@behio/storefront-sdk 2.0.1 → 2.0.2

package/dist/next.mjs

@@ -1,6 +1,6 @@
 import {
   BehioStorefront
-} from "./chunk-SCFR6JH7.mjs";
+} from "./chunk-MCWHR3BY.mjs";
 
 // src/next.ts
 import { cookies, headers } from "next/headers";

package/dist/react.d.mts

@@ -2855,6 +2855,19 @@ declare class BehioStorefront {
     private isRefreshing;
     private refreshPromise;
     private cartSession?;
+    private requestContextVersion;
+    private authContextVersion;
+    /** @internal Opaque generation, never a token or customer identifier. */
+    getRequestContextVersion(): number;
+    /** @internal Refreshes must not restore a session that has been replaced. */
+    getAuthContextVersion(): number;
+    /** @internal A refresh rotates credentials within the same customer session. */
+    acceptRefreshedTokens(tokens: {
+        accessToken: string;
+        refreshToken: string;
+    }, expectedVersion: number): boolean;
+    /** @internal An obsolete response must not update cache, session or retries. */
+    assertRequestContext(version: number, authOnly?: boolean): void;
     private listeners;
     private requestInterceptors;
     private responseInterceptors;

package/dist/react.d.ts

@@ -2855,6 +2855,19 @@ declare class BehioStorefront {
     private isRefreshing;
     private refreshPromise;
     private cartSession?;
+    private requestContextVersion;
+    private authContextVersion;
+    /** @internal Opaque generation, never a token or customer identifier. */
+    getRequestContextVersion(): number;
+    /** @internal Refreshes must not restore a session that has been replaced. */
+    getAuthContextVersion(): number;
+    /** @internal A refresh rotates credentials within the same customer session. */
+    acceptRefreshedTokens(tokens: {
+        accessToken: string;
+        refreshToken: string;
+    }, expectedVersion: number): boolean;
+    /** @internal An obsolete response must not update cache, session or retries. */
+    assertRequestContext(version: number, authOnly?: boolean): void;
     private listeners;
     private requestInterceptors;
     private responseInterceptors;

package/dist/react.js

@@ -244,6 +244,8 @@ var BehioStorefront = class {
     // Token refresh lock
     this.isRefreshing = false;
     this.refreshPromise = null;
+    this.requestContextVersion = 0;
+    this.authContextVersion = 0;
     // Event emitter
     this.listeners = /* @__PURE__ */ new Map();
     // Interceptors
@@ -287,6 +289,28 @@ var BehioStorefront = class {
     this.subscriptions = new SubscriptionsModule(this);
     this.certificates = new CourseCertificatesModule(this);
   }
+  /** @internal Opaque generation, never a token or customer identifier. */
+  getRequestContextVersion() {
+    return this.requestContextVersion;
+  }
+  /** @internal Refreshes must not restore a session that has been replaced. */
+  getAuthContextVersion() {
+    return this.authContextVersion;
+  }
+  /** @internal A refresh rotates credentials within the same customer session. */
+  acceptRefreshedTokens(tokens, expectedVersion) {
+    if (this.authContextVersion !== expectedVersion) return false;
+    if (!this.accessToken) this.setTokens(tokens);
+    else {
+      this.accessToken = tokens.accessToken;
+      this.refreshToken = tokens.refreshToken;
+    }
+    return true;
+  }
+  /** @internal An obsolete response must not update cache, session or retries. */
+  assertRequestContext(version, authOnly = false) {
+    if (version !== (authOnly ? this.authContextVersion : this.requestContextVersion)) throw new BehioApiError(409, null, "The storefront session or pricing context changed. Please retry in the current context.");
+  }
   // --- Public methods ---
   /**
    * Called by the analytics tracker when the visitor grants (id) or revokes
@@ -380,11 +404,19 @@ var BehioStorefront = class {
   }
   /** Set auth tokens (e.g. from localStorage) */
   setTokens(tokens) {
+    if (this.accessToken !== tokens.accessToken || this.refreshToken !== tokens.refreshToken) {
+      this.authContextVersion++;
+      this.requestContextVersion++;
+    }
     this.accessToken = tokens.accessToken;
     this.refreshToken = tokens.refreshToken;
   }
   /** Clear auth tokens */
   clearTokens() {
+    if (this.accessToken || this.refreshToken) {
+      this.authContextVersion++;
+      this.requestContextVersion++;
+    }
     this.accessToken = void 0;
     this.refreshToken = void 0;
   }
@@ -398,6 +430,7 @@ var BehioStorefront = class {
   }
   /** Set cart session token (e.g. from cookie) */
   setCartSession(token) {
+    if (this.cartSession !== token) this.requestContextVersion++;
     this.cartSession = token;
   }
   /** Get cart session token */
@@ -406,6 +439,7 @@ var BehioStorefront = class {
   }
   /** Clear cart session */
   clearCartSession() {
+    if (this.cartSession) this.requestContextVersion++;
     this.cartSession = void 0;
   }
   // --- Default currency / locale (runtime-switchable) ---
@@ -416,6 +450,7 @@ var BehioStorefront = class {
    * (falls back to the shop's default currency server-side).
    */
   setCurrency(currency) {
+    if (this.defaultCurrency !== (currency || void 0)) this.requestContextVersion++;
     this.defaultCurrency = currency || void 0;
   }
   /** Get the current default currency, if any. */
@@ -425,13 +460,16 @@ var BehioStorefront = class {
   /** Set the catalog's delivery country. Use cart.setDestination separately for the cart. */
   setCountry(country) {
     const normalized = country?.trim().toUpperCase();
-    this.defaultCountry = normalized && /^[A-Z]{2}$/.test(normalized) ? normalized : void 0;
+    const next = normalized && /^[A-Z]{2}$/.test(normalized) ? normalized : void 0;
+    if (this.defaultCountry !== next) this.requestContextVersion++;
+    this.defaultCountry = next;
   }
   getCountry() {
     return this.defaultCountry;
   }
   /** Set the default locale sent on every catalog request (per-call wins). */
   setLocale(locale) {
+    if (this.defaultLocale !== (locale || void 0)) this.requestContextVersion++;
     this.defaultLocale = locale || void 0;
   }
   /** Get the current default locale, if any. */
@@ -487,18 +525,17 @@ var BehioStorefront = class {
       return;
     }
     this.isRefreshing = true;
+    const authVersion = this.authContextVersion;
     this.refreshPromise = (async () => {
       try {
         const res = await this.auth.refresh();
-        if (res.error) {
+        if (res.error) throw new BehioApiError(res.error.status ?? 401, res.error.body, res.error.message);
+        if (this.authContextVersion === authVersion) this.emit("auth:token-refresh");
+      } catch (err) {
+        if (this.authContextVersion === authVersion) {
           this.clearTokens();
           this.emit("auth:token-refresh-failed");
-          throw new BehioApiError(401, null, "Token refresh failed");
         }
-        this.emit("auth:token-refresh");
-      } catch (err) {
-        this.clearTokens();
-        this.emit("auth:token-refresh-failed");
         if (err instanceof BehioApiError) throw err;
         throw new BehioApiError(401, null, "Token refresh failed");
       } finally {
@@ -535,6 +572,7 @@ var BehioStorefront = class {
    * @internal — use the typed module methods (behio.certificates.downloadPdf).
    */
   async requestBlob(path) {
+    const authVersion = this.authContextVersion;
     try {
       const headers = { "X-Api-Key": this.apiKey };
       if (this.accessToken)
@@ -550,7 +588,9 @@ var BehioStorefront = class {
         }
         throw new BehioApiError(res.status, body);
       }
-      return ok(await res.blob());
+      const blob = await res.blob();
+      this.assertRequestContext(authVersion, true);
+      return ok(blob);
     } catch (err) {
       if (this.throwOnAvailabilityError && isAvailabilityFailure(err)) {
         throw err;
@@ -564,6 +604,8 @@ var BehioStorefront = class {
    * public callers must go through `request()` which returns Result.
    */
   async rawRequest(method, path, options) {
+    const authOnly = path.startsWith("/auth/");
+    const requestVersion = authOnly ? this.authContextVersion : this.requestContextVersion;
     const params = new URLSearchParams();
     if (options?.query) {
       for (const [key, value] of Object.entries(options.query)) {
@@ -629,6 +671,7 @@ var BehioStorefront = class {
     }
     this.emit("request", { method, path });
     for (let attempt = 0; attempt <= this.retries; attempt++) {
+      this.assertRequestContext(requestVersion, authOnly);
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), this.timeout);
       if (options?.signal) {
@@ -650,6 +693,7 @@ var BehioStorefront = class {
         });
       } catch (err) {
         clearTimeout(timeoutId);
+        this.assertRequestContext(requestVersion, authOnly);
         const isAbort = err instanceof DOMException && err.name === "AbortError";
         const networkErr = new BehioNetworkError(
           isAbort ? "Request timed out" : err.message || "Network error",
@@ -666,6 +710,7 @@ var BehioStorefront = class {
       } finally {
         clearTimeout(timeoutId);
       }
+      this.assertRequestContext(requestVersion, authOnly);
       const remaining = res.headers.get("X-RateLimit-Remaining");
       const reset = res.headers.get("X-RateLimit-Reset");
       if (remaining) this.rateLimitRemaining = parseInt(remaining, 10);
@@ -679,6 +724,7 @@ var BehioStorefront = class {
       this.emit("response", { method, path, status: res.status });
       if (!res.ok) {
         const body = await res.json().catch(() => null);
+        this.assertRequestContext(requestVersion, authOnly);
         const apiError = new BehioApiError(
           res.status,
           body,
@@ -687,11 +733,13 @@ var BehioStorefront = class {
         if (res.status === 401 && this.refreshToken && options?.auth !== false && !options?._isRetryAfterRefresh) {
           try {
             await this.handleTokenRefresh();
+            this.assertRequestContext(requestVersion, authOnly);
             return this.rawRequest(method, path, {
               ...options,
               _isRetryAfterRefresh: true
             });
-          } catch {
+          } catch (error) {
+            if (error instanceof BehioApiError && error.status === 409) throw error;
             this.emit("error", apiError);
             throw apiError;
           }
@@ -716,6 +764,7 @@ var BehioStorefront = class {
         } catch {
         }
       }
+      this.assertRequestContext(requestVersion, authOnly);
       return responseData;
     }
     throw new BehioNetworkError("Request failed after retries");
@@ -1060,17 +1109,21 @@ var AuthModule = class {
         }
       };
     }
+    const authVersion = this.client.getAuthContextVersion();
     const res = await this.client.request("POST", "/auth/refresh", {
       body: { refreshToken: token },
       auth: false
     });
     if (res.error) return res;
-    this.client.setTokens(res.data);
+    if (!this.client.acceptRefreshedTokens(res.data, authVersion)) {
+      return { data: null, error: toSdkError(new BehioApiError(409, null, "The customer session changed.")) };
+    }
     return res;
   }
   /** Logout (invalidate refresh token) */
   async logout(refreshToken) {
     const token = refreshToken || this.client.getRefreshToken();
+    const authVersion = this.client.getAuthContextVersion();
     const res = await this.client.request(
       "POST",
       "/auth/logout",
@@ -1078,8 +1131,10 @@ var AuthModule = class {
         body: { refreshToken: token }
       }
     );
-    this.client.clearTokens();
-    this.client.emit("auth:logout");
+    if (this.client.getAuthContextVersion() === authVersion) {
+      this.client.clearTokens();
+      this.client.emit("auth:logout");
+    }
     return res;
   }
   /** Request password reset email */
@@ -2705,6 +2760,19 @@ function useCartCount(options) {
 // src/react/hooks/use-auth.ts
 var import_react6 = require("react");
 var import_react_query14 = require("@tanstack/react-query");
+
+// src/react/utils/clear-customer-queries.ts
+async function clearCustomerQueries(queryClient, client) {
+  const version = client.getAuthContextVersion();
+  await queryClient.cancelQueries({ queryKey: ["behio"] });
+  if (client.getAuthContextVersion() !== version) return false;
+  for (const query of queryClient.getQueryCache().findAll({ queryKey: ["behio"] })) {
+    query.setState({ data: void 0, dataUpdatedAt: 0, error: null, errorUpdatedAt: 0, status: "pending" });
+  }
+  return true;
+}
+
+// src/react/hooks/use-auth.ts
 var CUSTOMER_KEY = ["behio", "customer"];
 var CART_KEY3 = ["behio", "cart"];
 function useAuth() {
@@ -2727,42 +2795,52 @@ function useAuth() {
     },
     [client, storage]
   );
-  const clearAuth = (0, import_react6.useCallback)(() => {
+  const clearAuth = (0, import_react6.useCallback)(async () => {
     client.clearTokens();
     storage.remove(STORAGE_KEYS.ACCESS_TOKEN);
     storage.remove(STORAGE_KEYS.REFRESH_TOKEN);
+    if (!await clearCustomerQueries(queryClient, client)) return;
+    queryClient.setQueryData([...CART_KEY3], null);
     queryClient.setQueryData([...CUSTOMER_KEY], null);
-    queryClient.invalidateQueries({ queryKey: ["behio", "orders"] });
-    queryClient.invalidateQueries({ queryKey: ["behio", "addresses"] });
-    void refreshBundleQueries(queryClient);
+    if (client.getCartSession()) void queryClient.invalidateQueries({ queryKey: [...CART_KEY3] });
+    void queryClient.invalidateQueries({ queryKey: ["behio"] });
   }, [client, storage, queryClient]);
   const postAuth = (0, import_react6.useCallback)(async () => {
+    const authVersion = client.getAuthContextVersion();
+    if (!await clearCustomerQueries(queryClient, client)) return;
     await queryClient.invalidateQueries({ queryKey: [...CUSTOMER_KEY] });
+    if (client.getAuthContextVersion() !== authVersion) return;
     if (client.getCartSession()) {
       try {
         await unwrap(client.cart.merge());
+        if (client.getAuthContextVersion() !== authVersion) return;
         client.clearCartSession();
         storage.remove(STORAGE_KEYS.CART_SESSION);
       } catch {
       }
     }
+    if (client.getAuthContextVersion() !== authVersion) return;
     queryClient.invalidateQueries({ queryKey: [...CART_KEY3] });
     void refreshBundleQueries(queryClient);
   }, [client, storage, queryClient]);
   const loginMutation = (0, import_react_query14.useMutation)({
     mutationFn: async ({ email, password }) => {
-      return unwrap(client.auth.login({ email, password }));
+      const tokens = await unwrap(client.auth.login({ email, password }));
+      return { tokens, authVersion: client.getAuthContextVersion() };
     },
-    onSuccess: async (tokens) => {
+    onSuccess: async ({ tokens, authVersion }) => {
+      if (client.getAuthContextVersion() !== authVersion) return;
       persistTokens(tokens);
       await postAuth();
     }
   });
   const registerMutation = (0, import_react_query14.useMutation)({
     mutationFn: async (input) => {
-      return unwrap(client.auth.register(input));
+      const result = await unwrap(client.auth.register(input));
+      return { result, authVersion: client.getAuthContextVersion() };
     },
-    onSuccess: async (result) => {
+    onSuccess: async ({ result, authVersion }) => {
+      if (client.getAuthContextVersion() !== authVersion) return;
       if (result.accessToken && result.refreshToken) {
         persistTokens({ accessToken: result.accessToken, refreshToken: result.refreshToken });
         await postAuth();
@@ -2771,8 +2849,9 @@ function useAuth() {
   });
   const logoutMutation = (0, import_react_query14.useMutation)({
     mutationFn: () => unwrap(client.auth.logout()),
-    onSettled: () => {
-      clearAuth();
+    onMutate: () => client.getAuthContextVersion(),
+    onSettled: (_result, _error, _variables, authVersion) => {
+      if (!client.getAccessToken() || client.getAuthContextVersion() === authVersion) return clearAuth();
     }
   });
   const forgotPasswordMutation = (0, import_react_query14.useMutation)({