sanity 6.6.0-next.35 → 6.6.0-next.37

package/lib/_chunks-dts/ActiveWorkspaceMatcherContext.d.ts

@@ -629,6 +629,26 @@ interface AuthStoreOptions extends AuthConfig {
    * @internal
    */
   consumeHashToken: () => string | undefined;
+  /**
+   * Observes the session token issued by the embedding workbench "OS", if the
+   * Studio is running as a federated remote inside it. While it yields a token,
+   * that token is authoritative: it takes precedence over `loginMethod` and
+   * every other mechanism, is used in-memory only (never persisted), and the
+   * auth state tracks it over time — so an OS sign-out (`null`) transitions the
+   * Studio to unauthenticated. Returns `undefined` outside the workbench, in
+   * which case the normal auth flow runs. Defaults to a no-op.
+   * @internal
+   */
+  observeWorkbenchToken?: () => Observable<string | null> | undefined;
+  /**
+   * Asks the workbench "OS" to reissue its session token, called when the
+   * current one is rejected (a 401 surfaced as forced logout). In the workbench
+   * this replaces tearing down the session locally, since the OS owns it — the
+   * reissued token flows back through `observeWorkbenchToken`. Defaults to a
+   * no-op.
+   * @internal
+   */
+  refreshWorkbenchToken?: () => void;
 }
 /**
  * Lets the auth store's `/users/me` probe diagnose and report the failures the
@@ -662,16 +682,19 @@ declare function _createAuthStore({
   loginMethod,
   getSessionId,
   consumeHashToken,
+  observeWorkbenchToken,
+  refreshWorkbenchToken,
   getRequestErrorHandler,
   getRequestFailureDiagnostics,
   ...providerOptions
 }: AuthStoreOptions): AuthStore;
 /**
- * Public options for `createAuthStore`. The `getSessionId` and `consumeHashToken`
- * dependencies are wired automatically using the default implementations.
+ * Public options for `createAuthStore`. The `getSessionId`, `consumeHashToken`,
+ * `observeWorkbenchToken` and `refreshWorkbenchToken` dependencies are wired
+ * automatically using the default implementations.
  * @internal
  */
-type CreateAuthStoreOptions = Omit<AuthStoreOptions, 'getSessionId' | 'consumeHashToken'>;
+type CreateAuthStoreOptions = Omit<AuthStoreOptions, 'getSessionId' | 'consumeHashToken' | 'observeWorkbenchToken' | 'refreshWorkbenchToken'>;
 /**
  * @internal
  */

package/lib/_chunks-es/index2.js

@@ -5604,6 +5604,26 @@ function isAuthStore(maybeStore) {
 function isCookielessCompatibleLoginMethod(loginMethod) {
   return ["dual", "token"].includes(loginMethod);
 }
+const OS_BUS_KEY = /* @__PURE__ */ Symbol.for("sanity.os.bus");
+function isWorkbenchEnvironment() {
+  return typeof globalThis == "object" && OS_BUS_KEY in globalThis;
+}
+function observeWorkbenchToken() {
+  if (isWorkbenchEnvironment())
+    return from(import("@sanity/workbench")).pipe(
+      switchMap(({
+        os
+      }) => os.subscribe("auth.token")),
+      // Any failure (importing the host bundle, or the subscription) means "no OS token".
+      catchError(() => of(null))
+    );
+}
+function refreshWorkbenchToken() {
+  isWorkbenchEnvironment() && import("@sanity/workbench").then(({
+    os
+  }) => os.emit("auth.token.refresh", void 0), () => {
+  });
+}
 const getCurrentUser = async (client, tag, getRequestErrorHandler, diagnostics) => {
   const probeClient = typeof client.withConfig == "function" ? client.withConfig({
     _requestHandler: void 0
@@ -5671,6 +5691,10 @@ function _createAuthStore({
   loginMethod = "dual",
   getSessionId: getSessionId2,
   consumeHashToken: consumeHashToken2,
+  observeWorkbenchToken: observeWorkbenchToken2 = () => {
+  },
+  refreshWorkbenchToken: refreshWorkbenchToken2 = () => {
+  },
   getRequestErrorHandler,
   getRequestFailureDiagnostics,
   ...providerOptions
@@ -5757,7 +5781,7 @@ function _createAuthStore({
     refCount: !0
   })), cookieAuthChanged$ = cookieAuthState.value.pipe(filter((v) => v?.authenticated !== "pending"), distinctUntilChanged(isEqual$1)), cookieWorkspaceClient$ = cookieAuthChanged$.pipe(map(({
     authenticated
-  }) => authenticated ? cookieClient : void 0)), workspaceClient$ = (loginMethod === "dual" ? dualClient$ : loginMethod === "cookie" ? cookieWorkspaceClient$ : tokenClient$).pipe(distinctUntilChanged()), dualCookieRecheck$ = loginMethod === "dual" ? cookieAuthChanged$.pipe(skip$1(1), switchMap(() => dualClient$)) : EMPTY$5, initialToken = currentTokenState?.token ?? null, dualTokenRecheck$ = loginMethod === "dual" ? tokenStorage.value.pipe(map((state) => state?.token ?? null), distinctUntilChanged(), filter((token) => typeof token == "string" && token !== initialToken), switchMap(() => dualClient$)) : EMPTY$5, authState$ = concat(initial$, merge(workspaceClient$.pipe(skip$1(1)), dualCookieRecheck$, dualTokenRecheck$).pipe(mergeMap(async (client) => {
+  }) => authenticated ? cookieClient : void 0)), workspaceClient$ = (loginMethod === "dual" ? dualClient$ : loginMethod === "cookie" ? cookieWorkspaceClient$ : tokenClient$).pipe(distinctUntilChanged()), dualCookieRecheck$ = loginMethod === "dual" ? cookieAuthChanged$.pipe(skip$1(1), switchMap(() => dualClient$)) : EMPTY$5, initialToken = currentTokenState?.token ?? null, dualTokenRecheck$ = loginMethod === "dual" ? tokenStorage.value.pipe(map((state) => state?.token ?? null), distinctUntilChanged(), filter((token) => typeof token == "string" && token !== initialToken), switchMap(() => dualClient$)) : EMPTY$5, existingAuthState$ = concat(initial$, merge(workspaceClient$.pipe(skip$1(1)), dualCookieRecheck$, dualTokenRecheck$).pipe(mergeMap(async (client) => {
     if (!client)
       return {
         client: cookieClient,
@@ -5770,7 +5794,30 @@ function _createAuthStore({
       authenticated: !!currentUser?.id,
       currentUser: currentUser || null
     };
-  }))).pipe(
+  }))), workbenchToken$ = observeWorkbenchToken2()?.pipe(shareReplay({
+    bufferSize: 1,
+    refCount: !0
+  })), authState$ = (workbenchToken$ ? workbenchToken$.pipe(switchMap((workbenchToken) => {
+    if (!workbenchToken)
+      return of({
+        client: cookieClient,
+        authenticated: !1,
+        currentUser: null
+      });
+    const client = clientFactory({
+      ...AUTH_CLIENT_OPTIONS,
+      ...hostOptions,
+      projectId,
+      dataset,
+      token: workbenchToken,
+      ignoreBrowserTokenWarning: !0
+    });
+    return from(getCurrentUser(client, "initial", getRequestErrorHandler, getRequestFailureDiagnostics?.())).pipe(map((currentUser) => ({
+      client,
+      authenticated: !!currentUser?.id,
+      currentUser: currentUser || null
+    })));
+  })) : existingAuthState$).pipe(
     // Cookie state is broadcast to other tabs (and sibling workspaces for the
     // same project in this page) only on meaningful events: post-login probe
     // in handleCallbackUrl, and logout. Broadcasting on every authState$
@@ -5886,6 +5933,10 @@ function _createAuthStore({
   }
   let _didLogOut = !1;
   async function logout() {
+    if (workbenchToken$) {
+      refreshWorkbenchToken2();
+      return;
+    }
     _didLogOut = !0;
     const tokenClient = await firstValueFrom(tokenClient$), stripMiddleware = (c2) => typeof c2.withConfig == "function" ? c2.withConfig({
       _requestHandler: void 0
@@ -5910,7 +5961,7 @@ function _createAuthStore({
   return {
     handleCallbackUrl,
     state: authState$,
-    token: tokenStorage.value.pipe(map((t) => t?.token || null)),
+    token: workbenchToken$ ?? tokenStorage.value.pipe(map((t) => t?.token || null)),
     LoginComponent,
     logout
   };
@@ -5919,7 +5970,9 @@ const createAuthStore = memoize$1(
   (options) => _createAuthStore({
     ...options,
     getSessionId: getHashSessionId,
-    consumeHashToken
+    consumeHashToken,
+    observeWorkbenchToken,
+    refreshWorkbenchToken
   }),
   // `getRequestErrorHandler` / `getRequestFailureDiagnostics` are functions
   // (not hashable, and not part of the store's identity — they just look up UI
@@ -81381,6 +81434,18 @@ const INITIAL_STATE$1 = {
   error: null,
   loading: !0
 };
+async function hasPermissionFromAnyGrant(userId, grants, permission, documentValue) {
+  return documentValue ? (await Promise.all(grants.map(async (grant) => {
+    try {
+      const {
+        granted
+      } = await grantsPermissionOn(userId, [grant], permission, documentValue);
+      return granted;
+    } catch {
+      return !1;
+    }
+  }))).some(Boolean) : !0;
+}
 function useUserListWithPermissions(opts) {
   const $ = c(21), {
     documentValue,
@@ -81408,9 +81473,7 @@ function useUserListWithPermissions(opts) {
     let t42;
     $[15] !== documentValue || $[16] !== permission ? (t42 = async (t52) => {
       const [users_0, groups] = t52, grantPromises = users_0?.map(async (user_0) => {
-        const flattenedGrants = [...groups.map((group2) => group2.members?.includes(user_0.id) ? group2.grants : [])].flat(), {
-          granted
-        } = await grantsPermissionOn(user_0.id, flattenedGrants, permission, documentValue);
+        const flattenedGrants = [...groups.map((group2) => group2.members?.includes(user_0.id) ? group2.grants : [])].flat(), granted = await hasPermissionFromAnyGrant(user_0.id, flattenedGrants, permission, documentValue);
         return {
           ...user_0,
           granted