Skip to content

feat(auth): make auth.hasToken() public - #307

Merged
netanelgilad merged 1 commit into
mainfrom
claude/brave-dijkstra-jymtmb
Oct 6, 2026
Merged

netanelgilad merged 1 commit into
mainfrom
claude/brave-dijkstra-jymtmb

Conversation

@netanelgilad

Copy link
Copy Markdown
Collaborator

Summary

base44.auth.hasToken() already exists. The analytics module uses it to skip auth.me() for anonymous visitors, but it was typed on the internal-only InternalAuthModule. This PR moves it onto the public AuthModule, documents it, and removes InternalAuthModule. Runtime behavior is unchanged.

Why: apps need the same check. The TanStack Start app template calls auth.me() on every page load. For an anonymous visitor that request can only return 401, and in production those 401s showed up on most new TanStack apps (base44-dev/apper#28607). That template currently works around this with getAccessToken(), which reads localStorage directly. That breaks when a token is set with setToken(token, false), and it duplicates state the client already tracks.

Semantics (documented in the JSDoc):

  • It reports only that a token is present, not whether it's valid. Use isAuthenticated() to check validity.
  • It tracks the token from createClient({ token }), setToken() and logout().
  • A session held only in an HTTP-only cookie isn't visible to the client and reads as false.

Testing

  • tsc --noEmit, npm run test:types and vitest run tests/unit (318 passed) all pass. The existing hasToken test now calls the public client.auth without a cast.
  • typedoc reports the same 11 warnings as before, all pre-existing. The new hasToken() section renders in AuthModule.mdx, and its links to me(), isAuthenticated(), createClient(), setToken() and logout() resolve.

🤖 Generated with Claude Code

https://claude.ai/code/session_017E6ba4b3bzDDW4VXPzWFbw


Generated by Claude Code

hasToken() already existed on the internal auth surface for the analytics
module. Apps need the same check to skip auth.me() for anonymous visitors
(a request that can only 401) without reading localStorage themselves, so
move it onto the public AuthModule and drop InternalAuthModule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017E6ba4b3bzDDW4VXPzWFbw
@netanelgilad netanelgilad self-assigned this Oct 6, 2026
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

🚀 Package Preview Available!


Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.52-pr.307.064de09

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.52-pr.307.064de09"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.52-pr.307.064de09"
  }
}

Preview published to npm registry — try new features instantly!

@netanelgilad
netanelgilad merged commit 6e9ffea into main Oct 6, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants