@withone/connect 0.15.0 → 0.16.0

package/src/flow.ts

@@ -156,12 +156,6 @@ export function createConnectFlow(
   };
 }
 
-/** @deprecated Renamed to `createConnectFlow` (it is not a React hook;
- *  React apps can use `useOneConnect` from `@withone/connect/react`).
- *  Removed in the next minor. */
-export const useOneConnect = (options: OneConnectFlowOptions): OneConnectFlow =>
-  createConnectFlow(options);
-
 /** Test seam: forget this page load's outcome. */
 export function resetPageReturnForTests(): void {
   pageReturn = undefined;

package/src/index.ts

@@ -1,4 +1,4 @@
-export { createConnectFlow, readConnectReturn, useOneConnect } from "./flow";
+export { createConnectFlow, readConnectReturn } from "./flow";
 export {
   mountConnectButton,
   registerConnectButton,
@@ -22,8 +22,3 @@ export type {
   OneConnectTheme,
 } from "./types";
 
-import type { OneConnectFlow, OneConnectFlowOptions } from "./types";
-/** @deprecated Renamed to `OneConnectFlowOptions`; removed in the next minor. */
-export type OneConnectOptions = OneConnectFlowOptions;
-/** @deprecated Renamed to `OneConnectFlow`; removed in the next minor. */
-export type OneConnectHandle = OneConnectFlow;

package/src/next.ts

@@ -14,7 +14,7 @@
  * That serves /api/one/authorize and /api/one/callback. Register
  * `https://yourapp.com/api/one/callback` as the app's redirect URI.
  */
-import type { OneConnectClient } from "./server";
+import type { CompleteAuthorizationResult, OneConnectClient } from "./server";
 
 export interface OneConnectRoutesOptions {
   /** The app's own id for the signed-in user, or null when nobody is
@@ -25,6 +25,15 @@ export interface OneConnectRoutesOptions {
   /** Where to send the browser when nobody is signed in. Answers 401
    *  when omitted. */
   signInUrl?: string;
+  /** Called after every callback, before the browser is redirected:
+   *  `result.outcome` is "connected", "declined" or "failed", and
+   *  `result.message` says why a flow failed. For your logs and metrics;
+   *  never show the message to the user. An error it throws is ignored,
+   *  so the user still lands back in the app. */
+  onComplete?: (event: {
+    userId: string;
+    result: CompleteAuthorizationResult;
+  }) => void | Promise<void>;
 }
 
 export interface OneConnectRoutes {
@@ -114,6 +123,13 @@ export function createOneConnectRoutes(
       url: request.url,
       getCookie: (name) => readCookie(request, name),
     });
+    if (options.onComplete) {
+      try {
+        await options.onComplete({ userId: user, result });
+      } catch {
+        /* the app's own hook threw; the redirect still happens */
+      }
+    }
     return redirectWithCookies(
       result.redirectUrl,
       result.clearCookieName

package/src/node.ts

@@ -29,8 +29,12 @@ export interface OneConnectNodeOptions {
   loginHintFor?: (
     request: IncomingMessage,
   ) => Promise<string | null> | string | null;
-  /** Where to send the browser when nobody is signed in. */
+  /** Where to send the browser when nobody is signed in. Answers 401
+   *  when omitted. */
   signInUrl?: string;
+  /** Called after every callback with how it ended; see
+   *  `OneConnectRoutesOptions.onComplete`. */
+  onComplete?: OneConnectRoutesOptions["onComplete"];
 }
 
 export type NodeHandler = (
@@ -80,27 +84,31 @@ export function createOneConnectHandlers(
   options: OneConnectNodeOptions,
 ): OneConnectHandlers {
   // The web adapter receives a Request; the Node callbacks want the
-  // original IncomingMessage, so it is carried alongside by closure.
-  let current: IncomingMessage | null = null;
-  const routeOptions: OneConnectRoutesOptions = {
-    identifyUser: () => options.identifyUser(current as IncomingMessage),
-    loginHintFor: options.loginHintFor
-      ? () => options.loginHintFor!(current as IncomingMessage)
+  // original IncomingMessage. Each Request maps to its own message, so
+  // concurrent requests never read each other's session or login hint.
+  const origin = new WeakMap<Request, IncomingMessage>();
+  const nodeRequestFor = (request: Request): IncomingMessage => {
+    const message = origin.get(request);
+    if (!message) throw new Error("@withone/connect/node: unknown request");
+    return message;
+  };
+  const loginHintFor = options.loginHintFor;
+  const routes = createOneConnectRoutes(oneConnect, {
+    identifyUser: (request) => options.identifyUser(nodeRequestFor(request)),
+    loginHintFor: loginHintFor
+      ? (request) => loginHintFor(nodeRequestFor(request))
       : undefined,
     signInUrl: options.signInUrl,
-  };
-  const routes = createOneConnectRoutes(oneConnect, routeOptions);
+    onComplete: options.onComplete,
+  } satisfies OneConnectRoutesOptions);
 
   const handle = async (
     request: IncomingMessage,
     response: ServerResponse,
   ): Promise<void> => {
-    current = request;
-    try {
-      await send(response, await routes.GET(toWebRequest(request)));
-    } finally {
-      current = null;
-    }
+    const web = toWebRequest(request);
+    origin.set(web, request);
+    await send(response, await routes.GET(web));
   };
 
   return { authorize: handle, callback: handle };

package/src/server/types.ts

@@ -121,7 +121,7 @@ export interface OneConnectBaseConfig {
 export interface OneConnectKeyConfig extends OneConnectBaseConfig {
   mode?: "key";
   /** The app's connect key, minted on the app's page in the dashboard.
-   *  Server only. One key per environment. */
+   *  Server only. Connect keys work in Production. */
   connectKey: string;
   userStore: OneConnectUserStore;
   tokenStore?: never;

package/src/types.ts

@@ -75,9 +75,9 @@ export interface ConnectButtonLogo {
   imageUrl: string;
 }
 
-/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in the next minor. */
+/** @deprecated Renamed to `ConnectButtonLogoInput`; removed in 0.17.0. */
 export type ConnectButtonPlatformInput = ConnectButtonLogoInput;
-/** @deprecated Renamed to `ConnectButtonLogo`; removed in the next minor. */
+/** @deprecated Renamed to `ConnectButtonLogo`; removed in 0.17.0. */
 export type ConnectButtonPlatform = ConnectButtonLogo;
 
 export type ConnectButtonVariant = "default" | "accent" | "block";
@@ -94,7 +94,7 @@ export interface ConnectButtonProps {
    *  into a "+N" chip. Decoration only; the permission set decides what
    *  One asks for. */
   logos?: ConnectButtonLogoInput[];
-  /** @deprecated Renamed to `logos`; removed in the next minor. */
+  /** @deprecated Renamed to `logos`; removed in 0.17.0. */
   platforms?: ConnectButtonLogoInput[];
   /** Whether this user has a live grant, from your server. When set, it
    *  decides the Connected state. When omitted, the button shows