@calimero-network/mero-js 25.0.1 → 25.0.2

package/dist/mero-js.d.ts

@@ -98,6 +98,9 @@ export declare class MeroJs {
     private tokenData;
     private refreshPromise;
     private tokenStore;
+    private storeHoldsTokens;
+    private tokenGeneration;
+    private readonly onStorage;
     private rpcClient;
     private sseClient;
     private wsClient;
@@ -152,6 +155,9 @@ export declare class MeroJs {
         username: string;
         password: string;
     }): Promise<TokenData>;
+    private persistTokens;
+    private signedOutElsewhere;
+    private dropLocalTokens;
     /**
      * Get a valid token. Returns the current token as-is.
      * The server rejects refresh attempts while the access token is still valid,

package/dist/mero-js.js

@@ -55,6 +55,14 @@ export class MeroJs {
     constructor(config) {
         this.tokenData = null;
         this.refreshPromise = null;
+        // True while the store is known to hold our tokens; a store that cannot persist never sets it.
+        this.storeHoldsTokens = false;
+        // Bumped when local tokens are dropped, so a refresh already in flight cannot restore them.
+        this.tokenGeneration = 0;
+        this.onStorage = () => {
+            if (this.signedOutElsewhere())
+                this.dropLocalTokens();
+        };
         this.rpcClient = null;
         this.sseClient = null;
         this.wsClient = null;
@@ -67,6 +75,9 @@ export class MeroJs {
         // Restore tokens from store if available
         if (this.tokenStore) {
             this.tokenData = this.tokenStore.getTokens();
+            this.storeHoldsTokens = this.tokenData !== null;
+            if (typeof window !== 'undefined')
+                window.addEventListener('storage', this.onStorage);
         }
         // Create HTTP client with token management
         // For Tauri, explicitly set credentials to 'omit' to avoid network errors
@@ -90,7 +101,7 @@ export class MeroJs {
             onTokenRefresh: async (newToken) => {
                 if (this.tokenData) {
                     this.tokenData.access_token = newToken;
-                    this.tokenStore?.setTokens(this.tokenData);
+                    this.persistTokens(this.tokenData);
                 }
             },
             onAuthRevoked: async () => {
@@ -242,13 +253,29 @@ export class MeroJs {
                 refresh_token: response.data.refresh_token,
                 expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
             };
-            this.tokenStore?.setTokens(this.tokenData);
+            this.persistTokens(this.tokenData);
             return this.tokenData;
         }
         catch (error) {
             throw new Error(`Authentication failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
         }
     }
+    persistTokens(data) {
+        if (!this.tokenStore)
+            return;
+        this.tokenStore.setTokens(data);
+        this.storeHoldsTokens = this.tokenStore.getTokens() !== null;
+    }
+    // Raw store read: an empty store is a logout, another node's bundle is not.
+    signedOutElsewhere() {
+        return this.storeHoldsTokens && !this.tokenStore?.getTokens();
+    }
+    dropLocalTokens() {
+        this.tokenGeneration++;
+        this.refreshPromise = null;
+        this.tokenData = null;
+        this.storeHoldsTokens = false;
+    }
     /**
      * Get a valid token. Returns the current token as-is.
      * The server rejects refresh attempts while the access token is still valid,
@@ -306,8 +333,14 @@ export class MeroJs {
     async performTokenRefreshLocked(triggeringAccessToken) {
         // Another instance/tab may have rotated the bundle while we were queued behind
         // the lock — the store, not our in-memory copy, is the source of truth.
+        if (this.signedOutElsewhere()) {
+            // Another holder signed out and emptied the store; refreshing would undo that.
+            this.dropLocalTokens();
+            throw new Error('Signed out in another tab');
+        }
         const stored = this.tokenStore?.getTokens() ?? null;
         if (stored?.refresh_token) {
+            this.storeHoldsTokens = true;
             this.tokenData = stored;
             if (triggeringAccessToken && stored.access_token !== triggeringAccessToken) {
                 // Someone else already refreshed. Reuse their bundle rather than replaying
@@ -318,11 +351,24 @@ export class MeroJs {
         if (!this.tokenData?.refresh_token) {
             throw new Error('No refresh token available');
         }
+        // The store held the token we present; if it no longer does after the refresh, the
+        // session was replaced or signed out meanwhile and our rotated tokens must not be written.
+        const generation = this.tokenGeneration;
+        const presented = this.tokenData.access_token;
+        const storeHeldPresented = this.tokenStore?.getTokens()?.access_token === presented;
         try {
             const response = await this.authClient.refreshToken({
                 access_token: this.tokenData.access_token,
                 refresh_token: this.tokenData.refresh_token,
             });
+            // A local drop already set the state; a store change by another tab is adopted.
+            if (generation !== this.tokenGeneration)
+                throw new Error('Signed out during token refresh');
+            if (storeHeldPresented && this.tokenStore?.getTokens()?.access_token !== presented) {
+                this.tokenData = this.tokenStore?.getTokens() ?? null;
+                this.storeHoldsTokens = this.tokenData !== null;
+                throw new Error('Signed out during token refresh');
+            }
             const accessToken = response.data.access_token;
             this.tokenData = {
                 access_token: accessToken,
@@ -331,7 +377,7 @@ export class MeroJs {
                 refresh_token: response.data.refresh_token,
                 expires_at: expiresAtFromJwt(accessToken, Date.now() + 3600000),
             };
-            this.tokenStore?.setTokens(this.tokenData);
+            this.persistTokens(this.tokenData);
             return this.tokenData;
         }
         catch (error) {
@@ -346,8 +392,7 @@ export class MeroJs {
      * Clear the current token
      */
     clearToken() {
-        this.refreshPromise = null;
-        this.tokenData = null;
+        this.dropLocalTokens();
         this.tokenStore?.clear();
     }
     /**
@@ -364,7 +409,7 @@ export class MeroJs {
     setTokenData(data) {
         const expiresAt = data.expires_at || expiresAtFromJwt(data.access_token, Date.now() + 3600000);
         this.tokenData = { ...data, expires_at: expiresAt };
-        this.tokenStore?.setTokens(this.tokenData);
+        this.persistTokens(this.tokenData);
     }
     /**
      * Get the current token data (for debugging)
@@ -376,6 +421,8 @@ export class MeroJs {
      * Close all event connections and clean up resources
      */
     close() {
+        if (typeof window !== 'undefined')
+            window.removeEventListener('storage', this.onStorage);
         this.sseClient?.close();
         this.wsClient?.close();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "25.0.1",
+  "version": "25.0.2",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {