@stackframe/stack 2.4.17 → 2.4.20

package/dist/esm/providers/styled-components-registry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/providers/styled-components-registry.tsx"],"sourcesContent":["'use client';\n \nimport React, { useState } from 'react';\nimport { useServerInsertedHTML } from 'next/navigation';\nimport { ServerStyleSheet, StyleSheetManager } from 'styled-components';\n \nexport default function StyledComponentsRegistry({\n  children,\n}: {\n  children: React.ReactNode,\n}) {\n  // Only create stylesheet once with lazy initial state\n  // x-ref: https://reactjs.org/docs/hooks-reference.html#lazy-initial-state\n  const [styledComponentsStyleSheet] = useState(() => new ServerStyleSheet());\n \n  useServerInsertedHTML(() => {\n    const styles = styledComponentsStyleSheet.getStyleElement();\n    styledComponentsStyleSheet.instance.clearTag();\n    return <>{styles}</>;\n  });\n \n  if (typeof window !== 'undefined') return <>{children}</>;\n \n  return (\n    <StyleSheetManager sheet={styledComponentsStyleSheet.instance}>\n      {children}\n    </StyleSheetManager>\n  );\n}"],"mappings":";;;AAEA,SAAgB,gBAAgB;AAChC,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,yBAAyB;AAczC;AAZI,SAAR,yBAA0C;AAAA,EAC/C;AACF,GAEG;AAGD,QAAM,CAAC,0BAA0B,IAAI,SAAS,MAAM,IAAI,iBAAiB,CAAC;AAE1E,wBAAsB,MAAM;AAC1B,UAAM,SAAS,2BAA2B,gBAAgB;AAC1D,+BAA2B,SAAS,SAAS;AAC7C,WAAO,gCAAG,kBAAO;AAAA,EACnB,CAAC;AAED,MAAI,OAAO,WAAW;AAAa,WAAO,gCAAG,UAAS;AAEtD,SACE,oBAAC,qBAAkB,OAAO,2BAA2B,UAClD,UACH;AAEJ;","names":[]}
+{"version":3,"sources":["../../../src/providers/styled-components-registry.tsx"],"sourcesContent":["'use client';\n \nimport React, { useState } from 'react';\nimport { useServerInsertedHTML } from 'next/navigation';\nimport { ServerStyleSheet, StyleSheetManager } from 'styled-components';\nimport { isBrowserLike } from '@stackframe/stack-shared/src/utils/env';\n \nexport default function StyledComponentsRegistry({\n  children,\n}: {\n  children: React.ReactNode,\n}) {\n  // Only create stylesheet once with lazy initial state\n  // x-ref: https://reactjs.org/docs/hooks-reference.html#lazy-initial-state\n  const [styledComponentsStyleSheet] = useState(() => new ServerStyleSheet());\n \n  useServerInsertedHTML(() => {\n    const styles = styledComponentsStyleSheet.getStyleElement();\n    styledComponentsStyleSheet.instance.clearTag();\n    return <>{styles}</>;\n  });\n \n  if (isBrowserLike()) return <>{children}</>;\n \n  return (\n    <StyleSheetManager sheet={styledComponentsStyleSheet.instance}>\n      {children}\n    </StyleSheetManager>\n  );\n}\n"],"mappings":";;;AAEA,SAAgB,gBAAgB;AAChC,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,qBAAqB;AAcnB;AAZI,SAAR,yBAA0C;AAAA,EAC/C;AACF,GAEG;AAGD,QAAM,CAAC,0BAA0B,IAAI,SAAS,MAAM,IAAI,iBAAiB,CAAC;AAE1E,wBAAsB,MAAM;AAC1B,UAAM,SAAS,2BAA2B,gBAAgB;AAC1D,+BAA2B,SAAS,SAAS;AAC7C,WAAO,gCAAG,kBAAO;AAAA,EACnB,CAAC;AAED,MAAI,cAAc;AAAG,WAAO,gCAAG,UAAS;AAExC,SACE,oBAAC,qBAAkB,OAAO,2BAA2B,UAClD,UACH;AAEJ;","names":[]}

package/dist/index.d.mts

@@ -28,6 +28,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 import '@radix-ui/react-tabs';
 import '@radix-ui/react-collapsible';
 import '@radix-ui/react-avatar';

package/dist/index.d.ts

@@ -28,6 +28,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 import '@radix-ui/react-tabs';
 import '@radix-ui/react-collapsible';
 import '@radix-ui/react-avatar';

package/dist/lib/auth.d.mts

@@ -1,11 +1,13 @@
-import * as oauth4webapi from 'oauth4webapi';
 import { StackClientInterface } from '@stackframe/stack-shared';
-import { TokenStore } from '@stackframe/stack-shared/dist/interface/clientInterface';
 
 declare function signInWithOAuth(iface: StackClientInterface, { provider, redirectUrl, }: {
     provider: string;
     redirectUrl?: string;
 }): Promise<void>;
-declare function callOAuthCallback(iface: StackClientInterface, tokenStore: TokenStore, redirectUrl: string): Promise<oauth4webapi.OAuth2TokenEndpointResponse | null>;
+declare function callOAuthCallback(iface: StackClientInterface, redirectUrl: string): Promise<{
+    newUser: boolean;
+    accessToken: string;
+    refreshToken: string;
+} | null>;
 
 export { callOAuthCallback, signInWithOAuth };

package/dist/lib/auth.d.ts

@@ -1,11 +1,13 @@
-import * as oauth4webapi from 'oauth4webapi';
 import { StackClientInterface } from '@stackframe/stack-shared';
-import { TokenStore } from '@stackframe/stack-shared/dist/interface/clientInterface';
 
 declare function signInWithOAuth(iface: StackClientInterface, { provider, redirectUrl, }: {
     provider: string;
     redirectUrl?: string;
 }): Promise<void>;
-declare function callOAuthCallback(iface: StackClientInterface, tokenStore: TokenStore, redirectUrl: string): Promise<oauth4webapi.OAuth2TokenEndpointResponse | null>;
+declare function callOAuthCallback(iface: StackClientInterface, redirectUrl: string): Promise<{
+    newUser: boolean;
+    accessToken: string;
+    refreshToken: string;
+} | null>;
 
 export { callOAuthCallback, signInWithOAuth };

package/dist/lib/auth.js

@@ -61,7 +61,7 @@ function consumeOAuthCallbackQueryParams(expectedState) {
   window.history.replaceState({}, "", newUrl.toString());
   return originalUrl;
 }
-async function callOAuthCallback(iface, tokenStore, redirectUrl) {
+async function callOAuthCallback(iface, redirectUrl) {
   const { codeVerifier, state } = (0, import_cookie.getVerifierAndState)();
   if (!codeVerifier || !state) {
     throw new Error("Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.");
@@ -74,8 +74,7 @@ async function callOAuthCallback(iface, tokenStore, redirectUrl) {
       originalUrl.searchParams,
       (0, import_url.constructRedirectUrl)(redirectUrl),
       codeVerifier,
-      state,
-      tokenStore
+      state
     );
   } catch (e) {
     throw new import_errors.StackAssertionError("Error signing in during OAuth callback. Please try again.", { cause: e });

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { saveVerifierAndState, getVerifierAndState } from \"./cookie\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { TokenStore } from \"@stackframe/stack-shared/dist/interface/clientInterface\";\nimport { neverResolve, wait } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  {\n    provider,\n    redirectUrl,\n  } : { \n    provider: string,\n    redirectUrl?: string,\n  }\n) {\n  redirectUrl = constructRedirectUrl(redirectUrl);\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl(\n    provider,\n    redirectUrl,\n    codeChallenge,\n    state,\n  );\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n * \n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl; \n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  tokenStore: TokenStore,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback(\n      originalUrl.searchParams,\n      constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n      tokenStore,\n    );\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0D;AAC1D,iBAAqC;AAErC,sBAAmC;AACnC,oBAAoC;AAEpC,eAAsB,gBACpB,OACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,oBAAc,iCAAqB,WAAW;AAC9C,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,YACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC;AAAa,WAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM;AAAA,MACjB,YAAY;AAAA,UACZ,iCAAqB,WAAW;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { StackClientInterface } from \"@stackframe/stack-shared\";\nimport { saveVerifierAndState, getVerifierAndState } from \"./cookie\";\nimport { constructRedirectUrl } from \"../utils/url\";\nimport { neverResolve, wait } from \"@stackframe/stack-shared/dist/utils/promises\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\n\nexport async function signInWithOAuth(\n  iface: StackClientInterface,\n  {\n    provider,\n    redirectUrl,\n  } : { \n    provider: string,\n    redirectUrl?: string,\n  }\n) {\n  redirectUrl = constructRedirectUrl(redirectUrl);\n  const { codeChallenge, state } = await saveVerifierAndState();\n  const location = await iface.getOAuthUrl(\n    provider,\n    redirectUrl,\n    codeChallenge,\n    state,\n  );\n  window.location.assign(location);\n  await neverResolve();\n}\n\n/**\n * Checks if the current URL has the query parameters for an OAuth callback, and if so, removes them.\n * \n * Must be synchronous for the logic in callOAuthCallback to work without race conditions.\n */\nfunction consumeOAuthCallbackQueryParams(expectedState: string): null | URL {\n  const requiredParams = [\"code\", \"state\"];\n  const originalUrl = new URL(window.location.href);\n  for (const param of requiredParams) {\n    if (!originalUrl.searchParams.has(param)) {\n      return null;\n    }\n  }\n\n  if (expectedState !== originalUrl.searchParams.get(\"state\")) {\n    // If the state doesn't match, then the callback wasn't meant for us.\n    // Maybe the website uses another OAuth library?\n    return null;\n  }\n\n\n  const newUrl = new URL(originalUrl);\n  for (const param of requiredParams) {\n    newUrl.searchParams.delete(param);\n  }\n\n  // let's get rid of the authorization code in the history as we\n  // don't redirect to `redirectUrl` if there's a validation error\n  // (as the redirectUrl might be malicious!).\n  //\n  // We use history.replaceState instead of location.assign(...) to\n  // prevent an unnecessary reload\n  window.history.replaceState({}, \"\", newUrl.toString());\n\n  return originalUrl; \n}\n\nexport async function callOAuthCallback(\n  iface: StackClientInterface,\n  redirectUrl: string,\n) {\n  // note: this part of the function (until the return) needs\n  // to be synchronous, to prevent race conditions when\n  // callOAuthCallback is called multiple times in parallel\n  const { codeVerifier, state } = getVerifierAndState();\n  if (!codeVerifier || !state) {\n    throw new Error(\"Invalid OAuth callback URL parameters. It seems like the OAuth flow was interrupted, so please try again.\");\n  }\n  const originalUrl = consumeOAuthCallbackQueryParams(state);\n  if (!originalUrl) return null;\n\n  // the rest can be asynchronous (we now know that we are the\n  // intended recipient of the callback)\n  try {\n    return await iface.callOAuthCallback(\n      originalUrl.searchParams,\n      constructRedirectUrl(redirectUrl),\n      codeVerifier,\n      state,\n    );\n  } catch (e) {\n    throw new StackAssertionError(\"Error signing in during OAuth callback. Please try again.\", { cause: e });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0D;AAC1D,iBAAqC;AACrC,sBAAmC;AACnC,oBAAoC;AAEpC,eAAsB,gBACpB,OACA;AAAA,EACE;AAAA,EACA;AACF,GAIA;AACA,oBAAc,iCAAqB,WAAW;AAC9C,QAAM,EAAE,eAAe,MAAM,IAAI,UAAM,oCAAqB;AAC5D,QAAM,WAAW,MAAM,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,SAAS,OAAO,QAAQ;AAC/B,YAAM,8BAAa;AACrB;AAOA,SAAS,gCAAgC,eAAmC;AAC1E,QAAM,iBAAiB,CAAC,QAAQ,OAAO;AACvC,QAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI;AAChD,aAAW,SAAS,gBAAgB;AAClC,QAAI,CAAC,YAAY,aAAa,IAAI,KAAK,GAAG;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,kBAAkB,YAAY,aAAa,IAAI,OAAO,GAAG;AAG3D,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAW,SAAS,gBAAgB;AAClC,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC;AAQA,SAAO,QAAQ,aAAa,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC;AAErD,SAAO;AACT;AAEA,eAAsB,kBACpB,OACA,aACA;AAIA,QAAM,EAAE,cAAc,MAAM,QAAI,mCAAoB;AACpD,MAAI,CAAC,gBAAgB,CAAC,OAAO;AAC3B,UAAM,IAAI,MAAM,2GAA2G;AAAA,EAC7H;AACA,QAAM,cAAc,gCAAgC,KAAK;AACzD,MAAI,CAAC;AAAa,WAAO;AAIzB,MAAI;AACF,WAAO,MAAM,MAAM;AAAA,MACjB,YAAY;AAAA,UACZ,iCAAqB,WAAW;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AACV,UAAM,IAAI,kCAAoB,6DAA6D,EAAE,OAAO,EAAE,CAAC;AAAA,EACzG;AACF;","names":[]}

package/dist/lib/hooks.d.mts

@@ -5,6 +5,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/hooks.d.ts

@@ -5,6 +5,7 @@ import '@stackframe/stack-shared/dist/utils/json';
 import '@stackframe/stack-shared/dist/interface/adminInterface';
 import '@stackframe/stack-shared/dist/interface/serverInterface';
 import '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import '@stackframe/stack-shared/dist/sessions';
 
 /**
  * Returns the current user object. Equivalent to `useStackApp().useUser()`.

package/dist/lib/stack-app.d.mts

@@ -1,11 +1,20 @@
 import { ServerUserJson, OAuthProviderConfigJson, KnownErrors } from '@stackframe/stack-shared';
-import { TokenStore, UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
+import { UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProjectUpdateOptions, ApiKeySetCreateOptions } from '@stackframe/stack-shared/dist/interface/adminInterface';
 import { ServerUserUpdateJson, ServerTeamCustomizableJson, ServerPermissionDefinitionCustomizableJson, ServerPermissionDefinitionJson, EmailTemplateType } from '@stackframe/stack-shared/dist/interface/serverInterface';
 import { ListEmailTemplatesCrud, EmailTemplateCrud } from '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 
-type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | Request) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
+type RequestLike = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+};
+type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | RequestLike | {
+    accessToken: string;
+    refreshToken: string;
+}) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
 type HandlerUrls = {
     handler: string;
     signIn: string;
@@ -36,8 +45,7 @@ type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId e
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = ((StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
 }) | (Omit<StackServerAppConstructorOptions<HasTokenStore, ProjectId>, "publishableClientKey" | "secretServerKey"> & {
-    projectOwnerTokens: TokenStore;
-    refreshProjectOwnerTokens: () => Promise<void>;
+    projectOwnerSession: InternalSession;
 }));
 type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
     uniqueIdentifier: string;
@@ -46,17 +54,26 @@ declare const stackAppInternalsSymbol: unique symbol;
 type RedirectToOptions = {
     replace?: boolean;
 };
+type Session = {
+    getTokens(): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
+};
+/**
+ * Contains everything related to the current user session.
+ */
 type Auth<T, C> = {
-    readonly tokenStore: TokenStore;
-    refreshAccessToken(this: T): Promise<void>;
-    updateSelectedTeam(this: T, team: Team | null): Promise<void>;
-    update(this: T, user: C): Promise<void>;
+    readonly _internalSession: InternalSession;
+    readonly currentSession: Session;
     signOut(this: T): Promise<void>;
-    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | undefined>;
+    update(this: T, user: C): Promise<void>;
+    updateSelectedTeam(this: T, team: Team | null): Promise<void>;
+    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     updatePassword(this: T, options: {
         oldPassword: string;
         newPassword: string;
-    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
 };
 type InternalAuth<T> = {
     createProject(this: T, newProject: ProjectUpdateOptions & {
@@ -230,21 +247,84 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | undefined>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
     callOAuthCallback(): Promise<boolean>;
-    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | undefined>;
-    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | undefined>;
+    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | void>;
+    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | void>;
     resetPassword(options: {
         code: string;
         password: string;
-    }): Promise<KnownErrors["PasswordResetError"] | undefined>;
-    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | undefined>;
-    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | undefined>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | undefined>;
+    }): Promise<KnownErrors["PasswordResetError"] | void>;
+    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | void>;
+    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | void>;
+    /**
+     * With most browsers now disabling third-party cookies by default, the best way to send authenticated requests
+     * across different origins is to pass the tokens in a header.
+     *
+     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
+     * authenticated requests.
+     *
+     * On the server, you can then pass in the `Request` object to the `tokenStore` option
+     * on your Stack app to fetch user details. Please note that CORS by default does not allow custom headers, so you
+     * must set the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
+     * to include `x-stack-auth` in the CORS preflight response.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await fetch("https://api.example.com", {
+     *   headers: {
+     *     ...await stackApp.getCrossOriginHeaders()
+     *     // you can also add your own headers here
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(req: Request) {
+     *   const user = await stackServerApp.getUser({ tokenStore: req });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getCrossOriginHeaders(): Promise<{
+        "x-stack-auth": string;
+    }>;
+    /**
+     * With most browsers now disabling third-party cookies by default, there need to be new ways to send authenticated
+     * requests across different origins. While `getCrossOriginHeaders` is the recommended way to do this, there
+     * are some cases where you might want to send the tokens differently, for example when you are using WebSockets
+     * or non-HTTP protocols.
+     *
+     * This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
+     * There, you can use the `tokenStore` option on your Stack app to fetch user details.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await rpcCall(rpcEndpoint, {
+     *   data: {
+     *     auth: await stackApp.getCrossOriginTokenObject(),
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(data) {
+     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getCrossOriginTokenObject(): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
     [stackAppInternalsSymbol]: {
         toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>;
         setCurrentUser(userJsonPromise: Promise<UserJson | null>): void;

package/dist/lib/stack-app.d.ts

@@ -1,11 +1,20 @@
 import { ServerUserJson, OAuthProviderConfigJson, KnownErrors } from '@stackframe/stack-shared';
-import { TokenStore, UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
+import { UserJson, UserUpdateJson, ProjectJson, ProductionModeError, TeamJson, EmailConfigJson, DomainConfigJson, ClientProjectJson } from '@stackframe/stack-shared/dist/interface/clientInterface';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProjectUpdateOptions, ApiKeySetCreateOptions } from '@stackframe/stack-shared/dist/interface/adminInterface';
 import { ServerUserUpdateJson, ServerTeamCustomizableJson, ServerPermissionDefinitionCustomizableJson, ServerPermissionDefinitionJson, EmailTemplateType } from '@stackframe/stack-shared/dist/interface/serverInterface';
 import { ListEmailTemplatesCrud, EmailTemplateCrud } from '@stackframe/stack-shared/dist/interface/crud/email-templates';
+import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 
-type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | Request) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
+type RequestLike = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+};
+type TokenStoreInit<HasTokenStore extends boolean = boolean> = HasTokenStore extends true ? ("cookie" | "nextjs-cookie" | "memory" | RequestLike | {
+    accessToken: string;
+    refreshToken: string;
+}) : HasTokenStore extends false ? null : TokenStoreInit<true> | TokenStoreInit<false>;
 type HandlerUrls = {
     handler: string;
     signIn: string;
@@ -36,8 +45,7 @@ type StackServerAppConstructorOptions<HasTokenStore extends boolean, ProjectId e
 type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = ((StackServerAppConstructorOptions<HasTokenStore, ProjectId> & {
     superSecretAdminKey?: string;
 }) | (Omit<StackServerAppConstructorOptions<HasTokenStore, ProjectId>, "publishableClientKey" | "secretServerKey"> & {
-    projectOwnerTokens: TokenStore;
-    refreshProjectOwnerTokens: () => Promise<void>;
+    projectOwnerSession: InternalSession;
 }));
 type StackClientAppJson<HasTokenStore extends boolean, ProjectId extends string> = StackClientAppConstructorOptions<HasTokenStore, ProjectId> & {
     uniqueIdentifier: string;
@@ -46,17 +54,26 @@ declare const stackAppInternalsSymbol: unique symbol;
 type RedirectToOptions = {
     replace?: boolean;
 };
+type Session = {
+    getTokens(): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
+};
+/**
+ * Contains everything related to the current user session.
+ */
 type Auth<T, C> = {
-    readonly tokenStore: TokenStore;
-    refreshAccessToken(this: T): Promise<void>;
-    updateSelectedTeam(this: T, team: Team | null): Promise<void>;
-    update(this: T, user: C): Promise<void>;
+    readonly _internalSession: InternalSession;
+    readonly currentSession: Session;
     signOut(this: T): Promise<void>;
-    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | undefined>;
+    update(this: T, user: C): Promise<void>;
+    updateSelectedTeam(this: T, team: Team | null): Promise<void>;
+    sendVerificationEmail(this: T): Promise<KnownErrors["EmailAlreadyVerified"] | void>;
     updatePassword(this: T, options: {
         oldPassword: string;
         newPassword: string;
-    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["PasswordMismatch"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
 };
 type InternalAuth<T> = {
     createProject(this: T, newProject: ProjectUpdateOptions & {
@@ -230,21 +247,84 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
     signInWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["EmailPasswordMismatch"] | undefined>;
+    }): Promise<KnownErrors["EmailPasswordMismatch"] | void>;
     signUpWithCredential(options: {
         email: string;
         password: string;
-    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | undefined>;
+    }): Promise<KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"] | void>;
     callOAuthCallback(): Promise<boolean>;
-    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | undefined>;
-    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | undefined>;
+    sendForgotPasswordEmail(email: string): Promise<KnownErrors["UserNotFound"] | void>;
+    sendMagicLinkEmail(email: string): Promise<KnownErrors["RedirectUrlNotWhitelisted"] | void>;
     resetPassword(options: {
         code: string;
         password: string;
-    }): Promise<KnownErrors["PasswordResetError"] | undefined>;
-    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | undefined>;
-    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | undefined>;
-    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | undefined>;
+    }): Promise<KnownErrors["PasswordResetError"] | void>;
+    verifyPasswordResetCode(code: string): Promise<KnownErrors["PasswordResetCodeError"] | void>;
+    verifyEmail(code: string): Promise<KnownErrors["EmailVerificationError"] | void>;
+    signInWithMagicLink(code: string): Promise<KnownErrors["MagicLinkError"] | void>;
+    /**
+     * With most browsers now disabling third-party cookies by default, the best way to send authenticated requests
+     * across different origins is to pass the tokens in a header.
+     *
+     * This function returns a header object that can be used with `fetch` or other HTTP request libraries to send
+     * authenticated requests.
+     *
+     * On the server, you can then pass in the `Request` object to the `tokenStore` option
+     * on your Stack app to fetch user details. Please note that CORS by default does not allow custom headers, so you
+     * must set the [`Access-Control-Allow-Headers` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers)
+     * to include `x-stack-auth` in the CORS preflight response.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await fetch("https://api.example.com", {
+     *   headers: {
+     *     ...await stackApp.getCrossOriginHeaders()
+     *     // you can also add your own headers here
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(req: Request) {
+     *   const user = await stackServerApp.getUser({ tokenStore: req });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getCrossOriginHeaders(): Promise<{
+        "x-stack-auth": string;
+    }>;
+    /**
+     * With most browsers now disabling third-party cookies by default, there need to be new ways to send authenticated
+     * requests across different origins. While `getCrossOriginHeaders` is the recommended way to do this, there
+     * are some cases where you might want to send the tokens differently, for example when you are using WebSockets
+     * or non-HTTP protocols.
+     *
+     * This function returns a token object that can be JSON-serialized and sent to the server in any way you like.
+     * There, you can use the `tokenStore` option on your Stack app to fetch user details.
+     *
+     * Example:
+     *
+     * ```ts
+     * // client
+     * const res = await rpcCall(rpcEndpoint, {
+     *   data: {
+     *     auth: await stackApp.getCrossOriginTokenObject(),
+     *   },
+     * });
+     *
+     * // server
+     * function handleRequest(data) {
+     *   const user = await stackServerApp.getUser({ tokenStore: data.auth });
+     *   return new Response("Welcome, " + user.displayName);
+     * }
+     * ```
+     */
+    getCrossOriginTokenObject(): Promise<{
+        accessToken: string | null;
+        refreshToken: string | null;
+    }>;
     [stackAppInternalsSymbol]: {
         toClientJson(): StackClientAppJson<HasTokenStore, ProjectId>;
         setCurrentUser(userJsonPromise: Promise<UserJson | null>): void;