| 1 | import { |
| 2 | buildConnectClerkAuthorizeUrl, |
| 3 | connectLoopbackRedirectUri, |
| 4 | CONNECT_OAUTH_SCOPES, |
| 5 | type ConnectAuthorizeRequest, |
| 6 | } from "@t3tools/shared/connectAuth"; |
| 7 | import { clerkFrontendApiUrlFromPublishableKey } from "@t3tools/shared/relayAuth"; |
| 8 | |
| 9 | import { isHostedStaticApp } from "../hostedPairing"; |
| 10 | import { hasCloudPublicConfig, resolveCloudPublicConfig, trimNonEmpty } from "./publicConfig"; |
| 11 | |
| 12 | function resolveConnectCliOAuthClientId(): string | null { |
| 13 | return trimNonEmpty(import.meta.env.VITE_CLERK_CLI_OAUTH_CLIENT_ID as string | undefined); |
| 14 | } |
| 15 | |
| 16 | export function hasConnectCliAuthConfig(): boolean { |
| 17 | return Boolean( |
| 18 | resolveCloudPublicConfig().clerkPublishableKey && resolveConnectCliOAuthClientId(), |
| 19 | ); |
| 20 | } |
| 21 | |
| 22 | /** |
| 23 | * Gate for the /connect route: the CLI handshake only exists on the hosted |
| 24 | * deployment (the same bundle ships inside local instances) and needs the |
| 25 | * Clerk CLI OAuth client configured at build time. |
| 26 | */ |
| 27 | export function connectCliAuthRoutesEnabled(): boolean { |
| 28 | return isHostedStaticApp() && hasCloudPublicConfig() && hasConnectCliAuthConfig(); |
| 29 | } |
| 30 | |
| 31 | /** |
| 32 | * Builds the Clerk authorize URL for a CLI-initiated connect request. The |
| 33 | * authorization code returns to the CLI's `127.0.0.1` listener directly, so |
| 34 | * this page never sees it. Clerk enforces its registered redirect URI |
| 35 | * allowlist either way. |
| 36 | */ |
| 37 | export function buildConnectCliClerkAuthorizeUrl(request: ConnectAuthorizeRequest): string | null { |
| 38 | const { clerkPublishableKey } = resolveCloudPublicConfig(); |
| 39 | const clientId = resolveConnectCliOAuthClientId(); |
| 40 | if (!clerkPublishableKey || !clientId) { |
| 41 | return null; |
| 42 | } |
| 43 | return buildConnectClerkAuthorizeUrl({ |
| 44 | authorizationEndpoint: `${clerkFrontendApiUrlFromPublishableKey(clerkPublishableKey)}/oauth/authorize`, |
| 45 | clientId, |
| 46 | redirectUri: connectLoopbackRedirectUri(request.loopbackPort), |
| 47 | scopes: CONNECT_OAUTH_SCOPES, |
| 48 | state: request.state, |
| 49 | challenge: request.challenge, |
| 50 | }); |
| 51 | } |
| 52 | |
| 53 | /** |
| 54 | * Where Clerk sends the browser once the sign-in modal on /connect completes. |
| 55 | * It has to be the authorize endpoint rather than this page: /connect carries |
| 56 | * the CLI request in its fragment, so navigating back to the same URL is a |
| 57 | * same-document fragment navigation the browser never reloads — and Clerk |
| 58 | * treats any post-sign-in navigation as a page unload and skips the state emit |
| 59 | * that would otherwise re-render the surface, so the session never arrives |
| 60 | * either. Falls back to the current URL when the authorize URL cannot be |
| 61 | * built, which only happens on a deployment without the CLI OAuth config. |
| 62 | */ |
| 63 | export function connectCliSignInRedirectUrl( |
| 64 | request: ConnectAuthorizeRequest, |
| 65 | currentHref: string, |
| 66 | ): string { |
| 67 | return buildConnectCliClerkAuthorizeUrl(request) ?? currentHref; |
| 68 | } |