zitejs 0.9.90 → 0.9.92

package/dist/cjs/auth/index.d.ts

@@ -209,6 +209,12 @@ export declare const signUp: {
 };
 export declare function loginWithRedirect(opts?: {
     redirectUrl?: string;
+    /**
+     * @deprecated Ignored. There is one sign-in screen now — the server works out
+     * from the email whether it's a sign-in or a sign-up. Still accepted, because
+     * app source written before that change would otherwise stop typechecking on
+     * its next build, and a typecheck error fails the build outright.
+     */
     initialView?: 'login' | 'signup';
 }): void;
 export declare function logout(opts?: {

package/dist/cjs/auth/index.js

@@ -33,13 +33,26 @@ exports.signUp = authClient.signUp;
 function loginWithRedirect(opts) {
     if (window.location.pathname.startsWith('/auth/'))
         return;
-    const params = new URLSearchParams();
-    if (opts?.redirectUrl)
-        params.set('redirectUrl', opts.redirectUrl);
-    if (opts?.initialView)
-        params.set('view', opts.initialView);
-    const query = params.toString();
-    window.location.href = '/auth/login' + (query ? '?' + query : '');
+    // Default to wherever the user already is, so a deep link survives the round
+    // trip through login without every app having to remember to pass it. Pass
+    // `redirectUrl` only to send them somewhere else instead.
+    //
+    // Resolved to an absolute URL either way, on purpose: better-auth
+    // character-checks a *relative* callbackURL — an encoded space, a fragment or
+    // any non-ASCII in the path fails its regex and the destination is dropped —
+    // but never inspects the path of an absolute one. Normalising here means a
+    // caller can pass whichever form reads best without having to know that.
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 function logout(opts) {
     (0, exports.signOut)().then(() => {

package/dist/cjs/auth/index.test.js

@@ -35,6 +35,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const authExports = __importStar(require("./index.js"));
+/**
+ * `loginWithRedirect` navigates the browser; the test env is node, so stand up
+ * the only two bits of `window` it touches. Assigning `href` on a plain object
+ * is enough — all we care about is where it tried to go.
+ */
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vitest_1.vi.stubGlobal('window', { location });
+    return location;
+}
+/** What the receiving end (`/auth/login`) will actually read back out. */
+function redirectParamOf(href) {
+    return new URLSearchParams(href.split('?')[1] ?? '').get('redirectUrl');
+}
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.unstubAllGlobals();
+});
 (0, vitest_1.describe)('zitejs/auth exports', () => {
     (0, vitest_1.it)('exports loginWithRedirect as a function', () => {
         (0, vitest_1.expect)(typeof authExports.loginWithRedirect).toBe('function');
@@ -65,3 +82,69 @@ const authExports = __importStar(require("./index.js"));
         (0, vitest_1.expect)(typeof authExports.updateProfile).toBe('function');
     });
 });
+(0, vitest_1.describe)('loginWithRedirect', () => {
+    (0, vitest_1.it)('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
+    (0, vitest_1.it)('captures the current URL when called with no arguments', () => {
+        const location = stubLocation('https://app.zite.so/orders/123?tab=open');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href.startsWith('/auth/login?')).toBe(true);
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/orders/123?tab=open');
+    });
+    (0, vitest_1.it)('round-trips a path better-auth would reject in relative form', () => {
+        // Encoded spaces and fragments fail better-auth's relative-callbackURL
+        // regex. Sending the absolute URL sidesteps that check entirely, so the
+        // deep link survives instead of 403ing at verify time.
+        const href = 'https://app.zite.so/items/hello%20world#row-3';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe(href);
+    });
+    (0, vitest_1.it)('lets an explicit redirectUrl override the current URL', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({
+            redirectUrl: 'https://app.zite.so/dashboard',
+        });
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    (0, vitest_1.it)('resolves a relative override against the current origin', () => {
+        // Callers shouldn't have to know that better-auth treats relative and
+        // absolute callbackURLs differently — whichever form reads best in app code
+        // leaves here absolute.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/dashboard' });
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    (0, vitest_1.it)('is a no-op on the auth page, so it cannot capture itself', () => {
+        const href = 'https://app.zite.so/auth/login?redirectUrl=%2Forders';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href).toBe(href);
+    });
+    (0, vitest_1.it)('accepts the deprecated initialView without emitting it', () => {
+        // App source predating the one-door sign-in still passes this. Dropping it
+        // from the type would fail those apps' next typecheck, and a typecheck error
+        // fails the build — so it stays accepted, and stays ignored.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ initialView: 'signup' });
+        const params = new URLSearchParams(location.href.split('?')[1] ?? '');
+        (0, vitest_1.expect)(params.get('view')).toBeNull();
+        (0, vitest_1.expect)(params.get('redirectUrl')).toBe('https://app.zite.so/pricing');
+    });
+});

package/dist/esm/auth/index.d.ts

@@ -209,6 +209,12 @@ export declare const signUp: {
 };
 export declare function loginWithRedirect(opts?: {
     redirectUrl?: string;
+    /**
+     * @deprecated Ignored. There is one sign-in screen now — the server works out
+     * from the email whether it's a sign-in or a sign-up. Still accepted, because
+     * app source written before that change would otherwise stop typechecking on
+     * its next build, and a typecheck error fails the build outright.
+     */
     initialView?: 'login' | 'signup';
 }): void;
 export declare function logout(opts?: {

package/dist/esm/auth/index.js

@@ -26,13 +26,26 @@ export const signUp = authClient.signUp;
 export function loginWithRedirect(opts) {
     if (window.location.pathname.startsWith('/auth/'))
         return;
-    const params = new URLSearchParams();
-    if (opts?.redirectUrl)
-        params.set('redirectUrl', opts.redirectUrl);
-    if (opts?.initialView)
-        params.set('view', opts.initialView);
-    const query = params.toString();
-    window.location.href = '/auth/login' + (query ? '?' + query : '');
+    // Default to wherever the user already is, so a deep link survives the round
+    // trip through login without every app having to remember to pass it. Pass
+    // `redirectUrl` only to send them somewhere else instead.
+    //
+    // Resolved to an absolute URL either way, on purpose: better-auth
+    // character-checks a *relative* callbackURL — an encoded space, a fragment or
+    // any non-ASCII in the path fails its regex and the destination is dropped —
+    // but never inspects the path of an absolute one. Normalising here means a
+    // caller can pass whichever form reads best without having to know that.
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 export function logout(opts) {
     signOut().then(() => {

package/dist/esm/auth/index.test.js

@@ -1,5 +1,22 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import * as authExports from './index.js';
+/**
+ * `loginWithRedirect` navigates the browser; the test env is node, so stand up
+ * the only two bits of `window` it touches. Assigning `href` on a plain object
+ * is enough — all we care about is where it tried to go.
+ */
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vi.stubGlobal('window', { location });
+    return location;
+}
+/** What the receiving end (`/auth/login`) will actually read back out. */
+function redirectParamOf(href) {
+    return new URLSearchParams(href.split('?')[1] ?? '').get('redirectUrl');
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
 describe('zitejs/auth exports', () => {
     it('exports loginWithRedirect as a function', () => {
         expect(typeof authExports.loginWithRedirect).toBe('function');
@@ -30,3 +47,69 @@ describe('zitejs/auth exports', () => {
         expect(typeof authExports.updateProfile).toBe('function');
     });
 });
+describe('loginWithRedirect', () => {
+    it('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        expect(location.href).toBe('/auth/login');
+    });
+    it('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        expect(location.href).toBe('/auth/login');
+    });
+    it('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
+    it('captures the current URL when called with no arguments', () => {
+        const location = stubLocation('https://app.zite.so/orders/123?tab=open');
+        authExports.loginWithRedirect();
+        expect(location.href.startsWith('/auth/login?')).toBe(true);
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/orders/123?tab=open');
+    });
+    it('round-trips a path better-auth would reject in relative form', () => {
+        // Encoded spaces and fragments fail better-auth's relative-callbackURL
+        // regex. Sending the absolute URL sidesteps that check entirely, so the
+        // deep link survives instead of 403ing at verify time.
+        const href = 'https://app.zite.so/items/hello%20world#row-3';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        expect(redirectParamOf(location.href)).toBe(href);
+    });
+    it('lets an explicit redirectUrl override the current URL', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({
+            redirectUrl: 'https://app.zite.so/dashboard',
+        });
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    it('resolves a relative override against the current origin', () => {
+        // Callers shouldn't have to know that better-auth treats relative and
+        // absolute callbackURLs differently — whichever form reads best in app code
+        // leaves here absolute.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/dashboard' });
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/dashboard');
+    });
+    it('is a no-op on the auth page, so it cannot capture itself', () => {
+        const href = 'https://app.zite.so/auth/login?redirectUrl=%2Forders';
+        const location = stubLocation(href);
+        authExports.loginWithRedirect();
+        expect(location.href).toBe(href);
+    });
+    it('accepts the deprecated initialView without emitting it', () => {
+        // App source predating the one-door sign-in still passes this. Dropping it
+        // from the type would fail those apps' next typecheck, and a typecheck error
+        // fails the build — so it stays accepted, and stays ignored.
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ initialView: 'signup' });
+        const params = new URLSearchParams(location.href.split('?')[1] ?? '');
+        expect(params.get('view')).toBeNull();
+        expect(params.get('redirectUrl')).toBe('https://app.zite.so/pricing');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.90",
+  "version": "0.9.92",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",

package/dist/cjs/meta/index.d.ts

@@ -1,14 +0,0 @@
-export type ZiteProjectUser = {
-    uuid: string;
-    firstName: string | null;
-    lastName: string | null;
-    email: string;
-    profilePictureUrl: string | null;
-};
-export type MetaListUsersResult = {
-    users: ZiteProjectUser[];
-};
-export declare class ZiteMeta {
-    static listUsers(): Promise<MetaListUsersResult>;
-}
-export declare const Meta: typeof ZiteMeta;

package/dist/cjs/meta/index.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Meta = exports.ZiteMeta = void 0;
-const sdkCall_js_1 = require("../internal/sdkCall.js");
-const META_SDK_INTEGRATION_ID = '__meta__';
-class ZiteMeta {
-    static listUsers() {
-        return (0, sdkCall_js_1.getSdkCall)()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
-    }
-}
-exports.ZiteMeta = ZiteMeta;
-exports.Meta = ZiteMeta;

package/dist/esm/meta/index.d.ts

@@ -1,14 +0,0 @@
-export type ZiteProjectUser = {
-    uuid: string;
-    firstName: string | null;
-    lastName: string | null;
-    email: string;
-    profilePictureUrl: string | null;
-};
-export type MetaListUsersResult = {
-    users: ZiteProjectUser[];
-};
-export declare class ZiteMeta {
-    static listUsers(): Promise<MetaListUsersResult>;
-}
-export declare const Meta: typeof ZiteMeta;

package/dist/esm/meta/index.js

@@ -1,8 +0,0 @@
-import { getSdkCall } from '../internal/sdkCall.js';
-const META_SDK_INTEGRATION_ID = '__meta__';
-export class ZiteMeta {
-    static listUsers() {
-        return getSdkCall()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
-    }
-}
-export const Meta = ZiteMeta;