@arex95/vue-core 3.3.0 → 5.1.0

package/dist/services/credentials.d.ts

@@ -1,51 +1,32 @@
-import { LocationPreference } from "@/types/SessionConfig";
+import { LocationPreference } from '@/types/SessionConfig';
 /**
- * Removes all stored authentication credentials (access and refresh tokens) from the specified storage locations.
+ * Removes all stored authentication credentials (access + refresh tokens)
+ * from the specified storage location(s).
  *
- * @param {LocationPreference} location - The storage location to clear. Can be 'local' for `localStorage`,
- *   'session' for `sessionStorage`, 'cookie' for cookies, or 'any' to clear all.
- * @returns {Promise<void>} A promise that resolves when the credentials have been cleared.
+ * With location='any', ALL storage locations are cleared — including cookies.
+ * This prevents orphaned tokens surviving a logout.
  */
 export declare const cleanCredentials: (location: LocationPreference) => Promise<void>;
 /**
  * Retrieves and decrypts the access token from the specified storage location.
- *
- * @param {string} secretKey - The secret key to use for decryption.
- * @param {LocationPreference} location - The storage location to search ('local', 'session', 'cookie', or 'any').
- * @returns {Promise<string | null>} A promise that resolves with the decrypted access token, or `null` if it's not found.
  */
 export declare const getAuthToken: (secretKey: string, location: LocationPreference) => Promise<string | null>;
 /**
  * Retrieves and decrypts the refresh token from the specified storage location.
- *
- * @param {string} secretKey - The secret key to use for decryption.
- * @param {LocationPreference} location - The storage location to search ('local', 'session', 'cookie', or 'any').
- * @returns {Promise<string | null>} A promise that resolves with the decrypted refresh token, or `null` if it's not found.
  */
 export declare const getAuthRefreshToken: (secretKey: string, location: LocationPreference) => Promise<string | null>;
 /**
- * Encrypts and stores the access token in the specified storage location.
- *
- * @param {string} token - The access token to store.
- * @param {string} secretKey - The secret key to use for encryption.
- * @param {LocationPreference} location - The storage location ('local', 'session', or 'cookie').
- * @returns {Promise<void>} A promise that resolves when the token has been stored.
+ * Encrypts and stores the access token.
  */
 export declare const storeAuthToken: (token: string, secretKey: string, location: LocationPreference) => Promise<void>;
 /**
- * Encrypts and stores the refresh token in the specified storage location.
- *
- * @param {string} token - The refresh token to store.
- * @param {string} secretKey - The secret key to use for encryption.
- * @param {LocationPreference} location - The storage location ('local', 'session', or 'cookie').
- * @returns {Promise<void>} A promise that resolves when the token has been stored.
+ * Encrypts and stores the refresh token.
  */
 export declare const storeAuthRefreshToken: (token: string, secretKey: string, location: LocationPreference) => Promise<void>;
 /**
- * Verifies the current user's authentication status by checking for a valid, unexpired access token.
- * It searches for the token in all storage locations (sessionStorage, localStorage, cookies).
- * If the token is missing, malformed, or expired, it logs the issue, clears credentials, and returns `false`.
+ * Verifies the current user's authentication status by checking for a
+ * valid, unexpired access token across all storage locations.
  *
- * @returns {Promise<boolean>} A promise that resolves to `true` if the user is authenticated, and `false` otherwise.
+ * Returns false (without throwing) if the token is missing, malformed, or expired.
  */
 export declare const verifyAuth: () => Promise<boolean>;

package/dist/services/refreshTokens.d.ts

@@ -1,12 +1,15 @@
-import { AuthResponse, Fetcher } from "@/types";
+import { AuthResponse, Fetcher } from '@/types';
 /**
- * Refreshes the access and refresh tokens by making a POST request to the refresh endpoint.
- * It retrieves the current refresh token from storage, sends it to the refresh endpoint,
- * and then stores the new tokens upon a successful response. If the refresh process fails
- * or no refresh token is found, it clears all credentials and reloads the page.
+ * Refreshes the access and refresh tokens.
  *
- * @param {Fetcher} [fetcher] - Optional fetcher function to use for the refresh request. If not provided, uses the default configured fetcher.
- * @returns {Promise<AuthResponse>} A promise that resolves with the new authentication response containing the refreshed tokens.
- * @throws {Error} Throws an error if the refresh token is missing or if the refresh request fails, which is then caught to trigger a logout.
+ * Fixes over the original:
+ *   1. Uses `persistence` (the location where tokens were originally stored)
+ *      instead of hardcoding `"any"` — so cookies / localStorage / sessionStorage
+ *      are searched in the right place.
+ *   2. Sends the refresh token in the request body using the configured
+ *      `refreshTokenPaths.refreshTokenPath` as the body key, so the backend
+ *      always receives it regardless of withCredentials or cookie settings.
+ *
+ * On failure: clears credentials and calls `onRefreshFailed` callback.
  */
 export declare const refreshTokens: (fetcher?: Fetcher) => Promise<AuthResponse>;

package/dist/utils/encryption.d.ts

@@ -1,44 +1,24 @@
 /**
- * Converts an `ArrayBuffer` or `Uint8Array` into a hexadecimal string representation.
- *
- * @param {ArrayBuffer | Uint8Array} buffer - The buffer to convert.
- * @returns {string} The resulting hexadecimal string.
+ * Converts an `ArrayBuffer` or `Uint8Array` into a hexadecimal string.
  */
 export declare function ab2hex(buffer: ArrayBuffer | Uint8Array): string;
 /**
  * Converts a hexadecimal string into a `Uint8Array`.
- *
- * @param {string} hex - The hexadecimal string to convert.
- * @returns {Uint8Array} The resulting `Uint8Array`.
- * @throws {TypeError} If the input is not a string.
- * @throws {Error} If the hexadecimal string has an invalid format or an odd length.
  */
 export declare function hex2ab(hex: string): Uint8Array;
 /**
- * Derives a `CryptoKey` for AES-CBC encryption from a plain-text secret key.
- * It uses SHA-256 to hash the secret key, ensuring a fixed-length key suitable for the Web Crypto API.
+ * Derives a CryptoKey for AES-CBC-256 from a plain-text secret using SHA-256.
  *
- * @param {string} secretKey - The plain-text secret key.
- * @returns {Promise<CryptoKey>} A promise that resolves with the derived `CryptoKey`.
- * @throws {Error} If the `secretKey` is null or empty.
+ * @throws {Error} If secretKey is empty or Web Crypto API is unavailable.
  */
 export declare function importKey(secretKey: string): Promise<CryptoKey>;
 /**
- * Encrypts a plain-text value using AES-CBC with a given secret key.
- * A random 16-byte initialization vector (IV) is generated for each encryption.
- *
- * @param {string} value - The plain-text string to encrypt.
- * @param {string} secretKey - The secret key to use for encryption.
- * @returns {Promise<string>} A promise that resolves with a concatenated hexadecimal string of the IV and the ciphertext.
- * @throws {Error} If the `secretKey` is null or empty.
+ * Encrypts a plain-text string using AES-CBC-256.
+ * A unique 16-byte IV is generated per call.
+ * Output format: IV_hex (32 chars) + ciphertext_hex.
  */
 export declare function encrypt(value: string, secretKey: string): Promise<string>;
 /**
- * Decrypts a hexadecimal string (IV + ciphertext) using AES-CBC with a given secret key.
- *
- * @param {string} encryptedValue - The concatenated hexadecimal string of the IV and ciphertext.
- * @param {string} secretKey - The secret key to use for decryption.
- * @returns {Promise<string>} A promise that resolves with the decrypted plain-text string.
- * @throws {Error} If the encrypted value is null, empty, or too short, or if the `secretKey` is invalid.
+ * Decrypts a hex string (IV_hex + ciphertext_hex) produced by `encrypt()`.
  */
 export declare function decrypt(encryptedValue: string, secretKey: string): Promise<string>;

package/dist/utils/storage.d.ts

@@ -1,26 +1,37 @@
-import { LocationPreference } from "@/types";
-import { CookieOptions } from "./ssr";
+import { LocationPreference } from '@/types';
+import { CookieOptions } from './ssr';
 /**
- * Encrypts and stores a key-value pair in either `localStorage`, `sessionStorage`, or cookies.
- * Cookies are automatically used in SSR environments and can be explicitly requested.
- * Cookies include security options: Secure (HTTPS only), SameSite (CSRF protection), and encryption.
+ * Encrypts and stores a value in the requested storage.
  *
- * @param {string} key - The key for the storage item.
- * @param {string} value - The string value to encrypt and store.
- * @param {string} secretKey - The secret key to use for encryption.
- * @param {LocationPreference} location - The storage location: 'local' for `localStorage`, 'session' for `sessionStorage`, 'cookie' for cookies, or 'any' for retrieval.
- * @param {CookieOptions} [cookieOptions] - Optional cookie-specific options (only used when location is 'cookie').
- * @returns {Promise<void>} A promise that resolves when the item has been stored.
+ * | location  | where it goes               | persistence         |
+ * |-----------|----------------------------|---------------------|
+ * | 'cookie'  | document.cookie            | expires option      |
+ * | 'local'   | localStorage               | until explicitly cleared |
+ * | 'any'     | localStorage               | until explicitly cleared |
+ * | 'session' | sessionStorage             | until tab closes    |
+ *
+ * Note: 'any' stores in localStorage (same as 'local') for maximum
+ * persistence. Previously it stored in sessionStorage — that was a bug.
+ *
+ * In SSR environments cookies are always used regardless of location
+ * (localStorage / sessionStorage do not exist on the server).
  */
 export declare function storeEncryptedItem(key: string, value: string, secretKey: string, location: LocationPreference, cookieOptions?: CookieOptions): Promise<void>;
 /**
- * Retrieves and decrypts an item from `localStorage`, `sessionStorage`, or cookies.
- * When location is 'any', checks in order: sessionStorage, localStorage, cookies.
- * Cookies are automatically checked in SSR environments.
+ * Retrieves and decrypts a value from storage.
+ *
+ * Search order by location:
+ *
+ * | location  | search order                              |
+ * |-----------|-------------------------------------------|
+ * | 'cookie'  | cookies only                              |
+ * | 'local'   | localStorage only                         |
+ * | 'session' | sessionStorage only                       |
+ * | 'any'     | sessionStorage → localStorage → cookies   |
+ *
+ * In SSR, cookies are always checked first (localStorage / sessionStorage
+ * are not available on the server).
  *
- * @param {string} key - The key of the item to retrieve.
- * @param {string} secretKey - The secret key to use for decryption.
- * @param {LocationPreference} location - The storage location to search: 'local', 'session', 'cookie', or 'any' (checks session, local, cookie in that order).
- * @returns {Promise<string | null>} A promise that resolves with the decrypted value, or `null` if the item is not found or decryption fails.
+ * Returns null if the key is not found or decryption fails.
  */
 export declare function getDecryptedItem(key: string, secretKey: string, location: LocationPreference): Promise<string | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arex95/vue-core",
-  "version": "3.3.0",
+  "version": "5.1.0",
   "description": "Opinionated Vue Core",
   "main": "dist/index.js",
   "module": "dist/index.mjs",