pxt-core 8.6.15 → 8.6.17

package/built/pxt.js

@@ -97950,8 +97950,8 @@ var pxt;
                     callbackState,
                     callbackPathname: window.location.pathname,
                     idp,
+                    persistent
                 };
-                await pxt.storage.shared.setAsync(AUTH_CONTAINER, AUTH_LOGIN_STATE_KEY, loginState);
                 // Redirect to the login endpoint.
                 const loginUrl = pxt.Util.stringifyQueryString('/api/auth/login', {
                     response_type: "token",
@@ -97961,6 +97961,8 @@ var pxt;
                 });
                 const apiResult = await this.apiAsync(loginUrl);
                 if (apiResult.success) {
+                    loginState.authCodeVerifier = apiResult.resp.authCodeVerifier;
+                    await pxt.storage.shared.setAsync(AUTH_CONTAINER, AUTH_LOGIN_STATE_KEY, loginState);
                     pxt.tickEvent('auth.login.start', { 'provider': idp });
                     window.location.href = apiResult.resp.loginUrl;
                 }
@@ -97972,16 +97974,25 @@ var pxt;
              * Sign out the user and clear the auth token cookie.
              */
             async logoutAsync(continuationHash) {
+                if (!hasIdentity()) {
+                    return;
+                }
+                this.clearState();
+                return await AuthClient.staticLogoutAsync(continuationHash);
+            }
+            /**
+             * Sign out the user and clear the auth token cookie.
+             */
+            static async staticLogoutAsync(continuationHash) {
                 if (!hasIdentity()) {
                     return;
                 }
                 pxt.tickEvent('auth.logout');
                 // backend will clear the cookie token and pass back the provider logout endpoint.
-                await this.apiAsync('/api/auth/logout');
+                await AuthClient.staticApiAsync('/api/auth/logout');
                 // Clear csrf token so we can no longer make authenticated requests.
                 await pxt.storage.shared.delAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY);
                 // Update state and UI to reflect logged out state.
-                this.clearState();
                 const hash = continuationHash ? continuationHash.startsWith('#') ? continuationHash : `#${continuationHash}` : "";
                 // Redirect to home screen, or skillmap home screen
                 if (pxt.BrowserUtils.hasWindow()) {
@@ -98279,12 +98290,15 @@ var pxt;
                 pxt.storage.shared.delAsync(AUTH_CONTAINER, AUTH_USER_STATE_KEY)
                     .then(() => this.onStateCleared());
             }
-            /*protected*/ async apiAsync(url, data, method) {
+            /*protected*/ async apiAsync(url, data, method, authToken) {
+                return await AuthClient.staticApiAsync(url, data, method, authToken);
+            }
+            static async staticApiAsync(url, data, method, authToken) {
                 var _a;
                 const headers = {};
-                const csrfToken = await pxt.storage.shared.getAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY);
-                if (csrfToken) {
-                    headers["authorization"] = `mkcd ${csrfToken}`;
+                authToken = authToken || (await pxt.storage.shared.getAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY));
+                if (authToken) {
+                    headers["authorization"] = `mkcd ${authToken}`;
                 }
                 headers[X_PXT_TARGET] = (_a = pxt.appTarget) === null || _a === void 0 ? void 0 : _a.id;
                 url = pxt.BrowserUtils.isLocalHostDev() ? `${pxt.cloud.DEV_BACKEND}${url}` : url;
@@ -98304,7 +98318,7 @@ var pxt;
                 }).catch(async (e) => {
                     if (!/logout/.test(url) && e.statusCode == 401) {
                         // 401/Unauthorized. logout now.
-                        await this.logoutAsync();
+                        await AuthClient.staticLogoutAsync();
                     }
                     return {
                         statusCode: e.statusCode,
@@ -98355,6 +98369,14 @@ var pxt;
                     pxt.debug("Missing authToken in auth callback.");
                     break;
                 }
+                // If this auth request was assigned an auth code, claim it now. This will set
+                // the required auth cookie in this domain (for cross-domain authentication).
+                if (loginState.authCodeVerifier) {
+                    const otacCheckUrl = pxt.Util.stringifyQueryString('/api/otac/check', {
+                        persistent: loginState.persistent,
+                    });
+                    await AuthClient.staticApiAsync(otacCheckUrl, null, null, loginState.authCodeVerifier);
+                }
                 // Store csrf token in local storage. It is ok to do this even when
                 // "Remember me" wasn't selected because this token is not usable
                 // without its cookie-based counterpart. When "Remember me" is false,

package/built/pxtlib.d.ts

@@ -122,6 +122,10 @@ declare namespace pxt.auth {
          * Sign out the user and clear the auth token cookie.
          */
         logoutAsync(continuationHash?: string): Promise<void>;
+        /**
+         * Sign out the user and clear the auth token cookie.
+         */
+        static staticLogoutAsync(continuationHash?: string): Promise<void>;
         deleteProfileAsync(): Promise<void>;
         private initialUserPreferences_;
         initialUserPreferencesAsync(): Promise<UserPreferences | undefined>;
@@ -173,7 +177,8 @@ declare namespace pxt.auth {
          * Direct access to state$ allowed.
          */
         private clearState;
-        apiAsync<T = any>(url: string, data?: any, method?: string): Promise<ApiResult<T>>;
+        apiAsync<T = any>(url: string, data?: any, method?: string, authToken?: string): Promise<ApiResult<T>>;
+        static staticApiAsync<T = any>(url: string, data?: any, method?: string, authToken?: string): Promise<ApiResult<T>>;
     }
     type CallbackState = {
         hash?: string;

package/built/pxtlib.js

@@ -264,8 +264,8 @@ var pxt;
                     callbackState,
                     callbackPathname: window.location.pathname,
                     idp,
+                    persistent
                 };
-                await pxt.storage.shared.setAsync(AUTH_CONTAINER, AUTH_LOGIN_STATE_KEY, loginState);
                 // Redirect to the login endpoint.
                 const loginUrl = pxt.Util.stringifyQueryString('/api/auth/login', {
                     response_type: "token",
@@ -275,6 +275,8 @@ var pxt;
                 });
                 const apiResult = await this.apiAsync(loginUrl);
                 if (apiResult.success) {
+                    loginState.authCodeVerifier = apiResult.resp.authCodeVerifier;
+                    await pxt.storage.shared.setAsync(AUTH_CONTAINER, AUTH_LOGIN_STATE_KEY, loginState);
                     pxt.tickEvent('auth.login.start', { 'provider': idp });
                     window.location.href = apiResult.resp.loginUrl;
                 }
@@ -286,16 +288,25 @@ var pxt;
              * Sign out the user and clear the auth token cookie.
              */
             async logoutAsync(continuationHash) {
+                if (!hasIdentity()) {
+                    return;
+                }
+                this.clearState();
+                return await AuthClient.staticLogoutAsync(continuationHash);
+            }
+            /**
+             * Sign out the user and clear the auth token cookie.
+             */
+            static async staticLogoutAsync(continuationHash) {
                 if (!hasIdentity()) {
                     return;
                 }
                 pxt.tickEvent('auth.logout');
                 // backend will clear the cookie token and pass back the provider logout endpoint.
-                await this.apiAsync('/api/auth/logout');
+                await AuthClient.staticApiAsync('/api/auth/logout');
                 // Clear csrf token so we can no longer make authenticated requests.
                 await pxt.storage.shared.delAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY);
                 // Update state and UI to reflect logged out state.
-                this.clearState();
                 const hash = continuationHash ? continuationHash.startsWith('#') ? continuationHash : `#${continuationHash}` : "";
                 // Redirect to home screen, or skillmap home screen
                 if (pxt.BrowserUtils.hasWindow()) {
@@ -593,12 +604,15 @@ var pxt;
                 pxt.storage.shared.delAsync(AUTH_CONTAINER, AUTH_USER_STATE_KEY)
                     .then(() => this.onStateCleared());
             }
-            /*protected*/ async apiAsync(url, data, method) {
+            /*protected*/ async apiAsync(url, data, method, authToken) {
+                return await AuthClient.staticApiAsync(url, data, method, authToken);
+            }
+            static async staticApiAsync(url, data, method, authToken) {
                 var _a;
                 const headers = {};
-                const csrfToken = await pxt.storage.shared.getAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY);
-                if (csrfToken) {
-                    headers["authorization"] = `mkcd ${csrfToken}`;
+                authToken = authToken || (await pxt.storage.shared.getAsync(AUTH_CONTAINER, CSRF_TOKEN_KEY));
+                if (authToken) {
+                    headers["authorization"] = `mkcd ${authToken}`;
                 }
                 headers[X_PXT_TARGET] = (_a = pxt.appTarget) === null || _a === void 0 ? void 0 : _a.id;
                 url = pxt.BrowserUtils.isLocalHostDev() ? `${pxt.cloud.DEV_BACKEND}${url}` : url;
@@ -618,7 +632,7 @@ var pxt;
                 }).catch(async (e) => {
                     if (!/logout/.test(url) && e.statusCode == 401) {
                         // 401/Unauthorized. logout now.
-                        await this.logoutAsync();
+                        await AuthClient.staticLogoutAsync();
                     }
                     return {
                         statusCode: e.statusCode,
@@ -669,6 +683,14 @@ var pxt;
                     pxt.debug("Missing authToken in auth callback.");
                     break;
                 }
+                // If this auth request was assigned an auth code, claim it now. This will set
+                // the required auth cookie in this domain (for cross-domain authentication).
+                if (loginState.authCodeVerifier) {
+                    const otacCheckUrl = pxt.Util.stringifyQueryString('/api/otac/check', {
+                        persistent: loginState.persistent,
+                    });
+                    await AuthClient.staticApiAsync(otacCheckUrl, null, null, loginState.authCodeVerifier);
+                }
                 // Store csrf token in local storage. It is ok to do this even when
                 // "Remember me" wasn't selected because this token is not usable
                 // without its cookie-based counterpart. When "Remember me" is false,