@xh/hoist 78.0.0 → 78.1.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 78.1.1 - 2025-12-03
+
+### 🐞 Bug Fixes
+* Fix to Highchart timezone handling regression from version 77.  Applications should note that
+  Highcharts has deprecated the `time.useUTC` option and its functioning seem suspect. Apps
+  should set `time.timezone` instead. See https://api.highcharts.com/highcharts/time.useUTC.
+
+### ⚙️ Technical
+
+* Allow cross-tab persistence of client log levels
+
+## 78.1.0 - 2025-12-02
+
+### ⚙️ Technical
+* New property `MsalClientConfig.enableSsoSilent` to govern use of MSAL SSO api.
+
+* Existing property `MsalClientConfig.enableTelemetry` now defaults to `true`.
+
+* Improved use of MSAL client API, to maximize effectiveness of SSO.  Improved documentation
+ and logging.  Iframe attempts will now time out by default after 3 seconds vs. 10 seconds.
+ This can be further modified by apps via the option
+ `MsalClientConfig.msalClientOptions.system.iFrameHashTimeout`
+
+### 📚 Libraries
+
+* @auth0/auth0-spa-js `2.7 → 2.9`
+* @azure/msal-browser `4.25 → 4.26`
+
 ## 78.0.0 - 2025-11-21
 
 ### 💥 Breaking Changes
@@ -33,6 +61,12 @@
 
 ## 77.1.1 - 2025-11-12
 
+### 💥 Breaking Changes (upgrade difficulty: 🟢 LOW)
+
+* Apps that use and provide the `highcharts` library should be sure to update the version to v12.4.0.
+  Refer to `Bootstrap.js` in Toolbox for required import changes.
+    * Visit https://www.highcharts.com/blog/changelog/ for specific changes.
+
 ### 🎁 New Features
 
 * New method `StoreRecord.getModifiedValues()` to gather edited data from a store record.

package/admin/differ/Differ.ts

@@ -64,7 +64,7 @@ const tbar = hoistCmp.factory<DifferModel>(({model}) => {
             placeholder: 'https://remote-host/',
             enableCreate: true,
             createMessageFn: identity,
-            width: 250,
+            width: 350,
             options: model.remoteHosts
         }),
         button({

package/admin/differ/DifferModel.ts

@@ -60,8 +60,14 @@ export class DifferModel extends HoistModel {
         recordsRequired: true
     };
 
+    /**
+     * All other configured appInstances URLs, excepting the current one.
+     * (Use of startsWith allows configs to end in trailing /)
+     */
     get remoteHosts(): string[] {
-        return XH.getConf('xhAppInstances').filter(it => it !== window.location.origin);
+        return XH.getConf('xhAppInstances').filter(
+            (it: string) => !it.startsWith(window.location.origin)
+        );
     }
 
     constructor({
@@ -83,6 +89,9 @@ export class DifferModel extends HoistModel {
 
         this.url = entityName + 'DiffAdmin';
 
+        // Default to first available remote for comparison
+        this.remoteHost = this.remoteHosts[0];
+
         const rendererIsComplex = true;
         this.gridModel = new GridModel({
             store: {

package/build/types/admin/differ/DifferModel.d.ts

@@ -24,6 +24,10 @@ export declare class DifferModel extends HoistModel {
     hasLoaded: boolean;
     get readonly(): boolean;
     applyRemoteAction: RecordActionSpec;
+    /**
+     * All other configured appInstances URLs, excepting the current one.
+     * (Use of startsWith allows configs to end in trailing /)
+     */
     get remoteHosts(): string[];
     constructor({ parentModel, entityName, displayName, columnFields, matchFields, valueRenderer }: Partial<DifferModel>);
     doLoadAsync(loadSpec: LoadSpec): Promise<void>;

package/build/types/cmp/grid/GridModel.d.ts

@@ -326,39 +326,39 @@ export declare class GridModel extends HoistModel {
     localExport(filename: string, type: 'excel' | 'csv', params?: PlainObject): void;
     /**
      * Select records in the grid.
-     *
      * @param records - one or more record(s) / ID(s) to select.
-     * @param options - additional options containing the following keys:
-     *      ensureVisible - true to make selection visible if it is within a
-     *          collapsed node or outside of the visible scroll window. Default true.
-     *      clearSelection - true to clear previous selection (rather than
-     *          add to it). Default true.
+     * @param opts - additional post-selection options
      */
     selectAsync(records: Some<StoreRecordOrId>, opts?: {
+        /**
+         * True (default) to scroll the grid or expand nodes as needed to make selection
+         * visible if it is within a collapsed node or outside of the visible scroll window.
+         */
         ensureVisible?: boolean;
+        /** True (default) to clear previous selection (rather than add to it). */
         clearSelection?: boolean;
     }): Promise<void>;
     /**
      * Select the first row in the grid.
      *
-     * See {@link preSelectFirstAsync} for a useful variant of this method.  preSelectFirstAsync()
-     * will not change the selection if there is already a selection, which is what applications
-     * typically want to do when loading/reloading a grid.
-     *
-     * @param opts -
-     *      expandParentGroups - set to true to expand nodes to allow selection when the
-     *          first selectable node is in a collapsed group. Default true.
-     *      ensureVisible - set to to true to scroll to the selected row if it is outside of the
-     *      visible scroll window. Default true.
-     *
+     * See {@link preSelectFirstAsync} for a useful variant of this method that will leave the
+     * any pre-existing selection unchanged, which is what apps typically want when reloading an
+     * already-populated grid.
      */
     selectFirstAsync(opts?: {
+        /**
+         * True (default) to expand nodes as needed to allow selection when the first selectable
+         * node is in a collapsed group.
+         */
         expandParentGroups?: boolean;
+        /**
+         * True (default) to scroll the grid or expand nodes as needed to make selection
+         * visible if it is outside of the visible scroll window.
+         */
         ensureVisible?: boolean;
     }): Promise<void>;
     /**
      * Select the first row in the grid, if no other selection present.
-     *
      * This method delegates to {@link selectFirstAsync}.
      */
     preSelectFirstAsync(): Promise<void>;

package/build/types/core/XH.d.ts

@@ -186,11 +186,11 @@ export declare class XHApi {
     get logLevel(): LogLevel;
     /**
      * Set the minimum severity for Hoist log utils until the page is refreshed. Optionally persist
-     * this adjustment to sessionStorage to maintain for the lifetime of the browser tab.
+     * this adjustment for up to 1440 minutes in local storage.
      *
      * Hint: call this method from the console to adjust your app's log level while troubleshooting.
      */
-    setLogLevel(level: LogLevel, persistInSessionStorage?: boolean): void;
+    setLogLevel(level: LogLevel, persistMins?: number): void;
     /**
      * Main entry point to start the client app - initializes and renders application code.
      * Call from the app's entry-point file within your project's `/client-app/src/apps/` folder.

package/build/types/security/msal/MsalClient.d.ts

@@ -19,7 +19,7 @@ export interface MsalClientConfig extends BaseOAuthClientConfig<MsalTokenSpec> {
     domainHint?: string;
     /**
      * True to enable support for built-in telemetry provided by this class's internal MSAL client.
-     * Captured performance events will be summarized as {@link MsalClientTelemetry}.
+     * Captured performance events will be summarized as {@link MsalClientTelemetry}. Default true.
      */
     enableTelemetry?: boolean;
     /**
@@ -42,6 +42,17 @@ export interface MsalClientConfig extends BaseOAuthClientConfig<MsalTokenSpec> {
      * See https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/token-lifetimes.md
      */
     initRefreshTokenExpirationOffsetSecs?: number;
+    /**
+     * Enable the use of the MSAL ssoSilent() API, which will attempt to use credentials gained by
+     * another app or tab to start a new session for this app.  Requires iFrames and 3rd party
+     * cookies to be enabled.  Default true.
+     *
+     *  In practice, and according to documentation, this operation is likely to fail for a
+     *  number of reasons, and can often do so as timeout.  Therefore, keeping the timeout limit
+     *  value -- `system.iFrameHashTimeout` -- at a relatively low value is critical.  Hoist
+     *  defaults this value to 3000ms vs. the default 10000ms.
+     */
+    enableSsoSilent?: boolean;
     /** The log level of MSAL. Default is LogLevel.Warning. */
     msalLogLevel?: LogLevel;
     /**
@@ -105,14 +116,19 @@ export declare class MsalClient extends BaseOAuthClient<MsalClientConfig, MsalTo
     private get loginScopes();
     private get loginExtraScopesToConsent();
     private get refreshOffsetArgs();
-    private noteUserAuthenticated;
+    private setAccount;
+    private noteAuthComplete;
+    private authRequestCore;
 }
+type AuthMethod = 'acquireSilent' | 'ssoSilent' | 'loginPopup' | 'loginRedirect';
 /**
  * Telemetry produced by this client (if enabled) + included in {@link ClientHealthService}
  * reporting. Leverages MSAL's opt-in support for emitting performance events.
  * See https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/performance.md
  */
 interface MsalClientTelemetry {
+    /** Method of last authentication for this client. */
+    authMethod: AuthMethod;
     /** Stats across all events */
     summary: {
         successCount: number;

package/build/types/utils/js/LogUtils.d.ts

@@ -44,11 +44,11 @@ export interface APIWarnOptions {
 export declare function getLogLevel(): LogLevel;
 /**
  * Set the minimum severity for Hoist log utils until the page is refreshed. Optionally persist
- * this adjustment to sessionStorage to maintain for the lifetime of the browser tab.
+ * this adjustment to localStorage for up to 24 hours.
  *
  * @internal - use public `XH.setLogLevel()`.
  */
-export declare function setLogLevel(level: LogLevel, persistInSessionStorage?: boolean): void;
+export declare function setLogLevel(level: LogLevel, persistMins?: number): void;
 /**
  * Time and log execution of a function to `console.info()`.
  *

package/cmp/grid/GridModel.ts

@@ -751,19 +751,22 @@ export class GridModel extends HoistModel {
 
     /**
      * Select records in the grid.
-     *
      * @param records - one or more record(s) / ID(s) to select.
-     * @param options - additional options containing the following keys:
-     *      ensureVisible - true to make selection visible if it is within a
-     *          collapsed node or outside of the visible scroll window. Default true.
-     *      clearSelection - true to clear previous selection (rather than
-     *          add to it). Default true.
+     * @param opts - additional post-selection options
      */
     async selectAsync(
         records: Some<StoreRecordOrId>,
-        opts?: {ensureVisible?: boolean; clearSelection?: boolean}
+        opts: {
+            /**
+             * True (default) to scroll the grid or expand nodes as needed to make selection
+             * visible if it is within a collapsed node or outside of the visible scroll window.
+             */
+            ensureVisible?: boolean;
+            /** True (default) to clear previous selection (rather than add to it). */
+            clearSelection?: boolean;
+        } = {}
     ) {
-        const {ensureVisible = true, clearSelection = true} = opts ?? {};
+        const {ensureVisible = true, clearSelection = true} = opts;
         this.selModel.select(records, clearSelection);
         if (ensureVisible) await this.ensureSelectionVisibleAsync();
     }
@@ -771,19 +774,25 @@ export class GridModel extends HoistModel {
     /**
      * Select the first row in the grid.
      *
-     * See {@link preSelectFirstAsync} for a useful variant of this method.  preSelectFirstAsync()
-     * will not change the selection if there is already a selection, which is what applications
-     * typically want to do when loading/reloading a grid.
-     *
-     * @param opts -
-     *      expandParentGroups - set to true to expand nodes to allow selection when the
-     *          first selectable node is in a collapsed group. Default true.
-     *      ensureVisible - set to to true to scroll to the selected row if it is outside of the
-     *      visible scroll window. Default true.
-     *
+     * See {@link preSelectFirstAsync} for a useful variant of this method that will leave the
+     * any pre-existing selection unchanged, which is what apps typically want when reloading an
+     * already-populated grid.
      */
-    async selectFirstAsync(opts?: {expandParentGroups?: boolean; ensureVisible?: boolean}) {
-        const {expandParentGroups = true, ensureVisible = true} = opts ?? {};
+    async selectFirstAsync(
+        opts: {
+            /**
+             * True (default) to expand nodes as needed to allow selection when the first selectable
+             * node is in a collapsed group.
+             */
+            expandParentGroups?: boolean;
+            /**
+             * True (default) to scroll the grid or expand nodes as needed to make selection
+             * visible if it is outside of the visible scroll window.
+             */
+            ensureVisible?: boolean;
+        } = {}
+    ) {
+        const {expandParentGroups = true, ensureVisible = true} = opts;
         await this.whenReadyAsync();
         if (!this.isReady) return;
 
@@ -803,7 +812,6 @@ export class GridModel extends HoistModel {
 
     /**
      * Select the first row in the grid, if no other selection present.
-     *
      * This method delegates to {@link selectFirstAsync}.
      */
     async preSelectFirstAsync() {

package/core/XH.ts

@@ -371,12 +371,12 @@ export class XHApi {
 
     /**
      * Set the minimum severity for Hoist log utils until the page is refreshed. Optionally persist
-     * this adjustment to sessionStorage to maintain for the lifetime of the browser tab.
+     * this adjustment for up to 1440 minutes in local storage.
      *
      * Hint: call this method from the console to adjust your app's log level while troubleshooting.
      */
-    setLogLevel(level: LogLevel, persistInSessionStorage: boolean = false) {
-        setLogLevel(level, persistInSessionStorage);
+    setLogLevel(level: LogLevel, persistMins: number = -1) {
+        setLogLevel(level, persistMins);
     }
 
     //----------------------

package/data/Store.ts

@@ -763,7 +763,10 @@ export class Store extends HoistBase {
     /** True if the store has changes which need to be committed. */
     @computed
     get isDirty(): boolean {
-        return this._current !== this._committed || this.summaryRecords?.some(it => it.isModified);
+        return (
+            this._current !== this._committed ||
+            (this.summaryRecords?.some(it => it.isModified) ?? false)
+        );
     }
 
     /** Alias for {@link Store.isDirty} */

package/kit/highcharts/index.ts

@@ -27,8 +27,8 @@ export function installHighcharts(HighchartsImpl) {
     }
 
     HighchartsImpl.setOptions({
-        global: {
-            useUTC: false
+        time: {
+            timezone: undefined
         },
         lang: {
             thousandsSep: ','

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xh/hoist",
-  "version": "78.0.0",
+  "version": "78.1.1",
   "description": "Hoist add-on for building and deploying React Applications.",
   "repository": "github:xh/hoist-react",
   "homepage": "https://xh.io",
@@ -28,8 +28,8 @@
     ]
   },
   "dependencies": {
-    "@auth0/auth0-spa-js": "~2.7.0",
-    "@azure/msal-browser": "~4.25.0",
+    "@auth0/auth0-spa-js": "~2.9.1",
+    "@azure/msal-browser": "~4.26.2",
     "@blueprintjs/core": "^5.10.5",
     "@blueprintjs/datetime": "^5.3.7",
     "@blueprintjs/datetime2": "^2.3.7",

package/security/BaseOAuthClient.ts

@@ -180,8 +180,8 @@ export abstract class BaseOAuthClient<
      * Request a full logout from the underlying OAuth provider.
      */
     async logoutAsync(): Promise<void> {
-        await this.doLogoutAsync();
         this.setSelectedUsername(null);
+        await this.doLogoutAsync();
     }
 
     /**