@unhingged/vizu-core 0.1.4 → 0.1.6

package/dist/index.d.cts

@@ -458,7 +458,29 @@ declare class CloudStorageAdapter implements StorageAdapter {
     private pendingAuth;
     /** Whether we've already fired onAuthChanged for the current token. */
     private lastNotifiedTokenId;
+    /**
+     * Sticky flag set when /connect tells us this workspace is inaccessible
+     * to the signed-in user (no role, origin not allowed, workspace gone).
+     * Future resolveToken calls reject immediately instead of reopening the
+     * popup — the answer won't change without a Clerk account switch, which
+     * a page reload covers. Cleared only by reload (or future explicit API).
+     */
+    private accessDenied;
+    /**
+     * Last denial reason from /connect's postMessage — useful for hosts that
+     * want to render a workspace-level "no access" banner. Null until denied.
+     */
+    private accessDeniedReason;
     constructor(opts: CloudStorageOptions);
+    /**
+     * Pull a token out of the URL fragment if /connect just redirected us
+     * back here. Strips the fragment on success so the token doesn't sit
+     * in browser history or get shared if the user copies the URL.
+     *
+     * The fragment is base64-encoded JSON with compact keys; see
+     * apps/landing/app/connect/RedirectComplete.tsx for the producer side.
+     */
+    private readHashToken;
     /**
      * Open the sign-in popup right now (or no-op if a valid token is
      * cached). Vizu calls this on enable() so the user signs in BEFORE
@@ -469,6 +491,16 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * state.
      */
     preflightAuth(): Promise<void>;
+    /**
+     * Whether /connect has already told us the user can't access this
+     * workspace. Vizu's write gate checks this before reopening the popup —
+     * a denied state means clicking again will yield the same "No access"
+     * page, so we suppress the retry until a page reload (or explicit API
+     * call in the future).
+     */
+    isAccessDenied(): boolean;
+    /** Last denial reason; null when not denied. */
+    accessDenialReason(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -521,7 +553,9 @@ declare class CloudStorageAdapter implements StorageAdapter {
     private fetchAuthed;
     private parseJson;
 }
-type CloudErrorCode = 'auth_required' | 'auth_canceled' | 'auth_unavailable' | 'popup_blocked' | 'origin_not_allowed' | 'workspace_not_found' | 'http_error';
+type CloudErrorCode = 'auth_required' | 'auth_canceled' | 'auth_unavailable' | 'popup_blocked' | 'origin_not_allowed' | 'workspace_not_found'
+/** /connect resolved access for the signed-in user → no role on the workspace. Sticky for the session. */
+ | 'access_denied' | 'http_error';
 interface CloudError extends Error {
     code: CloudErrorCode;
     status?: number;

package/dist/index.d.ts

@@ -458,7 +458,29 @@ declare class CloudStorageAdapter implements StorageAdapter {
     private pendingAuth;
     /** Whether we've already fired onAuthChanged for the current token. */
     private lastNotifiedTokenId;
+    /**
+     * Sticky flag set when /connect tells us this workspace is inaccessible
+     * to the signed-in user (no role, origin not allowed, workspace gone).
+     * Future resolveToken calls reject immediately instead of reopening the
+     * popup — the answer won't change without a Clerk account switch, which
+     * a page reload covers. Cleared only by reload (or future explicit API).
+     */
+    private accessDenied;
+    /**
+     * Last denial reason from /connect's postMessage — useful for hosts that
+     * want to render a workspace-level "no access" banner. Null until denied.
+     */
+    private accessDeniedReason;
     constructor(opts: CloudStorageOptions);
+    /**
+     * Pull a token out of the URL fragment if /connect just redirected us
+     * back here. Strips the fragment on success so the token doesn't sit
+     * in browser history or get shared if the user copies the URL.
+     *
+     * The fragment is base64-encoded JSON with compact keys; see
+     * apps/landing/app/connect/RedirectComplete.tsx for the producer side.
+     */
+    private readHashToken;
     /**
      * Open the sign-in popup right now (or no-op if a valid token is
      * cached). Vizu calls this on enable() so the user signs in BEFORE
@@ -469,6 +491,16 @@ declare class CloudStorageAdapter implements StorageAdapter {
      * state.
      */
     preflightAuth(): Promise<void>;
+    /**
+     * Whether /connect has already told us the user can't access this
+     * workspace. Vizu's write gate checks this before reopening the popup —
+     * a denied state means clicking again will yield the same "No access"
+     * page, so we suppress the retry until a page reload (or explicit API
+     * call in the future).
+     */
+    isAccessDenied(): boolean;
+    /** Last denial reason; null when not denied. */
+    accessDenialReason(): string | null;
     load(_namespace: string): Promise<VizuComment[]>;
     addComment(_namespace: string, comment: VizuComment): Promise<void>;
     updateComment(_namespace: string, id: string, patch: Partial<VizuComment>): Promise<VizuComment | null>;
@@ -521,7 +553,9 @@ declare class CloudStorageAdapter implements StorageAdapter {
     private fetchAuthed;
     private parseJson;
 }
-type CloudErrorCode = 'auth_required' | 'auth_canceled' | 'auth_unavailable' | 'popup_blocked' | 'origin_not_allowed' | 'workspace_not_found' | 'http_error';
+type CloudErrorCode = 'auth_required' | 'auth_canceled' | 'auth_unavailable' | 'popup_blocked' | 'origin_not_allowed' | 'workspace_not_found'
+/** /connect resolved access for the signed-in user → no role on the workspace. Sticky for the session. */
+ | 'access_denied' | 'http_error';
 interface CloudError extends Error {
     code: CloudErrorCode;
     status?: number;

package/dist/index.js

@@ -336,15 +336,76 @@ var CloudStorageAdapter = class {
     this.pendingAuth = null;
     /** Whether we've already fired onAuthChanged for the current token. */
     this.lastNotifiedTokenId = null;
+    /**
+     * Sticky flag set when /connect tells us this workspace is inaccessible
+     * to the signed-in user (no role, origin not allowed, workspace gone).
+     * Future resolveToken calls reject immediately instead of reopening the
+     * popup — the answer won't change without a Clerk account switch, which
+     * a page reload covers. Cleared only by reload (or future explicit API).
+     */
+    this.accessDenied = false;
+    /**
+     * Last denial reason from /connect's postMessage — useful for hosts that
+     * want to render a workspace-level "no access" banner. Null until denied.
+     */
+    this.accessDeniedReason = null;
     this.workspace = opts.workspace;
     this.apiUrl = (opts.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
     this.autoSignIn = opts.autoSignIn !== false;
     this.onAuthChanged = opts.onAuthChanged;
-    this.cachedToken = this.readStoredToken();
+    const fromHash = this.readHashToken();
+    if (fromHash) {
+      this.cachedToken = fromHash;
+      this.writeStoredToken(fromHash);
+    } else {
+      this.cachedToken = this.readStoredToken();
+    }
     if (this.cachedToken && !this.isExpired(this.cachedToken)) {
       this.fireAuthChanged(this.cachedToken);
     }
   }
+  /**
+   * Pull a token out of the URL fragment if /connect just redirected us
+   * back here. Strips the fragment on success so the token doesn't sit
+   * in browser history or get shared if the user copies the URL.
+   *
+   * The fragment is base64-encoded JSON with compact keys; see
+   * apps/landing/app/connect/RedirectComplete.tsx for the producer side.
+   */
+  readHashToken() {
+    if (typeof window === "undefined") return null;
+    const hash = window.location.hash;
+    if (!hash || hash.length < 2) return null;
+    const params = new URLSearchParams(hash.slice(1));
+    const payload = params.get("vizu_auth");
+    if (!payload) return null;
+    try {
+      const json = JSON.parse(atob(payload));
+      if (!json.t || !json.e || !json.u || !json.w) return null;
+      if (json.w !== this.workspace) return null;
+      const stored = {
+        token: json.t,
+        expiresAt: json.e,
+        userId: json.u,
+        user: typeof json.n === "string" ? {
+          id: json.u,
+          name: json.n,
+          avatarUrl: typeof json.a === "string" ? json.a : void 0
+        } : null
+      };
+      params.delete("vizu_auth");
+      const remaining = params.toString();
+      const newHash = remaining ? `#${remaining}` : "";
+      try {
+        const newUrl = window.location.pathname + window.location.search + newHash;
+        window.history.replaceState(null, "", newUrl);
+      } catch {
+      }
+      return stored;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Open the sign-in popup right now (or no-op if a valid token is
    * cached). Vizu calls this on enable() so the user signs in BEFORE
@@ -357,6 +418,20 @@ var CloudStorageAdapter = class {
   async preflightAuth() {
     await this.resolveToken();
   }
+  /**
+   * Whether /connect has already told us the user can't access this
+   * workspace. Vizu's write gate checks this before reopening the popup —
+   * a denied state means clicking again will yield the same "No access"
+   * page, so we suppress the retry until a page reload (or explicit API
+   * call in the future).
+   */
+  isAccessDenied() {
+    return this.accessDenied;
+  }
+  /** Last denial reason; null when not denied. */
+  accessDenialReason() {
+    return this.accessDeniedReason;
+  }
   /* ─── StorageAdapter v2 ───────────────────────────────────────────── */
   async load(_namespace) {
     const out = [];
@@ -547,6 +622,12 @@ var CloudStorageAdapter = class {
       this.fireAuthChanged(fresh);
       return fresh;
     }
+    if (this.accessDenied) {
+      throw makeAuthError(
+        "access_denied",
+        `No access to workspace "${this.workspace}" (${this.accessDeniedReason ?? "no_access"}).`
+      );
+    }
     if (!this.autoSignIn) {
       throw makeAuthError("auth_required", "Sign-in required; autoSignIn is disabled.");
     }
@@ -593,18 +674,39 @@ var CloudStorageAdapter = class {
         `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},noopener=no,popup=yes`
       );
       if (!popup) {
-        return reject(
-          makeAuthError(
-            "popup_blocked",
-            "Sign-in popup was blocked by the browser. Allow popups for this site and try again."
-          )
-        );
+        try {
+          const returnTo = window.location.href;
+          const redirectUrl = this.apiUrl + "/connect?workspace=" + encodeURIComponent(this.workspace) + "&origin=" + encodeURIComponent(hostOrigin) + "&return_to=" + encodeURIComponent(returnTo);
+          window.location.assign(redirectUrl);
+          return;
+        } catch (err) {
+          return reject(
+            makeAuthError(
+              "popup_blocked",
+              "Sign-in popup was blocked and redirect fallback failed: " + (err instanceof Error ? err.message : String(err))
+            )
+          );
+        }
       }
       let resolved = false;
       const onMessage = (e) => {
         if (e.origin !== apiOrigin) return;
         const data = e.data;
-        if (!data || data.type !== "vizu:auth") return;
+        if (!data) return;
+        if (data.type === "vizu:auth-denied" && data.workspace === this.workspace) {
+          resolved = true;
+          cleanup();
+          this.accessDenied = true;
+          this.accessDeniedReason = typeof data.reason === "string" ? data.reason : "no_access";
+          reject(
+            makeAuthError(
+              "access_denied",
+              `No access to workspace "${this.workspace}" (${this.accessDeniedReason}).`
+            )
+          );
+          return;
+        }
+        if (data.type !== "vizu:auth") return;
         if (data.workspace !== this.workspace) return;
         if (typeof data.token !== "string" || typeof data.expiresAt !== "string" || typeof data.userId !== "string") return;
         resolved = true;
@@ -3156,6 +3258,7 @@ var Vizu = class {
   requireUserOrAuth() {
     if (!(this.storage instanceof CloudStorageAdapter)) return true;
     if (this.user) return true;
+    if (this.storage.isAccessDenied()) return false;
     void this.storage.preflightAuth().catch(() => {
     });
     return false;