mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-19 21:00:40 +08:00
Other minor redirect URL changes:
- app.urls.* is now deprecated
- redirectToSignOut now sets and preserves after_auth_return_to
- OAuth sign-in after_auth_return_to now carries callback-return context
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **High Risk**
> High risk because it changes OAuth authorization/token issuance,
redirect URL validation, and introduces a new cross-domain handoff
endpoint plus a DB migration linking authorization codes to refresh
tokens, which can affect login/session security and reliability.
>
> **Overview**
> Adds **hosted URL targets** for SDK `urls` resolution (new `{ type:
"hosted" }`/`{ type: "handler-component" }`/`{ type: "custom" }`
options), including env-driven hosted handler domain/template support
and fallback routing for unknown `/handler/*` paths.
>
> Implements a **cross-domain OAuth PKCE handoff**: a new
`/auth/oauth/cross-domain/authorize` endpoint issues one-time
authorization-code redirects bound to the caller’s session refresh
token; authorization codes now persist `grantedRefreshTokenId` and token
issuance reuses/validates ownership of that refresh token. Redirect
planning for `redirectTo*` (and OAuth callback handling) is refactored
into `redirect-page-urls.ts` to preserve `after_auth_return_to` and
cross-domain handoff params.
>
> Tightens redirect safety (e.g., `after_callback_redirect_url` is
validated/whitelisted), centralizes SDK env var reads via `envVars` with
lint enforcement, hardens `EventTracker` startup for partial DOM test
environments, and adds unit/E2E coverage plus a demo page for manual
cross-domain verification.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9197d4f32b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Cross-domain OAuth PKCE handoff flow (client + server) for hosted
sign-in.
* Hosted handler URL templating with local development domain suffix
support.
* Demo UI page to exercise hosted cross-domain sign-in/out and OAuth
flows.
* Authorization codes now preserve an associated refresh-token id to
support cross-domain exchanges.
* **Bug Fixes**
* Stricter redirect-URL validation and stronger refresh-token ownership
checks.
* More robust event-tracker startup guards in partial DOM environments.
* **Tests**
* New E2E and unit tests covering cross-domain authorize, callback
validation, and handoff flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
39 lines
1.0 KiB
TypeScript
39 lines
1.0 KiB
TypeScript
'use client';
|
|
|
|
import { createSupabaseClient } from "@/utils/supabase-client";
|
|
import { useStackApp, useUser } from "@stackframe/stack";
|
|
import { useEffect, useState } from "react";
|
|
|
|
export default function Page() {
|
|
const app = useStackApp();
|
|
const user = useUser();
|
|
const supabase = createSupabaseClient();
|
|
const [data, setData] = useState<null | any[]>(null);
|
|
|
|
useEffect(() => {
|
|
supabase.from("data").select().then(({ data }) => setData(data ?? []));
|
|
}, []);
|
|
|
|
const listContent = data === null ?
|
|
<p>Loading...</p> :
|
|
data.length === 0 ?
|
|
<p>No notes found</p> :
|
|
data.map((note) => <li key={note.id}>{note.text}</li>);
|
|
|
|
return (
|
|
<div>
|
|
{
|
|
user ?
|
|
<>
|
|
<p>You are signed in</p>
|
|
<p>User ID: {user.id}</p>
|
|
<button onClick={async () => await app.redirectToSignOut()}>Sign Out</button>
|
|
</> :
|
|
<button onClick={async () => await app.redirectToSignIn()}>Sign In</button>
|
|
}
|
|
<h3>Supabase data</h3>
|
|
<ul>{listContent}</ul>
|
|
</div>
|
|
)
|
|
}
|