleAuthCallback.test.ts

@@ -5,7 +5,6 @@ import {createSanityInstance, type SanityInstance} from '../store/createSanityIn
 import {AuthStateType} from './authStateType'
 import {getAuthState} from './authStore'
 import {handleAuthCallback} from './handleAuthCallback'
-import {handleOAuthCallback} from './oauth/oauthActions'
 import {subscribeToStateAndFetchCurrentUser} from './subscribeToStateAndFetchCurrentUser'
 import {subscribeToStorageEventsAndSetToken} from './subscribeToStorageEventsAndSetToken'
 import {getAuthCode, getTokenFromLocation, getTokenFromStorage} from './utils'
@@ -23,11 +22,6 @@ vi.mock('./utils', async (importOriginal) => {
 vi.mock('./subscribeToStateAndFetchCurrentUser')
 vi.mock('./subscribeToStorageEventsAndSetToken')
 
-vi.mock('./oauth/oauthActions', async (importOriginal) => {
-  const original = await importOriginal<typeof import('./oauth/oauthActions')>()
-  return {...original, handleOAuthCallback: vi.fn()}
-})
-
 // Mock logger to prevent actual logging during tests
 vi.mock('../utils/logger', async (importOriginal) => {
   const original = await importOriginal<typeof import('../utils/logger')>()
@@ -283,31 +277,4 @@ describe('handleCallback', () => {
     // Verify logger was called
     expect(createLogger).toHaveBeenCalled()
   })
-
-  it('delegates to handleOAuthCallback in OAuth mode', async () => {
-    const clientFactory = vi.fn()
-    vi.mocked(getTokenFromStorage).mockReturnValue(null)
-    vi.mocked(handleOAuthCallback).mockResolvedValue('https://app.example.com/callback')
-
-    instance = createSanityInstance({
-      projectId: 'p',
-      dataset: 'd',
-      auth: {
-        clientFactory,
-        oauth: {
-          clientId: 'client-abc',
-          redirectUri: 'https://app.example.com/callback',
-          organizationId: 'org123',
-        },
-      },
-    })
-
-    const href = 'https://app.example.com/callback?code=abc&state=xyz'
-    const result = await handleAuthCallback(instance, href)
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(handleOAuthCallback).toHaveBeenCalledWith(instance, href)
-    expect(getAuthCode).not.toHaveBeenCalled()
-    expect(clientFactory).not.toHaveBeenCalled()
-  })
 })

package/src/auth/handleAuthCallback.ts

@@ -3,7 +3,6 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore, type AuthStoreState, type DashboardContext} from './authStore'
-import {handleOAuthCallback} from './oauth/oauthActions'
 import {
   createLoggedInAuthState,
   getAuthCode,
@@ -13,10 +12,6 @@ import {
 } from './utils'
 
 /**
- * Handles the auth redirect callback. In OAuth mode this delegates to
- * {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
- * long-lived token.
- *
  * @public
  */
 export const handleAuthCallback = bindActionGlobally(
@@ -24,7 +19,7 @@ export const handleAuthCallback = bindActionGlobally(
   async ({state, instance}, locationHref: string = getDefaultLocation()) => {
     const logger = getAuthLogger(instance)
 
-    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth} =
+    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey} =
       state.get().options
 
     // If a token is provided, no need to handle callback
@@ -33,11 +28,6 @@ export const handleAuthCallback = bindActionGlobally(
       return false
     }
 
-    if (oauth) {
-      logger.debug('OAuth mode - delegating to handleOAuthCallback')
-      return handleOAuthCallback(instance, locationHref)
-    }
-
     // Don't handle the callback if already in flight.
     const {authState} = state.get()
     if (authState.type === AuthStateType.LOGGING_IN && authState.isExchangingToken) {

package/src/auth/logout.test.ts

@@ -169,7 +169,7 @@ describe('logout', () => {
     expect(removeItem).toHaveBeenCalledWith('__sanity_auth_token')
   })
 
-  it('revokes OAuth tokens instead of calling /auth/logout in OAuth mode', async () => {
+  it('clears the OAuth tokens from the store on logout', async () => {
     const oauthTokens: OAuthTokens = {
       accessToken: 'oauth-access',
       tokenType: 'bearer',
@@ -204,16 +204,8 @@ describe('logout', () => {
     // Boots logged in with the persisted OAuth tokens exposed on the store.
     expect(getOAuthTokensState(instance).getCurrent()).toMatchObject({accessToken: 'oauth-access'})
 
-    const first = logout(instance)
-    // Session is marked as destroying so a concurrent call is a no-op
-    expect(getAuthState(instance).getCurrent()).toMatchObject({isDestroyingSession: true})
     await logout(instance)
-    await first
 
-    expect(mockRequest).toHaveBeenCalledTimes(1)
-    expect(mockRequest).toHaveBeenCalledWith(
-      expect.objectContaining({url: '/auth/oauth/revoke', tag: 'oauth.revoke'}),
-    )
     expect(getOAuthTokensState(instance).getCurrent()).toBeNull()
     expect(getAuthState(instance).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
     expect(map.get(OAUTH_TOKENS_KEY)).toBeUndefined()

package/src/auth/logout.ts

@@ -3,22 +3,14 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
-import {revokeOAuthTokens} from './oauth/oauthActions'
 
 /**
- * Logs the current user out. In OAuth mode this revokes the OAuth tokens
- * instead of calling the legacy `/auth/logout` endpoint; revocation is
- * best-effort, so the OAuth path resolves even if the revoke request fails,
- * whereas the legacy path rejects when `/auth/logout` fails. Local state and
- * storage are cleared in both cases.
- *
  * @public
  */
 export const logout = bindActionGlobally(authStore, async ({state, instance}) => {
   const logger = getAuthLogger(instance)
 
-  const {clientFactory, apiHost, providedToken, storageArea, storageKey, oauth} =
-    state.get().options
+  const {clientFactory, apiHost, providedToken, storageArea, storageKey} = state.get().options
 
   // If a token is statically provided, logout does nothing
   if (providedToken) {
@@ -33,15 +25,6 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.debug('Skipping logout - already in progress')
     return
   }
-
-  if (oauth) {
-    logger.debug('OAuth mode - revoking tokens instead of calling /auth/logout')
-    state.set('loggingOut', {
-      authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: true},
-    })
-    await revokeOAuthTokens(instance)
-    return
-  }
   const token = authState.type === AuthStateType.LOGGED_IN && authState.token
 
   try {

package/src/auth/oauth/oauthActions.test.ts

@@ -9,7 +9,6 @@ import {subscribeToStateAndFetchCurrentUser} from '../subscribeToStateAndFetchCu
 import {
   getOAuthTokensState,
   handleOAuthCallback,
-  OAUTH_RETURN_TO_KEY,
   OAUTH_STATE_KEY,
   OAUTH_VERIFIER_KEY,
   refreshOAuthTokens,
@@ -43,11 +42,6 @@ const oauthConfig = {
   organizationId: 'org123',
 }
 
-const oauthConfigNoOrg = {
-  clientId: 'client-abc',
-  redirectUri: 'https://app.example.com/callback',
-}
-
 const seededTokens: OAuthTokens = {
   accessToken: 'stored-access',
   tokenType: 'bearer',
@@ -99,7 +93,6 @@ interface SetupOptions {
   sessionSeed?: Record<string, string>
   initialLocationHref?: string
   withOAuthConfig?: boolean
-  oauthConfig?: {clientId: string; redirectUri: string; organizationId?: string}
   apiHost?: string
 }
 
@@ -118,7 +111,7 @@ function setup(options: SetupOptions = {}) {
       storageArea,
       initialLocationHref: options.initialLocationHref ?? 'https://app.example.com/',
       ...(options.apiHost && {apiHost: options.apiHost}),
-      ...(options.withOAuthConfig === false ? {} : {oauth: options.oauthConfig ?? oauthConfig}),
+      ...(options.withOAuthConfig === false ? {} : {oauth: oauthConfig}),
     },
   })
 
@@ -163,39 +156,6 @@ describe('startOAuthAuthorization', () => {
     expect(url.searchParams.getAll('resource')).toEqual(['urn:io.sanity:organization:org123'])
   })
 
-  it('stashes the current location to return to, keeping app params intact', async () => {
-    const href = 'https://app.example.com/documents/abc?state=draft&code=x#h'
-    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
-    vi.stubGlobal('location', {href})
-    const {session} = setup()
-
-    await startOAuthAuthorization(instance!)
-
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe(href)
-  })
-
-  it('strips stale OAuth params from the stashed location when already on the callback route', async () => {
-    const href = 'https://app.example.com/callback?x=1&code=old&state=old'
-    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
-    vi.stubGlobal('location', {href})
-    const {session} = setup()
-
-    await startOAuthAuthorization(instance!)
-
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
-  })
-
-  it('omits the resource param when no organizationId is configured', async () => {
-    const assign = vi.fn()
-    vi.stubGlobal('window', {location: {assign}})
-    setup({initialLocationHref: 'https://app.example.com/', oauthConfig: oauthConfigNoOrg})
-
-    await startOAuthAuthorization(instance!)
-
-    const url = new URL(assign.mock.calls[0][0])
-    expect(url.searchParams.has('resource')).toBe(false)
-  })
-
   it('throws when OAuth is not configured', async () => {
     setup({withOAuthConfig: false})
     await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
@@ -243,75 +203,6 @@ describe('handleOAuthCallback', () => {
     })
   })
 
-  it('returns the stashed same-origin location after a successful exchange', async () => {
-    const returnTo = 'https://app.example.com/documents/abc?x=1'
-    const {session} = setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: returnTo,
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(returnTo)
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
-  it('ignores a stashed location on a different origin', async () => {
-    setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'https://evil.example.com/',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-  })
-
-  it('ignores a stashed location that is not a URL', async () => {
-    setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'not a url',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-  })
-
-  it('does not restore the stashed location on a state mismatch', async () => {
-    const {session} = setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'different',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
-  it('does not restore the stashed location on an ?error= callback', async () => {
-    const {session} = setup({sessionSeed: {[OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep'}})
-
-    const result = await handleOAuthCallback(
-      instance!,
-      'https://app.example.com/callback?error=access_denied',
-    )
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
   it('does not perform a second exchange on a duplicate concurrent invocation', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)
@@ -330,31 +221,6 @@ describe('handleOAuthCallback', () => {
     expect(await first).toBe('https://app.example.com/callback')
   })
 
-  it('does not clobber LOGGED_IN when called again with a stale callback URL', async () => {
-    const {request} = setup({
-      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-    // Artifacts are now cleared; a repeat with the same URL fails state validation.
-    // Seed fresh artifacts as if a re-authorization started in this tab: the
-    // ignored stale callback must not wipe them.
-    sessionStorage.setItem(OAUTH_STATE_KEY, 'state-next')
-    sessionStorage.setItem(OAUTH_VERIFIER_KEY, 'verifier-next')
-    const result = await handleOAuthCallback(instance!, callbackHref)
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(request).toHaveBeenCalledTimes(1)
-    expect(getAuthState(instance!).getCurrent()).toMatchObject({
-      type: AuthStateType.LOGGED_IN,
-      token: 'new-access',
-    })
-    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
-    expect(sessionStorage.getItem(OAUTH_VERIFIER_KEY)).toBe('verifier-next')
-  })
-
   it('surfaces an ?error= callback as ERROR without exchanging', async () => {
     const {request} = setup()
 
@@ -368,25 +234,6 @@ describe('handleOAuthCallback', () => {
     expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
   })
 
-  it('ignores an ?error= callback when a session is already established', async () => {
-    setup({
-      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
-      sessionSeed: {[OAUTH_STATE_KEY]: 'state-next', [OAUTH_VERIFIER_KEY]: 'verifier-next'},
-    })
-
-    const result = await handleOAuthCallback(
-      instance!,
-      'https://app.example.com/callback?error=access_denied',
-    )
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(getAuthState(instance!).getCurrent()).toMatchObject({
-      type: AuthStateType.LOGGED_IN,
-      token: seededTokens.accessToken,
-    })
-    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
-  })
-
   it('surfaces an ?error= callback without a description', async () => {
     setup()
     await handleOAuthCallback(instance!, 'https://app.example.com/callback?error=access_denied')
@@ -422,18 +269,6 @@ describe('handleOAuthCallback', () => {
     expect(request).not.toHaveBeenCalled()
   })
 
-  it('omits the resource param when no organizationId is configured', async () => {
-    const {request} = setup({
-      oauthConfig: oauthConfigNoOrg,
-      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
-    })
-
-    await handleOAuthCallback(instance!, callbackHref)
-
-    const body = parseBody(request.mock.calls[0][0].body)
-    expect(body.has('resource')).toBe(false)
-  })
-
   it('sets ERROR when the token exchange fails', async () => {
     const request = vi.fn().mockRejectedValue(new Error('boom'))
     const {session} = setup({
@@ -468,18 +303,6 @@ describe('refreshOAuthTokens', () => {
     expect(readStored(storageArea)).toMatchObject({accessToken: 'new-access'})
   })
 
-  it('omits the resource param when no organizationId is configured', async () => {
-    const {request} = setup({
-      oauthConfig: oauthConfigNoOrg,
-      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
-    })
-
-    await refreshOAuthTokens(instance!)
-
-    const body = parseBody(request.mock.calls[0][0].body)
-    expect(body.has('resource')).toBe(false)
-  })
-
   it('shares a single in-flight request across concurrent callers', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)