@base44-preview/sdk 0.8.54-pr.264.92c17fa → 0.8.54-pr.264.cfcaa05

package/dist/modules/auth.js

@@ -1,4 +1,4 @@
-import { removeAccessToken } from "../utils/auth-utils.js";
+import { getAccessToken, removeAccessToken } from "../utils/auth-utils.js";
 import { resetAnalyticsSessionContext } from "./analytics.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
@@ -59,6 +59,16 @@ function removeStoredAccessTokens() {
     removeAccessToken({});
     removeAccessToken({ storageKey: "token" });
 }
+const isStoredAccessToken = (authorization) => authorization ===
+    `Bearer ${getAccessToken({ saveToStorage: false, removeFromUrl: false })}`;
+// A rejected token left in storage boots the next page with it, and an app
+// whose own /login does that loops 401 → /login. A token stored since the
+// request went out (a login in this or another tab) is not the rejected one.
+function clearTokenOnRejection(error, sentAuthorization) {
+    if (error.status === 401 && isStoredAccessToken(sentAuthorization)) {
+        removeStoredAccessTokens();
+    }
+}
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -94,7 +104,14 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Get current user information
         async me() {
-            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
+            const sentAuthorization = axios.defaults.headers.common["Authorization"];
+            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios
+                .get(`/apps/${appId}/entities/User/me`)
+                .catch((error) => {
+                clearTokenOnRejection(error, sentAuthorization);
+                throw error;
+            })
+                .finally(() => {
                 // Only retire this request if it is still the shared one. An identity
                 // change mid-flight clears `pendingMe` and the next caller starts a
                 // fresh request; an unconditional clear here would retire that newer
@@ -121,9 +138,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                 : window.location.href;
             // Build the login URL
             const loginUrl = `${options.appBaseUrl}/login?from_url=${encodeURIComponent(redirectUrl)}`;
-            // The login page must not boot with the token that just got us here,
-            // or a rejected token redirects to /login forever.
-            removeStoredAccessTokens();
+            // Redirect to the login page
             window.location.href = loginUrl;
         },
         // Redirects the user to a provider's login page

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.54-pr.264.92c17fa",
+  "version": "0.8.54-pr.264.cfcaa05",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",