@stackframe/react 2.8.69 → 2.8.70

package/dist/esm/lib/stack-app/apps/implementations/client-app-impl.js

@@ -64,6 +64,7 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
     this._currentUserTeamsCache = createCacheBySession(async (session) => {
       return await this._interface.listCurrentUserTeams(session);
     });
+    /** @deprecated Used by legacy getConnectedAccount(providerId) — uses old per-provider access token endpoint */
     this._currentUserOAuthConnectionAccessTokensCache = createCacheBySession(
       async (session, [providerId, scope]) => {
         try {
@@ -77,6 +78,7 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         return null;
       }
     );
+    /** @deprecated Used by legacy getConnectedAccount(providerId) — combines token check + redirect */
     this._currentUserOAuthConnectionCache = createCacheBySession(
       async (session, [providerId, scope, redirect]) => {
         return await this._getUserOAuthConnectionCacheFn({
@@ -90,6 +92,49 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         });
       }
     );
+    this._currentUserConnectedAccountsCache = createCacheBySession(
+      async (session) => {
+        const result = await this._interface.listConnectedAccounts(session);
+        return result.items.map((item) => this._createOAuthConnectionFromCrudItem(item, session));
+      }
+    );
+    this._currentUserOAuthConnectionAccessTokensByAccountCache = createCacheBySession(
+      async (session, [providerId, providerAccountId, scope]) => {
+        try {
+          const result = await this._interface.createProviderAccessTokenByAccount(providerId, providerAccountId, scope, session);
+          return { accessToken: result.access_token };
+        } catch (err) {
+          if (KnownErrors.OAuthConnectionDoesNotHaveRequiredScope.isInstance(err) || KnownErrors.OAuthConnectionNotConnectedToUser.isInstance(err)) {
+            return null;
+          }
+          throw err;
+        }
+      }
+    );
+    this._currentUserValidConnectedAccountForProviderCache = createCacheBySession(
+      async (session, [provider, scopeString]) => {
+        const connectedAccounts = Result.orThrow(await this._currentUserConnectedAccountsCache.getOrWait([session], "write-only"));
+        const matchingAccounts = connectedAccounts.filter((a) => a.provider === provider);
+        const scopes = scopeString ? scopeString.split(" ") : void 0;
+        for (const account of matchingAccounts) {
+          const tokenResult = await account.getAccessToken({ scopes });
+          if (tokenResult.status === "ok") {
+            return account;
+          }
+        }
+        await addNewOAuthProviderOrScope(
+          this._interface,
+          {
+            provider,
+            redirectUrl: this.urls.oauthCallback,
+            errorRedirectUrl: this.urls.error,
+            providerScope: mergeScopeStrings(scopeString, (this._oauthScopesOnSignIn[provider] ?? []).join(" "))
+          },
+          session
+        );
+        return await neverResolve();
+      }
+    );
     this._teamMemberProfilesCache = createCacheBySession(
       async (session, [teamId]) => {
         return await this._interface.listTeamMemberProfiles({ teamId }, session);
@@ -260,14 +305,14 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       this._initUniqueIdentifier();
     }
     this._analyticsOptions = resolvedOptions.analytics;
+    const getAnalyticsAccessToken = async () => {
+      this._ensurePersistentTokenStore();
+      return await (await this.getUser({ or: "anonymous" })).getAccessToken();
+    };
     if (isBrowserLike() && this._analyticsOptions?.replays?.enabled === true) {
       this._sessionRecorder = new SessionRecorder({
         projectId: this.projectId,
-        getAccessToken: async () => {
-          const session = await this._getSession();
-          const tokens = await session.getOrFetchLikelyValidTokens(2e4, 75e3);
-          return tokens?.accessToken.token ?? null;
-        },
+        getAccessToken: getAnalyticsAccessToken,
         sendBatch: async (body, opts) => {
           return await this._interface.sendSessionReplayBatch(body, await this._getSession(), opts);
         }
@@ -277,11 +322,7 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
     if (isBrowserLike() && this.projectId === "internal") {
       this._eventTracker = new EventTracker({
         projectId: this.projectId,
-        getAccessToken: async () => {
-          const session = await this._getSession();
-          const tokens = await session.getOrFetchLikelyValidTokens(2e4, 75e3);
-          return tokens?.accessToken.token ?? null;
-        },
+        getAccessToken: getAnalyticsAccessToken,
         sendBatch: async (body, opts) => {
           return await this._interface.sendAnalyticsEventBatch(body, await this._getSession(), opts);
         }
@@ -297,6 +338,7 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       return await createPlaceholderCookieHelper();
     }
   }
+  /** @deprecated Used by legacy getConnectedAccount(providerId) — combines user check + token check + redirect into one cache */
   async _getUserOAuthConnectionCacheFn(options) {
     const user = await options.getUser();
     let hasConnection = true;
@@ -329,24 +371,58 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
     } else if (!hasConnection) {
       return null;
     }
+    const matchingProvider = user.oauth_providers.find((p) => p.id === options.providerId);
+    const providerAccountId = matchingProvider?.account_id ?? "";
     return {
       id: options.providerId,
+      // deprecated, for backward compat
+      provider: options.providerId,
+      providerAccountId,
       async getAccessToken() {
         const result = await options.getOrWaitOAuthToken();
         if (!result) {
-          throw new StackAssertionError("No access token available");
+          throw new StackAssertionError(`Failed to retrieve an access token for this connected account (provider: ${options.providerId}). This usually means the OAuth refresh token has been revoked or expired. The user needs to re-authorize by calling \`linkConnectedAccount\` or using \`getOrLinkConnectedAccount\`.`);
         }
         return result;
       },
       useAccessToken() {
         const result = options.useOAuthToken();
         if (!result) {
-          throw new StackAssertionError("No access token available");
+          throw new StackAssertionError(`Failed to retrieve an access token for this connected account (provider: ${options.providerId}). This usually means the OAuth refresh token has been revoked or expired. The user needs to re-authorize by calling \`linkConnectedAccount\` or using \`getOrLinkConnectedAccount\`.`);
         }
         return result;
       }
     };
   }
+  _createOAuthConnectionFromCrudItem(item, session) {
+    const app = this;
+    const providerId = item.provider;
+    const providerAccountId = item.provider_account_id;
+    return {
+      id: providerId,
+      // deprecated, for backward compat
+      provider: providerId,
+      providerAccountId,
+      async getAccessToken(options) {
+        const scopeString = options?.scopes?.join(" ") ?? "";
+        const result = Result.orThrow(await app._currentUserOAuthConnectionAccessTokensByAccountCache.getOrWait([session, providerId, providerAccountId, scopeString], "write-only"));
+        if (!result) {
+          const scopeDetail = scopeString ? `The requested scopes [${scopeString}] are not available on the existing token.` : "The OAuth refresh token has likely been revoked or expired.";
+          return Result.error(new KnownErrors.OAuthAccessTokenNotAvailable(providerId, `${scopeDetail} The user needs to re-authorize by calling \`linkConnectedAccount\` or using \`getOrLinkConnectedAccount\`.`));
+        }
+        return Result.ok(result);
+      },
+      useAccessToken(options) {
+        const scopeString = options?.scopes?.join(" ") ?? "";
+        const result = useAsyncCache(app._currentUserOAuthConnectionAccessTokensByAccountCache, [session, providerId, providerAccountId, scopeString], "connection.useAccessToken()");
+        if (!result) {
+          const scopeDetail = scopeString ? `The requested scopes [${scopeString}] are not available on the existing token.` : "The OAuth refresh token has likely been revoked or expired.";
+          return Result.error(new KnownErrors.OAuthAccessTokenNotAvailable(providerId, `${scopeDetail} The user needs to re-authorize by calling \`linkConnectedAccount\` or using \`getOrLinkConnectedAccount\`.`));
+        }
+        return Result.ok(result);
+      }
+    };
+  }
   _initUniqueIdentifier() {
     if (!this._uniqueIdentifier) {
       throw new StackAssertionError("Unique identifier not initialized");
@@ -978,7 +1054,10 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
             },
             session
           );
-          await app._currentUserOAuthProvidersCache.refresh([session]);
+          await Promise.all([
+            app._currentUserOAuthProvidersCache.refresh([session]),
+            app._currentUserConnectedAccountsCache.refresh([session])
+          ]);
           return Result.ok(void 0);
         } catch (error) {
           if (KnownErrors.OAuthProviderAccountIdAlreadyUsedForSignIn.isInstance(error)) {
@@ -989,7 +1068,10 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       },
       async delete() {
         await app._interface.deleteOAuthProvider(crud.user_id, crud.id, session);
-        await app._currentUserOAuthProvidersCache.refresh([session]);
+        await Promise.all([
+          app._currentUserOAuthProvidersCache.refresh([session]),
+          app._currentUserConnectedAccountsCache.refresh([session])
+        ]);
       }
     };
   }
@@ -1153,13 +1235,36 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
   }
   _createUserExtraFromCurrent(crud, session) {
     const app = this;
-    async function getConnectedAccount(id, options) {
-      const scopeString = options?.scopes?.join(" ");
-      return Result.orThrow(await app._currentUserOAuthConnectionCache.getOrWait([session, id, scopeString || "", options?.or === "redirect"], "write-only"));
-    }
-    function useConnectedAccount(id, options) {
-      const scopeString = options?.scopes?.join(" ");
-      return useAsyncCache(app._currentUserOAuthConnectionCache, [session, id, scopeString || "", options?.or === "redirect"], "user.useConnectedAccount()");
+    async function getConnectedAccount(idOrAccount, options) {
+      const scopeString = options?.scopes?.join(" ") ?? "";
+      if (typeof idOrAccount === "object" && "provider" in idOrAccount && "providerAccountId" in idOrAccount) {
+        const { provider, providerAccountId } = idOrAccount;
+        const connectedAccounts = Result.orThrow(await app._currentUserConnectedAccountsCache.getOrWait([session], "write-only"));
+        const found = connectedAccounts.find(
+          (a) => a.provider === provider && a.providerAccountId === providerAccountId
+        );
+        if (!found) {
+          return null;
+        }
+        return found;
+      }
+      return Result.orThrow(await app._currentUserOAuthConnectionCache.getOrWait([session, idOrAccount, scopeString, options?.or === "redirect"], "write-only"));
+    }
+    function useConnectedAccount(idOrAccount, options) {
+      const scopeString = options?.scopes?.join(" ") ?? "";
+      if (typeof idOrAccount === "object" && "provider" in idOrAccount && "providerAccountId" in idOrAccount) {
+        const { provider, providerAccountId } = idOrAccount;
+        const connectedAccounts = useAsyncCache(
+          app._currentUserConnectedAccountsCache,
+          [session],
+          "user.useConnectedAccount()"
+        );
+        const found = connectedAccounts.find(
+          (a) => a.provider === provider && a.providerAccountId === providerAccountId
+        );
+        return found ?? null;
+      }
+      return useAsyncCache(app._currentUserOAuthConnectionCache, [session, idOrAccount, scopeString, options?.or === "redirect"], "user.useConnectedAccount()");
     }
     return {
       async getActiveSessions() {
@@ -1181,6 +1286,42 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       getConnectedAccount,
       useConnectedAccount,
       // THIS_LINE_PLATFORM react-like
+      async listConnectedAccounts() {
+        return Result.orThrow(await app._currentUserConnectedAccountsCache.getOrWait([session], "write-only"));
+      },
+      useConnectedAccounts() {
+        return useAsyncCache(app._currentUserConnectedAccountsCache, [session], "user.useConnectedAccounts()");
+      },
+      async linkConnectedAccount(provider, options) {
+        const scopeString = options?.scopes?.join(" ") ?? "";
+        await addNewOAuthProviderOrScope(
+          app._interface,
+          {
+            provider,
+            redirectUrl: app.urls.oauthCallback,
+            errorRedirectUrl: app.urls.error,
+            providerScope: mergeScopeStrings(scopeString, (app._oauthScopesOnSignIn[provider] ?? []).join(" "))
+          },
+          session
+        );
+        await neverResolve();
+      },
+      async getOrLinkConnectedAccount(provider, options) {
+        const connectedAccounts = Result.orThrow(await app._currentUserConnectedAccountsCache.getOrWait([session], "write-only"));
+        const matchingAccounts = connectedAccounts.filter((a) => a.provider === provider);
+        for (const account of matchingAccounts) {
+          const tokenResult = await account.getAccessToken({ scopes: options?.scopes });
+          if (tokenResult.status === "ok") {
+            return account;
+          }
+        }
+        await this.linkConnectedAccount(provider, options);
+        return await neverResolve();
+      },
+      useOrLinkConnectedAccount(provider, options) {
+        const scopeString = options?.scopes?.join(" ") ?? "";
+        return useAsyncCache(app._currentUserValidConnectedAccountForProviderCache, [session, provider, scopeString], "user.useOrLinkConnectedAccount()");
+      },
       async getTeam(teamId) {
         const teams = await this.listTeams();
         return teams.find((t) => t.id === teamId) ?? null;
@@ -1833,6 +1974,8 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         case void 0:
         case "anonymous-if-exists[deprecated]":
         case "return-null": {
+          crud = null;
+          break;
         }
       }
     }
@@ -2250,6 +2393,8 @@ ${url}`);
     return false;
   }
   async _signOut(session, options) {
+    this._eventTracker?.clearBuffer();
+    this._sessionRecorder?.clearBuffer();
     await storeLock.withWriteLock(async () => {
       await this._interface.signOut(session);
       if (options?.redirectUrl) {
@@ -2355,7 +2500,10 @@ ${url}`);
     await this._refreshSession(session);
   }
   async _refreshSession(session) {
-    await this._currentUserCache.refresh([session]);
+    await Promise.all([
+      this._currentUserCache.refresh([session]),
+      this._currentUserConnectedAccountsCache.refresh([session])
+    ]);
     session.suggestAccessTokenExpired();
   }
   async _refreshUsers() {