mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-13 21:01:21 +08:00
Some checks failed
all-good: Did all the other checks pass? / all-good (push) Has been cancelled
Ensure Prisma migrations are in sync with the schema / check_prisma_migrations (22.x) (push) Has been cancelled
DB migration compat / Check if migrations changed (push) Has been cancelled
Docker Server Build and Push / Docker Build and Push Server (push) Has been cancelled
Docker Server Build and Run / docker (push) Has been cancelled
Runs E2E API Tests (Local Emulator) / E2E Tests (Local Emulator, Node ${{ matrix.node-version }}) (22.x) (push) Has been cancelled
Runs E2E API Tests / E2E Tests (Node ${{ matrix.node-version }}, Freestyle ${{ matrix.freestyle-mode }}) (mock, 22.x) (push) Has been cancelled
Runs E2E API Tests / E2E Tests (Node ${{ matrix.node-version }}, Freestyle ${{ matrix.freestyle-mode }}) (prod, 22.x) (push) Has been cancelled
Runs E2E API Tests with custom port prefix / build (22.x) (push) Has been cancelled
Runs E2E Fallback Tests / E2E Fallback Tests (Node ${{ matrix.node-version }}) (22.x) (push) Has been cancelled
Lint & build / lint_and_build (24) (push) Has been cancelled
TOC Generator / TOC Generator (push) Has been cancelled
DB migration compat / Back-compat — Current branch migrations with ${{ needs.check-migrations-changed.outputs.base_branch }} branch code (push) Has been cancelled
DB migration compat / Forward-compat — Current branch code with ${{ needs.check-migrations-changed.outputs.base_branch }} branch migrations (push) Has been cancelled
DB migration compat / No migration changes (skipped) (push) Has been cancelled
## Summary
**Stacked on #1468** (`docs/hexclave-rename-plan` — the plan doc). Diff
vs that base = the actual PR 1 code.
This is **PR 1 of the Hexclave rebrand: the invisible compatibility
layer**. Everything is additive. Old SDKs, old wire identifiers, and old
env var names keep working unchanged. The backend dual-accepts and
dual-emits; new SDK code emits `x-hexclave-*` headers and the
`hexclave_` Bearer prefix; cookies dual-write; env vars dual-read across
every category. **No user-visible rebranding lands here** — that's PR 2.
See [`RENAME-TO-HEXCLAVE.md`](./RENAME-TO-HEXCLAVE.md) → *"PR 1
implementation guide"* for the full per-work-area spec, file pointers,
and chosen approach.
## What's implemented (all 14 PR-1 work-areas)
- **SDK export aliases** — `Hexclave*` aliases for the user-facing
`Stack*` exports added in `packages/template`; codegen propagates them
to `@stackframe/{js,stack,react,tanstack-start}`. React-only aliases
correctly excluded from `@stackframe/js`. (`e60550a2`)
- **JWT issuer dual-accept** — `decodeAccessToken` accepts both
`api.stack-auth.com` and `api.hexclave.com` issuers. Signing unchanged.
(`fc781def`)
- **Request-header dual-accept** — backend + dashboard proxies normalize
`x-hexclave-*` → `x-stack-*` at the existing empty proxy hook (so
`smart-request.tsx` and every route schema keep working unchanged); CORS
allowlists extended via a derive-once helper. (`2a056eac`)
- **MCP `ask_hexclave`** — registered alongside `ask_stack_auth` via a
shared helper; `ask_stack_auth` behavior byte-identical. (`30ffd604`)
- **Dev-tool** — DOM ids + header emit switched.
`window.HexclaveDevTool` exposed alongside `window.StackDevTool`.
(`32131ea7`)
- **The big consolidated commit** (`7fed864a`):
- **Env vars** — central `getEnvVariable` prefix-transform (HEXCLAVE
first, STACK fallback); dashboard + template client env files dual-read;
`turbo.json` globalEnv; `NEXT_PUBLIC_STACK_PORT_PREFIX` renamed outright
across ~82 files including docker.
- **Cookies** — dual-write/dual-read auth (`stack-access`/`-refresh-*`
and custom-domain variants), OAuth-state
(`stack-oauth-{inner,outer}-*`), and low-risk cookies (`stack-is-https`,
`stack-last-seen-changelog-version`). Bypass sites patched (backend
OAuth callback, dashboard remote-dev auth route, impersonation snippets,
snapshot serializer).
- **Bearer prefix** — SDK token parser accepts both `stackauth_` and
`hexclave_`; emits `hexclave_`. Discovery correction: this is purely
SDK-internal — the backend never parses it.
- **Response headers** — backend dual-emits
`x-hexclave-{request-id,actual-status,known-error}`; SDKs dual-read (new
first, stack fallback).
- **SDK request-header emit switch** —
`client/server/admin-interface.ts` + dashboard `api-headers.ts` +
`internal-project-headers.ts` + `feedback-form.tsx` switched to
`x-hexclave-*`. Plus `stack_response_mode` query param.
- **Storage keys** — dev-tool / cli-auth / oauth-button / docs keys
renamed (straight); `stack:session-replay:v1` dual-read so in-progress
recordings survive SDK upgrades; `stack_mfa_attempt_code` dual-read.
- **Query params** — cross-domain params dual-emit/dual-accept via
shared helpers; backend `oauth/authorize` accepts
`hexclave_response_mode` and `stack_response_mode`; `stack-init-id`
renamed.
- **`Symbol.for`** — app-internals symbol gets a parallel
`Symbol.for("Hexclave--app-internals")` getter on each attach site (no
read-site churn — old symbol still attached). 3 file-private symbols
renamed outright.
- **Config discovery** — prefer `hexclave.config.ts`, fall back to
`stack.config.ts` at every discovery site (CLI / dashboard / backend /
local-emulator); `init` writes the new filename; CLI credentials path
migrates.
- **Internal renames** — `StackAssertionError`,
`StackClient/Server/AdminInterface` renamed outright (no alias, per the
"internal-only → rename" rule). ~264 files touched.
- **Review-pass fixes** (`21217fbe`) — three real bugs found by parallel
review agents and fixed:
- `snapshot-serializer.ts` was interpolating the whole
`keyedCookieNamePrefixes` array (`${arr}`) — adding a second prefix
would have corrupted **every** OAuth-cookie snapshot, not just new ones.
- **Docker port-prefix producer/consumer mismatch** —
`entrypoint.sh`/`run-emulator.sh`/cloud-init `user-data` were still
producing `NEXT_PUBLIC_STACK_PORT_PREFIX` while the dashboard sentinel +
consumers had been renamed; silent self-host regression (custom port
prefix would be ignored).
- **Missing `hexclave-oauth-inner-*` dual-write** in the OAuth authorize
route — callback's fallback masked it but the dual-write was specified
by the plan.
- Plus: `mcp.test.ts` tool-list assertions updated to include
`ask_hexclave`; two dashboard header-emit sites switched to
`x-hexclave-*` for consistency.
- **E2E snapshot serializer follow-up** (`4b16cc5d`) —
`x-hexclave-request-id` added to the hidden-headers list (mirroring
`x-stack-request-id` treatment), and 2 sample inline snapshots
regenerated in `projects.test.ts` to include the new dual-emitted
headers.
## Verification
- **`pnpm typecheck`** — clean (the fresh-worktree `@/.source` / Prisma
codegen gap in `stack-docs` is pre-existing and unrelated).
- **`pnpm lint`** — 29/29 packages green.
- **`pnpm exec turbo run build --filter=./packages/*`** — 13/13 packages
build (including `@stackframe/stack-cli` once the dashboard standalone
is present).
- **Live E2E** against a running backend on `cl/hexclave-pr1`:
- `pnpm test run
apps/e2e/tests/backend/endpoints/api/v1/internal/mcp.test.ts` — **6/6
pass** (verifies the new `ask_hexclave` tool — the hand-written inline
snapshot matched actual MCP server output).
- `pnpm test run
apps/e2e/tests/backend/endpoints/api/v1/internal/projects.test.ts` —
**11/11 pass** (verifies wire dual-accept + dual-emit end-to-end; the
snapshot serializer fix was found and applied during this check).
A four-agent parallel **review pass** also audited the full diff for
logic/runtime bugs across the work-areas (wire headers + JWT, cookies +
bearer + symbols, env vars, query params + config + MCP + aliases). All
in-slice review verdicts were ✓ except the three bugs listed above,
which are now fixed.
## Known follow-ups (out of scope for this PR)
- **E2E snapshots across the rest of the suite** — backend now
dual-emits `x-hexclave-{known-error,actual-status}` alongside
`x-stack-*`, which legitimately appears in inline snapshots throughout
`apps/e2e`. Two were regenerated here as a sample; the rest should regen
with `vitest -u` in CI.
- **Docker shell env vars beyond `PORT_PREFIX`** — `entrypoint.sh` still
reads `STACK_*` env vars directly (the JS-side `getEnvVariable`
transform doesn't help the shell). JS consumers dual-read so it works in
practice; full shell-level dual-read is a deeper self-host follow-up.
- **`@stackframe/stack-cli` build ordering** — pre-existing; needs
`build:rde-standalone` first. Not affected by this PR.
## Test plan
- [ ] CI runs full e2e suite (with `vitest -u` to absorb dual-emit
snapshot deltas, then committed back)
- [ ] Spot-check: an old SDK build (emitting only `x-stack-*`) still
authenticates against the new backend
- [ ] Spot-check: a new SDK (emitting `x-hexclave-*` / `Bearer
hexclave_*`) still authenticates against an old backend during deploy
ordering
- [ ] Manual: `npx @stackframe/stack-cli@latest init` (new onboarding
entrypoint) generates `hexclave.config.ts`
- [ ] Manual: existing `stack.config.ts`-only project still resolves (no
migration required)
---------
Co-authored-by: bilal <bilal@stack-auth.com>
237 lines
9.3 KiB
TypeScript
237 lines
9.3 KiB
TypeScript
import * as esbuild from 'esbuild-wasm/lib/browser.js';
|
||
import { join } from 'path';
|
||
import { getProcessEnv, isBrowserLike } from './env';
|
||
import { captureError, HexclaveAssertionError, throwErr } from "./errors";
|
||
import { createGlobalAsync } from './globals';
|
||
import { ignoreUnhandledRejection, runAsynchronously } from './promises';
|
||
import { Result } from "./results";
|
||
import { traceSpan, withTraceSpan } from './telemetry';
|
||
|
||
|
||
// esbuild requires self property to be set, and it is not set by default in nodejs
|
||
(globalThis.self as any) ??= globalThis as any;
|
||
|
||
let esbuildInitializePromise: Promise<void> | null = null;
|
||
|
||
if (typeof process !== "undefined" && typeof process.exit === "function" && getProcessEnv("NODE_ENV") === 'development') {
|
||
// On development Node.js servers, initialize ESBuild as soon as the module is imported so we have to wait less on the first request
|
||
runAsynchronously(async () => {
|
||
try {
|
||
await initializeEsbuild();
|
||
} catch (e) {
|
||
captureError("initialize-esbuild-in-dev", e);
|
||
(globalThis as any).process?.exit?.(1);
|
||
}
|
||
});
|
||
}
|
||
|
||
export function initializeEsbuild(): Promise<void> {
|
||
const esbuildWasmUrl = `https://unpkg.com/esbuild-wasm@${esbuild.version}/esbuild.wasm`;
|
||
if (esbuildInitializePromise == null) {
|
||
esbuildInitializePromise = withTraceSpan('initializeEsbuild', async () => {
|
||
try {
|
||
let initOptions;
|
||
if (isBrowserLike()) {
|
||
initOptions = {
|
||
wasmURL: esbuildWasmUrl,
|
||
};
|
||
} else {
|
||
const esbuildWasmModule = await createGlobalAsync('esbuildWasmModule', async () => {
|
||
const esbuildWasmResponse = await fetch(esbuildWasmUrl);
|
||
if (!esbuildWasmResponse.ok) {
|
||
throw new HexclaveAssertionError(`Failed to fetch esbuild.wasm: ${esbuildWasmResponse.status} ${esbuildWasmResponse.statusText}: ${await esbuildWasmResponse.text()}`);
|
||
}
|
||
const esbuildWasm = await esbuildWasmResponse.arrayBuffer();
|
||
const esbuildWasmArray = new Uint8Array(esbuildWasm);
|
||
if (esbuildWasmArray[0] !== 0x00 || esbuildWasmArray[1] !== 0x61 || esbuildWasmArray[2] !== 0x73 || esbuildWasmArray[3] !== 0x6d) {
|
||
throw new HexclaveAssertionError(`Invalid esbuild.wasm file: ${new TextDecoder().decode(esbuildWasmArray)}`);
|
||
}
|
||
return new WebAssembly.Module(esbuildWasm);
|
||
});
|
||
initOptions = {
|
||
wasmModule: esbuildWasmModule,
|
||
worker: false,
|
||
};
|
||
}
|
||
try {
|
||
await esbuild.initialize(initOptions);
|
||
} catch (e) {
|
||
if (e instanceof Error && e.message === 'Cannot call "initialize" more than once') {
|
||
// this happens especially in local development, just ignore
|
||
} else {
|
||
throw e;
|
||
}
|
||
}
|
||
} catch (e) {
|
||
esbuildInitializePromise = null;
|
||
throw new HexclaveAssertionError("Failed to initialize ESBuild", { cause: e });
|
||
}
|
||
})();
|
||
ignoreUnhandledRejection(esbuildInitializePromise);
|
||
}
|
||
|
||
return esbuildInitializePromise;
|
||
}
|
||
|
||
export async function bundleJavaScript(sourceFiles: Record<string, string> & { '/entry.js': string }, options: {
|
||
format?: 'iife' | 'esm' | 'cjs',
|
||
externalPackages?: Record<string, string>,
|
||
keepAsImports?: string[],
|
||
sourcemap?: false | 'inline',
|
||
allowHttpImports?: boolean,
|
||
} = {}): Promise<Result<string, string>> {
|
||
await initializeEsbuild();
|
||
|
||
const sourceFilesMap = new Map(Object.entries(sourceFiles));
|
||
const externalPackagesMap = new Map(Object.entries(options.externalPackages ?? {}));
|
||
const keepAsImports = options.keepAsImports ?? [];
|
||
|
||
const httpImportCache = new Map<string, { contents: string, loader: esbuild.Loader, resolveDir: string }>();
|
||
|
||
const extToLoader: Map<string, esbuild.Loader> = new Map([
|
||
['tsx', 'tsx'],
|
||
['ts', 'ts'],
|
||
['js', 'js'],
|
||
['jsx', 'jsx'],
|
||
['json', 'json'],
|
||
['css', 'css'],
|
||
]);
|
||
let result;
|
||
try {
|
||
result = await traceSpan('bundleJavaScript', async () => await esbuild.build({
|
||
entryPoints: ['/entry.js'],
|
||
bundle: true,
|
||
write: false,
|
||
format: options.format ?? 'iife',
|
||
platform: 'browser',
|
||
target: 'es2015',
|
||
jsx: 'automatic',
|
||
sourcemap: options.sourcemap ?? 'inline',
|
||
external: keepAsImports,
|
||
plugins: [
|
||
...options.allowHttpImports ? [{
|
||
name: "esm-sh-only",
|
||
setup(build: esbuild.PluginBuild) {
|
||
// Handle absolute URLs and relative imports from esm.sh modules.
|
||
build.onResolve({ filter: /.*/ }, (args) => {
|
||
// Only touch absolute http(s) specifiers or children of our own namespace
|
||
const isHttp = args.path.startsWith("http://") || args.path.startsWith("https://");
|
||
const fromEsmNs = args.namespace === "esm-sh";
|
||
|
||
if (!isHttp && !fromEsmNs) return null; // Let other plugins handle bare/relative/local
|
||
|
||
// Resolve relative URLs inside esm.sh-fetched modules
|
||
const url = new URL(args.path, fromEsmNs ? args.importer : undefined);
|
||
|
||
if (url.protocol !== "https:" || url.host !== "esm.sh") {
|
||
throw new Error(`Blocked non-esm.sh URL import: ${url.href}`);
|
||
}
|
||
|
||
return { path: url.href, namespace: "esm-sh" };
|
||
});
|
||
|
||
build.onLoad({ filter: /.*/, namespace: "esm-sh" }, async (args) => {
|
||
if (httpImportCache.has(args.path)) return httpImportCache.get(args.path)!;
|
||
|
||
const res = await fetch(args.path, { redirect: "follow" });
|
||
if (!res.ok) throw new Error(`Fetch ${res.status} ${res.statusText} for ${args.path}`);
|
||
const finalUrl = new URL(res.url);
|
||
// Defensive: follow shouldn’t leave esm.sh, but re-check.
|
||
if (finalUrl.host !== "esm.sh") {
|
||
throw new Error(`Redirect escaped esm.sh: ${finalUrl.href}`);
|
||
}
|
||
|
||
const ct = (res.headers.get("content-type") || "").toLowerCase();
|
||
let loader: esbuild.Loader =
|
||
ct.includes("css") ? "css" :
|
||
ct.includes("json") ? "json" :
|
||
ct.includes("typescript") ? "ts" :
|
||
ct.includes("jsx") ? "jsx" :
|
||
ct.includes("tsx") ? "tsx" :
|
||
"js";
|
||
|
||
// Fallback by extension (esm.sh sometimes omits CT)
|
||
const p = finalUrl.pathname;
|
||
if (p.endsWith(".css")) loader = "css";
|
||
else if (p.endsWith(".json")) loader = "json";
|
||
else if (p.endsWith(".ts")) loader = "ts";
|
||
else if (p.endsWith(".tsx")) loader = "tsx";
|
||
else if (p.endsWith(".jsx")) loader = "jsx";
|
||
|
||
const contents = await res.text();
|
||
const result = {
|
||
contents,
|
||
loader,
|
||
// Ensures relative imports inside that module resolve against the file’s URL
|
||
resolveDir: new URL(".", finalUrl.href).toString(),
|
||
watchFiles: [finalUrl.href],
|
||
};
|
||
httpImportCache.set(args.path, result);
|
||
return result;
|
||
});
|
||
},
|
||
} as esbuild.Plugin] : [],
|
||
{
|
||
name: 'replace-packages-with-globals',
|
||
setup(build) {
|
||
build.onResolve({ filter: /.*/ }, args => {
|
||
// Skip packages that should remain external (not be shimmed)
|
||
if (keepAsImports.includes(args.path)) {
|
||
return undefined;
|
||
}
|
||
if (externalPackagesMap.has(args.path)) {
|
||
return { path: args.path, namespace: 'package-shim' };
|
||
}
|
||
return undefined;
|
||
});
|
||
|
||
build.onLoad({ filter: /.*/, namespace: 'package-shim' }, (args) => {
|
||
const contents = externalPackagesMap.get(args.path);
|
||
if (contents == null) throw new HexclaveAssertionError(`esbuild requested file ${args.path} that is not in the virtual file system`);
|
||
|
||
return { contents, loader: 'ts' };
|
||
});
|
||
},
|
||
},
|
||
{
|
||
name: 'virtual-fs',
|
||
setup(build) {
|
||
build.onResolve({ filter: /.*/ }, args => {
|
||
const absolutePath = join("/", args.path);
|
||
if (sourceFilesMap.has(absolutePath)) {
|
||
return { path: absolutePath, namespace: 'virtual' };
|
||
}
|
||
return undefined;
|
||
});
|
||
|
||
/* 2️⃣ Load the module from the map */
|
||
build.onLoad({ filter: /.*/, namespace: 'virtual' }, args => {
|
||
const contents = sourceFilesMap.get(args.path);
|
||
if (contents == null) throw new HexclaveAssertionError(`esbuild requested file ${args.path} that is not in the virtual file system`);
|
||
|
||
const ext = args.path.split('.').pop() ?? '';
|
||
const loader = extToLoader.get(ext) ?? throwErr(`esbuild requested file ${args.path} with unknown extension ${ext}`);
|
||
|
||
return { contents, loader };
|
||
});
|
||
},
|
||
},
|
||
],
|
||
}));
|
||
} catch (e) {
|
||
if (e instanceof Error && e.message.startsWith("Build failed with ")) {
|
||
return Result.error(e.message);
|
||
}
|
||
throw e;
|
||
}
|
||
|
||
if (result.errors.length > 0) {
|
||
return Result.error(result.errors.map(e => e.text).join('\n'));
|
||
}
|
||
|
||
if (result.outputFiles.length > 0) {
|
||
return Result.ok(result.outputFiles[0].text);
|
||
}
|
||
return throwErr("No output generated??");
|
||
}
|