apps 0.0.1-beta.2 → 0.0.1-beta.4

package/types/apps/src/contracts/ui-auth.d.ts

@@ -1,7 +1,5 @@
 /** Browser authentication protocol. Identity and session storage belong to the host. */
 import { Schema } from "effect";
-import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
-import { UiFailed, UiForbidden, UiUnauthorized } from "./ui.js";
 /** Opaque correlation ID; possession alone does not authorize an app session. */
 export declare const AppSignInId: Schema.brand<Schema.String, "AppSignInId">;
 export type AppSignInId = typeof AppSignInId.Type;
@@ -10,19 +8,13 @@ export declare const AppSignInCode: Schema.RedactedFromValue<Schema.String>;
 /** A path on the current app origin, including its query and fragment; never a redirect to another host or host-owned route. */
 export declare const AppReturnPath: Schema.brand<Schema.String, "AppReturnPath">;
 export type AppReturnPath = typeof AppReturnPath.Type;
-/** The trusted callback exchanges an authorization code bound to a browser attempt. */
+/** Callback query on the app origin. The code is single-use and works only with its attempt's cookie. */
 export declare const AppSignInCallback: Schema.Struct<{
     readonly request: Schema.brand<Schema.String, "AppSignInId">;
     readonly code: Schema.RedactedFromValue<Schema.String>;
 }>;
-/** Host-owned endpoints on every app origin, independent of the product's login mechanism. */
-export declare const AppSignInApi: HttpApi.HttpApi<"app-sign-in", HttpApiGroup.HttpApiGroup<"appSignIn", HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/_executor/auth/start", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly returnTo: Schema.brand<Schema.String, "AppReturnPath">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly url: Schema.String;
-}>>, Schema.toCodecJson<typeof UiForbidden | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"complete", "POST", "/_executor/auth/complete", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly request: Schema.brand<Schema.String, "AppSignInId">;
-    readonly code: Schema.RedactedFromValue<Schema.String>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly returnTo: Schema.brand<Schema.String, "AppReturnPath">;
-}>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiFailed>, never, never>, false>>;
+/** Host-owned callback path on every app origin. */
+export declare const appSignInCallbackPath = "/_executor/auth/callback";
+/** Why the product could not authorize an attempt; the dashboard explains it without retrying. */
+export declare const AppSignInFailure: Schema.Literals<readonly ["ended", "forbidden", "unavailable"]>;
+export type AppSignInFailure = typeof AppSignInFailure.Type;

package/types/apps/src/implementation/ui-auth.d.ts

@@ -1,5 +1,6 @@
-/** Trusted bootstrap documents run before authored UI and never contain product credentials. */
+/** Host responses around app sign-in. They carry no script and never contain product credentials. */
 import { HttpServerResponse } from "effect/unstable/http";
+import { type AppSignInId } from "../contracts/ui-auth.js";
 /** Private app responses must not leak authentication URLs through caches or referrers. */
 export declare const appPrivateHeaders: {
     "cache-control": string;
@@ -7,7 +8,12 @@ export declare const appPrivateHeaders: {
     "x-content-type-options": string;
     "content-security-policy": string;
 };
-/** Serve only a fixed host script while authentication runs; the original URL remains available to that script. */
-export declare const appSignInPage: () => HttpServerResponse.HttpServerResponse;
-/** Preserve deep links, erase callback proofs before any request, and let the host set HttpOnly cookies. */
-export declare const appSignInScript: () => HttpServerResponse.HttpServerResponse;
+/** Every sign-in hop is a server redirect, so the browser paints nothing until the app itself. */
+export declare const appRedirect: (url: string) => HttpServerResponse.HttpServerResponse;
+/**
+ * The callback URL carries the code in its query. It exists only as a redirect `Location`, never as
+ * a rendered document, and redeeming it also requires the attempt's HttpOnly cookie.
+ */
+export declare const appSignInCallback: (origin: string, request: AppSignInId, code: string) => string;
+/** A failed callback explains itself without script; reopening the app URL starts a new attempt. */
+export declare const appSignInFailed: () => HttpServerResponse.HttpServerResponse;

package/types/apps/src/ui-auth.d.ts

@@ -1,3 +1,3 @@
-/** Host-only app authentication protocol and bootstrap; products supply identity and session lifecycle. */
+/** Host-only app authentication protocol; products supply identity and session lifecycle. */
 export * from "./contracts/ui-auth.js";
-export { appPrivateHeaders, appSignInPage, appSignInScript } from "./implementation/ui-auth.js";
+export { appPrivateHeaders, appRedirect, appSignInCallback, appSignInFailed, } from "./implementation/ui-auth.js";

package/js/chunk-TE4KO4HI.js

@@ -1,47 +0,0 @@
-import {
-  HttpServerResponse_exports
-} from "./chunk-QKHR7BMF.js";
-
-// src/implementation/ui-auth.ts
-var appPrivateHeaders = {
-  "cache-control": "no-store",
-  "referrer-policy": "no-referrer",
-  "x-content-type-options": "nosniff",
-  "content-security-policy": "frame-ancestors 'none'"
-};
-var appSignInPage = () => HttpServerResponse_exports.text(
-  `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Opening app</title></head><body><p>Opening app\u2026</p><a href="/" hidden>Try again</a><script src="/_executor/auth/browser.js"></script></body></html>`,
-  {
-    contentType: "text/html",
-    headers: {
-      ...appPrivateHeaders,
-      "content-security-policy": "default-src 'none'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'"
-    }
-  }
-);
-var appSignInScript = () => HttpServerResponse_exports.text(
-  `
-const callback = location.pathname === "/_executor/auth/callback";
-const parameters = new URLSearchParams(location.hash.slice(1));
-const body = callback
-  ? {request: parameters.get("request"), code: parameters.get("code")}
-  : {returnTo: location.pathname + location.search + location.hash};
-if (callback) history.replaceState(null, "", location.pathname);
-fetch(callback ? "/_executor/auth/complete" : "/_executor/auth/start", {
-  method: "POST", headers: {"content-type":"application/json"}, body: JSON.stringify(body)
-}).then(async response => {
-  if (!response.ok) throw new Error();
-  const result = await response.json();
-  location.replace(callback ? result.returnTo : result.url);
-}).catch(() => {
-  document.querySelector("p").textContent = "Could not sign in to this app. Try opening it again.";
-  document.querySelector("a").hidden = false;
-});`,
-  { contentType: "text/javascript", headers: appPrivateHeaders }
-);
-
-export {
-  appPrivateHeaders,
-  appSignInPage,
-  appSignInScript
-};