zitejs 0.9.89 → 0.9.91

package/README.md

@@ -11,6 +11,7 @@ const contacts = await zite.contacts.findAll();
 
 // Query and update Zite auth users from backend endpoints
 const { records: users } = await zite.auth.findAllUsers({
+  appIds: ['app-1'],
   filters: { email: 'person@example.com' },
 });
 await zite.auth.updateUserProfile(users[0].id, {

package/dist/cjs/auth/index.d.ts

@@ -209,6 +209,12 @@ export declare const signUp: {
 };
 export declare function loginWithRedirect(opts?: {
     redirectUrl?: string;
+    /**
+     * @deprecated Ignored. There is one sign-in screen now — the server works out
+     * from the email whether it's a sign-in or a sign-up. Still accepted, because
+     * app source written before that change would otherwise stop typechecking on
+     * its next build, and a typecheck error fails the build outright.
+     */
     initialView?: 'login' | 'signup';
 }): void;
 export declare function logout(opts?: {

package/dist/cjs/auth/index.js

@@ -33,13 +33,18 @@ exports.signUp = authClient.signUp;
 function loginWithRedirect(opts) {
     if (window.location.pathname.startsWith('/auth/'))
         return;
-    const params = new URLSearchParams();
-    if (opts?.redirectUrl)
-        params.set('redirectUrl', opts.redirectUrl);
-    if (opts?.initialView)
-        params.set('view', opts.initialView);
-    const query = params.toString();
-    window.location.href = '/auth/login' + (query ? '?' + query : '');
+    // Default to wherever the user already is, so a deep link survives the round
+    // trip through login without every app having to remember to pass it. Pass
+    // `redirectUrl` only to send them somewhere else instead.
+    //
+    // Resolved to an absolute URL either way, on purpose: better-auth
+    // character-checks a *relative* callbackURL — an encoded space, a fragment or
+    // any non-ASCII in the path fails its regex and the destination is dropped —
+    // but never inspects the path of an absolute one. Normalising here means a
+    // caller can pass whichever form reads best without having to know that.
+    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
+    window.location.href =
+        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
 }
 function logout(opts) {
     (0, exports.signOut)().then(() => {

package/dist/cjs/auth/index.test.js

@@ -35,6 +35,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const authExports = __importStar(require("./index.js"));
+/**
+ * `loginWithRedirect` navigates the browser; the test env is node, so stand up
+ * the only two bits of `window` it touches. Assigning `href` on a plain object
+ * is enough — all we care about is where it tried to go.
+ */
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vitest_1.vi.stubGlobal('window', { location });
+    return location;
+}
+/** What the receiving end (`/auth/login`) will actually read back out. */
+function redirectParamOf(href) {
+    return new URLSearchParams(href.split('?')[1] ?? '').get('redirectUrl');
+}
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.unstubAllGlobals();
+});
 (0, vitest_1.describe)('zitejs/auth exports', () => {
     (0, vitest_1.it)('exports loginWithRedirect as a function', () => {
         (0, vitest_1.expect)(typeof authExports.loginWithRedirect).toBe('function');
@@ -65,3 +82,51 @@ const authExports = __importStar(require("./index.js"));
         (0, vitest_1.expect)(typeof authExports.updateProfile).toBe('function');
     });
 });
+(0, vitest_1.describe)('loginWithRedirect', () => {
+    (0, vitest_1.it)('captures the current URL when called with no arguments', () => {
+        const location = stubLocation('https://app.zite.so/orders/123?tab=open');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href.startsWith('/auth/login?')).toBe(true);
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/orders/123?tab=open');
+    });
+    (0, vitest_1.it)('round-trips a path better-auth would reject in relative form', () => {
+        // Encoded spaces and fragments fail better-auth's relative-callbackURL
+        // regex. Sending the absolute URL sidesteps that check entirely, so the
+        // deep link survives instead of 403ing at verify time.
+        const href = 'https://app.zite.so/items/hello%20world#row-3';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe(href);
+    });
+    (0, vitest_1.it)('lets an explicit redirectUrl override the current URL', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({
+            redirectUrl: 'https://app.zite.so/dashboard',
+        });
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    (0, vitest_1.it)('resolves a relative override against the current origin', () => {
+        // Callers shouldn't have to know that better-auth treats relative and
+        // absolute callbackURLs differently — whichever form reads best in app code
+        // leaves here absolute.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/dashboard' });
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    (0, vitest_1.it)('is a no-op on the auth page, so it cannot capture itself', () => {
+        const href = 'https://app.zite.so/auth/login?redirectUrl=%2Forders';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href).toBe(href);
+    });
+    (0, vitest_1.it)('accepts the deprecated initialView without emitting it', () => {
+        // App source predating the one-door sign-in still passes this. Dropping it
+        // from the type would fail those apps' next typecheck, and a typecheck error
+        // fails the build — so it stays accepted, and stays ignored.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ initialView: 'signup' });
+        const params = new URLSearchParams(location.href.split('?')[1] ?? '');
+        (0, vitest_1.expect)(params.get('view')).toBeNull();
+        (0, vitest_1.expect)(params.get('redirectUrl')).toBe('https://app.zite.so/pricing');
+    });
+});

package/dist/cjs/runtime/index.d.ts

@@ -65,7 +65,10 @@ export interface AuthUser {
     lastName: string | null;
     image: string | null;
 }
-export type FindAllAuthUsersOptions = Omit<TableFindAllOptions, "fields">;
+export type FindAllAuthUsersOptions = Omit<TableFindAllOptions, "fields"> & {
+    /** Restrict results to users belonging to any of these apps. */
+    appIds?: string[];
+};
 export type FindAllAuthUsersResult<T extends AuthUser = AuthUser> = {
     records: T[];
     total: number;

package/dist/cjs/sync/lib.js

@@ -330,8 +330,9 @@ function generateDbTs(schema) {
     lines.push("//   .bulkCreate({ records, matchOn? }) → { success: boolean, records: T[] }");
     lines.push("//");
     lines.push("// Zite auth users:");
-    lines.push("//   zite.auth.findAllUsers({ filter?, filters?, sort?, limit?, offset? })");
+    lines.push("//   zite.auth.findAllUsers({ appIds?, filter?, filters?, sort?, limit?, offset? })");
     lines.push("//     Supports the same filter, sort, and pagination options as table .findAll()");
+    lines.push("//     appIds restricts results to users belonging to any listed app");
     lines.push("//   zite.auth.updateUserProfile(userId, { firstName?, lastName?, image? })");
     lines.push("//   User email addresses cannot be updated through this API");
     lines.push("//");

package/dist/esm/auth/index.d.ts

@@ -209,6 +209,12 @@ export declare const signUp: {
 };
 export declare function loginWithRedirect(opts?: {
     redirectUrl?: string;
+    /**
+     * @deprecated Ignored. There is one sign-in screen now — the server works out
+     * from the email whether it's a sign-in or a sign-up. Still accepted, because
+     * app source written before that change would otherwise stop typechecking on
+     * its next build, and a typecheck error fails the build outright.
+     */
     initialView?: 'login' | 'signup';
 }): void;
 export declare function logout(opts?: {

package/dist/esm/auth/index.js

@@ -26,13 +26,18 @@ export const signUp = authClient.signUp;
 export function loginWithRedirect(opts) {
     if (window.location.pathname.startsWith('/auth/'))
         return;
-    const params = new URLSearchParams();
-    if (opts?.redirectUrl)
-        params.set('redirectUrl', opts.redirectUrl);
-    if (opts?.initialView)
-        params.set('view', opts.initialView);
-    const query = params.toString();
-    window.location.href = '/auth/login' + (query ? '?' + query : '');
+    // Default to wherever the user already is, so a deep link survives the round
+    // trip through login without every app having to remember to pass it. Pass
+    // `redirectUrl` only to send them somewhere else instead.
+    //
+    // Resolved to an absolute URL either way, on purpose: better-auth
+    // character-checks a *relative* callbackURL — an encoded space, a fragment or
+    // any non-ASCII in the path fails its regex and the destination is dropped —
+    // but never inspects the path of an absolute one. Normalising here means a
+    // caller can pass whichever form reads best without having to know that.
+    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
+    window.location.href =
+        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
 }
 export function logout(opts) {
     signOut().then(() => {

package/dist/esm/auth/index.test.js

@@ -1,5 +1,22 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import * as authExports from './index.js';
+/**
+ * `loginWithRedirect` navigates the browser; the test env is node, so stand up
+ * the only two bits of `window` it touches. Assigning `href` on a plain object
+ * is enough — all we care about is where it tried to go.
+ */
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vi.stubGlobal('window', { location });
+    return location;
+}
+/** What the receiving end (`/auth/login`) will actually read back out. */
+function redirectParamOf(href) {
+    return new URLSearchParams(href.split('?')[1] ?? '').get('redirectUrl');
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
 describe('zitejs/auth exports', () => {
     it('exports loginWithRedirect as a function', () => {
         expect(typeof authExports.loginWithRedirect).toBe('function');
@@ -30,3 +47,51 @@ describe('zitejs/auth exports', () => {
         expect(typeof authExports.updateProfile).toBe('function');
     });
 });
+describe('loginWithRedirect', () => {
+    it('captures the current URL when called with no arguments', () => {
+        const location = stubLocation('https://app.zite.so/orders/123?tab=open');
+        authExports.loginWithRedirect();
+        expect(location.href.startsWith('/auth/login?')).toBe(true);
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/orders/123?tab=open');
+    });
+    it('round-trips a path better-auth would reject in relative form', () => {
+        // Encoded spaces and fragments fail better-auth's relative-callbackURL
+        // regex. Sending the absolute URL sidesteps that check entirely, so the
+        // deep link survives instead of 403ing at verify time.
+        const href = 'https://app.zite.so/items/hello%20world#row-3';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        expect(redirectParamOf(location.href)).toBe(href);
+    });
+    it('lets an explicit redirectUrl override the current URL', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({
+            redirectUrl: 'https://app.zite.so/dashboard',
+        });
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    it('resolves a relative override against the current origin', () => {
+        // Callers shouldn't have to know that better-auth treats relative and
+        // absolute callbackURLs differently — whichever form reads best in app code
+        // leaves here absolute.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/dashboard' });
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    it('is a no-op on the auth page, so it cannot capture itself', () => {
+        const href = 'https://app.zite.so/auth/login?redirectUrl=%2Forders';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        expect(location.href).toBe(href);
+    });
+    it('accepts the deprecated initialView without emitting it', () => {
+        // App source predating the one-door sign-in still passes this. Dropping it
+        // from the type would fail those apps' next typecheck, and a typecheck error
+        // fails the build — so it stays accepted, and stays ignored.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ initialView: 'signup' });
+        const params = new URLSearchParams(location.href.split('?')[1] ?? '');
+        expect(params.get('view')).toBeNull();
+        expect(params.get('redirectUrl')).toBe('https://app.zite.so/pricing');
+    });
+});

package/dist/esm/runtime/index.d.ts

@@ -65,7 +65,10 @@ export interface AuthUser {
     lastName: string | null;
     image: string | null;
 }
-export type FindAllAuthUsersOptions = Omit<TableFindAllOptions, "fields">;
+export type FindAllAuthUsersOptions = Omit<TableFindAllOptions, "fields"> & {
+    /** Restrict results to users belonging to any of these apps. */
+    appIds?: string[];
+};
 export type FindAllAuthUsersResult<T extends AuthUser = AuthUser> = {
     records: T[];
     total: number;

package/dist/esm/sync/lib.js

@@ -320,8 +320,9 @@ export function generateDbTs(schema) {
     lines.push("//   .bulkCreate({ records, matchOn? }) → { success: boolean, records: T[] }");
     lines.push("//");
     lines.push("// Zite auth users:");
-    lines.push("//   zite.auth.findAllUsers({ filter?, filters?, sort?, limit?, offset? })");
+    lines.push("//   zite.auth.findAllUsers({ appIds?, filter?, filters?, sort?, limit?, offset? })");
     lines.push("//     Supports the same filter, sort, and pagination options as table .findAll()");
+    lines.push("//     appIds restricts results to users belonging to any listed app");
     lines.push("//   zite.auth.updateUserProfile(userId, { firstName?, lastName?, image? })");
     lines.push("//   User email addresses cannot be updated through this API");
     lines.push("//");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.89",
+  "version": "0.9.91",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",

package/dist/cjs/meta/index.d.ts

@@ -1,14 +0,0 @@
-export type ZiteProjectUser = {
-    uuid: string;
-    firstName: string | null;
-    lastName: string | null;
-    email: string;
-    profilePictureUrl: string | null;
-};
-export type MetaListUsersResult = {
-    users: ZiteProjectUser[];
-};
-export declare class ZiteMeta {
-    static listUsers(): Promise<MetaListUsersResult>;
-}
-export declare const Meta: typeof ZiteMeta;

package/dist/cjs/meta/index.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Meta = exports.ZiteMeta = void 0;
-const sdkCall_js_1 = require("../internal/sdkCall.js");
-const META_SDK_INTEGRATION_ID = '__meta__';
-class ZiteMeta {
-    static listUsers() {
-        return (0, sdkCall_js_1.getSdkCall)()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
-    }
-}
-exports.ZiteMeta = ZiteMeta;
-exports.Meta = ZiteMeta;

package/dist/esm/meta/index.d.ts

@@ -1,14 +0,0 @@
-export type ZiteProjectUser = {
-    uuid: string;
-    firstName: string | null;
-    lastName: string | null;
-    email: string;
-    profilePictureUrl: string | null;
-};
-export type MetaListUsersResult = {
-    users: ZiteProjectUser[];
-};
-export declare class ZiteMeta {
-    static listUsers(): Promise<MetaListUsersResult>;
-}
-export declare const Meta: typeof ZiteMeta;

package/dist/esm/meta/index.js

@@ -1,8 +0,0 @@
-import { getSdkCall } from '../internal/sdkCall.js';
-const META_SDK_INTEGRATION_ID = '__meta__';
-export class ZiteMeta {
-    static listUsers() {
-        return getSdkCall()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
-    }
-}
-export const Meta = ZiteMeta;