@wix/astro 1.0.21 → 1.0.23

package/build-runtime/context/non-elevated.js

@@ -1,6 +1,7 @@
 import {
   authAsyncLocalStorage
 } from "../chunk-C3QOE2TZ.js";
+import "../chunk-MLKGABMK.js";
 
 // src/context/non-elevated.ts
 import { createClient, OAuthStrategy } from "@wix/sdk";
@@ -19,7 +20,7 @@ var authProxy = new Proxy(
       return function(...args) {
         const store = authAsyncLocalStorage.getStore();
         if (store?.sessionTokens) {
-          auth.setTokens(store.sessionTokens.tokens);
+          auth.setTokens(store.sessionTokens);
         }
         return value.apply(auth, args);
       };

package/build-runtime/middleware/auth.js

@@ -4,6 +4,7 @@ import {
 import {
   saveSessionTokensToCookie
 } from "../chunk-VMS3NKCF.js";
+import "../chunk-MLKGABMK.js";
 
 // src/utils/generateVisitorTokens.ts
 import { OAuthStrategy } from "@wix/sdk";
@@ -38,7 +39,7 @@ function getSessionTokensFromCookie(context) {
     if (rawCookie != null) {
       const tokensParseResult = tokensSchema.safeParse(rawCookie);
       if (tokensParseResult.success && tokensParseResult.data.clientId === WIX_CLIENT_ID2) {
-        return tokensParseResult.data;
+        return tokensParseResult.data.tokens;
       }
     }
   }
@@ -47,17 +48,26 @@ function getSessionTokensFromCookie(context) {
 
 // src/middleware/auth.ts
 var onRequest = async (context, next) => {
+  const existingTokens = getExistingTokens(context);
+  const usedTokens = existingTokens ?? await generateVisitorTokens();
   const store = {
-    sessionTokens: getSessionTokensFromCookie(context)
+    sessionTokens: usedTokens
   };
   const response = await authAsyncLocalStorage.run(store, () => {
     return next();
   });
-  if (!context.isPrerendered && store.sessionTokens == null) {
-    saveSessionTokensToCookie(context, await generateVisitorTokens());
+  if (!context.isPrerendered && existingTokens !== usedTokens) {
+    saveSessionTokensToCookie(context, usedTokens);
   }
   return response;
 };
+function getExistingTokens(context) {
+  const existingTokens = getSessionTokensFromCookie(context);
+  if (existingTokens && existingTokens.accessToken.expiresAt + 600 > Date.now() / 1e3) {
+    return existingTokens;
+  }
+  return null;
+}
 export {
   onRequest
 };

package/build-runtime/middleware/html-embeds.d.ts

@@ -0,0 +1,5 @@
+import { MiddlewareHandler } from 'astro';
+
+declare const onRequest: MiddlewareHandler;
+
+export { onRequest };

package/build-runtime/middleware/html-embeds.js

@@ -0,0 +1,66 @@
+import "../chunk-MLKGABMK.js";
+
+// src/middleware/html-embeds.ts
+import { httpClient } from "@wix/essentials";
+
+// src/utils/transformStreamUtils.ts
+function injectAfterTransformStream(predicate, htmlToInject) {
+  let hasInjected = false;
+  return new TransformStream({
+    transform: (chunk, controller) => {
+      if (!hasInjected) {
+        const index = predicate.exec(chunk);
+        if (index) {
+          const position = index.index + index[0].length;
+          chunk = chunk.slice(0, position) + htmlToInject + chunk.slice(position);
+          hasInjected = true;
+        }
+      }
+      controller.enqueue(chunk);
+    }
+  });
+}
+function injectBeforeTransformStream(predicate, htmlToInject) {
+  let hasInjected = false;
+  return new TransformStream({
+    transform: (chunk, controller) => {
+      if (!hasInjected) {
+        const index = chunk.indexOf(predicate);
+        if (index > -1) {
+          chunk = chunk.slice(0, index) + htmlToInject + chunk.slice(index);
+          hasInjected = true;
+        }
+      }
+      controller.enqueue(chunk);
+    }
+  });
+}
+
+// src/middleware/html-embeds.ts
+var bodyEndTransformStream = (htmlToInject) => injectBeforeTransformStream("</body>", htmlToInject);
+var headTransformStream = (htmlToInject) => injectBeforeTransformStream("</head>", htmlToInject);
+var bodyStartTransformStream = (htmlToInject) => injectAfterTransformStream(/<body(?![^>]*\/>)[^>]*>/, htmlToInject);
+async function fetchScripts() {
+  return httpClient.fetchWithAuth("https://edge.wixapis.com/assets/scripts/v1/site-scripts").then((res) => res.json()).then((data) => data.siteScripts);
+}
+var onRequest = async (context, next) => {
+  const response = await next();
+  const contentType = response.headers.get("Content-Type");
+  if (contentType !== "text/html") {
+    return response;
+  }
+  if (context.url.pathname.startsWith("/_wix")) {
+    return response;
+  }
+  const scripts = await fetchScripts();
+  const headInjection = scripts.filter((x) => x.position === "HEAD").map((x) => x.html).join("\n");
+  const bodyStartInjection = scripts.filter((x) => x.position === "BODY_START").map((x) => x.html).join("\n");
+  const bodyEndInjection = scripts.filter((x) => x.position === "BODY_END").map((x) => x.html).join("\n");
+  return new Response(
+    response.body?.pipeThrough(new TextDecoderStream()).pipeThrough(headTransformStream(headInjection)).pipeThrough(bodyStartTransformStream(bodyStartInjection)).pipeThrough(bodyEndTransformStream(bodyEndInjection)).pipeThrough(new TextEncoderStream()),
+    response
+  );
+};
+export {
+  onRequest
+};

package/build-runtime/routes/auth/callback.js

@@ -2,20 +2,22 @@ import {
   saveSessionTokensToCookie
 } from "../../chunk-VMS3NKCF.js";
 import {
-  z
-} from "../../chunk-YMZMZCBN.js";
+  object,
+  string
+} from "../../chunk-RKE6XT5Z.js";
 import {
   auth,
   oAuthStateCookieName
 } from "../../chunk-UZPSWWI5.js";
+import "../../chunk-MLKGABMK.js";
 
 // src/routes/auth/callback.ts
-var oauthCookieSchema = z.object({
-  codeChallenge: z.string(),
-  codeVerifier: z.string(),
-  originalUri: z.string(),
-  redirectUri: z.string(),
-  state: z.string()
+var oauthCookieSchema = object({
+  codeChallenge: string(),
+  codeVerifier: string(),
+  originalUri: string(),
+  redirectUri: string(),
+  state: string()
 });
 var GET = async (context) => {
   const oauthStateCookie = context.cookies.get(oAuthStateCookieName);

package/build-runtime/routes/auth/login.js

@@ -1,24 +1,30 @@
 import {
-  z
-} from "../../chunk-YMZMZCBN.js";
+  _enum,
+  object,
+  string
+} from "../../chunk-RKE6XT5Z.js";
 import {
   auth,
   oAuthStateCookieName
 } from "../../chunk-UZPSWWI5.js";
+import "../../chunk-MLKGABMK.js";
 
 // src/routes/auth/login.ts
-var loginSearchParams = z.object({
-  prompt: z.enum(["login", "none"]).optional(),
-  returnToUrl: z.string().optional()
+var loginSearchParams = object({
+  prompt: _enum(["login", "none"]).optional(),
+  returnToUrl: string().optional()
 });
-var GET = async ({ url }) => {
+var GET = async ({ request, url }) => {
   const { prompt, returnToUrl = "/" } = loginSearchParams.parse(
     Object.fromEntries(url.searchParams.entries())
   );
-  const oauthData = auth.generateOAuthData(
-    new URL("/api/auth/callback", url).toString(),
-    returnToUrl
-  );
+  const callbackUrl = new URL("/api/auth/callback", url);
+  const referer = request.headers.get("referer");
+  if (referer != null) {
+    const originalUrl = new URL(referer);
+    callbackUrl.protocol = originalUrl.protocol;
+  }
+  const oauthData = auth.generateOAuthData(callbackUrl.toString(), returnToUrl);
   const { authUrl } = await auth.getAuthUrl(oauthData, {
     prompt,
     responseMode: "query"

package/build-runtime/routes/auth/logout-callback.js

@@ -5,6 +5,7 @@ import {
   auth,
   returnToQueryParamName
 } from "../../chunk-UZPSWWI5.js";
+import "../../chunk-MLKGABMK.js";
 
 // src/routes/auth/logout-callback.ts
 var GET = async (context) => {

package/build-runtime/routes/auth/logout.js

@@ -1,14 +1,16 @@
 import {
-  z
-} from "../../chunk-YMZMZCBN.js";
+  object,
+  string
+} from "../../chunk-RKE6XT5Z.js";
 import {
   auth,
   returnToQueryParamName
 } from "../../chunk-UZPSWWI5.js";
+import "../../chunk-MLKGABMK.js";
 
 // src/routes/auth/logout.ts
-var logoutSearchParams = z.object({
-  returnToUrl: z.string().optional()
+var logoutSearchParams = object({
+  returnToUrl: string().optional()
 });
 var POST = async ({ redirect, request, url }) => {
   const { returnToUrl = "/" } = logoutSearchParams.parse(
@@ -16,6 +18,11 @@ var POST = async ({ redirect, request, url }) => {
   );
   const baseUrl = `${new URL(request.url).origin}/${import.meta.env.BASE_URL}`;
   const postFlowUrl = new URL("/api/auth/logout-callback", baseUrl);
+  const referer = request.headers.get("referer");
+  if (referer != null) {
+    const originalUrl = new URL(referer);
+    postFlowUrl.protocol = originalUrl.protocol;
+  }
   postFlowUrl.searchParams.set(returnToQueryParamName, returnToUrl);
   const { logoutUrl } = await auth.logout(postFlowUrl.toString());
   return redirect(logoutUrl);

package/build-runtime/routes/service-plugins.js

@@ -1,3 +1,5 @@
+import "../chunk-MLKGABMK.js";
+
 // src/routes/service-plugins.ts
 var ALL = async (context) => {
   const { ALL: ALL2 } = await import(

package/build-runtime/routes/webhooks.js

@@ -1,3 +1,5 @@
+import "../chunk-MLKGABMK.js";
+
 // src/routes/webhooks.ts
 var ALL = async (context) => {
   const { ALL: ALL2 } = await import(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/astro",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "devDependencies": {
     "@wix/dashboard": "^1.3.35",
     "@wix/essentials": "^0.1.23",
@@ -15,7 +15,7 @@
     "tsup": "^8.1.0",
     "variant": "^3.0.0-dev.27",
     "vite": "6.2.6",
-    "zod": "^3.24.2"
+    "zod": "^3.25.67"
   },
   "exports": {
     ".": "./build/index.js",
@@ -48,5 +48,5 @@
       ]
     }
   },
-  "falconPackageHash": "1582964b2e070bcdaacf19658e234f267a2a3080254a5cc19a91fca2"
+  "falconPackageHash": "5741caa5bbdd4030f672591a362f5f6d5cfc52902d127c7833873141"
 }

package/src/context/non-elevated.ts

@@ -23,7 +23,7 @@ const authProxy = new Proxy(
         const store = authAsyncLocalStorage.getStore();
 
         if (store?.sessionTokens) {
-          auth.setTokens(store.sessionTokens.tokens);
+          auth.setTokens(store.sessionTokens);
         }
 
         // eslint-disable-next-line @typescript-eslint/no-unsafe-function-type

package/src/context/setup.ts

@@ -9,6 +9,6 @@ export function setup(options: { clientId: string }): void {
   }
 
   if (!location.pathname.startsWith('/_wix/extensions/backoffice')) {
-    getSessionClient(options).enableContext('module');
+    getSessionClient(options).enableContext('global');
   }
 }

package/src/context/utils.ts

@@ -1,7 +1,7 @@
 import type { WixClient } from '@wix/sdk';
 import { createClient, TokenRole } from '@wix/sdk';
 import { SiteSessionAuth } from '@wix/sdk/auth/site-session';
-import { z } from 'zod';
+import * as z from 'zod/v4';
 
 export function getSessionClient(options: { clientId: string }): WixClient {
   return createClient({

package/src/index.ts

@@ -89,6 +89,15 @@ const createIntegration = (
           `
         );
 
+        // inject HTML embeds
+        addMiddleware({
+          entrypoint: new URL(
+            '../build-runtime/middleware/html-embeds.js',
+            import.meta.url
+          ),
+          order: 'post',
+        });
+
         // support server side context calls
         addMiddleware({
           entrypoint: new URL(

package/src/middleware/auth.ts

@@ -1,21 +1,37 @@
-import type { MiddlewareHandler } from 'astro';
+import type { APIContext, MiddlewareHandler } from 'astro';
 import { authAsyncLocalStorage } from '../utils/authAsyncLocalStorage.js';
 import { generateVisitorTokens } from '../utils/generateVisitorTokens.js';
 import { getSessionTokensFromCookie } from '../utils/getSessionTokensFromCookie.js';
 import { saveSessionTokensToCookie } from '../utils/saveSessionTokensToCookie.js';
 
 export const onRequest: MiddlewareHandler = async (context, next) => {
+  const existingTokens = getExistingTokens(context);
+  const usedTokens = existingTokens ?? (await generateVisitorTokens());
+
   const store = {
-    sessionTokens: getSessionTokensFromCookie(context),
+    sessionTokens: usedTokens,
   };
 
   const response = await authAsyncLocalStorage.run(store, () => {
     return next();
   });
 
-  if (!context.isPrerendered && store.sessionTokens == null) {
-    saveSessionTokensToCookie(context, await generateVisitorTokens());
+  if (!context.isPrerendered && existingTokens !== usedTokens) {
+    saveSessionTokensToCookie(context, usedTokens);
   }
 
   return response;
 };
+
+function getExistingTokens(context: APIContext) {
+  const existingTokens = getSessionTokensFromCookie(context);
+
+  if (
+    existingTokens &&
+    existingTokens.accessToken.expiresAt + 600 > Date.now() / 1000
+  ) {
+    return existingTokens;
+  }
+
+  return null;
+}

package/src/middleware/html-embeds.ts

@@ -0,0 +1,67 @@
+import type { MiddlewareHandler } from 'astro';
+import { httpClient } from '@wix/essentials';
+import {
+  injectAfterTransformStream,
+  injectBeforeTransformStream,
+} from '../utils/transformStreamUtils.js';
+
+interface SiteScript {
+  html: string;
+  position: 'BODY_END' | 'BODY_START' | 'HEAD';
+}
+
+const bodyEndTransformStream = (htmlToInject: string) =>
+  injectBeforeTransformStream('</body>', htmlToInject);
+
+const headTransformStream = (htmlToInject: string) =>
+  injectBeforeTransformStream('</head>', htmlToInject);
+
+const bodyStartTransformStream = (htmlToInject: string) =>
+  injectAfterTransformStream(/<body(?![^>]*\/>)[^>]*>/, htmlToInject);
+
+async function fetchScripts() {
+  return httpClient
+    .fetchWithAuth('https://edge.wixapis.com/assets/scripts/v1/site-scripts')
+    .then((res) => res.json() as Promise<{ siteScripts: SiteScript[] }>)
+    .then((data) => data.siteScripts);
+}
+
+export const onRequest: MiddlewareHandler = async (context, next) => {
+  const response = await next();
+  const contentType = response.headers.get('Content-Type');
+
+  if (contentType !== 'text/html') {
+    return response;
+  }
+
+  if (context.url.pathname.startsWith('/_wix')) {
+    return response;
+  }
+
+  const scripts = await fetchScripts();
+
+  const headInjection = scripts
+    .filter((x) => x.position === 'HEAD')
+    .map((x) => x.html)
+    .join('\n');
+
+  const bodyStartInjection = scripts
+    .filter((x) => x.position === 'BODY_START')
+    .map((x) => x.html)
+    .join('\n');
+
+  const bodyEndInjection = scripts
+    .filter((x) => x.position === 'BODY_END')
+    .map((x) => x.html)
+    .join('\n');
+
+  return new Response(
+    response.body
+      ?.pipeThrough(new TextDecoderStream())
+      .pipeThrough(headTransformStream(headInjection))
+      .pipeThrough(bodyStartTransformStream(bodyStartInjection))
+      .pipeThrough(bodyEndTransformStream(bodyEndInjection))
+      .pipeThrough(new TextEncoderStream()),
+    response
+  );
+};

package/src/routes/auth/callback.ts

@@ -1,5 +1,5 @@
 import type { APIRoute } from 'astro';
-import { z } from 'zod';
+import * as z from 'zod/v4';
 import { oAuthStateCookieName } from '../../constants.js';
 import { auth } from '../../utils/contextualAuth.js';
 import { saveSessionTokensToCookie } from '../../utils/saveSessionTokensToCookie.js';

package/src/routes/auth/login.ts

@@ -1,5 +1,5 @@
 import type { APIRoute } from 'astro';
-import { z } from 'zod';
+import * as z from 'zod/v4';
 import { oAuthStateCookieName } from '../../constants.js';
 import { auth } from '../../utils/contextualAuth.js';
 
@@ -8,15 +8,20 @@ const loginSearchParams = z.object({
   returnToUrl: z.string().optional(),
 });
 
-export const GET: APIRoute = async ({ url }) => {
+export const GET: APIRoute = async ({ request, url }) => {
   const { prompt, returnToUrl = '/' } = loginSearchParams.parse(
     Object.fromEntries(url.searchParams.entries())
   );
 
-  const oauthData = auth.generateOAuthData(
-    new URL('/api/auth/callback', url).toString(),
-    returnToUrl
-  );
+  const callbackUrl = new URL('/api/auth/callback', url);
+  const referer = request.headers.get('referer');
+
+  if (referer != null) {
+    const originalUrl = new URL(referer);
+    callbackUrl.protocol = originalUrl.protocol;
+  }
+
+  const oauthData = auth.generateOAuthData(callbackUrl.toString(), returnToUrl);
 
   const { authUrl } = await auth.getAuthUrl(oauthData, {
     prompt,

package/src/routes/auth/logout.ts

@@ -1,5 +1,5 @@
 import type { APIRoute } from 'astro';
-import { z } from 'zod';
+import * as z from 'zod/v4';
 import { returnToQueryParamName } from '../../constants.js';
 import { auth } from '../../utils/contextualAuth.js';
 
@@ -13,6 +13,13 @@ export const POST: APIRoute = async ({ redirect, request, url }) => {
   );
   const baseUrl = `${new URL(request.url).origin}/${import.meta.env.BASE_URL}`;
   const postFlowUrl = new URL('/api/auth/logout-callback', baseUrl);
+  const referer = request.headers.get('referer');
+
+  if (referer != null) {
+    const originalUrl = new URL(referer);
+    postFlowUrl.protocol = originalUrl.protocol;
+  }
+
   postFlowUrl.searchParams.set(returnToQueryParamName, returnToUrl);
 
   const { logoutUrl } = await auth.logout(postFlowUrl.toString());