@uipath/apollo-vertex 0.4.0 → 1.0.0

package/README.md

@@ -27,14 +27,14 @@ Everything, including the app shell, charts, feature flags, Solution Tests and A
 from the package root. Translation JSON files are available at `@uipath/apollo-vertex/locales/*`.
 
 npm 7+ and pnpm install the packages in `peerDependencies` automatically. Install these three
-yourself, because they are not on the public npm registry:
+yourself:
 
 - `@uipath/vs-core`
 - `@tanstack/react-db`
 - `@uipath/proteus-client`
 
 They are declared only in `peerDependenciesMeta` (as optional) so that pnpm does not try to install them
-in this workspace.
+in this workspace. The two `@uipath` packages are not on the public npm registry.
 
 ## Layout
 

package/dist/entries/index.d.ts

@@ -94,7 +94,7 @@ export { ShellLayout } from "../registry/shell/shell-layout";
 export { ShellSidebar } from "../registry/shell/shell-sidebar";
 export { ShellUserProvider, useUser, type User, } from "../registry/shell/shell-user-provider";
 export { SUPPORTED_LOCALES, configurei18n, type SupportedLocale, } from "../lib/i18n";
-export { STORAGE_KEYS, TOKEN_QUERY_KEY, type TokenData, ensureValidToken, login, logout, resolveReturnPath, toCodedAppFilePath, } from "../lib/auth";
+export { STORAGE_KEYS, TOKEN_QUERY_KEY, type TokenData, ensureValidToken, getStoredIdToken, getTokenQueryKey, login, logout, resolveReturnPath, toCodedAppFilePath, } from "../lib/auth";
 export { GroupMembershipGuard, type GroupMembershipGuardProps, } from "../registry/shell/group-membership-guard";
 export { useGroupId, type UseGroupIdOptions, type UseGroupIdResult, } from "../registry/shell/use-group-id";
 export { useGroupMembers, type UseGroupMembersOptions, type UseGroupMembersResult, } from "../registry/shell/use-group-members";

package/dist/entries/index.js

@@ -16,7 +16,7 @@ import { ShellLogin } from "../registry/shell/shell-login.js";
 import { ShellLayout } from "../registry/shell/shell-layout.js";
 import { ShellSidebar } from "../registry/shell/shell-sidebar.js";
 import { ShellUserProvider, useUser } from "../registry/shell/shell-user-provider.js";
-import { STORAGE_KEYS, TOKEN_QUERY_KEY, ensureValidToken, login, logout, resolveReturnPath, toCodedAppFilePath } from "../lib/auth.js";
+import { STORAGE_KEYS, TOKEN_QUERY_KEY, ensureValidToken, getStoredIdToken, getTokenQueryKey, login, logout, resolveReturnPath, toCodedAppFilePath } from "../lib/auth.js";
 import { GroupMembershipGuard } from "../registry/shell/group-membership-guard.js";
 import { useGroupId } from "../registry/shell/use-group-id.js";
 import { useGroupMembers } from "../registry/shell/use-group-members.js";
@@ -142,4 +142,4 @@ export * from "../registry/ai-chat/tools/data-fabric-line/index.js";
 export * from "../registry/ai-chat/tools/data-fabric-multi-line/index.js";
 export * from "../registry/ai-chat/tools/data-fabric-table/index.js";
 export * from "../registry/ai-chat/tools/data-fabric/index.js";
-export { AiChat, AiChatEmptyState, ApolloShell, AuthContext, AutopilotGradientIcon, BaselineCompare, CASE_EVALUATION_EVALUATOR_ID, CASE_EVALUATION_OUTPUT_RENDERER, CaseEvaluationDetailsSchema, CaseEvaluationOutputResult, CaseEvaluationOutputSchema, CheckboxField, EvaluationPairStatus, ExpandedAgents, ExpandedAgentsView, ExpandedRunTests, ExpandedRunTestsView, FeatureFlagContext, FeatureFlagGuard, FeatureFlagProvider, FieldError as FormFieldError, GENERIC_RENDERER, GroupMembershipGuard, IXP_EXTRACTION_EVALUATOR_ID, IXP_OUTPUT_RENDERER, IxpDetailsSchema, IxpDocStatus, IxpOutputResult, IxpOutputSchema, IxpVerdict, JSON_SIMILARITY_EVALUATOR_ID, JobRole, LLM_JUDGE_EVALUATOR_ID, LocaleProvider, MembershipDenied, NoDataMessage, ProcessOutputView, ProtectedFeatureRoute, RadioGroupField, Role, RunDetails, RunDetailsView, RunResultStatus, RunStatus, STALE_TIME_MS, STORAGE_KEYS, SUPPORTED_LOCALES, SaveAsTestButton, SelectField, ShellAuthProvider, ShellLayout, ShellLogin, ShellSidebar, ShellUserProvider, SolutionTestActionError, SolutionTestStatus, SolutionTests, SolutionTestsProvider, SolutionTestsView, SubmitButton, SummaryVerdict, SwitchField, TOKEN_QUERY_KEY, TextField, TextareaField, ThemeProvider, VerifyingMembership, VersionDeltaGlyph, addVertexTranslations, assertDateOrString, assertString, cn, configurei18n, createAgentHubConnection, createConversationalAgentConnection, createProteusProvider, ensureValidToken, genericRenderer, login, logout, makeProcessOutputRenderer, makeRenderer, resolveEvaluatorRenderer, resolveProcessOutputRenderer, resolveReturnPath, toCodedAppFilePath, useAccessToken, useAdoptJob, useAppForm, useAuth, useBaselineJobs, useCreateTest, useDataTable, useDeleteTest, useEntityColumns, useEntityDataTable, useFeatureFlag, useFeatureFlagProvider, useFieldContext, useForceStopBatch, useForceStopRun, useFormContext, useGroupId, useGroupMembers, useIsGroupMember, useIsMobile, useJobExpectedOutput, useRemoveJobBaseline, useResultAttachment, useRunResults, useRunTests, useSolutionTestBatchRuns, useSolutionTestRuns, useSolutionTests, useSolutionTestsConfig, useSolutionTestsContext, useTheme, useToggleTestActive, useTranslatedErrors, useUpdateBaseline, useUser, versionDelta, withForm };
+export { AiChat, AiChatEmptyState, ApolloShell, AuthContext, AutopilotGradientIcon, BaselineCompare, CASE_EVALUATION_EVALUATOR_ID, CASE_EVALUATION_OUTPUT_RENDERER, CaseEvaluationDetailsSchema, CaseEvaluationOutputResult, CaseEvaluationOutputSchema, CheckboxField, EvaluationPairStatus, ExpandedAgents, ExpandedAgentsView, ExpandedRunTests, ExpandedRunTestsView, FeatureFlagContext, FeatureFlagGuard, FeatureFlagProvider, FieldError as FormFieldError, GENERIC_RENDERER, GroupMembershipGuard, IXP_EXTRACTION_EVALUATOR_ID, IXP_OUTPUT_RENDERER, IxpDetailsSchema, IxpDocStatus, IxpOutputResult, IxpOutputSchema, IxpVerdict, JSON_SIMILARITY_EVALUATOR_ID, JobRole, LLM_JUDGE_EVALUATOR_ID, LocaleProvider, MembershipDenied, NoDataMessage, ProcessOutputView, ProtectedFeatureRoute, RadioGroupField, Role, RunDetails, RunDetailsView, RunResultStatus, RunStatus, STALE_TIME_MS, STORAGE_KEYS, SUPPORTED_LOCALES, SaveAsTestButton, SelectField, ShellAuthProvider, ShellLayout, ShellLogin, ShellSidebar, ShellUserProvider, SolutionTestActionError, SolutionTestStatus, SolutionTests, SolutionTestsProvider, SolutionTestsView, SubmitButton, SummaryVerdict, SwitchField, TOKEN_QUERY_KEY, TextField, TextareaField, ThemeProvider, VerifyingMembership, VersionDeltaGlyph, addVertexTranslations, assertDateOrString, assertString, cn, configurei18n, createAgentHubConnection, createConversationalAgentConnection, createProteusProvider, ensureValidToken, genericRenderer, getStoredIdToken, getTokenQueryKey, login, logout, makeProcessOutputRenderer, makeRenderer, resolveEvaluatorRenderer, resolveProcessOutputRenderer, resolveReturnPath, toCodedAppFilePath, useAccessToken, useAdoptJob, useAppForm, useAuth, useBaselineJobs, useCreateTest, useDataTable, useDeleteTest, useEntityColumns, useEntityDataTable, useFeatureFlag, useFeatureFlagProvider, useFieldContext, useForceStopBatch, useForceStopRun, useFormContext, useGroupId, useGroupMembers, useIsGroupMember, useIsMobile, useJobExpectedOutput, useRemoveJobBaseline, useResultAttachment, useRunResults, useRunTests, useSolutionTestBatchRuns, useSolutionTestRuns, useSolutionTests, useSolutionTestsConfig, useSolutionTestsContext, useTheme, useToggleTestActive, useTranslatedErrors, useUpdateBaseline, useUser, versionDelta, withForm };

package/dist/lib/auth.d.ts

@@ -5,6 +5,7 @@ export declare const STORAGE_KEYS: {
     readonly TOKEN: "uipath_token";
     readonly CODE_VERIFIER: "uipath_code_verifier";
     readonly STATE: "uipath_state";
+    readonly REQUESTED_SCOPE: "uipath_requested_scope";
     readonly AUTH_RETURN_TO: "auth_return_to";
     readonly LOGOUT_RETURN_TO: "logout_return_to";
 };
@@ -19,7 +20,9 @@ declare const TokenDataSchema: z.ZodObject<{
     expiresAt: z.ZodNumber;
 }, z.core.$strip>;
 export type TokenData = z.infer<typeof TokenDataSchema>;
-export declare const ensureValidToken: (queryClient: ReturnType<typeof useQueryClient>, clientId: string, baseUrl: string, redirectPath?: string) => Promise<string | null>;
+export declare const getTokenQueryKey: (clientId: string, scope: string) => readonly ["auth", "token", string, string];
+export declare const getStoredIdToken: (clientId: string, scope: string) => string | null;
+export declare const ensureValidToken: (clientId: string, scope: string, baseUrl: string, redirectPath?: string) => Promise<string | null>;
 export declare const login: (clientId: string, scope: string, baseUrl: string, redirectPath?: string) => Promise<void>;
-export declare const logout: (queryClient: ReturnType<typeof useQueryClient>) => void;
+export declare const logout: (queryClient: ReturnType<typeof useQueryClient>, clientId: string) => void;
 export {};

package/dist/lib/auth.js

@@ -1,3 +1,4 @@
+import { jwtDecode } from "jwt-decode";
 import pkce_challenge from "pkce-challenge";
 import { toast } from "sonner";
 import { z } from "zod";
@@ -15,6 +16,7 @@ const STORAGE_KEYS = {
     TOKEN: "uipath_token",
     CODE_VERIFIER: "uipath_code_verifier",
     STATE: "uipath_state",
+    REQUESTED_SCOPE: "uipath_requested_scope",
     AUTH_RETURN_TO: "auth_return_to",
     LOGOUT_RETURN_TO: "logout_return_to"
 };
@@ -56,11 +58,35 @@ const shouldRefreshToken = (tokenData)=>{
     const timeUntilExpiry = tokenData.expiresAt - Date.now();
     return timeUntilExpiry < REFRESH_THRESHOLD_MS;
 };
-const saveTokenData = (tokenData)=>{
-    localStorage.setItem(STORAGE_KEYS.TOKEN, JSON.stringify(tokenData));
+const normalizeScope = (scope)=>[
+        ...new Set(scope.split(/\s+/).filter(Boolean))
+    ].toSorted().join(" ");
+const getTokenStorageKey = (clientId, scope)=>`${STORAGE_KEYS.TOKEN}:${clientId}:${normalizeScope(scope)}`;
+const getTokenQueryKey = (clientId, scope)=>[
+        ...TOKEN_QUERY_KEY,
+        clientId,
+        normalizeScope(scope)
+    ];
+const readTokenData = (storageKey)=>{
+    try {
+        const { data, success } = TokenDataSchema.safeParse(JSON.parse(localStorage.getItem(storageKey) ?? "null"));
+        return success ? data : null;
+    } catch  {
+        return null;
+    }
+};
+const getStoredIdToken = (clientId, scope)=>readTokenData(getTokenStorageKey(clientId, scope))?.id_token ?? null;
+const saveTokenData = (storageKey, tokenData)=>{
+    localStorage.setItem(storageKey, JSON.stringify(tokenData));
 };
-const clearTokenData = ()=>{
-    localStorage.removeItem(STORAGE_KEYS.TOKEN);
+const clearTokenData = (storageKey)=>{
+    localStorage.removeItem(storageKey);
+};
+const clearPendingLogin = ()=>{
+    sessionStorage.removeItem(STORAGE_KEYS.CODE_VERIFIER);
+    sessionStorage.removeItem(STORAGE_KEYS.STATE);
+    sessionStorage.removeItem(STORAGE_KEYS.REQUESTED_SCOPE);
+    sessionStorage.removeItem(STORAGE_KEYS.AUTH_RETURN_TO);
 };
 const fetchTokenData = async (baseUrl, body)=>{
     const response = await fetch(getTokenEndpoint(baseUrl), {
@@ -88,14 +114,14 @@ const refreshAccessToken = (refreshToken, clientId, baseUrl)=>{
     });
     return fetchTokenData(baseUrl, body);
 };
-const refreshTokenIfNeeded = async (tokenData, clientId, baseUrl)=>{
+const refreshTokenIfNeeded = async (tokenData, clientId, baseUrl, storageKey)=>{
     if (!tokenData.refresh_token) return null;
     try {
         const newTokenData = await refreshAccessToken(tokenData.refresh_token, clientId, baseUrl);
-        saveTokenData(newTokenData);
+        saveTokenData(storageKey, newTokenData);
         return newTokenData.access_token;
     } catch  {
-        clearTokenData();
+        clearTokenData(storageKey);
         return null;
     }
 };
@@ -109,59 +135,50 @@ const exchangeCodeForToken = (code, codeVerifier, clientId, baseUrl, redirectPat
     });
     return fetchTokenData(baseUrl, body);
 };
-const handleOAuthCallback = async (clientId, baseUrl, redirectPath)=>{
+const handleOAuthCallback = async (clientId, scope, baseUrl, redirectPath)=>{
     const params = new URLSearchParams(window.location.search);
     const code = params.get("code");
     const state = params.get("state");
     const error = params.get("error");
-    if (error) throw new Error(`OAuth error: ${error}`);
-    if (!code || !state) return;
+    if (!state || !code && !error) return;
     const storedState = sessionStorage.getItem(STORAGE_KEYS.STATE);
-    if (state !== storedState) throw new Error("State mismatch");
     const codeVerifier = sessionStorage.getItem(STORAGE_KEYS.CODE_VERIFIER);
-    if (!codeVerifier) throw new Error("Code verifier not found");
+    const requestedScope = sessionStorage.getItem(STORAGE_KEYS.REQUESTED_SCOPE);
+    const returnTo = sessionStorage.getItem(STORAGE_KEYS.AUTH_RETURN_TO) ?? window.location.pathname;
+    clearPendingLogin();
     try {
+        if (null !== error || null === code) throw new Error(`OAuth error: ${error ?? "no code returned"}`);
+        if (state !== storedState) throw new Error("State mismatch");
+        if (!codeVerifier) throw new Error("Code verifier not found");
+        const loginUsedCurrentScope = null !== requestedScope && normalizeScope(requestedScope) === normalizeScope(scope);
+        if (!loginUsedCurrentScope) return void toast.info("Your sign-in settings changed. Please sign in again.");
         const tokenData = await exchangeCodeForToken(code, codeVerifier, clientId, baseUrl, redirectPath);
-        sessionStorage.removeItem(STORAGE_KEYS.CODE_VERIFIER);
-        sessionStorage.removeItem(STORAGE_KEYS.STATE);
-        saveTokenData(tokenData);
-        const returnTo = sessionStorage.getItem(STORAGE_KEYS.AUTH_RETURN_TO);
-        sessionStorage.removeItem(STORAGE_KEYS.AUTH_RETURN_TO);
-        const targetPath = returnTo ?? window.location.pathname;
-        window.history.replaceState({}, document.title, targetPath);
+        saveTokenData(getTokenStorageKey(clientId, scope), tokenData);
     } catch (authError) {
-        clearTokenData();
-        sessionStorage.removeItem(STORAGE_KEYS.AUTH_RETURN_TO);
         const message = authError instanceof Error ? authError.message : "Unknown error";
         toast.error(`Authentication failed: ${message}`);
-        throw authError;
+    } finally{
+        window.history.replaceState({}, document.title, returnTo);
     }
 };
-const ensureValidToken = async (queryClient, clientId, baseUrl, redirectPath)=>{
-    const params = new URLSearchParams(window.location.search);
-    const isInOAuthCallback = params.has("code") && params.has("state");
-    if (isInOAuthCallback) try {
-        await handleOAuthCallback(clientId, baseUrl, redirectPath);
-    } catch  {
-        queryClient.resetQueries({
-            queryKey: TOKEN_QUERY_KEY
-        });
-    }
-    const tokenDataStr = localStorage.getItem(STORAGE_KEYS.TOKEN);
+const ensureValidToken = async (clientId, scope, baseUrl, redirectPath)=>{
+    await handleOAuthCallback(clientId, scope, baseUrl, redirectPath);
+    const storageKey = getTokenStorageKey(clientId, scope);
+    const tokenDataStr = localStorage.getItem(storageKey);
     if (!tokenDataStr) return null;
     let parsed;
     try {
         parsed = JSON.parse(tokenDataStr);
     } catch  {
-        clearTokenData();
+        clearTokenData(storageKey);
         return null;
     }
     const { data: tokenData, success } = TokenDataSchema.safeParse(parsed);
     if (!success) {
-        clearTokenData();
+        clearTokenData(storageKey);
         return null;
     }
-    if (isTokenExpired(tokenData) || shouldRefreshToken(tokenData)) return refreshTokenIfNeeded(tokenData, clientId, baseUrl);
+    if (isTokenExpired(tokenData) || shouldRefreshToken(tokenData)) return refreshTokenIfNeeded(tokenData, clientId, baseUrl, storageKey);
     return tokenData.access_token;
 };
 const login = async (clientId, scope, baseUrl, redirectPath)=>{
@@ -169,6 +186,7 @@ const login = async (clientId, scope, baseUrl, redirectPath)=>{
     const state = generateRandomString(32);
     sessionStorage.setItem(STORAGE_KEYS.CODE_VERIFIER, pkce.code_verifier);
     sessionStorage.setItem(STORAGE_KEYS.STATE, state);
+    sessionStorage.setItem(STORAGE_KEYS.REQUESTED_SCOPE, scope);
     if (redirectPath && window.location.pathname !== redirectPath) sessionStorage.setItem(STORAGE_KEYS.AUTH_RETURN_TO, window.location.pathname);
     const params = new URLSearchParams({
         client_id: clientId,
@@ -181,13 +199,28 @@ const login = async (clientId, scope, baseUrl, redirectPath)=>{
     });
     window.location.href = `${getAuthorizationEndpoint(baseUrl)}?${params.toString()}`;
 };
-const logout = (queryClient)=>{
-    clearTokenData();
-    sessionStorage.removeItem(STORAGE_KEYS.CODE_VERIFIER);
-    sessionStorage.removeItem(STORAGE_KEYS.STATE);
-    sessionStorage.removeItem(STORAGE_KEYS.AUTH_RETURN_TO);
+const isUnscopedSessionOf = (clientId)=>{
+    const tokenData = readTokenData(STORAGE_KEYS.TOKEN);
+    if (null === tokenData) return true;
+    try {
+        const { aud } = jwtDecode(tokenData.id_token);
+        return Array.isArray(aud) ? aud.includes(clientId) : aud === clientId;
+    } catch  {
+        return true;
+    }
+};
+const logout = (queryClient, clientId)=>{
+    const clientPrefix = `${STORAGE_KEYS.TOKEN}:${clientId}:`;
+    const sessionKeys = Array.from({
+        length: localStorage.length
+    }, (_, index)=>localStorage.key(index)).filter((key)=>key === STORAGE_KEYS.TOKEN ? isUnscopedSessionOf(clientId) : key?.startsWith(clientPrefix) === true);
+    for (const key of sessionKeys)clearTokenData(key);
+    clearPendingLogin();
     queryClient.resetQueries({
-        queryKey: TOKEN_QUERY_KEY
+        queryKey: [
+            ...TOKEN_QUERY_KEY,
+            clientId
+        ]
     });
 };
-export { STORAGE_KEYS, TOKEN_QUERY_KEY, ensureValidToken, login, logout, resolveReturnPath, toCodedAppFilePath };
+export { STORAGE_KEYS, TOKEN_QUERY_KEY, ensureValidToken, getStoredIdToken, getTokenQueryKey, login, logout, resolveReturnPath, toCodedAppFilePath };

package/dist/registry/shell/shell-auth-provider.d.ts

@@ -18,8 +18,9 @@ interface UseAccessTokenProps {
     clientId: string;
     baseUrl: string;
     redirectPath?: string;
+    scope: string;
 }
-export declare const useAccessToken: ({ clientId, baseUrl, redirectPath, }: UseAccessTokenProps) => {
+export declare const useAccessToken: ({ clientId, baseUrl, redirectPath, scope, }: UseAccessTokenProps) => {
     accessToken: string | null;
     isLoading: boolean;
 };

package/dist/registry/shell/shell-auth-provider.js

@@ -4,7 +4,7 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { jwtDecode } from "jwt-decode";
 import { createContext, useContext } from "react";
 import { z } from "zod";
-import { TOKEN_QUERY_KEY, ensureValidToken, login, logout } from "../../lib/auth.js";
+import { ensureValidToken, getTokenQueryKey, login, logout } from "../../lib/auth.js";
 const JwtPayloadSchema = z.object({
     email: z.email(),
     first_name: z.string(),
@@ -36,11 +36,10 @@ const useAuth = ()=>{
     const context = useContext(AuthContext);
     return context ?? noAuthDefaults;
 };
-const useAccessToken = ({ clientId, baseUrl, redirectPath })=>{
-    const queryClient = useQueryClient();
+const useAccessToken = ({ clientId, baseUrl, redirectPath, scope })=>{
     const { data: token, isLoading } = useQuery({
-        queryKey: TOKEN_QUERY_KEY,
-        queryFn: ()=>ensureValidToken(queryClient, clientId, baseUrl, redirectPath),
+        queryKey: getTokenQueryKey(clientId, scope),
+        queryFn: ()=>ensureValidToken(clientId, scope, baseUrl, redirectPath),
         refetchInterval: 60000,
         enabled: "u" > typeof window
     });
@@ -54,7 +53,8 @@ const ShellAuthProvider = ({ children, clientId, scope, baseUrl, redirectPath })
     const { accessToken, isLoading } = useAccessToken({
         clientId,
         baseUrl,
-        redirectPath
+        redirectPath,
+        scope
     });
     const user = accessToken ? decodeJWT(accessToken) : null;
     const isAuthenticated = null != accessToken;
@@ -63,7 +63,7 @@ const ShellAuthProvider = ({ children, clientId, scope, baseUrl, redirectPath })
         isAuthenticated,
         isLoading,
         login: ()=>login(clientId, scope, baseUrl, redirectPath),
-        logout: ()=>logout(queryClient),
+        logout: ()=>logout(queryClient, clientId),
         accessToken
     };
     return /*#__PURE__*/ jsx(AuthContext.Provider, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/apollo-vertex",
-  "version": "0.4.0",
+  "version": "1.0.0",
   "description": "UiPath Apollo Vertex design system components",
   "license": "MIT",
   "keywords": [