@sanity/sdk 3.4.0-rc.0 → 3.4.0

package/src/auth/oauth/oauthActions.ts

@@ -17,25 +17,6 @@ export const OAUTH_VERIFIER_KEY = '__sanity_oauth_verifier'
 /** sessionStorage key for the CSRF `state` value. */
 export const OAUTH_STATE_KEY = '__sanity_oauth_state'
 
-/** sessionStorage key for the location to return to after the callback. */
-export const OAUTH_RETURN_TO_KEY = '__sanity_oauth_return_to'
-
-const OAUTH_CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description']
-
-/** Strips the OAuth callback params from a URL. */
-function stripOAuthParams(href: string): string {
-  const url = new URL(href, DEFAULT_BASE)
-  for (const param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param)
-  return url.toString()
-}
-
-/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
-function isCallbackRoute(href: string, redirectUri: string): boolean {
-  const current = new URL(href, DEFAULT_BASE)
-  const redirect = new URL(redirectUri, DEFAULT_BASE)
-  return current.origin === redirect.origin && current.pathname === redirect.pathname
-}
-
 interface TokenEndpointResponse {
   access_token: string
   token_type: string
@@ -48,19 +29,6 @@ function getResourceIndicator(organizationId: string): string {
   return `urn:io.sanity:organization:${organizationId}`
 }
 
-/**
- * Appends the RFC 8707 `resource` indicator to `params` when an organisation
- * id is configured. Without one, the request is left unscoped.
- */
-function appendResourceIndicator(
-  params: URLSearchParams,
-  oauth: NonNullable<AuthOptions['oauth']>,
-): void {
-  if (oauth.organizationId) {
-    params.append('resource', getResourceIndicator(oauth.organizationId))
-  }
-}
-
 /**
  * Serialises tokens for storage, converting `expiresAt` to an ISO string.
  *
@@ -102,21 +70,6 @@ function createOAuthClient(options: AuthOptions): SanityClient {
   })
 }
 
-/** POSTs form-encoded params to the OAuth token endpoint. */
-function postTokenRequest(
-  client: SanityClient,
-  params: URLSearchParams,
-  tag: string,
-): Promise<TokenEndpointResponse> {
-  return client.request<TokenEndpointResponse>({
-    method: 'POST',
-    url: '/auth/oauth/token',
-    headers: {'content-type': 'application/x-www-form-urlencoded'},
-    body: params.toString(),
-    tag,
-  })
-}
-
 /** Converts a token endpoint response to the {@link OAuthTokens} shape. */
 function toOAuthTokens(response: TokenEndpointResponse): OAuthTokens {
   return {
@@ -146,17 +99,6 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
   const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
   session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier)
   session?.setItem(OAUTH_STATE_KEY, oauthState)
-  // The redirect URI must match the registered one exactly, so the current
-  // location (deep link) is stashed here and restored by the callback. OAuth
-  // params are only stripped when we are already on the callback route, so
-  // legitimate app params like `?state=draft` survive the round trip.
-  const currentHref = getDefaultLocation()
-  if (currentHref !== DEFAULT_BASE) {
-    const returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri)
-      ? stripOAuthParams(currentHref)
-      : currentHref
-    session?.setItem(OAUTH_RETURN_TO_KEY, returnTo)
-  }
 
   const authorizeUrl = new URL(
     '/v1/auth/oauth/authorize',
@@ -168,7 +110,7 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
   authorizeUrl.searchParams.set('state', oauthState)
   authorizeUrl.searchParams.set('code_challenge', codeChallenge)
   authorizeUrl.searchParams.set('code_challenge_method', 'S256')
-  appendResourceIndicator(authorizeUrl.searchParams, options.oauth)
+  authorizeUrl.searchParams.append('resource', getResourceIndicator(options.oauth.organizationId))
 
   logger.info('Starting OAuth authorization')
   if (typeof window !== 'undefined' && typeof window.location?.assign === 'function') {
@@ -181,14 +123,9 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
  * responses, exchanges the authorization `code` for tokens, persists them, and
  * transitions to `LOGGED_IN`.
  *
- * Returns the URL for the caller to `history.replaceState` to when a callback
- * was processed: on success, the same-origin location the user was on when
- * the flow started (if any), otherwise the callback URL cleaned of OAuth
- * params. Returns `false` when there was nothing to handle (no code, or an
- * exchange already in progress). A callback that fails validation while a
- * session is already `LOGGED_IN` (e.g. a remount before the params were
- * stripped) is ignored with a warning and still returns the cleaned URL, so a
- * string result does not imply an exchange ran.
+ * Returns the callback URL cleaned of OAuth params (for the caller to
+ * `history.replaceState`) when a callback was processed, or `false` when there
+ * was nothing to handle (no code, or an exchange already in progress).
  *
  * @public
  */
@@ -215,29 +152,22 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
 
-    const cleanedUrl = stripOAuthParams(locationHref)
-
-    // Callback failures move to ERROR, unless a session is already
-    // established: a stale callback URL (e.g. remount before the params were
-    // stripped, after the artifacts were cleared) or a denied re-authorization
-    // must not clobber LOGGED_IN.
-    const rejectCallback = (name: string, message: string): string => {
-      if (authState.type === AuthStateType.LOGGED_IN) {
-        // Leave PKCE artifacts alone: a re-authorization may be in flight.
-        logger.warn(`${message} — ignoring callback, session already established`)
-        return cleanedUrl
-      }
-      logger.error(`${message} — rejecting callback`)
-      clearOAuthArtifacts(session)
-      state.set(name, {authState: {type: AuthStateType.ERROR, error: new Error(message)}})
-      return cleanedUrl
+    const cleanedUrlObj = new URL(locationHref, DEFAULT_BASE)
+    for (const param of ['code', 'state', 'error', 'error_description']) {
+      cleanedUrlObj.searchParams.delete(param)
     }
+    const cleanedUrl = cleanedUrlObj.toString()
 
     if (error) {
-      return rejectCallback(
-        'oauthCallbackError',
-        errorDescription ? `${error}: ${errorDescription}` : error,
-      )
+      logger.warn('OAuth callback returned an error', {error, errorDescription})
+      clearOAuthArtifacts(session)
+      state.set('oauthCallbackError', {
+        authState: {
+          type: AuthStateType.ERROR,
+          error: new Error(errorDescription ? `${error}: ${errorDescription}` : error),
+        },
+      })
+      return cleanedUrl
     }
 
     if (!code) {
@@ -247,12 +177,22 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const storedState = session?.getItem(OAUTH_STATE_KEY) ?? null
     if (!returnedState || !storedState || returnedState !== storedState) {
-      return rejectCallback('oauthStateMismatch', 'OAuth state mismatch')
+      logger.error('OAuth state mismatch — rejecting callback')
+      clearOAuthArtifacts(session)
+      state.set('oauthStateMismatch', {
+        authState: {type: AuthStateType.ERROR, error: new Error('OAuth state mismatch')},
+      })
+      return cleanedUrl
     }
 
     const codeVerifier = session?.getItem(OAUTH_VERIFIER_KEY) ?? null
     if (!codeVerifier) {
-      return rejectCallback('oauthVerifierMissing', 'OAuth code verifier missing')
+      logger.error('OAuth code verifier missing — cannot exchange code')
+      clearOAuthArtifacts(session)
+      state.set('oauthVerifierMissing', {
+        authState: {type: AuthStateType.ERROR, error: new Error('OAuth code verifier missing')},
+      })
+      return cleanedUrl
     }
 
     logger.info('Exchanging OAuth code for tokens')
@@ -268,13 +208,18 @@ export const handleOAuthCallback = bindActionGlobally(
         code_verifier: codeVerifier,
         redirect_uri: options.oauth.redirectUri,
         client_id: options.oauth.clientId,
+        resource: getResourceIndicator(options.oauth.organizationId),
+      })
+      const response = await client.request<TokenEndpointResponse>({
+        method: 'POST',
+        url: '/auth/oauth/token',
+        headers: {'content-type': 'application/x-www-form-urlencoded'},
+        body: params.toString(),
+        tag: 'oauth.token',
       })
-      appendResourceIndicator(params, options.oauth)
-      const response = await postTokenRequest(client, params, 'oauth.token')
 
       const tokens = toOAuthTokens(response)
       options.storageArea?.setItem(options.storageKey, serializeTokens(tokens))
-      const returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri)
       clearOAuthArtifacts(session)
 
       logger.info('OAuth tokens obtained, user logged in')
@@ -282,7 +227,7 @@ export const handleOAuthCallback = bindActionGlobally(
         authState: createLoggedInAuthState(tokens.accessToken, null),
         oauthTokens: tokens,
       })
-      return returnTo ?? cleanedUrl
+      return cleanedUrl
     } catch (exchangeError) {
       logger.error('Failed to exchange OAuth code for tokens', {error: exchangeError})
       clearOAuthArtifacts(session)
@@ -351,9 +296,15 @@ async function doRefreshOAuthTokens({
       grant_type: 'refresh_token',
       refresh_token: current.refreshToken,
       client_id: options.oauth.clientId,
+      resource: getResourceIndicator(options.oauth.organizationId),
+    })
+    const response = await client.request<TokenEndpointResponse>({
+      method: 'POST',
+      url: '/auth/oauth/token',
+      headers: {'content-type': 'application/x-www-form-urlencoded'},
+      body: params.toString(),
+      tag: 'oauth.refresh',
     })
-    appendResourceIndicator(params, options.oauth)
-    const response = await postTokenRequest(client, params, 'oauth.refresh')
 
     const tokens = toOAuthTokens(response)
     if (!tokens.refreshToken) tokens.refreshToken = current.refreshToken
@@ -435,20 +386,4 @@ export const getOAuthTokensState = bindActionGlobally(
 function clearOAuthArtifacts(session: Storage | undefined): void {
   session?.removeItem(OAUTH_VERIFIER_KEY)
   session?.removeItem(OAUTH_STATE_KEY)
-  session?.removeItem(OAUTH_RETURN_TO_KEY)
-}
-
-/**
- * Reads the stashed pre-authorize location, only honouring it when it shares
- * the registered redirect URI's origin so a tampered value cannot redirect
- * off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
- */
-function getSameOriginReturnTo(session: Storage | undefined, redirectUri: string): string | null {
-  const returnTo = session?.getItem(OAUTH_RETURN_TO_KEY) ?? null
-  if (!returnTo) return null
-  try {
-    return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null
-  } catch {
-    return null
-  }
 }

package/src/auth/oauth/oauthAuth.test.ts

@@ -83,11 +83,6 @@ describe('serialize/deserialize tokens', () => {
     expect(deserializeTokens('{"foo":"bar"}')).toBeNull()
     expect(deserializeTokens('123')).toBeNull()
   })
-
-  it('returns null when expiresAt does not parse to a valid date', () => {
-    const raw = JSON.stringify({...JSON.parse(serializeTokens(tokens)), expiresAt: 'garbage'})
-    expect(deserializeTokens(raw)).toBeNull()
-  })
 })
 
 describe('getOauthInitialState', () => {
@@ -99,16 +94,6 @@ describe('getOauthInitialState', () => {
     expect(result.authMethod).toBe('localstorage')
   })
 
-  it('returns LOGGED_OUT and clears storage when persisted tokens are corrupt', () => {
-    const storageArea = createMemoryStorage({
-      [OAUTH_TOKENS_KEY]: '{"accessToken":"a","expiresAt":"garbage"}',
-    })
-    const result = getOauthInitialState(baseOptions({storageArea}))
-    expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
-    expect(result.oauthTokens).toBeUndefined()
-    expect(storageArea.getItem(OAUTH_TOKENS_KEY)).toBeNull()
-  })
-
   it('returns LOGGING_IN when the callback URL matches the redirect URI', () => {
     const storageArea = createMemoryStorage()
     const result = getOauthInitialState(
@@ -125,14 +110,6 @@ describe('getOauthInitialState', () => {
     expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
   })
 
-  it('returns LOGGED_OUT when the redirect URI only carries a stray state param', () => {
-    const storageArea = createMemoryStorage()
-    const result = getOauthInitialState(
-      baseOptions({storageArea, initialLocationHref: 'https://app/callback?state=s'}),
-    )
-    expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
-  })
-
   it('returns LOGGED_OUT when there are no tokens and no callback', () => {
     const storageArea = createMemoryStorage()
     const result = getOauthInitialState(baseOptions({storageArea}))

package/src/auth/oauth/oauthAuth.ts

@@ -19,9 +19,7 @@ interface SerializedOAuthTokens extends Omit<OAuthTokens, 'expiresAt'> {
 
 /**
  * Parses persisted token JSON back into {@link OAuthTokens}. Returns `null`
- * when the value is missing or malformed, including an `expiresAt` that does
- * not parse to a valid date (an `Invalid Date` would otherwise read as never
- * expiring, since `NaN <= now` is always `false`).
+ * when the value is missing or malformed.
  *
  * @internal
  */
@@ -40,13 +38,11 @@ export function deserializeTokens(raw: string | null): OAuthTokens | null {
       return null
     }
     const value = parsed as SerializedOAuthTokens
-    const expiresAt = new Date(value.expiresAt)
-    if (Number.isNaN(expiresAt.getTime())) return null
     return {
       accessToken: value.accessToken,
       tokenType: 'bearer',
       expiresIn: value.expiresIn,
-      expiresAt,
+      expiresAt: new Date(value.expiresAt),
       ...(value.refreshToken !== undefined && {refreshToken: value.refreshToken}),
     }
   } catch {
@@ -59,7 +55,7 @@ export function deserializeTokens(raw: string | null): OAuthTokens | null {
  *
  * State discovery order:
  * 1. Persisted tokens in `__sanity_oauth_tokens` → `LOGGED_IN`
- * 2. Callback URL (contains `code` or `error` and matches `redirectUri`)
+ * 2. Callback URL (contains `code`/`state`/`error` and matches `redirectUri`)
  *    → `LOGGING_IN`
  * 3. Otherwise → `LOGGED_OUT`
  *
@@ -72,12 +68,7 @@ export function getOauthInitialState(options: AuthStrategyOptions): AuthStrategy
   const redirectUri = authConfig.oauth?.redirectUri
 
   // Persisted tokens win
-  const rawTokens = storageArea?.getItem(OAUTH_TOKENS_KEY) ?? null
-  const tokens = deserializeTokens(rawTokens)
-  if (rawTokens && !tokens) {
-    // Corrupt entry: drop it so it cannot keep shadowing a fresh login
-    storageArea?.removeItem(OAUTH_TOKENS_KEY)
-  }
+  const tokens = deserializeTokens(storageArea?.getItem(OAUTH_TOKENS_KEY) ?? null)
   if (tokens) {
     return {
       authState: createLoggedInAuthState(tokens.accessToken, null),
@@ -89,12 +80,11 @@ export function getOauthInitialState(options: AuthStrategyOptions): AuthStrategy
     }
   }
 
-  // Callback URL with code/error whose origin + pathname match our redirect
-  // URI (query and hash are ignored). `state` alone is not a callback: the
-  // server always sends `code` or `error`, and handleOAuthCallback would
-  // otherwise leave the app stuck in LOGGING_IN.
+  // Callback URL with code/state/error whose origin + pathname match our
+  // redirect URI (query and hash are ignored).
   const {searchParams} = new URL(initialLocationHref, DEFAULT_BASE)
-  const isCallback = searchParams.has('code') || searchParams.has('error')
+  const isCallback =
+    searchParams.has('code') || searchParams.has('state') || searchParams.has('error')
   if (redirectUri && isCallback) {
     const loc = new URL(initialLocationHref, DEFAULT_BASE)
     const redirect = new URL(redirectUri, DEFAULT_BASE)

package/src/config/authConfig.ts

@@ -90,11 +90,8 @@ export interface AuthConfig {
     redirectUri: string
 
     /**
-     * Organisation id used for RFC 8707 resource scoping. Optional: when
-     * omitted, the `resource` parameter is left off the authorize and token
-     * requests, so the issued tokens are not restricted to a single
-     * organisation.
+     * Organisation id used for RFC 8707 resource scoping.
      */
-    organizationId?: string
+    organizationId: string
   }
 }

package/src/dashboard/messageBus/bus.test.ts

@@ -170,6 +170,14 @@ describe('dashboard connection', () => {
     expect(callerId).toBe('favorites')
   })
 
+  it('exposes the id a connection connected with', () => {
+    installMessageBus({appId: 'dashboard'})
+    const application = connectMessageBus({appId: 'favorites'})
+    if (!application) throw new Error('Expected a dashboard message bus')
+
+    expect(application.appId).toBe('favorites')
+  })
+
   it('writes state to a connected application through its client', () => {
     const dashboard = installMessageBus({appId: 'dashboard'})
     const application = connectMessageBus({appId: 'favorites'})
@@ -469,6 +477,102 @@ describe('event topics', () => {
     expect(code).toBe('NO_RESPONDER')
     expect(finalized).toBe(true)
   })
+
+  it('rejects a sender with REFUSED and the given message', async () => {
+    const messageBus = createMessageBus()
+    messageBus.subscribe('test.echo', (message) => message.reject('not on screen'))
+
+    const error = await messageBus.emit('test.echo', {n: 1}).catch((caught) => caught)
+    expect(error).toBeInstanceOf(MessageBusError)
+    expect(error).toMatchObject({code: 'REFUSED', message: 'not on screen'})
+  })
+
+  it('warns and ignores a reply or reject after a reject', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const messageBus = createMessageBus()
+    messageBus.subscribe('test.echo', (message) => {
+      message.reject('first')
+      message.reject('second')
+      message.reply({n: 100})
+    })
+
+    await expect(messageBus.emit('test.echo', {n: 1})).rejects.toMatchObject({
+      code: 'REFUSED',
+      message: 'first',
+    })
+    expect(warn).toHaveBeenCalledWith(
+      '[sanity-sdk:message-bus] reject ignored for "test.echo": no waiting caller or already replied',
+    )
+    expect(warn).toHaveBeenCalledWith(
+      '[sanity-sdk:message-bus] reply ignored for "test.echo": no waiting caller or already replied',
+    )
+  })
+})
+
+describe('state topic rejections', () => {
+  it('rejects a pending query with REFUSED when the host rejects', async () => {
+    const host = createMessageBus()
+    registerStateTopics(host, {'test.suspending': undefined})
+    const {app, client} = connect(host, {appId: 'favorites'})
+
+    const pending = app.query('test.suspending', {timeout: null})
+    client.reject('test.suspending', 'hidden')
+
+    await expect(pending).rejects.toMatchObject({code: 'REFUSED', message: 'hidden'})
+  })
+
+  it('rejects a later query with REFUSED until a value is written', async () => {
+    const host = createMessageBus()
+    registerStateTopics(host, {'test.suspending': undefined})
+    const {app, client} = connect(host, {appId: 'favorites'})
+    client.reject('test.suspending', 'hidden')
+
+    await expect(app.query('test.suspending', {timeout: null})).rejects.toMatchObject({
+      code: 'REFUSED',
+      message: 'hidden',
+    })
+
+    client.emit('test.suspending', 'ready')
+    await expect(app.query('test.suspending')).resolves.toBe('ready')
+  })
+
+  it('rejects a query for a topic the connection already holds once rejected', async () => {
+    const host = createMessageBus()
+    registerStateTopics(host, {'test.count': 0})
+    const {app, client} = connect(host, {appId: 'favorites'})
+    client.emit('test.count', 1)
+    await expect(app.query('test.count')).resolves.toBe(1)
+
+    client.reject('test.count', 'hidden')
+
+    await expect(app.query('test.count')).rejects.toMatchObject({code: 'REFUSED'})
+    expect(app.subscribe('test.count').getCurrent()).toBe(1)
+  })
+
+  it('leaves subscribers silent through a rejection and delivers the later value', () => {
+    const host = createMessageBus()
+    registerStateTopics(host, {'test.suspending': undefined})
+    const {app, client} = connect(host, {appId: 'favorites'})
+    const seen: string[] = []
+    let errored: unknown
+    app.subscribe('test.suspending', (value) => seen.push(value), {})
+    app.subscribe('test.suspending').subscribe({error: (error) => (errored = error)})
+
+    client.reject('test.suspending', 'hidden')
+    client.emit('test.suspending', 'ready')
+
+    expect(errored).toBeUndefined()
+    expect(seen).toEqual(['ready'])
+  })
+
+  it('ignores a rejection once the connection has closed', async () => {
+    const host = createMessageBus()
+    registerStateTopics(host, {'test.count': 0})
+    const {app, client} = connect(host, {appId: 'favorites'})
+
+    app.disconnect()
+    expect(() => client.reject('test.count', 'hidden')).not.toThrow()
+  })
 })
 
 describe('application connections', () => {
@@ -883,6 +987,20 @@ describe('reset', () => {
     expect(seen).toEqual([{ok: true, value: null}, panel])
   })
 
+  it("clears a connection's rejections along with its state", async () => {
+    const host = installMessageBus({appId: 'dashboard'})
+    const application = connectMessageBus({appId: 'favorites'})
+    if (!application) throw new Error('Expected a dashboard message bus')
+    let client: MessageBusClient | undefined
+    host.connections.subscribe((connected) => (client = connected))
+    client?.reject('panels.mode', 'hidden')
+    await expect(application.query('panels.mode')).rejects.toMatchObject({code: 'REFUSED'})
+
+    resetMessageBus()
+
+    await expect(application.query('panels.mode')).resolves.toEqual({ok: true, value: null})
+  })
+
   it('keeps announcing new connections to a host subscribed before the reset', () => {
     const host = installMessageBus({appId: 'dashboard'})
     const seen: string[] = []