@calimero-network/mero-js 25.0.1 → 25.0.2

package/dist/index.cjs

@@ -12336,6 +12336,13 @@ var MeroJs = class {
   constructor(config) {
     this.tokenData = null;
     this.refreshPromise = null;
+    // True while the store is known to hold our tokens; a store that cannot persist never sets it.
+    this.storeHoldsTokens = false;
+    // Bumped when local tokens are dropped, so a refresh already in flight cannot restore them.
+    this.tokenGeneration = 0;
+    this.onStorage = () => {
+      if (this.signedOutElsewhere()) this.dropLocalTokens();
+    };
     this.rpcClient = null;
     this.sseClient = null;
     this.wsClient = null;
@@ -12347,6 +12354,8 @@ var MeroJs = class {
     this.tokenStore = config.tokenStore ?? null;
     if (this.tokenStore) {
       this.tokenData = this.tokenStore.getTokens();
+      this.storeHoldsTokens = this.tokenData !== null;
+      if (typeof window !== "undefined") window.addEventListener("storage", this.onStorage);
     }
     const isTauri = typeof window !== "undefined" && "__TAURI_INTERNALS__" in window;
     const getProof = resolveProofSigner(this.config.requestProof);
@@ -12365,7 +12374,7 @@ var MeroJs = class {
       onTokenRefresh: async (newToken) => {
         if (this.tokenData) {
           this.tokenData.access_token = newToken;
-          this.tokenStore?.setTokens(this.tokenData);
+          this.persistTokens(this.tokenData);
         }
       },
       onAuthRevoked: async () => {
@@ -12511,7 +12520,7 @@ var MeroJs = class {
         refresh_token: response.data.refresh_token,
         expires_at: expiresAtFromJwt(accessToken, Date.now() + 36e5)
       };
-      this.tokenStore?.setTokens(this.tokenData);
+      this.persistTokens(this.tokenData);
       return this.tokenData;
     } catch (error) {
       throw new Error(
@@ -12519,6 +12528,21 @@ var MeroJs = class {
       );
     }
   }
+  persistTokens(data) {
+    if (!this.tokenStore) return;
+    this.tokenStore.setTokens(data);
+    this.storeHoldsTokens = this.tokenStore.getTokens() !== null;
+  }
+  // Raw store read: an empty store is a logout, another node's bundle is not.
+  signedOutElsewhere() {
+    return this.storeHoldsTokens && !this.tokenStore?.getTokens();
+  }
+  dropLocalTokens() {
+    this.tokenGeneration++;
+    this.refreshPromise = null;
+    this.tokenData = null;
+    this.storeHoldsTokens = false;
+  }
   /**
    * Get a valid token. Returns the current token as-is.
    * The server rejects refresh attempts while the access token is still valid,
@@ -12572,8 +12596,13 @@ var MeroJs = class {
    * Perform the actual token refresh. Runs with the refresh lock held.
    */
   async performTokenRefreshLocked(triggeringAccessToken) {
+    if (this.signedOutElsewhere()) {
+      this.dropLocalTokens();
+      throw new Error("Signed out in another tab");
+    }
     const stored = this.tokenStore?.getTokens() ?? null;
     if (stored?.refresh_token) {
+      this.storeHoldsTokens = true;
       this.tokenData = stored;
       if (triggeringAccessToken && stored.access_token !== triggeringAccessToken) {
         return stored;
@@ -12582,11 +12611,20 @@ var MeroJs = class {
     if (!this.tokenData?.refresh_token) {
       throw new Error("No refresh token available");
     }
+    const generation = this.tokenGeneration;
+    const presented = this.tokenData.access_token;
+    const storeHeldPresented = this.tokenStore?.getTokens()?.access_token === presented;
     try {
       const response = await this.authClient.refreshToken({
         access_token: this.tokenData.access_token,
         refresh_token: this.tokenData.refresh_token
       });
+      if (generation !== this.tokenGeneration) throw new Error("Signed out during token refresh");
+      if (storeHeldPresented && this.tokenStore?.getTokens()?.access_token !== presented) {
+        this.tokenData = this.tokenStore?.getTokens() ?? null;
+        this.storeHoldsTokens = this.tokenData !== null;
+        throw new Error("Signed out during token refresh");
+      }
       const accessToken = response.data.access_token;
       this.tokenData = {
         access_token: accessToken,
@@ -12595,7 +12633,7 @@ var MeroJs = class {
         refresh_token: response.data.refresh_token,
         expires_at: expiresAtFromJwt(accessToken, Date.now() + 36e5)
       };
-      this.tokenStore?.setTokens(this.tokenData);
+      this.persistTokens(this.tokenData);
       return this.tokenData;
     } catch (error) {
       throw new Error(
@@ -12607,8 +12645,7 @@ var MeroJs = class {
    * Clear the current token
    */
   clearToken() {
-    this.refreshPromise = null;
-    this.tokenData = null;
+    this.dropLocalTokens();
     this.tokenStore?.clear();
   }
   /**
@@ -12625,7 +12662,7 @@ var MeroJs = class {
   setTokenData(data) {
     const expiresAt = data.expires_at || expiresAtFromJwt(data.access_token, Date.now() + 36e5);
     this.tokenData = { ...data, expires_at: expiresAt };
-    this.tokenStore?.setTokens(this.tokenData);
+    this.persistTokens(this.tokenData);
   }
   /**
    * Get the current token data (for debugging)
@@ -12637,6 +12674,7 @@ var MeroJs = class {
    * Close all event connections and clean up resources
    */
   close() {
+    if (typeof window !== "undefined") window.removeEventListener("storage", this.onStorage);
     this.sseClient?.close();
     this.wsClient?.close();
   }