@xh/hoist 73.0.0-SNAPSHOT.1743781894378 → 73.0.0-SNAPSHOT.1744046548420

package/CHANGELOG.md

@@ -2,12 +2,14 @@
 
 ## v73.0.0-SNAPSHOT - unreleased
 
-* Support for reporting Client Version in Admin WebSockets tab.
-* NULL check when accessing records in Store to prevent a thrown error
+### 🎁 New Features
+
+* Added the reported client app version as a column in the Admin Console WebSockets tab.
 
 ## v72.2.0 - 2025-03-13
 
 ### 🎁 New Features
+
 * Modified `TabContainerModel` to make more methods `protected`, improving extensibility for
   advanced use-cases.
 * Enhanced `XH.reloadApp` with new argument to clear query parameters before loading.
@@ -20,8 +22,8 @@
 
 ### 🐞 Bug Fixes
 
-* Prevent native browser context menu on Dash Canvas surfaces. It can hide the Dash Canvas custom
-  context menu when an app's `showBrowserContextMenu` flag is `true`.
+* Prevented native browser context menu from showing on `DashCanvas` surfaces and obscuring the
+  `DashCanvas` custom context menu.
 
 ## v72.1.0 - 2025-02-13
 

package/build/types/security/BaseOAuthClient.d.ts

@@ -40,14 +40,13 @@ export interface BaseOAuthClientConfig<S extends AccessTokenSpec> {
      */
     idScopes?: string[];
     /**
-     * Optional map of access tokens to be loaded and maintained.
+     * Optional spec for access tokens to be loaded and maintained to support access to one or more
+     * different back-end resources, distinct from the core Hoist auth flow via ID token.
      *
-     * Map of code to a spec for an access token.  The code is app-determined and
-     * will simply be used to get the loaded token via tha getAccessToken() method. The
-     * spec is implementation specific, but will typically include scopes to be loaded
-     * for the access token and potentially other meta-data required by the underlying provider.
-     *
-     * Use this map to gain targeted access tokens for different back-end resources.
+     * Map of key to a spec for an access token. The key is an arbitrary, app-determined string
+     * used to retrieve the loaded token via {@link getAccessTokenAsync}. The spec is implementation
+     * specific, but will typically include scopes to be loaded for the access token and potentially
+     * other metadata required by the underlying provider.
      */
     accessTokens?: Record<string, S>;
 }

package/build/types/security/Types.d.ts

@@ -2,11 +2,13 @@ import { Token } from './Token';
 export type TokenMap = Record<string, Token>;
 export interface AccessTokenSpec {
     /**
-     * Mode governing when the access token should be requested from provider.
-     *      eager (default) - initiate lookup on initialization, but do not block on failure.
-     *      lazy - lookup when requested by client.
+     * Mode governing when the access token should be requested from provider:
+     *      - eager (or undefined) - load on overall initialization, but do not block on failure.
+     *        Useful for tokens that an app is almost certain to require during a user session.
+     *      - lazy - defer loading until first requested by client. Useful for tokens that might
+     *        never be needed by the app during a given user session.
      */
-    fetchMode: 'eager' | 'lazy';
+    fetchMode?: 'eager' | 'lazy';
     /** Scopes for the desired access token.*/
     scopes: string[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xh/hoist",
-  "version": "73.0.0-SNAPSHOT.1743781894378",
+  "version": "73.0.0-SNAPSHOT.1744046548420",
   "description": "Hoist add-on for building and deploying React Applications.",
   "repository": "github:xh/hoist-react",
   "homepage": "https://xh.io",

package/security/BaseOAuthClient.ts

@@ -64,14 +64,13 @@ export interface BaseOAuthClientConfig<S extends AccessTokenSpec> {
     idScopes?: string[];
 
     /**
-     * Optional map of access tokens to be loaded and maintained.
+     * Optional spec for access tokens to be loaded and maintained to support access to one or more
+     * different back-end resources, distinct from the core Hoist auth flow via ID token.
      *
-     * Map of code to a spec for an access token.  The code is app-determined and
-     * will simply be used to get the loaded token via tha getAccessToken() method. The
-     * spec is implementation specific, but will typically include scopes to be loaded
-     * for the access token and potentially other meta-data required by the underlying provider.
-     *
-     * Use this map to gain targeted access tokens for different back-end resources.
+     * Map of key to a spec for an access token. The key is an arbitrary, app-determined string
+     * used to retrieve the loaded token via {@link getAccessTokenAsync}. The spec is implementation
+     * specific, but will typically include scopes to be loaded for the access token and potentially
+     * other metadata required by the underlying provider.
      */
     accessTokens?: Record<string, S>;
 }
@@ -314,7 +313,7 @@ export abstract class BaseOAuthClient<
         const eagerOnly = opts?.eagerOnly ?? false,
             useCache = opts?.useCache ?? true,
             accessSpecs = eagerOnly
-                ? pickBy(this.accessSpecs, spec => spec.fetchMode === 'eager')
+                ? pickBy(this.accessSpecs, spec => spec.fetchMode !== 'lazy') // specs are eager by default - opt-in to lazy
                 : this.accessSpecs,
             ret: TokenMap = {};
 

package/security/Types.ts

@@ -11,11 +11,13 @@ export type TokenMap = Record<string, Token>;
 
 export interface AccessTokenSpec {
     /**
-     * Mode governing when the access token should be requested from provider.
-     *      eager (default) - initiate lookup on initialization, but do not block on failure.
-     *      lazy - lookup when requested by client.
+     * Mode governing when the access token should be requested from provider:
+     *      - eager (or undefined) - load on overall initialization, but do not block on failure.
+     *        Useful for tokens that an app is almost certain to require during a user session.
+     *      - lazy - defer loading until first requested by client. Useful for tokens that might
+     *        never be needed by the app during a given user session.
      */
-    fetchMode: 'eager' | 'lazy';
+    fetchMode?: 'eager' | 'lazy';
 
     /** Scopes for the desired access token.*/
     scopes: string[];