@stackframe/stack 2.5.17 → 2.5.19

package/dist/esm/lib/stack-app.js

@@ -3,6 +3,7 @@ import { isReactServer } from "@stackframe/stack-sc";
 import { KnownError, KnownErrors, StackAdminInterface, StackClientInterface, StackServerInterface } from "@stackframe/stack-shared";
 import { getProductionModeErrors } from "@stackframe/stack-shared/dist/helpers/production-mode";
 import { InternalSession } from "@stackframe/stack-shared/dist/sessions";
+import { encodeBase64 } from "@stackframe/stack-shared/dist/utils/bytes";
 import { AsyncCache } from "@stackframe/stack-shared/dist/utils/caches";
 import { scrambleDuringCompileTime } from "@stackframe/stack-shared/dist/utils/compile-time";
 import { isBrowserLike } from "@stackframe/stack-shared/dist/utils/env";
@@ -23,7 +24,7 @@ import { constructRedirectUrl } from "../utils/url";
 import { addNewOAuthProviderOrScope, callOAuthCallback, signInWithOAuth } from "./auth";
 import { deleteCookie, getCookie, setOrDeleteCookie } from "./cookie";
 var NextNavigation = scrambleDuringCompileTime(NextNavigationUnscrambled);
-var clientVersion = "js @stackframe/stack@2.5.17";
+var clientVersion = "js @stackframe/stack@2.5.19";
 function getUrls(partial) {
   const handler = partial.handler ?? "/handler";
   const home = partial.home ?? "/";
@@ -44,6 +45,8 @@ function getUrls(partial) {
     home,
     accountSettings: `${handler}/account-settings`,
     error: `${handler}/error`,
+    teamInvitation: `${handler}/team-invitation`,
+    teamCreation: `${handler}/team-creation`,
     ...filterUndefined(partial)
   };
 }
@@ -175,6 +178,16 @@ var _StackClientAppImpl = class __StackClientAppImpl {
         });
       }
     );
+    this._teamMemberProfilesCache = createCacheBySession(
+      async (session, [teamId]) => {
+        return await this._interface.listTeamMemberProfiles({ teamId }, session);
+      }
+    );
+    this._currentUserTeamProfileCache = createCacheBySession(
+      async (session, [teamId]) => {
+        return await this._interface.getTeamMemberProfile({ teamId, userId: "me" }, session);
+      }
+    );
     this._memoryTokenStore = createEmptyTokenStore();
     this._requestTokenStores = /* @__PURE__ */ new WeakMap();
     this._storedCookieTokenStore = null;
@@ -456,6 +469,9 @@ var _StackClientAppImpl = class __StackClientAppImpl {
     return React.useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
   }
   async _signInToAccountWithTokens(tokens) {
+    if (!("accessToken" in tokens) || !("refreshToken" in tokens)) {
+      throw new StackAssertionError("Invalid tokens object; can't sign in with this", { tokens });
+    }
     const tokenStore = this._getOrCreateTokenStore();
     tokenStore.set(tokens);
   }
@@ -478,9 +494,12 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   _clientProjectFromCrud(crud) {
     return {
       id: crud.id,
+      displayName: crud.display_name,
       config: {
+        signUpEnabled: crud.config.sign_up_enabled,
         credentialEnabled: crud.config.credential_enabled,
         magicLinkEnabled: crud.config.magic_link_enabled,
+        clientTeamCreationEnabled: crud.config.client_team_creation_enabled,
         oauthProviders: crud.config.enabled_oauth_providers.map((p) => ({
           id: p.id
         }))
@@ -492,11 +511,37 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       id: crud.id
     };
   }
+  _clientTeamUserFromCrud(crud) {
+    return {
+      id: crud.user_id,
+      teamProfile: {
+        displayName: crud.display_name,
+        profileImageUrl: crud.profile_image_url
+      }
+    };
+  }
   _clientTeamFromCrud(crud) {
+    const app = this;
     return {
       id: crud.id,
       displayName: crud.display_name,
-      profileImageUrl: crud.profile_image_url
+      profileImageUrl: crud.profile_image_url,
+      async inviteUser(options) {
+        return await app._interface.sendTeamInvitation({
+          teamId: crud.id,
+          email: options.email,
+          session: app._getSession(),
+          callbackUrl: constructRedirectUrl(app.urls.teamInvitation)
+        });
+      },
+      async listUsers() {
+        const result = await app._teamMemberProfilesCache.getOrWait([app._getSession(), crud.id], "write-only");
+        return result.map((crud2) => app._clientTeamUserFromCrud(crud2));
+      },
+      useUsers() {
+        const result = useAsyncCache(app._teamMemberProfilesCache, [app._getSession(), crud.id], "team.useUsers()");
+        return result.map((crud2) => app._clientTeamUserFromCrud(crud2));
+      }
     };
   }
   _createAuth(session) {
@@ -542,11 +587,30 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       emailAuthEnabled: crud.auth_with_email,
       oauthProviders: crud.oauth_providers,
       selectedTeam: crud.selected_team && this._clientTeamFromCrud(crud.selected_team),
+      isMultiFactorRequired: crud.requires_totp_mfa,
       toClientJson() {
         return crud;
       }
     };
   }
+  _editableTeamProfileFromCrud(crud) {
+    const app = this;
+    return {
+      displayName: crud.display_name,
+      profileImageUrl: crud.profile_image_url,
+      async update(update) {
+        await app._interface.updateTeamMemberProfile({
+          teamId: crud.team_id,
+          userId: crud.user_id,
+          profile: {
+            display_name: update.displayName,
+            profile_image_url: update.profileImageUrl
+          }
+        }, app._getSession());
+        await app._currentUserTeamProfileCache.refresh([app._getSession(), crud.team_id]);
+      }
+    };
+  }
   _createUserExtra(crud, session) {
     const app = this;
     async function getConnectedAccount(id, options) {
@@ -592,6 +656,9 @@ var _StackClientAppImpl = class __StackClientAppImpl {
         await app._currentUserTeamsCache.refresh([session]);
         return app._clientTeamFromCrud(crud2);
       },
+      async leaveTeam(team) {
+        await app._interface.leaveTeam(team.id, session);
+      },
       async listPermissions(scope, options) {
         const recursive = options?.recursive ?? true;
         const permissions = await app._currentUserPermissionsCache.getOrWait([session, scope.id, recursive], "write-only");
@@ -613,17 +680,25 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       async hasPermission(scope, permissionId) {
         return await this.getPermission(scope, permissionId) !== null;
       },
-      update(update) {
-        return app._updateClientUser(update, session);
+      async update(update) {
+        return await app._updateClientUser(update, session);
       },
-      sendVerificationEmail() {
+      async sendVerificationEmail() {
         if (!crud?.primary_email) {
           throw new StackAssertionError("User does not have a primary email");
         }
-        return app._sendVerificationEmail(crud.primary_email, session);
+        return await app._sendVerificationEmail(crud.primary_email, session);
+      },
+      async updatePassword(options) {
+        return await app._updatePassword(options, session);
       },
-      updatePassword(options) {
-        return app._updatePassword(options, session);
+      async getTeamProfile(team) {
+        const result = await app._currentUserTeamProfileCache.getOrWait([session, team.id], "write-only");
+        return app._editableTeamProfileFromCrud(result);
+      },
+      useTeamProfile(team) {
+        const result = useAsyncCache(app._currentUserTeamProfileCache, [session, team.id], "user.useTeamProfile()");
+        return app._editableTeamProfileFromCrud(result);
       }
     };
   }
@@ -757,6 +832,12 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   async redirectToError(options) {
     return await this._redirectToHandler("error", options);
   }
+  async redirectToTeamInvitation(options) {
+    return await this._redirectToHandler("teamInvitation", options);
+  }
+  async redirectToTeamCreation(options) {
+    return await this._redirectToHandler("teamCreation", options);
+  }
   async sendForgotPasswordEmail(email) {
     const redirectUrl = constructRedirectUrl(this.urls.passwordReset);
     const error = await this._interface.sendForgotPasswordEmail(email, redirectUrl);
@@ -774,6 +855,42 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   async verifyPasswordResetCode(code) {
     return await this._interface.verifyPasswordResetCode(code);
   }
+  async verifyTeamInvitationCode(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "check",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return Result.ok(void 0);
+    } else {
+      return Result.error(result.error);
+    }
+  }
+  async acceptTeamInvitation(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "use",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return Result.ok(void 0);
+    } else {
+      return Result.error(result.error);
+    }
+  }
+  async getTeamInvitationDetails(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "details",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return Result.ok({ teamDisplayName: result.data.team_display_name });
+    } else {
+      return Result.error(result.error);
+    }
+  }
   async verifyEmail(code) {
     return await this._interface.verifyEmail(code);
   }
@@ -838,10 +955,49 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       }
     );
   }
+  /**
+   * @deprecated
+   * TODO remove
+   */
+  async _experimentalMfa(error, session) {
+    const otp = prompt("Please enter the six-digit TOTP code from your authenticator app.");
+    if (!otp) {
+      throw new KnownErrors.InvalidTotpCode();
+    }
+    return await this._interface.totpMfa(
+      error.details?.attempt_code ?? throwErr("attempt code missing"),
+      otp,
+      session
+    );
+  }
+  /**
+   * @deprecated
+   * TODO remove
+   */
+  async _catchMfaRequiredError(callback) {
+    try {
+      return await callback();
+    } catch (e) {
+      if (e instanceof KnownErrors.MultiFactorAuthenticationRequired) {
+        return await this._experimentalMfa(e, this._getSession());
+      }
+      throw e;
+    }
+  }
   async signInWithCredential(options) {
     this._ensurePersistentTokenStore();
     const session = this._getSession();
-    const result = await this._interface.signInWithCredential(options.email, options.password, session);
+    let result;
+    try {
+      result = await this._catchMfaRequiredError(async () => {
+        return await this._interface.signInWithCredential(options.email, options.password, session);
+      });
+    } catch (e) {
+      if (e instanceof KnownErrors.InvalidTotpCode) {
+        return e;
+      }
+      throw e;
+    }
     if (!(result instanceof KnownError)) {
       await this._signInToAccountWithTokens(result);
       return await this.redirectToAfterSignIn({ replace: true });
@@ -866,7 +1022,17 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   }
   async signInWithMagicLink(code) {
     this._ensurePersistentTokenStore();
-    const result = await this._interface.signInWithMagicLink(code);
+    let result;
+    try {
+      result = await this._catchMfaRequiredError(async () => {
+        return await this._interface.signInWithMagicLink(code);
+      });
+    } catch (e) {
+      if (e instanceof KnownErrors.InvalidTotpCode) {
+        return e;
+      }
+      throw e;
+    }
     if (result instanceof KnownError) {
       return result;
     }
@@ -879,10 +1045,21 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   }
   async callOAuthCallback() {
     this._ensurePersistentTokenStore();
-    const result = await callOAuthCallback(this._interface, this.urls.oauthCallback);
+    let result;
+    try {
+      result = await this._catchMfaRequiredError(async () => {
+        return await callOAuthCallback(this._interface, this.urls.oauthCallback);
+      });
+    } catch (e) {
+      if (e instanceof KnownErrors.InvalidTotpCode) {
+        alert("Invalid TOTP code. Please try signing in again.");
+      }
+      throw e;
+    }
     if (result) {
+      console.log("OAuth callback result", result);
       await this._signInToAccountWithTokens(result);
-      if (result.afterCallbackRedirectUrl) {
+      if ("afterCallbackRedirectUrl" in result && result.afterCallbackRedirectUrl) {
         await _redirectTo(result.afterCallbackRedirectUrl, { replace: true });
         return true;
       } else if (result.newUser) {
@@ -1036,11 +1213,8 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
     this._serverTeamsCache = createCache(async ([userId]) => {
       return await this._interface.listServerTeams({ userId });
     });
-    this._serverTeamUsersCache = createCache(async ([teamId]) => {
-      return await this._interface.listServerTeamUsers(teamId);
-    });
     this._serverTeamUserPermissionsCache = createCache(async ([teamId, userId, recursive]) => {
-      return await this._interface.listServerTeamMemberPermissions({ teamId, userId, recursive });
+      return await this._interface.listServerTeamPermissions({ teamId, userId, recursive }, null);
     });
     this._serverUserOAuthConnectionAccessTokensCache = createCache(
       async ([userId, providerId, scope]) => {
@@ -1068,12 +1242,33 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
         });
       }
     );
+    this._serverTeamMemberProfilesCache = createCache(
+      async ([teamId]) => {
+        return await this._interface.listServerTeamMemberProfiles({ teamId });
+      }
+    );
+    this._serverUserTeamProfileCache = createCache(
+      async ([teamId, userId]) => {
+        return await this._interface.getServerTeamMemberProfile({ teamId, userId });
+      }
+    );
   }
   async _updateServerUser(userId, update) {
     const result = await this._interface.updateServerUser(userId, serverUserUpdateOptionsToCrud(update));
     await this._refreshUsers();
     return result;
   }
+  _serverEditableTeamProfileFromCrud(crud) {
+    const app = this;
+    const clientProfile = this._editableTeamProfileFromCrud(crud);
+    return {
+      ...clientProfile,
+      async update(update) {
+        await clientProfile.update(update);
+        await app._serverUserTeamProfileCache.refresh([crud.team_id, crud.user_id]);
+      }
+    };
+  }
   _serverUserFromCrud(crud) {
     const app = this;
     async function getConnectedAccount(id, options) {
@@ -1152,6 +1347,9 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
         await app._serverTeamsCache.refresh([void 0]);
         return app._serverTeamFromCrud(team);
       },
+      leaveTeam: async (team) => {
+        await app._interface.leaveServerTeam({ teamId: team.id, userId: crud.id });
+      },
       async listPermissions(scope, options) {
         const recursive = options?.recursive ?? true;
         const permissions = await app._serverTeamUserPermissionsCache.getOrWait([scope.id, crud.id, recursive], "write-only");
@@ -1181,6 +1379,23 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
       },
       async updatePassword(options) {
         return await app._checkFeatureSupport("updatePassword() on ServerUser", {});
+      },
+      async getTeamProfile(team) {
+        const result = await app._serverUserTeamProfileCache.getOrWait([team.id, crud.id], "write-only");
+        return app._serverEditableTeamProfileFromCrud(result);
+      },
+      useTeamProfile(team) {
+        const result = useAsyncCache(app._serverUserTeamProfileCache, [team.id, crud.id], "user.useTeamProfile()");
+        return useMemo(() => app._serverEditableTeamProfileFromCrud(result), [result]);
+      }
+    };
+  }
+  _serverTeamUserFromCrud(crud) {
+    return {
+      ...this._serverUserFromCrud(crud.user),
+      teamProfile: {
+        displayName: crud.display_name,
+        profileImageUrl: crud.profile_image_url
       }
     };
   }
@@ -1201,9 +1416,6 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
       displayName: crud.display_name,
       profileImageUrl: crud.profile_image_url,
       createdAt: new Date(crud.created_at_millis),
-      async listUsers() {
-        return (await app._interface.listServerTeamUsers(crud.id)).map((u) => app._serverUserFromCrud(u));
-      },
       async update(update) {
         await app._interface.updateServerTeam(crud.id, serverTeamUpdateOptionsToCrud(update));
         await app._serverTeamsCache.refresh([void 0]);
@@ -1212,26 +1424,43 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
         await app._interface.deleteServerTeam(crud.id);
         await app._serverTeamsCache.refresh([void 0]);
       },
+      async listUsers() {
+        const result = await app._serverTeamMemberProfilesCache.getOrWait([crud.id], "write-only");
+        return result.map((u) => app._serverTeamUserFromCrud(u));
+      },
       useUsers() {
-        const result = useAsyncCache(app._serverTeamUsersCache, [crud.id], "team.useUsers()");
-        return useMemo(() => result.map((u) => app._serverUserFromCrud(u)), [result]);
+        const result = useAsyncCache(app._serverTeamMemberProfilesCache, [crud.id], "team.useUsers()");
+        return useMemo(() => result.map((u) => app._serverTeamUserFromCrud(u)), [result]);
       },
       async addUser(userId) {
         await app._interface.addServerUserToTeam({
           teamId: crud.id,
           userId
         });
-        await app._serverTeamUsersCache.refresh([crud.id]);
+        await app._serverTeamMemberProfilesCache.refresh([crud.id]);
       },
       async removeUser(userId) {
         await app._interface.removeServerUserFromTeam({
           teamId: crud.id,
           userId
         });
-        await app._serverTeamUsersCache.refresh([crud.id]);
+        await app._serverTeamMemberProfilesCache.refresh([crud.id]);
+      },
+      async inviteUser(options) {
+        return await app._interface.sendTeamInvitation({
+          teamId: crud.id,
+          email: options.email,
+          session: null,
+          callbackUrl: constructRedirectUrl(app.urls.teamInvitation)
+        });
       }
     };
   }
+  async createUser(options) {
+    const crud = await this._interface.createServerUser(serverUserCreateOptionsToCrud(options));
+    await this._refreshUsers();
+    return this._serverUserFromCrud(crud);
+  }
   async getUser(options) {
     this._ensurePersistentTokenStore(options?.tokenStore);
     const session = this._getSession(options?.tokenStore);
@@ -1409,8 +1638,10 @@ var _StackAdminAppImpl = class extends _StackServerAppImpl {
       isProductionMode: data.is_production_mode,
       config: {
         id: data.config.id,
+        signUpEnabled: data.config.sign_up_enabled,
         credentialEnabled: data.config.credential_enabled,
         magicLinkEnabled: data.config.magic_link_enabled,
+        clientTeamCreationEnabled: data.config.client_team_creation_enabled,
         allowLocalhost: data.config.allow_localhost,
         oauthProviders: data.config.oauth_providers.map((p) => p.type === "shared" ? {
           id: p.id,
@@ -1447,6 +1678,9 @@ var _StackAdminAppImpl = class extends _StackServerAppImpl {
         await app._interface.updateProject(adminProjectUpdateOptionsToCrud(update));
         await onRefresh();
       },
+      async delete() {
+        await app._interface.deleteProject();
+      },
       async getProductionModeErrors() {
         return getProductionModeErrors(data);
       },
@@ -1589,7 +1823,8 @@ function userUpdateOptionsToCrud(options) {
   return {
     display_name: options.displayName,
     client_metadata: options.clientMetadata,
-    selected_team_id: options.selectedTeamId
+    selected_team_id: options.selectedTeamId,
+    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret
   };
 }
 function serverUserUpdateOptionsToCrud(options) {
@@ -1601,7 +1836,17 @@ function serverUserUpdateOptionsToCrud(options) {
     selected_team_id: options.selectedTeamId,
     primary_email_auth_enabled: options.primaryEmailAuthEnabled,
     primary_email_verified: options.primaryEmailVerified,
-    password: options.password
+    password: options.password,
+    totp_secret_base64: options.totpMultiFactorSecret != null ? encodeBase64(options.totpMultiFactorSecret) : options.totpMultiFactorSecret
+  };
+}
+function serverUserCreateOptionsToCrud(options) {
+  return {
+    primary_email: options.primaryEmail,
+    password: options.password,
+    primary_email_auth_enabled: true,
+    display_name: options.displayName,
+    primary_email_verified: options.primaryEmailVerified
   };
 }
 function adminProjectUpdateOptionsToCrud(options) {
@@ -1635,10 +1880,12 @@ function adminProjectUpdateOptionsToCrud(options) {
         sender_name: options.config.emailConfig.senderName,
         sender_email: options.config.emailConfig.senderEmail
       }),
+      sign_up_enabled: options.config?.signUpEnabled,
       credential_enabled: options.config?.credentialEnabled,
       magic_link_enabled: options.config?.magicLinkEnabled,
       allow_localhost: options.config?.allowLocalhost,
       create_team_on_sign_up: options.config?.createTeamOnSignUp,
+      client_team_creation_enabled: options.config?.clientTeamCreationEnabled,
       team_creator_default_permissions: options.config?.teamCreatorDefaultPermissions,
       team_member_default_permissions: options.config?.teamMemberDefaultPermissions
     }