From e67a0b49cbb500b157ed8c3fd0924cf4411ef0af Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Sun, 26 Jul 2026 14:19:01 +0300 Subject: [PATCH 1/3] docs(sso): expose SSO module in the generated SDK reference Remove @internal from the SsoModule interface and SsoAccessTokenResponse so the SSO module (getAccessToken and getIdToken) is included when the SDK reference docs are generated. The JSDoc was already complete but hidden, so neither method appeared on the reference site. Also add a leading comment to the getIdToken example so the generator renders the import inside the code block instead of hoisting it into the code-group title. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/modules/sso.types.ts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/modules/sso.types.ts b/src/modules/sso.types.ts index 023bfb4..0002f6f 100644 --- a/src/modules/sso.types.ts +++ b/src/modules/sso.types.ts @@ -1,6 +1,5 @@ /** * Response from SSO access token endpoint. - * @internal */ export interface SsoAccessTokenResponse { access_token: string; @@ -15,8 +14,6 @@ export interface SsoAccessTokenResponse { * * This module is only available to use with a client in service role authentication mode, which means it can only be used in backend environments. * - * @internal - * * @example * ```typescript * // Access SSO module with service role @@ -55,6 +52,7 @@ export interface SsoModule { * * @example * ```typescript + * // Get the user's ID token to read identity claims such as email * import { createClientFromRequest } from 'npm:@base44/sdk'; * * Deno.serve(async (req) => { From 4103f061834bf7a9ebbffe469a4545337a126847 Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Sun, 26 Jul 2026 14:38:29 +0300 Subject: [PATCH 2/3] docs(sso): expose the sso field on the service-role client Remove @internal from the asServiceRole.sso field in the Base44Client type. Without this, the SSO module had no reference page but was still absent from the createClient / createClientFromRequest return types and the SDK overview. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/client.types.ts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/client.types.ts b/src/client.types.ts index 611f81b..4ba49e5 100644 --- a/src/client.types.ts +++ b/src/client.types.ts @@ -144,9 +144,7 @@ export interface Base44Client { functions: FunctionsModule; /** {@link IntegrationsModule | Integrations module} with elevated permissions. */ integrations: IntegrationsModule; - /** {@link SsoModule | SSO module} for generating SSO tokens. - * @internal - */ + /** {@link SsoModule | SSO module} for generating SSO tokens. */ sso: SsoModule; /** Cleanup function to disconnect WebSocket connections. */ cleanup: () => void; From 3b7bb2e557bf44f5af2f26085786a62e40acc867 Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Sun, 26 Jul 2026 15:01:28 +0300 Subject: [PATCH 3/3] docs(sso): clarify token methods and drop module-level example Rewrite getAccessToken and getIdToken to describe the actual behavior: both work only for the user who made the current request (the on-behalf-of user must match userid), getAccessToken refreshes an expired token when possible, and getIdToken returns the stored token as-is. Reference the auth module for obtaining the user id, and remove the module-level @example to match the other module reference pages. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/modules/sso.types.ts | 46 +++++++++++++++++++++++----------------- 1 file changed, 27 insertions(+), 19 deletions(-) diff --git a/src/modules/sso.types.ts b/src/modules/sso.types.ts index 0002f6f..25bad79 100644 --- a/src/modules/sso.types.ts +++ b/src/modules/sso.types.ts @@ -13,41 +13,49 @@ export interface SsoAccessTokenResponse { * services. * * This module is only available to use with a client in service role authentication mode, which means it can only be used in backend environments. - * - * @example - * ```typescript - * // Access SSO module with service role - * const response = await base44.asServiceRole.sso.getAccessToken('user_123'); - * console.log(response.data.access_token); - * ``` */ export interface SsoModule { /** - * Gets SSO access token for a specific user. + * Gets an SSO access token for the user who made the current request. * - * Retrieves a Single Sign-On access token that can be used to authenticate - * a user with external services or systems. + * Use this token to authenticate the user with external systems or services. + * This only works for that same user. Create the client with + * {@link createClientFromRequest} so it acts on behalf of the request's user, + * then pass that user's ID as `userid`. If `userid` is any other user, the + * call fails. An expired token is refreshed automatically when a refresh token + * is available. * - * @param userid - The user ID to get the access token for. + * @param userid - The ID of the user who made the current request, such as the + * `id` returned by {@link AuthModule | base44.auth.me()}. * @returns Promise resolving to the SSO access token response. * * @example * ```typescript - * // Get SSO access token for a user - * const response = await base44.asServiceRole.sso.getAccessToken('user_123'); - * console.log(response.access_token); + * // Get the user's SSO access token to call an external system + * import { createClientFromRequest } from 'npm:@base44/sdk'; + * + * Deno.serve(async (req) => { + * const base44 = createClientFromRequest(req); + * const user = await base44.auth.me(); + * const { access_token } = await base44.asServiceRole.sso.getAccessToken(user.id); + * + * return Response.json({ access_token }); + * }); * ``` */ getAccessToken(userid: string): Promise; /** - * Gets the stored SSO OIDC ID token for the current app user. + * Gets the stored SSO OIDC ID token for the user who made the current request. * - * The service-role client must include an on-behalf-of token for the same - * user specified by `userid`. This method returns the stored token as-is and - * does not refresh it. + * This only works for that same user, not for arbitrary users. Create the + * client with {@link createClientFromRequest} so it acts on behalf of the + * request's user, then pass that user's ID as `userid`. If `userid` is any + * other user, the call fails. The stored token is returned as-is and is never + * refreshed, so the call fails if the token has already expired. * - * @param userid - The current app user's ID. + * @param userid - The ID of the user who made the current request, such as the + * `id` returned by {@link AuthModule | base44.auth.me()}. * @returns Promise resolving to the raw ID-token string. * * @example