@0xchain/token 1.1.0-beta.61 → 1.1.0-beta.62

package/dist/cookieSecure.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 计算写 cookie 时的 secure 属性。
+ *
+ * 关键点：客户端（浏览器）以当前页面协议为准——https 页面就必须写 secure cookie，
+ * 否则会与服务端写入的 secure 同名 cookie 冲突，导航/刷新后客户端读不到。
+ * 这能让本地通过 https 代理调试时与线上行为一致。
+ *
+ * 服务端（无 window）无法感知页面协议，沿用 NODE_ENV==='production' 判断，
+ * 与既有线上行为保持一致。
+ */
+export declare function resolveCookieSecure(): boolean;
+//# sourceMappingURL=cookieSecure.d.ts.map

package/dist/cookieSecure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieSecure.d.ts","sourceRoot":"","sources":["../src/cookieSecure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAU7C"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AA+C9D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,qBAAqB,EAAE,WAAW,YAAY,GAAG,IAAI,KAAG,YAAY,GAAG,IAyCpG,CAAA;AAED,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAA;AAED,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAA;AAID,eAAO,MAAM,cAAc,wBA2C1B,CAAA;AACD,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAA;AAED,eAAe,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AA2E9D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,qBAAqB,EAAE,WAAW,YAAY,GAAG,IAAI,KAAG,YAAY,GAAG,IA0CpG,CAAA;AAED,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAA;AAED,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAA;AAID,eAAO,MAAM,cAAc,wBAgD1B,CAAA;AACD,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAA;AAED,eAAe,YAAY,CAAA"}

package/dist/index.js

@@ -1,41 +1,71 @@
 import Cookies from "js-cookie";
+function resolveCookieSecure() {
+  if (typeof window !== "undefined" && window.location) {
+    return window.location.protocol === "https:";
+  }
+  const authUrl = process.env.NEXT_PUBLIC_AUTH_URL || "";
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL || "";
+  if (authUrl.startsWith("https://") || appUrl.startsWith("https://")) {
+    return true;
+  }
+  return process.env.NODE_ENV === "production";
+}
 const COOKIE_DOMAIN = ".ichatgo.ai";
 const COOKIE_PATH = "/";
 const COOKIE_SAME_SITE = "lax";
-const COOKIE_SECURE = process.env.NODE_ENV === "production";
 const REFRESH_TOKEN_COOKIE_DAYS = 7;
 function expiresFromSeconds(seconds) {
   return new Date(Date.now() + Math.max(seconds, 0) * 1e3);
 }
+function decodeJwtExpiryMs(token) {
+  if (!token) return void 0;
+  const parts = token.split(".");
+  if (parts.length < 2) return void 0;
+  const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const raw = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("binary");
+    const utf8 = decodeURIComponent(
+      raw.split("").map((c) => `%${c.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
+    );
+    const payload = JSON.parse(utf8);
+    if (typeof payload.exp === "number") {
+      return payload.exp * 1e3;
+    }
+  } catch {
+  }
+  return void 0;
+}
 const cookieSetToken = (data) => {
   const expiresIn = data?.expires_in ?? 3600;
   const accessExpires = expiresFromSeconds(expiresIn);
+  const secure = resolveCookieSecure();
   Cookies.set("access_token", data?.access_token, {
     expires: accessExpires,
     domain: COOKIE_DOMAIN,
     sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
+    secure,
     path: COOKIE_PATH
   });
   Cookies.set("refresh_token", data?.refresh_token, {
     expires: REFRESH_TOKEN_COOKIE_DAYS,
     domain: COOKIE_DOMAIN,
     sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
+    secure,
     path: COOKIE_PATH
   });
   Cookies.set("id_token", data?.id_token, {
     expires: accessExpires,
     domain: COOKIE_DOMAIN,
     sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
+    secure,
     path: COOKIE_PATH
   });
   Cookies.set("token_expire", (Date.now() + expiresIn * 1e3).toString(), {
     expires: accessExpires,
     domain: COOKIE_DOMAIN,
     sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
+    secure,
     path: COOKIE_PATH
   });
 };
@@ -44,12 +74,13 @@ const setToken = (res, response) => {
     cookieSetToken(res);
     return null;
   } else {
+    const secure = resolveCookieSecure();
     response.cookies.set("access_token", res?.access_token, {
       httpOnly: false,
       maxAge: res?.expires_in,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
     response.cookies.set("refresh_token", res?.refresh_token, {
@@ -57,7 +88,7 @@ const setToken = (res, response) => {
       maxAge: 60 * 60 * 24 * 7,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
     response.cookies.set("id_token", res?.id_token, {
@@ -65,7 +96,7 @@ const setToken = (res, response) => {
       maxAge: res?.expires_in,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
     response.cookies.set("token_expire", (Date.now() + res?.expires_in * 1e3).toString(), {
@@ -73,7 +104,7 @@ const setToken = (res, response) => {
       maxAge: res?.expires_in,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
   }
@@ -130,10 +161,14 @@ const isTokenExpired = async () => {
   }
   const nearExpiry = (expireAt) => expireAt - Date.now() < 5 * 60 * 1e3;
   if (accessToken) {
+    const jwtExpiry = decodeJwtExpiryMs(accessToken);
+    if (jwtExpiry) {
+      return nearExpiry(jwtExpiry);
+    }
     if (t && !Number.isNaN(t)) {
       return nearExpiry(t);
     }
-    return false;
+    return Boolean(refreshToken);
   }
   if (refreshToken) {
     return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xchain/token",
-  "version": "1.1.0-beta.61",
+  "version": "1.1.0-beta.62",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",