@stackframe/js 2.8.56 → 2.8.59

package/dist/index.d.ts

@@ -37,6 +37,15 @@ type RedirectMethod = "window" | "none" | {
 };
 type GetCurrentUserOptions<HasTokenStore> = {
     or?: 'redirect' | 'throw' | 'return-null' | 'anonymous' | /** @deprecated */ 'anonymous-if-exists[deprecated]';
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements like email verification).
+     * By default, restricted users are filtered out (treated similar to anonymous users).
+     *
+     * Note: This option cannot be set to false when `or: 'anonymous'` is used, as all anonymous users are also restricted.
+     *
+     * @default false
+     */
+    includeRestricted?: boolean;
     tokenStore?: TokenStoreInit;
 } & (HasTokenStore extends false ? {
     tokenStore: TokenStoreInit;
@@ -84,6 +93,7 @@ type HandlerUrls = {
     teamInvitation: string;
     mfa: string;
     error: string;
+    onboarding: string;
 };
 type OAuthScopesOnSignIn = {
     [key in ProviderType]: string[];
@@ -99,6 +109,20 @@ type AuthLike<ExtraOptions = {}> = {
     signOut(options?: {
         redirectUrl?: URL | string;
     }): Promise<void>;
+    /**
+     * Returns the current access token, or null if the user is not signed in.
+     *
+     * The access token is a short-lived JWT that can be used to authenticate requests to external servers.
+     * It will be automatically refreshed when it expires.
+     */
+    getAccessToken(options?: {} & ExtraOptions): Promise<string | null>;
+    /**
+     * Returns the current refresh token, or null if the user is not signed in.
+     *
+     * The refresh token is a long-lived token that can be used to obtain new access tokens.
+     * It should be kept secret and never exposed to the client.
+     */
+    getRefreshToken(options?: {} & ExtraOptions): Promise<string | null>;
     /**
      * Returns headers for sending authenticated HTTP requests to external servers. Most commonly used in cross-origin
      * requests. Similar to `getAuthJson`, but specifically for HTTP requests.
@@ -115,8 +139,8 @@ type AuthLike<ExtraOptions = {}> = {
      * must include `x-stack-auth` in the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
      * of the CORS preflight response.
      *
-     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAuthJson()` function
-     * instead.
+     * If you are not using HTTP (and hence cannot set headers), you will need to use the `getAccessToken()` and
+     * `getRefreshToken()` functions instead.
      *
      * Example:
      *
@@ -140,6 +164,8 @@ type AuthLike<ExtraOptions = {}> = {
         "x-stack-auth": string;
     }>;
     /**
+     * @deprecated Use `getAccessToken()` and `getRefreshToken()` instead.
+     *
      * Creates a JSON-serializable object containing the information to authenticate a user on an external server.
      * Similar to `getAuthHeaders`, but returns an object that can be sent over any protocol instead of just
      * HTTP headers.
@@ -208,6 +234,17 @@ type CustomerProduct = {
     customerType: "user" | "team" | "custom";
     isServerOnly: boolean;
     stackable: boolean;
+    type: "one_time" | "subscription";
+    subscription: null | {
+        currentPeriodEnd: Date | null;
+        cancelAtPeriodEnd: boolean;
+        isCancelable: boolean;
+    };
+    switchOptions?: Array<{
+        productId: string;
+        displayName: string;
+        prices: InlineProduct["prices"];
+    }>;
 };
 type CustomerProductsList = CustomerProduct[] & {
     nextCursor: string | null;
@@ -223,6 +260,21 @@ type CustomerProductsRequestOptions = ({
 } & CustomerProductsListOptions) | ({
     customCustomerId: string;
 } & CustomerProductsListOptions);
+type CustomerDefaultPaymentMethod = {
+    id: string;
+    brand: string | null;
+    last4: string | null;
+    exp_month: number | null;
+    exp_year: number | null;
+} | null;
+type CustomerBilling = {
+    hasCustomer: boolean;
+    defaultPaymentMethod: CustomerDefaultPaymentMethod;
+};
+type CustomerPaymentMethodSetupIntent = {
+    clientSecret: string;
+    stripeAccountId: string;
+};
 type Customer<IsServer extends boolean = false> = {
     readonly id: string;
     createCheckoutUrl(options: ({
@@ -232,7 +284,16 @@ type Customer<IsServer extends boolean = false> = {
         product: InlineProduct;
         returnUrl?: string;
     } : never))): Promise<string>;
-} & AsyncStoreProperty<"item", [
+    createPaymentMethodSetupIntent(): Promise<CustomerPaymentMethodSetupIntent>;
+    setDefaultPaymentMethodFromSetupIntent(setupIntentId: string): Promise<CustomerDefaultPaymentMethod>;
+    switchSubscription(options: {
+        fromProductId: string;
+        toProductId: string;
+        priceId?: string;
+        quantity?: number;
+    }): Promise<void>;
+} & AsyncStoreProperty<"billing", [
+], CustomerBilling, false> & AsyncStoreProperty<"item", [
     itemId: string
 ], IsServer extends true ? ServerItem : Item, false> & AsyncStoreProperty<"products", [
     options?: CustomerProductsListOptions
@@ -254,6 +315,137 @@ type AdminSentEmail = {
     sentAt: Date;
     error?: unknown;
 };
+type AdminEmailOutboxRecipient = {
+    type: "user-primary-email";
+    userId: string;
+} | {
+    type: "user-custom-emails";
+    userId: string;
+    emails: string[];
+} | {
+    type: "custom-emails";
+    emails: string[];
+};
+type AdminEmailOutboxStatus = "paused" | "preparing" | "rendering" | "render-error" | "scheduled" | "queued" | "sending" | "server-error" | "skipped" | "bounced" | "delivery-delayed" | "sent" | "opened" | "clicked" | "marked-as-spam";
+type AdminEmailOutboxSimpleStatus = "in-progress" | "ok" | "error";
+type AdminEmailOutboxBase = {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    to: AdminEmailOutboxRecipient;
+    scheduledAt: Date;
+    isPaused: false;
+    hasRendered: false;
+    hasDelivered: false;
+};
+type AdminEmailOutboxRenderedFields = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    hasRendered: true;
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    subject: string;
+    html: string | null;
+    text: string | null;
+    isTransactional: boolean;
+    isHighPriority: boolean;
+    notificationCategoryId: string | null;
+};
+type AdminEmailOutboxStartedSendingFields = AdminEmailOutboxRenderedFields & {
+    startedSendingAt: Date;
+};
+type AdminEmailOutboxFinishedDeliveringFields = Omit<AdminEmailOutboxStartedSendingFields, "hasDelivered"> & {
+    hasDelivered: true;
+    deliveredAt: Date;
+};
+type AdminEmailOutboxPaused = Omit<AdminEmailOutboxBase, "isPaused"> & {
+    status: "paused";
+    simpleStatus: "in-progress";
+    isPaused: true;
+};
+type AdminEmailOutboxPreparing = AdminEmailOutboxBase & {
+    status: "preparing";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxRendering = AdminEmailOutboxBase & {
+    status: "rendering";
+    simpleStatus: "in-progress";
+    startedRenderingAt: Date;
+};
+type AdminEmailOutboxRenderError = AdminEmailOutboxBase & {
+    status: "render-error";
+    simpleStatus: "error";
+    startedRenderingAt: Date;
+    renderedAt: Date;
+    renderError: string;
+};
+type AdminEmailOutboxScheduled = AdminEmailOutboxRenderedFields & {
+    status: "scheduled";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxQueued = AdminEmailOutboxRenderedFields & {
+    status: "queued";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxSending = AdminEmailOutboxStartedSendingFields & {
+    status: "sending";
+    simpleStatus: "in-progress";
+};
+type AdminEmailOutboxServerError = AdminEmailOutboxStartedSendingFields & {
+    status: "server-error";
+    simpleStatus: "error";
+    errorAt: Date;
+    serverError: string;
+};
+type AdminEmailOutboxSkipped = Omit<AdminEmailOutboxBase, "hasRendered"> & {
+    status: "skipped";
+    simpleStatus: "ok";
+    hasRendered: boolean;
+    skippedAt: Date;
+    skippedReason: string;
+    skippedDetails: Record<string, unknown>;
+    startedRenderingAt?: Date;
+    renderedAt?: Date;
+    subject?: string;
+    html?: string | null;
+    text?: string | null;
+    isTransactional?: boolean;
+    isHighPriority?: boolean;
+    notificationCategoryId?: string | null;
+    startedSendingAt?: Date;
+};
+type AdminEmailOutboxBounced = AdminEmailOutboxStartedSendingFields & {
+    status: "bounced";
+    simpleStatus: "error";
+    bouncedAt: Date;
+};
+type AdminEmailOutboxDeliveryDelayed = AdminEmailOutboxStartedSendingFields & {
+    status: "delivery-delayed";
+    simpleStatus: "ok";
+    deliveryDelayedAt: Date;
+};
+type AdminEmailOutboxSent = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "sent";
+    simpleStatus: "ok";
+    canHaveDeliveryInfo: boolean;
+};
+type AdminEmailOutboxOpened = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "opened";
+    simpleStatus: "ok";
+    openedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxClicked = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "clicked";
+    simpleStatus: "ok";
+    clickedAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutboxMarkedAsSpam = AdminEmailOutboxFinishedDeliveringFields & {
+    status: "marked-as-spam";
+    simpleStatus: "ok";
+    markedAsSpamAt: Date;
+    canHaveDeliveryInfo: true;
+};
+type AdminEmailOutbox = AdminEmailOutboxPaused | AdminEmailOutboxPreparing | AdminEmailOutboxRendering | AdminEmailOutboxRenderError | AdminEmailOutboxScheduled | AdminEmailOutboxQueued | AdminEmailOutboxSending | AdminEmailOutboxServerError | AdminEmailOutboxSkipped | AdminEmailOutboxBounced | AdminEmailOutboxDeliveryDelayed | AdminEmailOutboxSent | AdminEmailOutboxOpened | AdminEmailOutboxClicked | AdminEmailOutboxMarkedAsSpam;
 type SendEmailOptionsBase = {
     themeId?: string | null | false;
     subject?: string;
@@ -278,6 +470,25 @@ type SendEmailOptions = SendEmailOptionsBase & XOR<[
         draftId: string;
     }
 ]>;
+type EmailDeliveryWindowStats = {
+    sent: number;
+    bounced: number;
+    marked_as_spam: number;
+};
+type EmailDeliveryStats = {
+    hour: EmailDeliveryWindowStats;
+    day: EmailDeliveryWindowStats;
+    week: EmailDeliveryWindowStats;
+    month: EmailDeliveryWindowStats;
+};
+type EmailDeliveryCapacity = {
+    rate_per_second: number;
+    penalty_factor: number;
+};
+type EmailDeliveryInfo = {
+    stats: EmailDeliveryStats;
+    capacity: EmailDeliveryCapacity;
+};
 
 type InternalApiKeyBase = {
     id: string;
@@ -477,18 +688,17 @@ type ServerOAuthProvider = {
     }): Promise<Result<void, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     delete(): Promise<void>;
 };
-type Session = {
-    getTokens(): Promise<{
-        accessToken: string | null;
-        refreshToken: string | null;
-    }>;
-};
 /**
  * Contains everything related to the current user session.
  */
 type Auth = AuthLike<{}> & {
     readonly _internalSession: InternalSession;
-    readonly currentSession: Session;
+    readonly currentSession: {
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+    };
 };
 /**
  * ```
@@ -534,6 +744,18 @@ type BaseUser = {
     readonly passkeyAuthEnabled: boolean;
     readonly isMultiFactorRequired: boolean;
     readonly isAnonymous: boolean;
+    /**
+     * Whether the user is in restricted state (signed up but hasn't completed onboarding requirements).
+     * For example, if email verification is required but the user hasn't verified their email yet.
+     */
+    readonly isRestricted: boolean;
+    /**
+     * The reason why the user is restricted, e.g., { type: "email_not_verified" } or { type: "anonymous" }.
+     * Null if the user is not restricted.
+     */
+    readonly restrictedReason: {
+        type: "anonymous" | "email_not_verified";
+    } | null;
     toClientJson(): CurrentUserCrud["Client"]["Read"];
     /**
      * @deprecated, use contact channel's usedForAuth instead
@@ -547,7 +769,7 @@ type BaseUser = {
     }[];
 };
 type UserExtra = {
-    setDisplayName(displayName: string): Promise<void>;
+    setDisplayName(displayName: string | null): Promise<void>;
     /** @deprecated Use contact channel's sendVerificationEmail instead */
     sendVerificationEmail(): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     setClientMetadata(metadata: any): Promise<void>;
@@ -585,7 +807,7 @@ type UserExtra = {
         recursive?: boolean;
     }): Promise<TeamPermission[]>;
     readonly selectedTeam: Team | null;
-    setSelectedTeam(team: Team | null): Promise<void>;
+    setSelectedTeam(teamOrId: string | Team | null): Promise<void>;
     createTeam(data: TeamCreateOptions): Promise<Team>;
     leaveTeam(team: Team): Promise<void>;
     getActiveSessions(): Promise<ActiveSession[]>;
@@ -610,8 +832,8 @@ type User = BaseUser;
 type CurrentUser = BaseUser & Auth & UserExtra & Customer;
 type CurrentInternalUser = CurrentUser & InternalUserExtra;
 type ProjectCurrentUser<ProjectId> = ProjectId extends "internal" ? CurrentInternalUser : CurrentUser;
-type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous">;
-type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword">;
+type TokenPartialUser = Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "isAnonymous" | "isRestricted" | "restrictedReason">;
+type SyncedPartialUser = TokenPartialUser & Pick<User, "id" | "displayName" | "primaryEmail" | "primaryEmailVerified" | "profileImageUrl" | "signedUpAt" | "clientMetadata" | "clientReadOnlyMetadata" | "isAnonymous" | "hasPassword" | "isRestricted" | "restrictedReason">;
 type ActiveSession = {
     id: string;
     userId: string;
@@ -622,13 +844,14 @@ type ActiveSession = {
     geoInfo?: GeoInfo;
 };
 type UserUpdateOptions = {
-    displayName?: string;
+    displayName?: string | null;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
     totpMultiFactorSecret?: Uint8Array | null;
     profileImageUrl?: string | null;
     otpAuthEnabled?: boolean;
     passkeyAuthEnabled?: boolean;
+    primaryEmail?: string | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string | null, options?: {
@@ -664,7 +887,12 @@ type ServerBaseUser = {
     createSession(options?: {
         expiresInMillis?: number;
         isImpersonation?: boolean;
-    }): Promise<Session>;
+    }): Promise<{
+        getTokens(): Promise<{
+            accessToken: string | null;
+            refreshToken: string | null;
+        }>;
+    }>;
 } & AsyncStoreProperty<"team", [id: string], ServerTeam | null, false> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"permission", [scope: Team, permissionId: string, options?: {
     direct?: boolean;
 }], AdminTeamPermission | null, false> & AsyncStoreProperty<"permissions", [scope: Team, options?: {
@@ -768,6 +996,15 @@ type ServerListUsersOptions = {
     orderBy?: 'signedUpAt';
     desc?: boolean;
     query?: string;
+    /**
+     * Whether to include restricted users (users who haven't completed onboarding requirements).
+     * Defaults to false.
+     */
+    includeRestricted?: boolean;
+    /**
+     * Whether to include anonymous users (and restricted users).
+     * Defaults to false.
+     */
     includeAnonymous?: boolean;
 };
 type ServerTeamCreateOptions = TeamCreateOptions & {
@@ -848,6 +1085,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         allowConnectedAccounts: boolean;
     }): Promise<Result<ServerOAuthProvider, InstanceType<typeof KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn>>>;
     sendEmail(options: SendEmailOptions): Promise<void>;
+    getEmailDeliveryStats(): Promise<EmailDeliveryInfo>;
 } & AsyncStoreProperty<"user", [id: string], ServerUser | null, false> & Omit<AsyncStoreProperty<"users", [], ServerUser[], true>, "listUsers" | "useUsers"> & AsyncStoreProperty<"teams", [], ServerTeam[], true> & AsyncStoreProperty<"dataVaultStore", [id: string], DataVaultStore, false> & AsyncStoreProperty<"item", [
     {
         itemId: string;
@@ -864,6 +1102,21 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
 ], CustomerProductsList, true> & StackClientApp<HasTokenStore, ProjectId>);
 declare const StackServerApp: StackServerAppConstructor;
 
+type EmailOutboxListOptions = {
+    status?: string;
+    simpleStatus?: string;
+    limit?: number;
+    cursor?: string;
+};
+type EmailOutboxListResult = {
+    items: AdminEmailOutbox[];
+    nextCursor: string | null;
+};
+type EmailOutboxUpdateOptions = {
+    isPaused?: boolean;
+    scheduledAtMillis?: number;
+    cancel?: boolean;
+};
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
     projectOwnerSession?: InternalSession;
@@ -988,6 +1241,12 @@ type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends st
         type: "subscription" | "one-time-purchase";
         id: string;
     }): Promise<void>;
+    listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>;
+    getOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>;
+    pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>;
+    cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>;
 } & StackServerApp<HasTokenStore, ProjectId>);
 declare const StackAdminApp: StackAdminAppConstructor;
 
@@ -1005,6 +1264,9 @@ type ProjectConfig = {
 type OAuthProviderConfig = {
     readonly id: string;
 };
+/**
+ * @deprecated This type is deprecated. Use the new config override setup instead.
+ */
 type AdminProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
@@ -1238,6 +1500,12 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         or: 'anonymous';
     }): Promise<ProjectCurrentUser<ProjectId>>;
     getUser(options?: GetCurrentUserOptions<HasTokenStore>): Promise<ProjectCurrentUser<ProjectId> | null>;
+    cancelSubscription(options: {
+        productId: string;
+    } | {
+        productId: string;
+        teamId: string;
+    }): Promise<void>;
     getPartialUser(options: GetCurrentPartialUserOptions<HasTokenStore> & {
         from: 'token';
     }): Promise<TokenPartialUser | null>;
@@ -1274,4 +1542,4 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
 }>);
 declare const StackClientApp: StackClientAppConstructor;
 
-export { type AdminDomainConfig, type AdminEmailConfig, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, type Session, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, stackAppInternalsSymbol };
+export { type AdminDomainConfig, type AdminEmailConfig, type AdminEmailOutbox, type AdminEmailOutboxRecipient, type AdminEmailOutboxSimpleStatus, type AdminEmailOutboxStatus, type AdminOAuthProviderConfig, type AdminOwnedProject, type AdminProject, type AdminProjectConfig, type AdminProjectConfigUpdateOptions, type AdminProjectCreateOptions, type AdminProjectPermission, type AdminProjectPermissionDefinition, type AdminProjectPermissionDefinitionCreateOptions, type AdminProjectPermissionDefinitionUpdateOptions, type AdminProjectUpdateOptions, type AdminSentEmail, type AdminTeamPermission, type AdminTeamPermissionDefinition, type AdminTeamPermissionDefinitionCreateOptions, type AdminTeamPermissionDefinitionUpdateOptions, type Auth, type Connection, type ContactChannel, type CurrentInternalServerUser, type CurrentInternalUser, type CurrentServerUser, type CurrentUser, type EditableTeamMemberProfile, type EmailOutboxListOptions, type EmailOutboxListResult, type EmailOutboxUpdateOptions, type GetCurrentUserOptions, type GetCurrentUserOptions as GetUserOptions, type HandlerUrls, type InternalApiKey, type InternalApiKeyBase, type InternalApiKeyBaseCrudRead, type InternalApiKeyCreateOptions, type InternalApiKeyFirstView, type OAuthConnection, type OAuthProvider, type OAuthProviderConfig, type OAuthScopesOnSignIn, type Project, type ProjectConfig, type ServerContactChannel, type ServerListUsersOptions, type ServerOAuthProvider, type ServerTeam, type ServerTeamCreateOptions, type ServerTeamMemberProfile, type ServerTeamUpdateOptions, type ServerTeamUser, type ServerUser, StackAdminApp, type StackAdminAppConstructor, type StackAdminAppConstructorOptions, StackClientApp, type StackClientAppConstructor, type StackClientAppConstructorOptions, type StackClientAppJson, StackServerApp, type StackServerAppConstructor, type StackServerAppConstructorOptions, type Team, type TeamCreateOptions, type TeamInvitation, type TeamMemberProfile, type TeamUpdateOptions, type TeamUser, type User, stackAppInternalsSymbol };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nexport * from './lib/stack-app';\n\nexport { getConvexProvidersConfig } from \"./integrations/convex\";\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAc,qCAJd;AAMA,oBAAyC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nexport * from './lib/stack-app';\n\nexport { getConvexProvidersConfig } from \"./integrations/convex\";\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAc,qCAJd;AAMA,oBAAyC;","names":[]}

package/dist/integrations/convex/component/convex.config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/integrations/convex/component/convex.config.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { defineComponent } from \"convex/server\";\n\nconst component = defineComponent(\"stack_auth\");\n\nexport default component;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgC;AAEhC,IAAM,gBAAY,+BAAgB,YAAY;AAE9C,IAAO,wBAAQ;","names":[]}
+{"version":3,"sources":["../../../../src/integrations/convex/component/convex.config.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { defineComponent } from \"convex/server\";\n\nconst component = defineComponent(\"stack_auth\");\n\nexport default component;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAAgC;AAEhC,IAAM,gBAAY,+BAAgB,YAAY;AAE9C,IAAO,wBAAQ;","names":[]}

package/dist/integrations/convex.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,kBAA0B;AAC1B,oBAA+B;AAExB,SAAS,yBAAyB,SAGtC;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,YAAY,QAAQ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yCAA6B,SAAS,IAAI,OAAO;AAAA,MACjE,MAAM,IAAI,IAAI,yCAA6B,SAAS,0BAA0B,OAAO;AAAA,MACrF,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yDAA6C,SAAS,IAAI,OAAO;AAAA,MACjF,MAAM,IAAI,IAAI,yCAA6B,SAAS,iDAAiD,OAAO;AAAA,MAC5G,WAAW;AAAA,IACb;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/integrations/convex.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { urlString } from \"@stackframe/stack-shared/dist/utils/urls\";\nimport { defaultBaseUrl } from \"../lib/stack-app/apps/implementations/common\";\n\nexport function getConvexProvidersConfig(options: {\n  baseUrl?: string,\n  projectId: string,\n}) {\n  const baseUrl = options.baseUrl || defaultBaseUrl;\n  const projectId = options.projectId;\n  return [\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json`, baseUrl),\n      algorithm: \"ES256\",\n    },\n    {\n      type: \"customJwt\",\n      issuer: new URL(urlString`/api/v1/projects-anonymous-users/${projectId}`, baseUrl),\n      jwks: new URL(urlString`/api/v1/projects/${projectId}/.well-known/jwks.json?include_anonymous=true`, baseUrl),\n      algorithm: \"ES256\",\n    },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,kBAA0B;AAC1B,oBAA+B;AAExB,SAAS,yBAAyB,SAGtC;AACD,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,YAAY,QAAQ;AAC1B,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yCAA6B,SAAS,IAAI,OAAO;AAAA,MACjE,MAAM,IAAI,IAAI,yCAA6B,SAAS,0BAA0B,OAAO;AAAA,MACrF,WAAW;AAAA,IACb;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,QAAQ,IAAI,IAAI,yDAA6C,SAAS,IAAI,OAAO;AAAA,MACjF,MAAM,IAAI,IAAI,yCAA6B,SAAS,iDAAiD,OAAO;AAAA,MAC5G,WAAW;AAAA,IACb;AAAA,EACF;AACF;","names":[]}

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { KnownError, StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n    session,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams() {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n      \n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams();\n  if (!consumed) return Result.ok(undefined);\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAiD;AAEjD,oBAA8C;AAC9C,sBAA6B;AAC7B,qBAAuB;AACvB,qBAAyB;AACzB,iBAAqC;AACrC,oBAAoE;AAEpE,eAAsB,gBACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF,8BAA0B,iCAAqB,OAAO,SAAS,MAAM,0BAA0B;AAAA,IAC/F;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,kCAAkC;AACzC,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,cAAQ,KAAK,IAAI,MAAM,uDAAuD,KAAK,2EAA2E,CAAC;AAC/J,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,SAAK,wBAAS,uDAAuD;AAC/H,QAAM,mBAAe,6CAA8B,aAAa;AAEhE,MAAI,CAAC,cAAc;AAGjB,YAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWZ;AACD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,aAAa;AAAA,IAC3B,OAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,WAAW,gCAAgC;AACjD,MAAI,CAAC,SAAU,QAAO,sBAAO,GAAG,MAAS;AAKzC,MAAI;AACF,WAAO,sBAAO,GAAG,MAAM,MAAM,kBAAkB;AAAA,MAC7C,aAAa,SAAS,YAAY;AAAA,MAClC,iBAAa,iCAAqB,aAAa,aAAa;AAAA,MAC5D,cAAc,SAAS;AAAA,MACvB,OAAO,SAAS;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ,SAAS,GAAG;AACV,QAAI,+BAAW,aAAa,CAAC,GAAG;AAC9B,YAAM;AAAA,IACR;AACA,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { KnownError, StackClientInterface } from \"@stackframe/stack-shared\";\nimport { InternalSession } from \"@stackframe/stack-shared/dist/sessions\";\nimport { StackAssertionError, throwErr } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { neverResolve } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { Result } from \"@stackframe/stack-shared/dist/utils/results\";\nimport { deindent } from \"@stackframe/stack-shared/dist/utils/strings\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { consumeVerifierAndStateCookie, saveVerifierAndState } from \"./cookie\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"authenticate\",\n    providerScope: options.providerScope,\n    session,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\nexport async function addNewOAuthProviderOrScope(\n  iface: StackClientInterface,\n  options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    providerScope?: string,\n  },\n  session: InternalSession,\n) {\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl({\n    provider: options.provider,\n    redirectUrl: constructRedirectUrl(options.redirectUrl, \"redirectUrl\"),\n    errorRedirectUrl: constructRedirectUrl(options.errorRedirectUrl, \"errorRedirectUrl\"),\n    afterCallbackRedirectUrl: constructRedirectUrl(window.location.href, \"afterCallbackRedirectUrl\"),\n    codeChallenge,\n    state,\n    type: \"link\",\n    session,\n    providerScope: options.providerScope,\n  });\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n *\n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams() {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      console.warn(new Error(`Missing required query parameter on OAuth callback: ${param}. Maybe you opened or reloaded the oauth-callback page from your history?`));\n      return null;\n    }\n  }\n\n  const expectedState = originalUrl.searchParams.get(\"state\") ?? throwErr(\"This should never happen; isn't state required above?\");\n  const cookieResult = consumeVerifierAndStateCookie(expectedState);\n\n  if (!cookieResult) {\n    // If the state can't be found in the cookies, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    console.warn(deindent`\n      Stack found an outer OAuth callback state in the query parameters, but not in cookies.\n      \n      This could have multiple reasons:\n        - The cookie expired, because the OAuth flow took too long.\n        - The user's browser deleted the cookie, either manually or because of a very strict cookie policy.\n        - The cookie was already consumed by this page, and the user already logged in.\n        - You are using another OAuth client library with the same callback URL as Stack.\n        - The user opened the OAuth callback page from their history.\n\n      Either way, it is probably safe to ignore this warning unless you are debugging an OAuth issue.\n    `);\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return {\n    originalUrl,\n    codeVerifier: cookieResult.codeVerifier,\n    state: expectedState,\n  };\n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const consumed = consumeOAuthCallbackQueryParams();\n  if (!consumed) return Result.ok(undefined);\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback, and the only instance\n  // of callOAuthCallback that's running)\n  try {\n    return Result.ok(await iface.callOAuthCallback({\n      oauthParams: consumed.originalUrl.searchParams,\n      redirectUri: constructRedirectUrl(redirectUrl, \"redirectUri\"),\n      codeVerifier: consumed.codeVerifier,\n      state: consumed.state,\n    }));\n  } catch (e) {\n    if (KnownError.isKnownError(e)) {\n      throw e;\n    }\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,0BAAiD;AAEjD,oBAA8C;AAC9C,sBAA6B;AAC7B,qBAAuB;AACvB,qBAAyB;AACzB,iBAAqC;AACrC,oBAAoE;AAEpE,eAAsB,gBACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN,eAAe,QAAQ;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAEA,eAAsB,2BACpB,OACA,SAMA,SACA;AACA,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC,UAAU,QAAQ;AAAA,IAClB,iBAAa,iCAAqB,QAAQ,aAAa,aAAa;AAAA,IACpE,sBAAkB,iCAAqB,QAAQ,kBAAkB,kBAAkB;AAAA,IACnF,8BAA0B,iCAAqB,OAAO,SAAS,MAAM,0BAA0B;AAAA,IAC/F;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,kCAAkC;AACzC,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,cAAQ,KAAK,IAAI,MAAM,uDAAuD,KAAK,2EAA2E,CAAC;AAC/J,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,YAAY,aAAa,IAAI,OAAO,SAAK,wBAAS,uDAAuD;AAC/H,QAAM,mBAAe,6CAA8B,aAAa;AAEhE,MAAI,CAAC,cAAc;AAGjB,YAAQ,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWZ;AACD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AAAA,IACL;AAAA,IACA,cAAc,aAAa;AAAA,IAC3B,OAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,WAAW,gCAAgC;AACjD,MAAI,CAAC,SAAU,QAAO,sBAAO,GAAG,MAAS;AAKzC,MAAI;AACF,WAAO,sBAAO,GAAG,MAAM,MAAM,kBAAkB;AAAA,MAC7C,aAAa,SAAS,YAAY;AAAA,MAClC,iBAAa,iCAAqB,aAAa,aAAa;AAAA,MAC5D,cAAc,SAAS;AAAA,MACvB,OAAO,SAAS;AAAA,IAClB,CAAC,CAAC;AAAA,EACJ,SAAS,GAAG;AACV,QAAI,+BAAW,aAAa,CAAC,GAAG;AAC9B,YAAM;AAAA,IACR;AACA,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}

package/dist/lib/cookie.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/cookie.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY\n//===========================================\nimport { isBrowserLike } from '@stackframe/stack-shared/dist/utils/env';\nimport { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';\nimport Cookies from \"js-cookie\";\nimport { calculatePKCECodeChallenge, generateRandomCodeVerifier, generateRandomState } from \"oauth4webapi\";\n\n\n// INFO: This file is used to manage cookies. It also sets some cookie flags automatically, see this description.\n//\n// It provides asynchronous setCookie, getCookie, deleteCookie, etc. functions that can be used in various environments\n// (browser + Next.js for now). Under the hood, they just get a CookieHelper object and then set the cookies there.\n//\n// The CookieHelper object is a simple object that lets you set, get and delete cookies synchronously. Acquiring one\n// is asynchronous (except for browser environments, where they can be acquired synchronously), but once you have it,\n// you can use it synchronously. This function is useful if you cannot await in the calling code, but otherwise you\n// should prefer to await the functions directly.\n//\n// Some cookie flags are set automatically by the CookieHelper (and hence also the <xyz>Cookie functions).\n// In particular:\n//  - SameSite is set to `Lax` by default, which is already true in Chromium-based browsers, so this creates\n//    compatibility with other browsers that use either Strict or None (particularly Safari and Firefox, and older\n//    versions of Chrome). If Partitioned is automatically set (as described below), then this value is set to `None`\n//    instead.\n//  - Secure is set depending on whether we could successfully determine that the client is on HTTPS. For this, we use a\n//    set of heuristics:\n//     - In a browser environment, we check window.location.protocol which is always accurate\n//     - In a Next.js server environment:\n//        - First we check the `stack-is-https` cookie, which is set in various places on the\n//          client with a Secure attribute. If that one is passed on to the server, we know that the client is on HTTPS\n//          and we can set the Secure flag on the cookie. TODO: Should we also do this with a second cookie with a\n//          __Host- prefix, so a malicious subdomain of the current domain cannot forcibly enable HTTPS mode and\n//          therefore prevent new cookies from being set?\n//        - Otherwise, we check the X-Forwarded-Proto header. If that one is `https`, we know that the client is\n//          (pretending to be) on HTTPS and we can set the Secure flag on the cookie. Note that this header is\n//          spoofable by malicious clients (so is the cookie actually), but since setting this value can only *increase*\n//          security (and therefore prevent setting of a cookie), and requires a malicious client, this is still safe.\n//        - If neither of the above is true, we don't set the Secure flag on the cookie.\n//  - Partitioned is set depending on whether it is needed & supported. Unfortunately, the fact that Partitioned\n//    cookies require SameSite=None, browsers that don't support it will still set them as normal third-party cookies,\n//    which are fundamentally unsafe. Therefore, we need to take extra care that we only ever set Partitioned cookies\n//    if we know for sure that the browser supports it.\n//    - In a browser environment, we check:\n//       - Whether `Secure` is set. If it's not, we don't set Partitioned.\n//       - Whether we can set & retrieve cookies without Partitioned being set. If this is the case, we are likely in a\n//         top-level context or a browser that partitions cookies by default (eg. Firefox). In this case, we don't need\n//         Partitioned and can just proceed as normal.\n//       - Whether CHIPS is supported. To prevent the case where CHIPS is not supported but third-party cookies are (in\n//         which we would accidentally set SameSite=None without Partitioned as the latter requires the former), we\n//         check this by running a simple test with document.cookie.\n//       - Whether the browser supports Partitioned cookies. If yes, set Partitioned. Otherwise, don't set Partitioned.\n//         Since there's no easy cross-compat way to do this (CookieStore and document.cookie do not return whether a\n//         cookie is partitioned on some/all versions of Safari and Firefox), we use a heuristic; we run this test by\n//         creating two cookies with the same name: One with Partitioned and one without. If there are two resulting\n//         cookies, that means they were put into different jars, implying that the browser supports Partitioned cookies\n//         (but doesn't partition cookies by default). If they result in just one cookie, that could mean that the\n//         browser doesn't support Partitioned cookies, or that the browser doesn't put partitioned cookies into\n//         different jars by default, in which case we still don't know. This heuristic works on Chrome, but may\n//         incorrectly conclude that some other browsers don't support Partitioned. But from a security perspective,\n//         that is better than accidentally setting SameSite=None without Partitioned. TODO: Find a better heuristic to\n//         to determine whether the browser supports Partitioned cookies or not.\n//    - In a Next.js server environment, right now we do nothing because of the complexity involved :( TODO: In the\n//      future, we could improve this for example by setting hint cookies from the client, but we need to make sure that\n//      no malicious actor (eg. on a malicious subdomain) can forcefully enable Partitioned cookies on a browser that\n//      does not support it.\n\n\ntype SetCookieOptions = { maxAge: number | \"session\", noOpIfServerComponent?: boolean, domain?: string, secure?: boolean };\ntype DeleteCookieOptions = { noOpIfServerComponent?: boolean, domain?: string };\n\nfunction ensureClient() {\n  if (!isBrowserLike()) {\n    throw new Error(\"cookieClient functions can only be called in a browser environment, yet window is undefined\");\n  }\n}\n\nexport type CookieHelper = {\n  get: (name: string) => string | null,\n  getAll: () => Record<string, string>,\n  set: (name: string, value: string, options: SetCookieOptions) => void,\n  setOrDelete: (name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) => void,\n  delete: (name: string, options: DeleteCookieOptions) => void,\n};\n\nconst placeholderCookieHelperIdentity = { \"placeholder cookie helper identity\": true };\nexport async function createPlaceholderCookieHelper(): Promise<CookieHelper> {\n  function throwError(): never {\n    throw new StackAssertionError(\"Throwing cookie helper is just a placeholder. This should never be called\");\n  }\n  return {\n    get: throwError,\n    getAll: throwError,\n    set: throwError,\n    setOrDelete: throwError,\n    delete: throwError,\n  };\n}\n\nexport async function createCookieHelper(): Promise<CookieHelper> {\n  if (isBrowserLike()) {\n    return createBrowserCookieHelper();\n  } else {\n    return await createPlaceholderCookieHelper();\n  }\n}\n\nexport function createBrowserCookieHelper(): CookieHelper {\n  return {\n    get: getCookieClient,\n    getAll: getAllCookiesClient,\n    set: setCookieClient,\n    setOrDelete: setOrDeleteCookieClient,\n    delete: deleteCookieClient,\n  };\n}\n\nfunction handleCookieError(e: unknown, options: DeleteCookieOptions | SetCookieOptions) {\n  if (e instanceof Error && e.message.includes(\"Cookies can only be modified in\")) {\n    if (options.noOpIfServerComponent) {\n      // ignore\n    } else {\n      throw new StackAssertionError(\"Attempted to set cookie in server component. Pass { noOpIfServerComponent: true } in the options of Stack's cookie functions if this is intentional and you want to ignore this error. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#options\");\n    }\n  } else {\n    throw e;\n  }\n}\n\n\nexport function getCookieClient(name: string): string | null {\n  const all = getAllCookiesClient();\n  return all[name] ?? null;\n}\n\nexport function getAllCookiesClient(): Record<string, string> {\n  ensureClient();\n  // set a helper cookie, see comment in `NextCookieHelper.set` above\n  Cookies.set(\"stack-is-https\", \"true\", { secure: true, expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365) });\n  return Cookies.get();\n}\n\nexport async function getCookie(name: string): Promise<string | null> {\n  const cookieHelper = await createCookieHelper();\n  return cookieHelper.get(name);\n}\n\nexport async function isSecure(): Promise<boolean> {\n  if (isBrowserLike()) {\n    return determineSecureFromClientContext();\n  }\n  return false;\n}\n\nfunction determineSecureFromClientContext(): boolean {\n  return typeof window !== \"undefined\" && window.location.protocol === \"https:\";\n}\n\n\nlet _shouldSetPartitionedClientCache: boolean | undefined = undefined;\nfunction shouldSetPartitionedClient() {\n  return _shouldSetPartitionedClientCache ??= _internalShouldSetPartitionedClient();\n}\nfunction _internalShouldSetPartitionedClient() {\n  ensureClient();\n\n  if (!(determineSecureFromClientContext())) {\n    return false;\n  }\n\n  // check whether we can set & retrieve normal cookies (either because we're on a top-level/same-origin context or the browser partitions cookies by default)\n  const cookie1Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n  document.cookie = `${cookie1Name}=value1; Secure; path=/`;\n  const cookies1 = document.cookie.split(\"; \");\n  document.cookie = `${cookie1Name}=delete1; Secure; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC;`;\n  if (cookies1.some((c) => c.startsWith(cookie1Name + \"=\"))) {\n    return false;\n  }\n\n\n  // check whether Partitioned cookies are supported by the browser\n  // TODO: See comment at the top. Feels like we should find a better way to do this\n  const cookie2Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n\n  // just to be safe, delete the cookie first to avoid weird RNG-prediction attacks\n  // I don't know what they look like (since this is a host cookie) but better safe than sorry\n  // (this function should be 100% bulletproof so we don't accidentally fall back to non-partitioned third party cookies on unsupported browsers)\n  document.cookie = `${cookie2Name}=delete1; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete2; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  // set the cookie, once partitioned and once not partitioned\n  document.cookie = `${cookie2Name}=set1; Secure; SameSite=None; Partitioned; path=/`;\n  document.cookie = `${cookie2Name}=set2; Secure; SameSite=None; path=/`;\n\n  // check if there are two cookies\n  const cookies2 = document.cookie.split(\"; \");\n  const numberOfCookiesWithThisName = cookies2.filter((c) => c.startsWith(cookie2Name + \"=\")).length;\n\n  // clean up\n  document.cookie = `${cookie2Name}=delete3; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete4; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  return numberOfCookiesWithThisName === 2;\n}\n\nfunction setCookieClientInternal(name: string, value: string, options: SetCookieOptions) {\n  const secure = options.secure ?? determineSecureFromClientContext();\n  const partitioned = shouldSetPartitionedClient();\n  Cookies.set(name, value, {\n    expires: options.maxAge === \"session\" ? undefined : new Date(Date.now() + (options.maxAge) * 1000),\n    domain: options.domain,\n    secure,\n    sameSite: \"Lax\",\n    ...(partitioned ? {\n      partitioned,\n      sameSite: \"None\",\n    } : {}),\n  });\n}\n\nfunction deleteCookieClientInternal(name: string, options: DeleteCookieOptions) {\n  for (const partitioned of [true, false]) {\n    if (options.domain !== undefined) {\n      Cookies.remove(name, { domain: options.domain, secure: determineSecureFromClientContext(), partitioned });\n    }\n    Cookies.remove(name, { secure: determineSecureFromClientContext(), partitioned });\n  }\n}\n\nexport function setOrDeleteCookieClient(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  ensureClient();\n  if (value === null) {\n    deleteCookieClientInternal(name, options);\n  } else {\n    setCookieClientInternal(name, value, options);\n  }\n}\n\nexport async function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.setOrDelete(name, value, options);\n}\n\nexport function deleteCookieClient(name: string, options: DeleteCookieOptions) {\n  ensureClient();\n  deleteCookieClientInternal(name, options);\n}\n\nexport async function deleteCookie(name: string, options: DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.delete(name, options);\n}\n\nexport function setCookieClient(name: string, value: string, options: SetCookieOptions) {\n  ensureClient();\n  setCookieClientInternal(name, value, options);\n}\n\nexport async function setCookie(name: string, value: string, options: SetCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.set(name, value, options);\n}\n\nexport async function saveVerifierAndState() {\n  const codeVerifier = generateRandomCodeVerifier();\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n  const state = generateRandomState();\n\n  await setCookie(\"stack-oauth-outer-\" + state, codeVerifier, { maxAge: 60 * 60 });\n\n  return {\n    codeChallenge,\n    state,\n  };\n}\n\nexport function consumeVerifierAndStateCookie(state: string) {\n  ensureClient();\n  const cookieName = \"stack-oauth-outer-\" + state;\n  const codeVerifier = getCookieClient(cookieName);\n  if (!codeVerifier) {\n    return null;\n  }\n  deleteCookieClient(cookieName, {});\n  return {\n    codeVerifier,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,iBAA8B;AAC9B,oBAAoC;AACpC,uBAAoB;AACpB,0BAA4F;AAiE5F,SAAS,eAAe;AACtB,MAAI,KAAC,0BAAc,GAAG;AACpB,UAAM,IAAI,MAAM,6FAA6F;AAAA,EAC/G;AACF;AAWA,eAAsB,gCAAuD;AAC3E,WAAS,aAAoB;AAC3B,UAAM,IAAI,kCAAoB,2EAA2E;AAAA,EAC3G;AACA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,qBAA4C;AAChE,UAAI,0BAAc,GAAG;AACnB,WAAO,0BAA0B;AAAA,EACnC,OAAO;AACL,WAAO,MAAM,8BAA8B;AAAA,EAC7C;AACF;AAEO,SAAS,4BAA0C;AACxD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAeO,SAAS,gBAAgB,MAA6B;AAC3D,QAAM,MAAM,oBAAoB;AAChC,SAAO,IAAI,IAAI,KAAK;AACtB;AAEO,SAAS,sBAA8C;AAC5D,eAAa;AAEb,mBAAAA,QAAQ,IAAI,kBAAkB,QAAQ,EAAE,QAAQ,MAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,KAAK,KAAK,GAAG,EAAE,CAAC;AACjH,SAAO,iBAAAA,QAAQ,IAAI;AACrB;AAEA,eAAsB,UAAU,MAAsC;AACpE,QAAM,eAAe,MAAM,mBAAmB;AAC9C,SAAO,aAAa,IAAI,IAAI;AAC9B;AAEA,eAAsB,WAA6B;AACjD,UAAI,0BAAc,GAAG;AACnB,WAAO,iCAAiC;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,mCAA4C;AACnD,SAAO,OAAO,WAAW,eAAe,OAAO,SAAS,aAAa;AACvE;AAGA,IAAI,mCAAwD;AAC5D,SAAS,6BAA6B;AACpC,SAAO,qCAAqC,oCAAoC;AAClF;AACA,SAAS,sCAAsC;AAC7C,eAAa;AAEb,MAAI,CAAE,iCAAiC,GAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AACrG,WAAS,SAAS,GAAG,WAAW;AAChC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,WAAS,SAAS,GAAG,WAAW;AAChC,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,GAAG;AACzD,WAAO;AAAA,EACT;AAKA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AAKrG,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,QAAM,8BAA8B,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,EAAE;AAG5F,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAEhC,SAAO,gCAAgC;AACzC;AAEA,SAAS,wBAAwB,MAAc,OAAe,SAA2B;AACvF,QAAM,SAAS,QAAQ,UAAU,iCAAiC;AAClE,QAAM,cAAc,2BAA2B;AAC/C,mBAAAA,QAAQ,IAAI,MAAM,OAAO;AAAA,IACvB,SAAS,QAAQ,WAAW,YAAY,SAAY,IAAI,KAAK,KAAK,IAAI,IAAK,QAAQ,SAAU,GAAI;AAAA,IACjG,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,GAAI,cAAc;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,IACZ,IAAI,CAAC;AAAA,EACP,CAAC;AACH;AAEA,SAAS,2BAA2B,MAAc,SAA8B;AAC9E,aAAW,eAAe,CAAC,MAAM,KAAK,GAAG;AACvC,QAAI,QAAQ,WAAW,QAAW;AAChC,uBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,QAAQ,QAAQ,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,IAC1G;AACA,qBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,EAClF;AACF;AAEO,SAAS,wBAAwB,MAAc,OAAsB,SAAiD;AAC3H,eAAa;AACb,MAAI,UAAU,MAAM;AAClB,+BAA2B,MAAM,OAAO;AAAA,EAC1C,OAAO;AACL,4BAAwB,MAAM,OAAO,OAAO;AAAA,EAC9C;AACF;AAEA,eAAsB,kBAAkB,MAAc,OAAsB,SAAiD;AAC3H,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,YAAY,MAAM,OAAO,OAAO;AAC/C;AAEO,SAAS,mBAAmB,MAAc,SAA8B;AAC7E,eAAa;AACb,6BAA2B,MAAM,OAAO;AAC1C;AAEA,eAAsB,aAAa,MAAc,SAA8B;AAC7E,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,OAAO,MAAM,OAAO;AACnC;AAEO,SAAS,gBAAgB,MAAc,OAAe,SAA2B;AACtF,eAAa;AACb,0BAAwB,MAAM,OAAO,OAAO;AAC9C;AAEA,eAAsB,UAAU,MAAc,OAAe,SAA2B;AACtF,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,IAAI,MAAM,OAAO,OAAO;AACvC;AAEA,eAAsB,uBAAuB;AAC3C,QAAM,mBAAe,gDAA2B;AAChD,QAAM,gBAAgB,UAAM,gDAA2B,YAAY;AACnE,QAAM,YAAQ,yCAAoB;AAElC,QAAM,UAAU,uBAAuB,OAAO,cAAc,EAAE,QAAQ,KAAK,GAAG,CAAC;AAE/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BAA8B,OAAe;AAC3D,eAAa;AACb,QAAM,aAAa,uBAAuB;AAC1C,QAAM,eAAe,gBAAgB,UAAU;AAC/C,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,qBAAmB,YAAY,CAAC,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,EACF;AACF;","names":["Cookies"]}
+{"version":3,"sources":["../../src/lib/cookie.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { isBrowserLike } from '@stackframe/stack-shared/dist/utils/env';\nimport { StackAssertionError } from '@stackframe/stack-shared/dist/utils/errors';\nimport Cookies from \"js-cookie\";\nimport { calculatePKCECodeChallenge, generateRandomCodeVerifier, generateRandomState } from \"oauth4webapi\";\n\n\n// INFO: This file is used to manage cookies. It also sets some cookie flags automatically, see this description.\n//\n// It provides asynchronous setCookie, getCookie, deleteCookie, etc. functions that can be used in various environments\n// (browser + Next.js for now). Under the hood, they just get a CookieHelper object and then set the cookies there.\n//\n// The CookieHelper object is a simple object that lets you set, get and delete cookies synchronously. Acquiring one\n// is asynchronous (except for browser environments, where they can be acquired synchronously), but once you have it,\n// you can use it synchronously. This function is useful if you cannot await in the calling code, but otherwise you\n// should prefer to await the functions directly.\n//\n// Some cookie flags are set automatically by the CookieHelper (and hence also the <xyz>Cookie functions).\n// In particular:\n//  - SameSite is set to `Lax` by default, which is already true in Chromium-based browsers, so this creates\n//    compatibility with other browsers that use either Strict or None (particularly Safari and Firefox, and older\n//    versions of Chrome). If Partitioned is automatically set (as described below), then this value is set to `None`\n//    instead.\n//  - Secure is set depending on whether we could successfully determine that the client is on HTTPS. For this, we use a\n//    set of heuristics:\n//     - In a browser environment, we check window.location.protocol which is always accurate\n//     - In a Next.js server environment:\n//        - First we check the `stack-is-https` cookie, which is set in various places on the\n//          client with a Secure attribute. If that one is passed on to the server, we know that the client is on HTTPS\n//          and we can set the Secure flag on the cookie. TODO: Should we also do this with a second cookie with a\n//          __Host- prefix, so a malicious subdomain of the current domain cannot forcibly enable HTTPS mode and\n//          therefore prevent new cookies from being set?\n//        - Otherwise, we check the X-Forwarded-Proto header. If that one is `https`, we know that the client is\n//          (pretending to be) on HTTPS and we can set the Secure flag on the cookie. Note that this header is\n//          spoofable by malicious clients (so is the cookie actually), but since setting this value can only *increase*\n//          security (and therefore prevent setting of a cookie), and requires a malicious client, this is still safe.\n//        - If neither of the above is true, we don't set the Secure flag on the cookie.\n//  - Partitioned is set depending on whether it is needed & supported. Unfortunately, the fact that Partitioned\n//    cookies require SameSite=None, browsers that don't support it will still set them as normal third-party cookies,\n//    which are fundamentally unsafe. Therefore, we need to take extra care that we only ever set Partitioned cookies\n//    if we know for sure that the browser supports it.\n//    - In a browser environment, we check:\n//       - Whether `Secure` is set. If it's not, we don't set Partitioned.\n//       - Whether we can set & retrieve cookies without Partitioned being set. If this is the case, we are likely in a\n//         top-level context or a browser that partitions cookies by default (eg. Firefox). In this case, we don't need\n//         Partitioned and can just proceed as normal.\n//       - Whether CHIPS is supported. To prevent the case where CHIPS is not supported but third-party cookies are (in\n//         which we would accidentally set SameSite=None without Partitioned as the latter requires the former), we\n//         check this by running a simple test with document.cookie.\n//       - Whether the browser supports Partitioned cookies. If yes, set Partitioned. Otherwise, don't set Partitioned.\n//         Since there's no easy cross-compat way to do this (CookieStore and document.cookie do not return whether a\n//         cookie is partitioned on some/all versions of Safari and Firefox), we use a heuristic; we run this test by\n//         creating two cookies with the same name: One with Partitioned and one without. If there are two resulting\n//         cookies, that means they were put into different jars, implying that the browser supports Partitioned cookies\n//         (but doesn't partition cookies by default). If they result in just one cookie, that could mean that the\n//         browser doesn't support Partitioned cookies, or that the browser doesn't put partitioned cookies into\n//         different jars by default, in which case we still don't know. This heuristic works on Chrome, but may\n//         incorrectly conclude that some other browsers don't support Partitioned. But from a security perspective,\n//         that is better than accidentally setting SameSite=None without Partitioned. TODO: Find a better heuristic to\n//         to determine whether the browser supports Partitioned cookies or not.\n//    - In a Next.js server environment, right now we do nothing because of the complexity involved :( TODO: In the\n//      future, we could improve this for example by setting hint cookies from the client, but we need to make sure that\n//      no malicious actor (eg. on a malicious subdomain) can forcefully enable Partitioned cookies on a browser that\n//      does not support it.\n\n\ntype SetCookieOptions = { maxAge: number | \"session\", noOpIfServerComponent?: boolean, domain?: string, secure?: boolean };\ntype DeleteCookieOptions = { noOpIfServerComponent?: boolean, domain?: string };\n\nfunction ensureClient() {\n  if (!isBrowserLike()) {\n    throw new Error(\"cookieClient functions can only be called in a browser environment, yet window is undefined\");\n  }\n}\n\nexport type CookieHelper = {\n  get: (name: string) => string | null,\n  getAll: () => Record<string, string>,\n  set: (name: string, value: string, options: SetCookieOptions) => void,\n  setOrDelete: (name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) => void,\n  delete: (name: string, options: DeleteCookieOptions) => void,\n};\n\nconst placeholderCookieHelperIdentity = { \"placeholder cookie helper identity\": true };\nexport async function createPlaceholderCookieHelper(): Promise<CookieHelper> {\n  function throwError(): never {\n    throw new StackAssertionError(\"Throwing cookie helper is just a placeholder. This should never be called\");\n  }\n  return {\n    get: throwError,\n    getAll: throwError,\n    set: throwError,\n    setOrDelete: throwError,\n    delete: throwError,\n  };\n}\n\nexport async function createCookieHelper(): Promise<CookieHelper> {\n  if (isBrowserLike()) {\n    return createBrowserCookieHelper();\n  } else {\n    return await createPlaceholderCookieHelper();\n  }\n}\n\nexport function createBrowserCookieHelper(): CookieHelper {\n  return {\n    get: getCookieClient,\n    getAll: getAllCookiesClient,\n    set: setCookieClient,\n    setOrDelete: setOrDeleteCookieClient,\n    delete: deleteCookieClient,\n  };\n}\n\nfunction handleCookieError(e: unknown, options: DeleteCookieOptions | SetCookieOptions) {\n  if (e instanceof Error && e.message.includes(\"Cookies can only be modified in\")) {\n    if (options.noOpIfServerComponent) {\n      // ignore\n    } else {\n      throw new StackAssertionError(\"Attempted to set cookie in server component. Pass { noOpIfServerComponent: true } in the options of Stack's cookie functions if this is intentional and you want to ignore this error. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#options\");\n    }\n  } else {\n    throw e;\n  }\n}\n\n\nexport function getCookieClient(name: string): string | null {\n  const all = getAllCookiesClient();\n  return all[name] ?? null;\n}\n\nexport function getAllCookiesClient(): Record<string, string> {\n  ensureClient();\n  // set a helper cookie, see comment in `NextCookieHelper.set` above\n  Cookies.set(\"stack-is-https\", \"true\", { secure: true, expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365) });\n  return Cookies.get();\n}\n\nexport async function getCookie(name: string): Promise<string | null> {\n  const cookieHelper = await createCookieHelper();\n  return cookieHelper.get(name);\n}\n\nexport async function isSecure(): Promise<boolean> {\n  if (isBrowserLike()) {\n    return determineSecureFromClientContext();\n  }\n  return false;\n}\n\nfunction determineSecureFromClientContext(): boolean {\n  return typeof window !== \"undefined\" && window.location.protocol === \"https:\";\n}\n\n\nlet _shouldSetPartitionedClientCache: boolean | undefined = undefined;\nfunction shouldSetPartitionedClient() {\n  return _shouldSetPartitionedClientCache ??= _internalShouldSetPartitionedClient();\n}\nfunction _internalShouldSetPartitionedClient() {\n  ensureClient();\n\n  if (!(determineSecureFromClientContext())) {\n    return false;\n  }\n\n  // check whether we can set & retrieve normal cookies (either because we're on a top-level/same-origin context or the browser partitions cookies by default)\n  const cookie1Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n  document.cookie = `${cookie1Name}=value1; Secure; path=/`;\n  const cookies1 = document.cookie.split(\"; \");\n  document.cookie = `${cookie1Name}=delete1; Secure; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC;`;\n  if (cookies1.some((c) => c.startsWith(cookie1Name + \"=\"))) {\n    return false;\n  }\n\n\n  // check whether Partitioned cookies are supported by the browser\n  // TODO: See comment at the top. Feels like we should find a better way to do this\n  const cookie2Name = \"__Host-stack-temporary-chips-test-\" + Math.random().toString(36).substring(2, 15);\n\n  // just to be safe, delete the cookie first to avoid weird RNG-prediction attacks\n  // I don't know what they look like (since this is a host cookie) but better safe than sorry\n  // (this function should be 100% bulletproof so we don't accidentally fall back to non-partitioned third party cookies on unsupported browsers)\n  document.cookie = `${cookie2Name}=delete1; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete2; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  // set the cookie, once partitioned and once not partitioned\n  document.cookie = `${cookie2Name}=set1; Secure; SameSite=None; Partitioned; path=/`;\n  document.cookie = `${cookie2Name}=set2; Secure; SameSite=None; path=/`;\n\n  // check if there are two cookies\n  const cookies2 = document.cookie.split(\"; \");\n  const numberOfCookiesWithThisName = cookies2.filter((c) => c.startsWith(cookie2Name + \"=\")).length;\n\n  // clean up\n  document.cookie = `${cookie2Name}=delete3; Secure; SameSite=None; Partitioned; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n  document.cookie = `${cookie2Name}=delete4; Secure; SameSite=None; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/`;\n\n  return numberOfCookiesWithThisName === 2;\n}\n\nfunction setCookieClientInternal(name: string, value: string, options: SetCookieOptions) {\n  const secure = options.secure ?? determineSecureFromClientContext();\n  const partitioned = shouldSetPartitionedClient();\n  Cookies.set(name, value, {\n    expires: options.maxAge === \"session\" ? undefined : new Date(Date.now() + (options.maxAge) * 1000),\n    domain: options.domain,\n    secure,\n    sameSite: \"Lax\",\n    ...(partitioned ? {\n      partitioned,\n      sameSite: \"None\",\n    } : {}),\n  });\n}\n\nfunction deleteCookieClientInternal(name: string, options: DeleteCookieOptions) {\n  for (const partitioned of [true, false]) {\n    if (options.domain !== undefined) {\n      Cookies.remove(name, { domain: options.domain, secure: determineSecureFromClientContext(), partitioned });\n    }\n    Cookies.remove(name, { secure: determineSecureFromClientContext(), partitioned });\n  }\n}\n\nexport function setOrDeleteCookieClient(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  ensureClient();\n  if (value === null) {\n    deleteCookieClientInternal(name, options);\n  } else {\n    setCookieClientInternal(name, value, options);\n  }\n}\n\nexport async function setOrDeleteCookie(name: string, value: string | null, options: SetCookieOptions & DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.setOrDelete(name, value, options);\n}\n\nexport function deleteCookieClient(name: string, options: DeleteCookieOptions) {\n  ensureClient();\n  deleteCookieClientInternal(name, options);\n}\n\nexport async function deleteCookie(name: string, options: DeleteCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.delete(name, options);\n}\n\nexport function setCookieClient(name: string, value: string, options: SetCookieOptions) {\n  ensureClient();\n  setCookieClientInternal(name, value, options);\n}\n\nexport async function setCookie(name: string, value: string, options: SetCookieOptions) {\n  const cookieHelper = await createCookieHelper();\n  cookieHelper.set(name, value, options);\n}\n\nexport async function saveVerifierAndState() {\n  const codeVerifier = generateRandomCodeVerifier();\n  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);\n  const state = generateRandomState();\n\n  await setCookie(\"stack-oauth-outer-\" + state, codeVerifier, { maxAge: 60 * 60 });\n\n  return {\n    codeChallenge,\n    state,\n  };\n}\n\nexport function consumeVerifierAndStateCookie(state: string) {\n  ensureClient();\n  const cookieName = \"stack-oauth-outer-\" + state;\n  const codeVerifier = getCookieClient(cookieName);\n  if (!codeVerifier) {\n    return null;\n  }\n  deleteCookieClient(cookieName, {});\n  return {\n    codeVerifier,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,iBAA8B;AAC9B,oBAAoC;AACpC,uBAAoB;AACpB,0BAA4F;AAiE5F,SAAS,eAAe;AACtB,MAAI,KAAC,0BAAc,GAAG;AACpB,UAAM,IAAI,MAAM,6FAA6F;AAAA,EAC/G;AACF;AAWA,eAAsB,gCAAuD;AAC3E,WAAS,aAAoB;AAC3B,UAAM,IAAI,kCAAoB,2EAA2E;AAAA,EAC3G;AACA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAEA,eAAsB,qBAA4C;AAChE,UAAI,0BAAc,GAAG;AACnB,WAAO,0BAA0B;AAAA,EACnC,OAAO;AACL,WAAO,MAAM,8BAA8B;AAAA,EAC7C;AACF;AAEO,SAAS,4BAA0C;AACxD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,EACV;AACF;AAeO,SAAS,gBAAgB,MAA6B;AAC3D,QAAM,MAAM,oBAAoB;AAChC,SAAO,IAAI,IAAI,KAAK;AACtB;AAEO,SAAS,sBAA8C;AAC5D,eAAa;AAEb,mBAAAA,QAAQ,IAAI,kBAAkB,QAAQ,EAAE,QAAQ,MAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,KAAK,KAAK,GAAG,EAAE,CAAC;AACjH,SAAO,iBAAAA,QAAQ,IAAI;AACrB;AAEA,eAAsB,UAAU,MAAsC;AACpE,QAAM,eAAe,MAAM,mBAAmB;AAC9C,SAAO,aAAa,IAAI,IAAI;AAC9B;AAEA,eAAsB,WAA6B;AACjD,UAAI,0BAAc,GAAG;AACnB,WAAO,iCAAiC;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,mCAA4C;AACnD,SAAO,OAAO,WAAW,eAAe,OAAO,SAAS,aAAa;AACvE;AAGA,IAAI,mCAAwD;AAC5D,SAAS,6BAA6B;AACpC,SAAO,qCAAqC,oCAAoC;AAClF;AACA,SAAS,sCAAsC;AAC7C,eAAa;AAEb,MAAI,CAAE,iCAAiC,GAAI;AACzC,WAAO;AAAA,EACT;AAGA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AACrG,WAAS,SAAS,GAAG,WAAW;AAChC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,WAAS,SAAS,GAAG,WAAW;AAChC,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,GAAG;AACzD,WAAO;AAAA,EACT;AAKA,QAAM,cAAc,uCAAuC,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,GAAG,EAAE;AAKrG,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAGhC,QAAM,WAAW,SAAS,OAAO,MAAM,IAAI;AAC3C,QAAM,8BAA8B,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,cAAc,GAAG,CAAC,EAAE;AAG5F,WAAS,SAAS,GAAG,WAAW;AAChC,WAAS,SAAS,GAAG,WAAW;AAEhC,SAAO,gCAAgC;AACzC;AAEA,SAAS,wBAAwB,MAAc,OAAe,SAA2B;AACvF,QAAM,SAAS,QAAQ,UAAU,iCAAiC;AAClE,QAAM,cAAc,2BAA2B;AAC/C,mBAAAA,QAAQ,IAAI,MAAM,OAAO;AAAA,IACvB,SAAS,QAAQ,WAAW,YAAY,SAAY,IAAI,KAAK,KAAK,IAAI,IAAK,QAAQ,SAAU,GAAI;AAAA,IACjG,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,GAAI,cAAc;AAAA,MAChB;AAAA,MACA,UAAU;AAAA,IACZ,IAAI,CAAC;AAAA,EACP,CAAC;AACH;AAEA,SAAS,2BAA2B,MAAc,SAA8B;AAC9E,aAAW,eAAe,CAAC,MAAM,KAAK,GAAG;AACvC,QAAI,QAAQ,WAAW,QAAW;AAChC,uBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,QAAQ,QAAQ,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,IAC1G;AACA,qBAAAA,QAAQ,OAAO,MAAM,EAAE,QAAQ,iCAAiC,GAAG,YAAY,CAAC;AAAA,EAClF;AACF;AAEO,SAAS,wBAAwB,MAAc,OAAsB,SAAiD;AAC3H,eAAa;AACb,MAAI,UAAU,MAAM;AAClB,+BAA2B,MAAM,OAAO;AAAA,EAC1C,OAAO;AACL,4BAAwB,MAAM,OAAO,OAAO;AAAA,EAC9C;AACF;AAEA,eAAsB,kBAAkB,MAAc,OAAsB,SAAiD;AAC3H,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,YAAY,MAAM,OAAO,OAAO;AAC/C;AAEO,SAAS,mBAAmB,MAAc,SAA8B;AAC7E,eAAa;AACb,6BAA2B,MAAM,OAAO;AAC1C;AAEA,eAAsB,aAAa,MAAc,SAA8B;AAC7E,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,OAAO,MAAM,OAAO;AACnC;AAEO,SAAS,gBAAgB,MAAc,OAAe,SAA2B;AACtF,eAAa;AACb,0BAAwB,MAAM,OAAO,OAAO;AAC9C;AAEA,eAAsB,UAAU,MAAc,OAAe,SAA2B;AACtF,QAAM,eAAe,MAAM,mBAAmB;AAC9C,eAAa,IAAI,MAAM,OAAO,OAAO;AACvC;AAEA,eAAsB,uBAAuB;AAC3C,QAAM,mBAAe,gDAA2B;AAChD,QAAM,gBAAgB,UAAM,gDAA2B,YAAY;AACnE,QAAM,YAAQ,yCAAoB;AAElC,QAAM,UAAU,uBAAuB,OAAO,cAAc,EAAE,QAAQ,KAAK,GAAG,CAAC;AAE/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,8BAA8B,OAAe;AAC3D,eAAa;AACb,QAAM,aAAa,uBAAuB;AAC1C,QAAM,eAAe,gBAAgB,UAAU;AAC/C,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,qBAAmB,YAAY,CAAC,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,EACF;AACF;","names":["Cookies"]}