@base44-preview/sdk 0.8.54-pr.344.ece486e → 0.8.55-pr.345.357a9ca

package/dist/modules/auth.js

@@ -1,3 +1,4 @@
+import { getAccessToken, removeAccessToken } from "../utils/auth-utils.js";
 import { resetAnalyticsSessionContext } from "./analytics.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
@@ -53,6 +54,21 @@ function loginViaPopup(url, redirectUrl, expectedOrigin) {
     }, 500);
     window.addEventListener("message", onMessage);
 }
+// "token" is the key the platform-v2 built-in SDK wrote.
+function removeStoredAccessTokens() {
+    removeAccessToken({});
+    removeAccessToken({ storageKey: "token" });
+}
+const isStoredAccessToken = (authorization) => authorization ===
+    `Bearer ${getAccessToken({ saveToStorage: false, removeFromUrl: false })}`;
+// A rejected token left in storage boots the next page with it, and an app
+// whose own /login does that loops 401 → /login. A token stored since the
+// request went out (a login in this or another tab) is not the rejected one.
+function clearTokenOnRejection(error, sentAuthorization) {
+    if (error.status === 401 && isStoredAccessToken(sentAuthorization)) {
+        removeStoredAccessTokens();
+    }
+}
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -88,7 +104,14 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Get current user information
         async me() {
-            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
+            const sentAuthorization = axios.defaults.headers.common["Authorization"];
+            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios
+                .get(`/apps/${appId}/entities/User/me`)
+                .catch((error) => {
+                clearTokenOnRejection(error, sentAuthorization);
+                throw error;
+            })
+                .finally(() => {
                 // Only retire this request if it is still the shared one. An identity
                 // change mid-flight clears `pendingMe` and the next caller starts a
                 // fresh request; an unconditional clear here would retire that newer
@@ -154,17 +177,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             hasAccessToken = false;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
-                // Remove token from localStorage
-                if (window.localStorage) {
-                    try {
-                        window.localStorage.removeItem("base44_access_token");
-                        // Remove "token" that is set by the built-in SDK of platform version 2
-                        window.localStorage.removeItem("token");
-                    }
-                    catch (e) {
-                        console.error("Failed to remove token from localStorage:", e);
-                    }
-                }
+                removeStoredAccessTokens();
                 // Determine the from_url parameter
                 const fromUrl = redirectUrl || window.location.href;
                 // Redirect to server-side logout endpoint to clear HTTP-only cookies

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.54-pr.344.ece486e",
+  "version": "0.8.55-pr.345.357a9ca",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",