@0xchain/token 1.1.0-beta.61 → 1.1.0-beta.63

package/dist/cookieSecure.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 计算写 cookie 时的 secure 属性。
+ *
+ * 关键点：客户端（浏览器）以当前页面协议为准——https 页面就必须写 secure cookie，
+ * 否则会与服务端写入的 secure 同名 cookie 冲突，导航/刷新后客户端读不到。
+ * 这能让本地通过 https 代理调试时与线上行为一致。
+ *
+ * 服务端（无 window）无法感知页面协议，沿用 NODE_ENV==='production' 判断，
+ * 与既有线上行为保持一致。
+ */
+export declare function resolveCookieSecure(): boolean;
+//# sourceMappingURL=cookieSecure.d.ts.map

package/dist/cookieSecure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieSecure.d.ts","sourceRoot":"","sources":["../src/cookieSecure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAU7C"}

package/dist/cookieStore.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Cookie 唯一真相源。
+ *
+ * 设计原则：domain / path / sameSite / secure 这套属性只在这里定义一次，
+ * set / get / remove 全部基于同一套属性。这样可以从机制上杜绝
+ * “写入带 secure、删除不带 secure 导致删不掉”这类属性漂移引发的
+ * cookie 时有时无问题。
+ */
+export declare const COOKIE_DOMAIN = ".ichatgo.ai";
+export declare const COOKIE_PATH = "/";
+export declare const COOKIE_SAME_SITE: "lax";
+export declare const REFRESH_TOKEN_COOKIE_DAYS = 7;
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3600;
+/** js-cookie：number 表示「天数」，须用 Date 表示绝对过期时间 */
+export declare function expiresFromSeconds(seconds: number): Date;
+export declare const cookieStore: {
+    get(key: string): string;
+    set(key: string, value: string, expires: Date | number): void;
+    /**
+     * 删除必须与写入属性完全一致（domain/path/sameSite/secure），
+     * 否则浏览器无法命中目标 cookie，删除会“静默失败”。
+     */
+    remove(key: string): void;
+};
+//# sourceMappingURL=cookieStore.d.ts.map

package/dist/cookieStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieStore.d.ts","sourceRoot":"","sources":["../src/cookieStore.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAC1C,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,gBAAgB,EAAG,KAAc,CAAA;AAE9C,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,gCAAgC,OAAO,CAAA;AAYpD,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAO,MAAM,WAAW;aACb,MAAM,GAAG,MAAM;aAGf,MAAM,SAAS,MAAM,WAAW,IAAI,GAAG,MAAM,GAAG,IAAI;IAG7D;;;OAGG;gBACS,MAAM,GAAG,IAAI;CAG1B,CAAA"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { ITokenManager, ITokenManagerResponse } from './type';
+export { decodeJwtPayload, isJwtExpired } from './jwt';
 /**
  * 设置|更新token到cookie
  * @param response NextResponse
@@ -11,6 +12,7 @@ export declare const getToken: (key?: string) => string;
 /** 兼容 OAuth 直出与 { data: token } 包装 */
 export declare function normalizeTokenPayload(res: unknown): ITokenManagerResponse | null;
 export declare const removeAllToken: () => void;
+export declare const removeTokenByKey: (key?: string) => void;
 export declare const isTokenExpired: () => Promise<boolean>;
 declare const TokenManager: ITokenManager;
 export default TokenManager;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AA+C9D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,qBAAqB,EAAE,WAAW,YAAY,GAAG,IAAI,KAAG,YAAY,GAAG,IAyCpG,CAAA;AAED,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAA;AAED,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAA;AAID,eAAO,MAAM,cAAc,wBA2C1B,CAAA;AACD,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAA;AAED,eAAe,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAa9D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AA2BvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,KAAK,qBAAqB,EAC1B,WAAW,YAAY,GAAG,IAAI,KAC7B,YAAY,GAAG,IA0DjB,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAC;AAEF,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,SAE5C,CAAC;AAEF,eAAO,MAAM,cAAc,wBA6C1B,CAAC;AAEF,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/index.js

@@ -1,86 +1,160 @@
 import Cookies from "js-cookie";
+function resolveCookieSecure() {
+  if (typeof window !== "undefined" && window.location) {
+    return window.location.protocol === "https:";
+  }
+  const authUrl = process.env.NEXT_PUBLIC_AUTH_URL || "";
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL || "";
+  if (authUrl.startsWith("https://") || appUrl.startsWith("https://")) {
+    return true;
+  }
+  return process.env.NODE_ENV === "production";
+}
 const COOKIE_DOMAIN = ".ichatgo.ai";
 const COOKIE_PATH = "/";
 const COOKIE_SAME_SITE = "lax";
-const COOKIE_SECURE = process.env.NODE_ENV === "production";
 const REFRESH_TOKEN_COOKIE_DAYS = 7;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3600;
+function baseAttributes() {
+  return {
+    domain: COOKIE_DOMAIN,
+    path: COOKIE_PATH,
+    sameSite: COOKIE_SAME_SITE,
+    secure: resolveCookieSecure()
+  };
+}
 function expiresFromSeconds(seconds) {
   return new Date(Date.now() + Math.max(seconds, 0) * 1e3);
 }
+const cookieStore = {
+  get(key) {
+    return Cookies.get(key) || "";
+  },
+  set(key, value, expires) {
+    Cookies.set(key, value, { ...baseAttributes(), expires });
+  },
+  /**
+   * 删除必须与写入属性完全一致（domain/path/sameSite/secure），
+   * 否则浏览器无法命中目标 cookie，删除会“静默失败”。
+   */
+  remove(key) {
+    Cookies.remove(key, baseAttributes());
+  }
+};
+function base64UrlDecode(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padLength = (4 - normalized.length % 4) % 4;
+  const padded = normalized + "=".repeat(padLength);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  }
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeJwtPayload(token) {
+  if (!token) return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payloadJson = base64UrlDecode(parts[1]);
+    return JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+}
+function getJwtExpiryMs(token) {
+  const payload = decodeJwtPayload(token);
+  if (typeof payload?.exp === "number") {
+    return payload.exp * 1e3;
+  }
+  return void 0;
+}
+function isJwtExpired(payload, options) {
+  if (!payload?.exp) return false;
+  const skew = options?.skewSeconds ?? 15;
+  const now = Math.floor(Date.now() / 1e3);
+  return payload.exp <= now + skew;
+}
 const cookieSetToken = (data) => {
-  const expiresIn = data?.expires_in ?? 3600;
+  const nextAccessToken = data?.access_token || getToken("access_token");
+  const nextRefreshToken = data?.refresh_token || getToken("refresh_token");
+  const nextIdToken = data?.id_token || getToken("id_token");
+  if (!nextAccessToken) {
+    return;
+  }
+  const expiresIn = data?.expires_in ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
   const accessExpires = expiresFromSeconds(expiresIn);
-  Cookies.set("access_token", data?.access_token, {
-    expires: accessExpires,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
-    path: COOKIE_PATH
-  });
-  Cookies.set("refresh_token", data?.refresh_token, {
-    expires: REFRESH_TOKEN_COOKIE_DAYS,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
-    path: COOKIE_PATH
-  });
-  Cookies.set("id_token", data?.id_token, {
-    expires: accessExpires,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
-    path: COOKIE_PATH
-  });
-  Cookies.set("token_expire", (Date.now() + expiresIn * 1e3).toString(), {
-    expires: accessExpires,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure: COOKIE_SECURE,
-    path: COOKIE_PATH
-  });
+  cookieStore.set("access_token", nextAccessToken, accessExpires);
+  if (nextRefreshToken) {
+    cookieStore.set("refresh_token", nextRefreshToken, REFRESH_TOKEN_COOKIE_DAYS);
+  }
+  if (nextIdToken) {
+    cookieStore.set("id_token", nextIdToken, accessExpires);
+  }
+  cookieStore.set(
+    "token_expire",
+    (Date.now() + expiresIn * 1e3).toString(),
+    accessExpires
+  );
 };
 const setToken = (res, response) => {
   if (!response) {
     cookieSetToken(res);
     return null;
-  } else {
-    response.cookies.set("access_token", res?.access_token, {
-      httpOnly: false,
-      maxAge: res?.expires_in,
-      domain: COOKIE_DOMAIN,
-      sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
-      path: COOKIE_PATH
-    });
-    response.cookies.set("refresh_token", res?.refresh_token, {
+  }
+  const nextAccessToken = res?.access_token;
+  const nextRefreshToken = res?.refresh_token;
+  const nextIdToken = res?.id_token;
+  const expiresIn = typeof res?.expires_in === "number" && res.expires_in > 0 ? res.expires_in : DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+  if (!nextAccessToken) {
+    return response;
+  }
+  const secure = resolveCookieSecure();
+  response.cookies.set("access_token", nextAccessToken, {
+    httpOnly: false,
+    maxAge: expiresIn,
+    domain: COOKIE_DOMAIN,
+    sameSite: COOKIE_SAME_SITE,
+    secure,
+    path: COOKIE_PATH
+  });
+  if (nextRefreshToken) {
+    response.cookies.set("refresh_token", nextRefreshToken, {
       httpOnly: false,
-      maxAge: 60 * 60 * 24 * 7,
+      maxAge: 60 * 60 * 24 * REFRESH_TOKEN_COOKIE_DAYS,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
-    response.cookies.set("id_token", res?.id_token, {
+  }
+  if (nextIdToken) {
+    response.cookies.set("id_token", nextIdToken, {
       httpOnly: false,
-      maxAge: res?.expires_in,
+      maxAge: expiresIn,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
     });
-    response.cookies.set("token_expire", (Date.now() + res?.expires_in * 1e3).toString(), {
+  }
+  response.cookies.set(
+    "token_expire",
+    (Date.now() + expiresIn * 1e3).toString(),
+    {
       httpOnly: false,
-      maxAge: res?.expires_in,
+      maxAge: expiresIn,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
-      secure: COOKIE_SECURE,
+      secure,
       path: COOKIE_PATH
-    });
-  }
+    }
+  );
   return response;
 };
 const getToken = (key) => {
-  return Cookies.get(key || "id_token") || "";
+  return cookieStore.get(key || "id_token");
 };
 function normalizeTokenPayload(res) {
   if (!res || typeof res !== "object") return null;
@@ -98,14 +172,14 @@ function normalizeTokenPayload(res) {
   return null;
 }
 const removeAllToken = () => {
-  Cookies.remove("id_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove("access_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove("refresh_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove(`sign_session`, { domain: COOKIE_DOMAIN });
-  Cookies.remove("token_expire", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
+  cookieStore.remove("id_token");
+  cookieStore.remove("access_token");
+  cookieStore.remove("refresh_token");
+  cookieStore.remove("sign_session");
+  cookieStore.remove("token_expire");
 };
 const removeTokenByKey = (key) => {
-  Cookies.remove(key || "id_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
+  cookieStore.remove(key || "id_token");
 };
 const isTokenExpired = async () => {
   let t;
@@ -114,26 +188,30 @@ const isTokenExpired = async () => {
   if (typeof window === "undefined") {
     try {
       const { cookies } = await import("next/headers");
-      const cookieStore = await cookies();
-      const tokenExpire = cookieStore.get("token_expire")?.value;
-      refreshToken = cookieStore.get("refresh_token")?.value;
-      accessToken = cookieStore.get("access_token")?.value;
+      const nextCookies = await cookies();
+      const tokenExpire = nextCookies.get("token_expire")?.value;
+      refreshToken = nextCookies.get("refresh_token")?.value;
+      accessToken = nextCookies.get("access_token")?.value;
       t = tokenExpire ? Number(tokenExpire) : void 0;
     } catch {
       return false;
     }
   } else {
-    const rawExpire = Cookies.get("token_expire");
+    const rawExpire = cookieStore.get("token_expire");
     t = rawExpire ? Number(rawExpire) : void 0;
-    refreshToken = Cookies.get("refresh_token");
-    accessToken = Cookies.get("access_token");
+    refreshToken = cookieStore.get("refresh_token");
+    accessToken = cookieStore.get("access_token");
   }
   const nearExpiry = (expireAt) => expireAt - Date.now() < 5 * 60 * 1e3;
   if (accessToken) {
+    const jwtExpiry = getJwtExpiryMs(accessToken);
+    if (jwtExpiry) {
+      return nearExpiry(jwtExpiry);
+    }
     if (t && !Number.isNaN(t)) {
       return nearExpiry(t);
     }
-    return false;
+    return Boolean(refreshToken);
   }
   if (refreshToken) {
     return true;
@@ -151,10 +229,13 @@ const TokenManager = {
   isTokenExpired
 };
 export {
+  decodeJwtPayload,
   TokenManager as default,
   getToken,
+  isJwtExpired,
   isTokenExpired,
   normalizeTokenPayload,
   removeAllToken,
+  removeTokenByKey,
   setToken
 };

package/dist/jwt.d.ts

@@ -0,0 +1,10 @@
+export type JwtPayload = Record<string, unknown> & {
+    exp?: number;
+};
+export declare function decodeJwtPayload(token?: string | null): JwtPayload | null;
+/** JWT exp 字段转毫秒时间戳；无法解析时返回 undefined */
+export declare function getJwtExpiryMs(token?: string | null): number | undefined;
+export declare function isJwtExpired(payload: JwtPayload | null, options?: {
+    skewSeconds?: number;
+}): boolean;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAeF,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAUzE;AAED,yCAAyC;AACzC,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,UAAU,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAKT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xchain/token",
-  "version": "1.1.0-beta.61",
+  "version": "1.1.0-beta.63",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",