@0xchain/token 1.1.0-beta.62 → 1.1.0-beta.64

package/dist/cookieStore.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Cookie 唯一真相源。
+ *
+ * 设计原则：domain / path / sameSite / secure 这套属性只在这里定义一次，
+ * set / get / remove 全部基于同一套属性。这样可以从机制上杜绝
+ * “写入带 secure、删除不带 secure 导致删不掉”这类属性漂移引发的
+ * cookie 时有时无问题。
+ */
+export declare const COOKIE_DOMAIN = ".ichatgo.ai";
+export declare const COOKIE_PATH = "/";
+export declare const COOKIE_SAME_SITE: "lax";
+export declare const REFRESH_TOKEN_COOKIE_DAYS = 7;
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3600;
+export declare const RUNTIME_ENV: string;
+/** 生产环境保持无后缀（兼容存量），其余环境按环境隔离 */
+export declare const COOKIE_ENV_SUFFIX: string;
+/**
+ * 生成环境作用域内的 cookie 名。
+ * 例：test 环境 `access_token` → `access_token__test`；生产环境保持 `access_token`。
+ * 幂等：已带后缀的名字不会重复追加。
+ */
+export declare function envCookieName(base: string): string;
+/** js-cookie：number 表示「天数」，须用 Date 表示绝对过期时间 */
+export declare function expiresFromSeconds(seconds: number): Date;
+export declare const cookieStore: {
+    get(key: string): string;
+    set(key: string, value: string, expires: Date | number): void;
+    /**
+     * 删除必须与写入属性完全一致（domain/path/sameSite/secure），
+     * 否则浏览器无法命中目标 cookie，删除会“静默失败”。
+     */
+    remove(key: string): void;
+};
+//# sourceMappingURL=cookieStore.d.ts.map

package/dist/cookieStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieStore.d.ts","sourceRoot":"","sources":["../src/cookieStore.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAC1C,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,gBAAgB,EAAG,KAAc,CAAA;AAE9C,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,gCAAgC,OAAO,CAAA;AAqBpD,eAAO,MAAM,WAAW,QAA2D,CAAA;AAEnF,gCAAgC;AAChC,eAAO,MAAM,iBAAiB,QAAyD,CAAA;AAEvF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAYD,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAO,MAAM,WAAW;aACb,MAAM,GAAG,MAAM;aAGf,MAAM,SAAS,MAAM,WAAW,IAAI,GAAG,MAAM,GAAG,IAAI;IAG7D;;;OAGG;gBACS,MAAM,GAAG,IAAI;CAG1B,CAAA"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import { NextResponse } from 'next/server';
 import { ITokenManager, ITokenManagerResponse } from './type';
+export { decodeJwtPayload, isJwtExpired } from './jwt';
+export { envCookieName, COOKIE_ENV_SUFFIX, RUNTIME_ENV, COOKIE_DOMAIN, } from './cookieStore';
 /**
  * 设置|更新token到cookie
  * @param response NextResponse
@@ -11,6 +13,7 @@ export declare const getToken: (key?: string) => string;
 /** 兼容 OAuth 直出与 { data: token } 包装 */
 export declare function normalizeTokenPayload(res: unknown): ITokenManagerResponse | null;
 export declare const removeAllToken: () => void;
+export declare const removeTokenByKey: (key?: string) => void;
 export declare const isTokenExpired: () => Promise<boolean>;
 declare const TokenManager: ITokenManager;
 export default TokenManager;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AA2E9D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,qBAAqB,EAAE,WAAW,YAAY,GAAG,IAAI,KAAG,YAAY,GAAG,IA0CpG,CAAA;AAED,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAA;AAED,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAA;AAID,eAAO,MAAM,cAAc,wBAgD1B,CAAA;AACD,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAA;AAED,eAAe,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAc9D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACvD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,aAAa,GACd,MAAM,eAAe,CAAC;AA+BvB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,KAAK,qBAAqB,EAC1B,WAAW,YAAY,GAAG,IAAI,KAC7B,YAAY,GAAG,IA0DjB,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,WAEpC,CAAC;AAEF,sCAAsC;AACtC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAc9B;AAED,eAAO,MAAM,cAAc,YAM1B,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,SAE5C,CAAC;AAEF,eAAO,MAAM,cAAc,wBA6C1B,CAAC;AAEF,QAAA,MAAM,YAAY,EAAE,aAMnB,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/index.js

@@ -14,104 +14,163 @@ const COOKIE_DOMAIN = ".ichatgo.ai";
 const COOKIE_PATH = "/";
 const COOKIE_SAME_SITE = "lax";
 const REFRESH_TOKEN_COOKIE_DAYS = 7;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3600;
+function normalizeRuntimeEnv(raw) {
+  const env = (raw || "").trim().toLowerCase();
+  if (!env || env === "prod" || env === "production") return "production";
+  return env;
+}
+const RUNTIME_ENV = normalizeRuntimeEnv(process.env.NEXT_PUBLIC_RUNTIME_ENV);
+const COOKIE_ENV_SUFFIX = RUNTIME_ENV === "production" ? "" : `__${RUNTIME_ENV}`;
+function envCookieName(base) {
+  if (!COOKIE_ENV_SUFFIX) return base;
+  if (base.endsWith(COOKIE_ENV_SUFFIX)) return base;
+  return `${base}${COOKIE_ENV_SUFFIX}`;
+}
+function baseAttributes() {
+  return {
+    domain: COOKIE_DOMAIN,
+    path: COOKIE_PATH,
+    sameSite: COOKIE_SAME_SITE,
+    secure: resolveCookieSecure()
+  };
+}
 function expiresFromSeconds(seconds) {
   return new Date(Date.now() + Math.max(seconds, 0) * 1e3);
 }
-function decodeJwtExpiryMs(token) {
-  if (!token) return void 0;
+const cookieStore = {
+  get(key) {
+    return Cookies.get(key) || "";
+  },
+  set(key, value, expires) {
+    Cookies.set(key, value, { ...baseAttributes(), expires });
+  },
+  /**
+   * 删除必须与写入属性完全一致（domain/path/sameSite/secure），
+   * 否则浏览器无法命中目标 cookie，删除会“静默失败”。
+   */
+  remove(key) {
+    Cookies.remove(key, baseAttributes());
+  }
+};
+function base64UrlDecode(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padLength = (4 - normalized.length % 4) % 4;
+  const padded = normalized + "=".repeat(padLength);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  }
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeJwtPayload(token) {
+  if (!token) return null;
   const parts = token.split(".");
-  if (parts.length < 2) return void 0;
-  const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  if (parts.length < 2) return null;
   try {
-    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-    const raw = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("binary");
-    const utf8 = decodeURIComponent(
-      raw.split("").map((c) => `%${c.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")
-    );
-    const payload = JSON.parse(utf8);
-    if (typeof payload.exp === "number") {
-      return payload.exp * 1e3;
-    }
+    const payloadJson = base64UrlDecode(parts[1]);
+    return JSON.parse(payloadJson);
   } catch {
+    return null;
+  }
+}
+function getJwtExpiryMs(token) {
+  const payload = decodeJwtPayload(token);
+  if (typeof payload?.exp === "number") {
+    return payload.exp * 1e3;
   }
   return void 0;
 }
+function isJwtExpired(payload, options) {
+  if (!payload?.exp) return false;
+  const skew = options?.skewSeconds ?? 15;
+  const now = Math.floor(Date.now() / 1e3);
+  return payload.exp <= now + skew;
+}
 const cookieSetToken = (data) => {
-  const expiresIn = data?.expires_in ?? 3600;
+  const nextAccessToken = data?.access_token || getToken("access_token");
+  const nextRefreshToken = data?.refresh_token || getToken("refresh_token");
+  const nextIdToken = data?.id_token || getToken("id_token");
+  if (!nextAccessToken) {
+    return;
+  }
+  const expiresIn = data?.expires_in ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
   const accessExpires = expiresFromSeconds(expiresIn);
+  cookieStore.set(envCookieName("access_token"), nextAccessToken, accessExpires);
+  if (nextRefreshToken) {
+    cookieStore.set(
+      envCookieName("refresh_token"),
+      nextRefreshToken,
+      REFRESH_TOKEN_COOKIE_DAYS
+    );
+  }
+  if (nextIdToken) {
+    cookieStore.set(envCookieName("id_token"), nextIdToken, accessExpires);
+  }
+  cookieStore.set(
+    envCookieName("token_expire"),
+    (Date.now() + expiresIn * 1e3).toString(),
+    accessExpires
+  );
+};
+const setToken = (res, response) => {
+  if (!response) {
+    cookieSetToken(res);
+    return null;
+  }
+  const nextAccessToken = res?.access_token;
+  const nextRefreshToken = res?.refresh_token;
+  const nextIdToken = res?.id_token;
+  const expiresIn = typeof res?.expires_in === "number" && res.expires_in > 0 ? res.expires_in : DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+  if (!nextAccessToken) {
+    return response;
+  }
   const secure = resolveCookieSecure();
-  Cookies.set("access_token", data?.access_token, {
-    expires: accessExpires,
+  response.cookies.set(envCookieName("access_token"), nextAccessToken, {
+    httpOnly: false,
+    maxAge: expiresIn,
     domain: COOKIE_DOMAIN,
     sameSite: COOKIE_SAME_SITE,
     secure,
     path: COOKIE_PATH
   });
-  Cookies.set("refresh_token", data?.refresh_token, {
-    expires: REFRESH_TOKEN_COOKIE_DAYS,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure,
-    path: COOKIE_PATH
-  });
-  Cookies.set("id_token", data?.id_token, {
-    expires: accessExpires,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure,
-    path: COOKIE_PATH
-  });
-  Cookies.set("token_expire", (Date.now() + expiresIn * 1e3).toString(), {
-    expires: accessExpires,
-    domain: COOKIE_DOMAIN,
-    sameSite: COOKIE_SAME_SITE,
-    secure,
-    path: COOKIE_PATH
-  });
-};
-const setToken = (res, response) => {
-  if (!response) {
-    cookieSetToken(res);
-    return null;
-  } else {
-    const secure = resolveCookieSecure();
-    response.cookies.set("access_token", res?.access_token, {
-      httpOnly: false,
-      maxAge: res?.expires_in,
-      domain: COOKIE_DOMAIN,
-      sameSite: COOKIE_SAME_SITE,
-      secure,
-      path: COOKIE_PATH
-    });
-    response.cookies.set("refresh_token", res?.refresh_token, {
+  if (nextRefreshToken) {
+    response.cookies.set(envCookieName("refresh_token"), nextRefreshToken, {
       httpOnly: false,
-      maxAge: 60 * 60 * 24 * 7,
+      maxAge: 60 * 60 * 24 * REFRESH_TOKEN_COOKIE_DAYS,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
       secure,
       path: COOKIE_PATH
     });
-    response.cookies.set("id_token", res?.id_token, {
+  }
+  if (nextIdToken) {
+    response.cookies.set(envCookieName("id_token"), nextIdToken, {
       httpOnly: false,
-      maxAge: res?.expires_in,
+      maxAge: expiresIn,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
       secure,
       path: COOKIE_PATH
     });
-    response.cookies.set("token_expire", (Date.now() + res?.expires_in * 1e3).toString(), {
+  }
+  response.cookies.set(
+    envCookieName("token_expire"),
+    (Date.now() + expiresIn * 1e3).toString(),
+    {
       httpOnly: false,
-      maxAge: res?.expires_in,
+      maxAge: expiresIn,
       domain: COOKIE_DOMAIN,
       sameSite: COOKIE_SAME_SITE,
       secure,
       path: COOKIE_PATH
-    });
-  }
+    }
+  );
   return response;
 };
 const getToken = (key) => {
-  return Cookies.get(key || "id_token") || "";
+  return cookieStore.get(envCookieName(key || "id_token"));
 };
 function normalizeTokenPayload(res) {
   if (!res || typeof res !== "object") return null;
@@ -129,14 +188,14 @@ function normalizeTokenPayload(res) {
   return null;
 }
 const removeAllToken = () => {
-  Cookies.remove("id_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove("access_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove("refresh_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
-  Cookies.remove(`sign_session`, { domain: COOKIE_DOMAIN });
-  Cookies.remove("token_expire", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
+  cookieStore.remove(envCookieName("id_token"));
+  cookieStore.remove(envCookieName("access_token"));
+  cookieStore.remove(envCookieName("refresh_token"));
+  cookieStore.remove(envCookieName("sign_session"));
+  cookieStore.remove(envCookieName("token_expire"));
 };
 const removeTokenByKey = (key) => {
-  Cookies.remove(key || "id_token", { path: COOKIE_PATH, domain: COOKIE_DOMAIN });
+  cookieStore.remove(envCookieName(key || "id_token"));
 };
 const isTokenExpired = async () => {
   let t;
@@ -145,23 +204,23 @@ const isTokenExpired = async () => {
   if (typeof window === "undefined") {
     try {
       const { cookies } = await import("next/headers");
-      const cookieStore = await cookies();
-      const tokenExpire = cookieStore.get("token_expire")?.value;
-      refreshToken = cookieStore.get("refresh_token")?.value;
-      accessToken = cookieStore.get("access_token")?.value;
+      const nextCookies = await cookies();
+      const tokenExpire = nextCookies.get(envCookieName("token_expire"))?.value;
+      refreshToken = nextCookies.get(envCookieName("refresh_token"))?.value;
+      accessToken = nextCookies.get(envCookieName("access_token"))?.value;
       t = tokenExpire ? Number(tokenExpire) : void 0;
     } catch {
       return false;
     }
   } else {
-    const rawExpire = Cookies.get("token_expire");
+    const rawExpire = cookieStore.get(envCookieName("token_expire"));
     t = rawExpire ? Number(rawExpire) : void 0;
-    refreshToken = Cookies.get("refresh_token");
-    accessToken = Cookies.get("access_token");
+    refreshToken = cookieStore.get(envCookieName("refresh_token"));
+    accessToken = cookieStore.get(envCookieName("access_token"));
   }
   const nearExpiry = (expireAt) => expireAt - Date.now() < 5 * 60 * 1e3;
   if (accessToken) {
-    const jwtExpiry = decodeJwtExpiryMs(accessToken);
+    const jwtExpiry = getJwtExpiryMs(accessToken);
     if (jwtExpiry) {
       return nearExpiry(jwtExpiry);
     }
@@ -186,10 +245,17 @@ const TokenManager = {
   isTokenExpired
 };
 export {
+  COOKIE_DOMAIN,
+  COOKIE_ENV_SUFFIX,
+  RUNTIME_ENV,
+  decodeJwtPayload,
   TokenManager as default,
+  envCookieName,
   getToken,
+  isJwtExpired,
   isTokenExpired,
   normalizeTokenPayload,
   removeAllToken,
+  removeTokenByKey,
   setToken
 };

package/dist/jwt.d.ts

@@ -0,0 +1,10 @@
+export type JwtPayload = Record<string, unknown> & {
+    exp?: number;
+};
+export declare function decodeJwtPayload(token?: string | null): JwtPayload | null;
+/** JWT exp 字段转毫秒时间戳；无法解析时返回 undefined */
+export declare function getJwtExpiryMs(token?: string | null): number | undefined;
+export declare function isJwtExpired(payload: JwtPayload | null, options?: {
+    skewSeconds?: number;
+}): boolean;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAeF,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAUzE;AAED,yCAAyC;AACzC,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,UAAU,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAKT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xchain/token",
-  "version": "1.1.0-beta.62",
+  "version": "1.1.0-beta.64",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",