@bounded-sh/core 0.0.23 → 0.0.25

package/dist/index.mjs

@@ -2923,6 +2923,7 @@ class WebSessionManager {
     /* STORE                                                              */
     /* ------------------------------------------------------------------ */
     static async storeSession(address, accessToken, idToken, refreshToken, issuer) {
+        var _a;
         if (typeof window === "undefined")
             return;
         // JWT-wallet binding: refuse to store a session whose idToken is bound
@@ -2945,7 +2946,7 @@ class WebSessionManager {
             if (typeof (err === null || err === void 0 ? void 0 : err.message) === "string" && err.message.includes("Refusing to store session")) {
                 throw err;
             }
-            console.warn("[WebSessionManager] storeSession: failed to decode idToken for validation:", err);
+            console.warn("[WebSessionManager] storeSession: failed to decode idToken for validation. reason:", (_a = err === null || err === void 0 ? void 0 : err.name) !== null && _a !== void 0 ? _a : "decode_failed");
         }
         const config = await getConfig();
         const currentAppId = config.appId;
@@ -2976,8 +2977,12 @@ class WebSessionManager {
         }
         /* ---------- check JWT expiration ---------- */
         try {
-            const { accessToken } = sessionObj;
-            const { exp } = JSON.parse(this.decodeBase64Url(accessToken.split(".")[1]));
+            // Check expiry on the ID TOKEN — it is ALWAYS a JWT. The OIDC access_token for
+            // email/social (hosted) logins is an OPAQUE string (not a JWT), so decoding IT
+            // here threw and the catch below wiped a perfectly valid session — breaking
+            // hosted login. The idToken carries the canonical identity (@user.id) + exp.
+            const { idToken } = sessionObj;
+            const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
             if (Date.now() > exp * 1000) {
                 const { refreshToken } = sessionObj;
                 if (!refreshToken)
@@ -3137,6 +3142,7 @@ class ReactNativeSessionManager {
     /* STORE                                                              */
     /* ------------------------------------------------------------------ */
     static async storeSession(address, accessToken, idToken, refreshToken, issuer) {
+        var _a;
         // JWT-wallet binding: refuse to store a session whose idToken is bound
         // to a different wallet than `address`. Prevents races that would otherwise
         // leave storage with mismatched address/token state.
@@ -3157,7 +3163,7 @@ class ReactNativeSessionManager {
             if (typeof (err === null || err === void 0 ? void 0 : err.message) === "string" && err.message.includes("Refusing to store session")) {
                 throw err;
             }
-            console.warn("[ReactNativeSessionManager] storeSession: failed to decode idToken for validation:", err);
+            console.warn("[ReactNativeSessionManager] storeSession: failed to decode idToken for validation. reason:", (_a = err === null || err === void 0 ? void 0 : err.name) !== null && _a !== void 0 ? _a : "decode_failed");
         }
         const config = await getConfig();
         const currentAppId = config.appId;
@@ -3185,8 +3191,10 @@ class ReactNativeSessionManager {
         }
         /* ---------- check JWT expiration ---------- */
         try {
-            const { accessToken } = sessionObj;
-            const { exp } = JSON.parse(this.decodeBase64Url(accessToken.split(".")[1]));
+            // Expiry on the ID TOKEN (always a JWT). The OIDC access_token for email/social
+            // logins is opaque, so decoding it threw → the catch wiped a valid session.
+            const { idToken } = sessionObj;
+            const { exp } = JSON.parse(this.decodeBase64Url(idToken.split(".")[1]));
             if (Date.now() > exp * 1000) {
                 const { refreshToken } = sessionObj;
                 if (!refreshToken)
@@ -5488,6 +5496,7 @@ function bearerFromAuthHeaders(headers) {
 // Monotonic counter for unique-ish fallback identity keys (no Date.now in some envs).
 let connectionEpoch = 0;
 function isTokenExpired(token) {
+    var _a;
     try {
         const payload = JSON.parse(decodeBase64Url(token.split('.')[1]));
         const expirationTime = payload.exp * 1000;
@@ -5495,7 +5504,7 @@ function isTokenExpired(token) {
         return currentTime > (expirationTime - 60000); // 60 second buffer
     }
     catch (error) {
-        console.error('[WS v2] Error checking token expiration:', error);
+        console.error('[WS v2] Error checking token expiration. reason:', (_a = error === null || error === void 0 ? void 0 : error.name) !== null && _a !== void 0 ? _a : 'decode_failed');
         return true;
     }
 }
@@ -6929,6 +6938,13 @@ function withoutAuthorization(headers) {
     }
     return Object.keys(clean).length > 0 ? clean : undefined;
 }
+function hasAuthorization(headers) {
+    if (!headers)
+        return false;
+    return Object.entries(headers).some(([key, value]) => key.toLowerCase() === 'authorization' &&
+        typeof value === 'string' &&
+        /^Bearer\s+\S+$/i.test(value.trim()));
+}
 async function liveAuthHeader(configIsServer, overrides) {
     if (overrides === null || overrides === void 0 ? void 0 : overrides._getAuthHeaders) {
         return overrides._getAuthHeaders();
@@ -6954,6 +6970,12 @@ async function intent(roomPath, intent, opts = {}) {
         throw new LiveIntentError('A room path is required');
     }
     const config = await getConfig();
+    const initialAuthHeader = await liveAuthHeader(config.isServer, opts._overrides);
+    if (!hasAuthorization(initialAuthHeader)) {
+        if (opts.fireAndForget)
+            return { ok: true };
+        throw new LiveIntentError('Authentication required to send a live intent. Call init() and sign in before sending live room intents.', 401);
+    }
     // Ride the already-open per-room socket instead of a fresh HTTP POST per
     // intent. That is what makes high-frequency input (~20-30Hz) cheap — one
     // persistent connection, no per-intent TCP/TLS or connection-pool contention
@@ -6987,6 +7009,9 @@ async function intent(roomPath, intent, opts = {}) {
     const overrideHeaders = withoutAuthorization((_b = opts._overrides) === null || _b === void 0 ? void 0 : _b.headers);
     const buildHeaders = async () => {
         const authHeader = await liveAuthHeader(config.isServer, opts._overrides);
+        if (!hasAuthorization(authHeader)) {
+            throw new LiveIntentError('Authentication required to send a live intent. Call init() and sign in before sending live room intents.', 401);
+        }
         return Object.assign(Object.assign(Object.assign({ 'Content-Type': 'application/json', 'X-App-Id': config.appId }, (overrideHeaders !== null && overrideHeaders !== void 0 ? overrideHeaders : {})), (extraHeaders !== null && extraHeaders !== void 0 ? extraHeaders : {})), (authHeader !== null && authHeader !== void 0 ? authHeader : {}));
     };
     const controller = new AbortController();
@@ -7008,6 +7033,8 @@ async function intent(roomPath, intent, opts = {}) {
     }
     catch (err) {
         clearTimeout(timer);
+        if (err instanceof LiveIntentError)
+            throw err;
         if ((err === null || err === void 0 ? void 0 : err.name) === 'AbortError') {
             throw new LiveIntentError(`Live intent to "${roomPath}" timed out after ${timeoutMs}ms`);
         }