@classic-homes/auth 0.1.53 → 0.1.56

package/README.md

@@ -37,6 +37,12 @@ initAuth({
     setItem: (key, value) => localStorage.setItem(key, value),
     removeItem: (key) => localStorage.removeItem(key),
   },
+  // ⚠️ SECURITY: localStorage (also the default when `storage` is omitted)
+  // persists the long-lived refresh token where any XSS can read it.
+  // Safer options exported from '@classic-homes/auth/core':
+  //   storage: createSessionStorage()  // per-tab, cleared on close
+  //   storage: createMemoryStorage()   // never persisted, lost on reload
+  // or keep tokens out of JS entirely with an httpOnly-cookie flow.
   // SSO configuration (optional)
   sso: {
     enabled: true,

package/dist/auth.svelte-WPCYPHEE.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-CPFM7JEI.js';
+import './chunk-2QYFVJEM.js';
+import './chunk-6NTZVDLW.js';

package/dist/{chunk-U5E4T4NS.js → chunk-2QYFVJEM.js}

@@ -1,9 +1,13 @@
-import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-EM7PUNZB.js';
+import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-6NTZVDLW.js';
 
 // src/core/client.ts
 var isRefreshing = false;
 var refreshSubscribers = [];
+var MAX_REFRESH_SUBSCRIBERS = 100;
 function subscribeTokenRefresh(cb) {
+  if (refreshSubscribers.length >= MAX_REFRESH_SUBSCRIBERS) {
+    throw new Error("Too many concurrent requests waiting for token refresh. Please try again.");
+  }
   refreshSubscribers.push(cb);
   return () => {
     const idx = refreshSubscribers.indexOf(cb);
@@ -11,8 +15,15 @@ function subscribeTokenRefresh(cb) {
   };
 }
 function onTokenRefreshed(token) {
-  refreshSubscribers.forEach((cb) => cb(token));
+  const subs = refreshSubscribers;
   refreshSubscribers = [];
+  subs.forEach((cb) => {
+    try {
+      cb(token);
+    } catch (e) {
+      console.error("Token refresh subscriber error:", e);
+    }
+  });
 }
 function getAccessToken() {
   const config = getConfig();
@@ -51,18 +62,16 @@ function updateStoredTokens(accessToken, refreshToken) {
   const config = getConfig();
   const storage = getStorage();
   const storageKey = config.storageKey ?? "classic_auth";
-  const authData = storage.getItem(storageKey);
   let parsed = {};
-  if (authData) {
-    try {
-      parsed = JSON.parse(authData);
-    } catch {
-    }
+  try {
+    const authData = storage.getItem(storageKey);
+    if (authData) parsed = JSON.parse(authData);
+  } catch {
   }
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
   storage.setItem(storageKey, JSON.stringify(parsed));
-  import('./auth.svelte-JXZ7XEE5.js').then(({ authStore }) => {
+  import('./auth.svelte-WPCYPHEE.js').then(({ authStore }) => {
     authStore.updateTokens(accessToken, refreshToken);
   }).catch(() => {
   });
@@ -81,13 +90,17 @@ async function refreshAccessToken() {
   if (!refreshToken) {
     return false;
   }
+  const timeoutMs = config.requestTimeout ?? 3e4;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetchFn(`${config.baseUrl}/auth/refresh`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken })
+      body: JSON.stringify({ refreshToken }),
+      signal: controller.signal
     });
     if (response.ok) {
       let apiResponse;
@@ -116,6 +129,8 @@ async function refreshAccessToken() {
     }
   } catch (error) {
     config.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+  } finally {
+    clearTimeout(timeoutId);
   }
   return false;
 }
@@ -131,11 +146,24 @@ function extractData(response) {
   }
   return response;
 }
-async function apiRequest(endpoint, options = {}) {
-  const { authenticated = false, customFetch, body, ...fetchOptions } = options;
+function apiRequest(endpoint, options = {}) {
+  return apiRequestInternal(endpoint, options, false);
+}
+async function apiRequestInternal(endpoint, options, isRetry) {
+  const { authenticated = false, customFetch, body, timeout, signal, ...fetchOptions } = options;
   const config = getConfig();
   const fetchFn = customFetch ?? getFetch();
   const url = endpoint.startsWith("http") ? endpoint : `${config.baseUrl}${endpoint}`;
+  const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  if (signal) {
+    if (signal.aborted) {
+      controller.abort();
+    } else {
+      signal.addEventListener("abort", () => controller.abort(), { once: true });
+    }
+  }
   const headers = {
     "Content-Type": "application/json",
     ...fetchOptions.headers
@@ -154,15 +182,26 @@ async function apiRequest(endpoint, options = {}) {
     const response = await fetchFn(url, {
       ...fetchOptions,
       headers,
-      body: body ? JSON.stringify(body) : void 0
+      body: body ? JSON.stringify(body) : void 0,
+      signal: controller.signal
     });
+    clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && typeof window !== "undefined") {
+      if (isRetry) {
+        clearStoredAuth();
+        config.onLogout?.();
+        throw new Error("Authentication failed. Please sign in again.");
+      }
       if (!isRefreshing) {
         isRefreshing = true;
-        const refreshed = await refreshAccessToken();
-        isRefreshing = false;
+        let refreshed = false;
+        try {
+          refreshed = await refreshAccessToken();
+        } finally {
+          isRefreshing = false;
+        }
         if (refreshed) {
-          return apiRequest(endpoint, options);
+          return apiRequestInternal(endpoint, options, true);
         } else {
           clearStoredAuth();
           config.onLogout?.();
@@ -172,21 +211,29 @@ async function apiRequest(endpoint, options = {}) {
         const REFRESH_TIMEOUT_MS = 3e4;
         return new Promise((resolve, reject) => {
           let settled = false;
-          let unsubscribe = null;
-          const timeoutId = setTimeout(() => {
+          const refreshTimeoutId = setTimeout(() => {
             if (!settled) {
               settled = true;
               unsubscribe?.();
               reject(new Error("Token refresh timed out. Please sign in again."));
             }
           }, REFRESH_TIMEOUT_MS);
-          unsubscribe = subscribeTokenRefresh(() => {
+          let unsubscribe = null;
+          try {
+            unsubscribe = subscribeTokenRefresh(() => {
+              if (!settled) {
+                settled = true;
+                clearTimeout(refreshTimeoutId);
+                apiRequestInternal(endpoint, options, true).then(resolve).catch(reject);
+              }
+            });
+          } catch (subscribeError) {
+            clearTimeout(refreshTimeoutId);
             if (!settled) {
               settled = true;
-              clearTimeout(timeoutId);
-              apiRequest(endpoint, options).then(resolve).catch(reject);
+              reject(subscribeError);
             }
-          });
+          }
         });
       }
     }
@@ -233,6 +280,10 @@ async function apiRequest(endpoint, options = {}) {
     }
     return data;
   } catch (error) {
+    clearTimeout(timeoutId);
+    if (error instanceof DOMException && error.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs}ms`);
+    }
     if (error instanceof Error) {
       throw error;
     }
@@ -268,6 +319,23 @@ var api = {
 };
 
 // src/core/api.ts
+async function fetchWithTimeout(url, init) {
+  const config = getConfig();
+  const fetchFn = config.fetch ?? fetch;
+  const timeoutMs = config.requestTimeout ?? 3e4;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetchFn(url, { ...init, signal: controller.signal });
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      throw new Error(`Request timed out after ${timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
 var authApi = {
   // ============================================================================
   // Authentication
@@ -292,8 +360,9 @@ var authApi = {
       return extractData(response);
     } catch (error) {
       const config = getConfig();
-      config.onAuthError?.(error instanceof Error ? error : new Error("Logout API call failed"));
-      return { success: true };
+      const err = error instanceof Error ? error : new Error("Logout API call failed");
+      config.onAuthError?.(err);
+      return { success: true, serverError: err.message };
     }
   },
   /**
@@ -489,13 +558,12 @@ var authApi = {
    */
   async verifyMFAChallenge(data) {
     const config = getConfig();
-    const fetchFn = config.fetch ?? fetch;
     const requestBody = {
       code: data.code,
       type: data.method === "backup" ? "backup" : "totp",
       trustDevice: data.trustDevice
     };
-    const response = await fetchFn(`${config.baseUrl}/auth/mfa/challenge`, {
+    const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -624,8 +692,7 @@ var authApi = {
       throw new Error("Not authenticated");
     }
     const config = getConfig();
-    const fetchFn = config.fetch ?? fetch;
-    const response = await fetchFn(`${config.baseUrl}/auth/sso/link`, {
+    const response = await fetchWithTimeout(`${config.baseUrl}/auth/sso/link`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -640,6 +707,11 @@ var authApi = {
     const result = await response.json();
     const authorizationUrl = extractData(result).authorizationUrl;
     if (authorizationUrl) {
+      if (!isValidRedirectUrl(authorizationUrl)) {
+        throw new Error(
+          "SSO link failed: authorization URL is not in the list of allowed redirect origins"
+        );
+      }
       window.location.href = authorizationUrl;
     }
   },

package/dist/{chunk-EM7PUNZB.js → chunk-6NTZVDLW.js}

@@ -36,6 +36,34 @@ function getDefaultStorage() {
     }
   };
 }
+function createSessionStorage() {
+  if (typeof window !== "undefined" && window.sessionStorage) {
+    return {
+      getItem: (key) => sessionStorage.getItem(key),
+      setItem: (key, value) => sessionStorage.setItem(key, value),
+      removeItem: (key) => sessionStorage.removeItem(key)
+    };
+  }
+  return {
+    getItem: () => null,
+    setItem: () => {
+    },
+    removeItem: () => {
+    }
+  };
+}
+function createMemoryStorage() {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => store.get(key) ?? null,
+    setItem: (key, value) => {
+      store.set(key, value);
+    },
+    removeItem: (key) => {
+      store.delete(key);
+    }
+  };
+}
 function getStorage() {
   const cfg = getConfig();
   return cfg.storage ?? getDefaultStorage();
@@ -91,7 +119,8 @@ function isTokenExpired(token) {
   if (!payload || !payload.exp) {
     return true;
   }
-  return payload.exp * 1e3 < Date.now();
+  const CLOCK_SKEW_MS = 3e4;
+  return payload.exp * 1e3 < Date.now() - CLOCK_SKEW_MS;
 }
 function getTokenRemainingTime(token) {
   const payload = decodeJWT(token);
@@ -122,4 +151,4 @@ function extractClaims(token, claims) {
   return result;
 }
 
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, resetConfig };
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, resetConfig };

package/dist/{chunk-TUFSFAAI.js → chunk-CPFM7JEI.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-U5E4T4NS.js';
-import { decodeJWT, isInitialized, getConfig, getStorage, getDefaultStorage } from './chunk-EM7PUNZB.js';
+import { authApi } from './chunk-2QYFVJEM.js';
+import { decodeJWT, isInitialized, getConfig, getStorage, getDefaultStorage } from './chunk-6NTZVDLW.js';
 
 // src/svelte/stores/auth.svelte.ts
 function getStorageKey() {

package/dist/{chunk-GOKAXJJS.js → chunk-MPPV5S7S.js}

@@ -1,4 +1,4 @@
-import { authApi } from './chunk-U5E4T4NS.js';
+import { authApi } from './chunk-2QYFVJEM.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -60,7 +60,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-JXZ7XEE5.js');
+        const { authStore } = await import('./auth.svelte-WPCYPHEE.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -246,7 +246,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-JXZ7XEE5.js');
+        const { authStore } = await import('./auth.svelte-WPCYPHEE.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-RKHRCHOI.js → chunk-UG4GSPGL.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-GOKAXJJS.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-TUFSFAAI.js';
-import { isInitialized, initAuth } from './chunk-EM7PUNZB.js';
+import { authService } from './chunk-MPPV5S7S.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-CPFM7JEI.js';
+import { isInitialized, initAuth } from './chunk-6NTZVDLW.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { L as LoginCredentials, h as LoginResponse, j as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, u as ProfileUpdateData, v as ChangePasswordData, l as Session, m as ApiKey, C as CreateApiKeyRequest, n as CreateApiKeyResponse, o as MFAStatus, M as MFASetupResponse, p as MFAChallengeData, D as Device, q as UserPreferences, s as LinkedAccount, t as SecurityEvent, P as Pagination } from '../types-CKcLRCI_.js';
-export { A as AuthConfig, f as AuthState, w as ResetPasswordData, S as SSOConfig, e as StorageAdapter, g as getConfig, b as getDefaultStorage, d as getFetch, c as getStorage, i as initAuth, a as isInitialized, r as resetConfig } from '../types-CKcLRCI_.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, c as getAvatarFallback, g as getDisplayName, e as getGreeting, d as getUserEmail, b as getUserInitials, i as isRoleDeniedError } from '../user-utils-Bi3-FHxY.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from '../types-Di6SR1q5.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, q as createMemoryStorage, r as createSessionStorage, s as getConfig, t as getDefaultStorage, u as getFetch, v as getStorage, w as initAuth, x as isInitialized, y as resetConfig } from '../types-Di6SR1q5.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-C-JbXqbj.js';
 
 /**
  * HTTP Client
@@ -8,13 +8,17 @@ export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDe
  * A configurable HTTP client for making API requests.
  * Handles authentication headers, token refresh, and error handling.
  */
-interface ApiRequestOptions extends Omit<RequestInit, 'body'> {
+interface ApiRequestOptions extends Omit<RequestInit, 'body' | 'signal'> {
     /** Whether to include auth headers */
     authenticated?: boolean;
     /** Custom fetch implementation for this request */
     customFetch?: typeof fetch;
     /** Request body (will be JSON stringified) */
     body?: unknown;
+    /** Request timeout in ms (overrides global config.requestTimeout) */
+    timeout?: number;
+    /** AbortSignal for manual cancellation */
+    signal?: AbortSignal;
 }
 interface ApiResponse<T = unknown> {
     data?: T;
@@ -42,6 +46,11 @@ declare function getSessionToken(): string | null;
 /**
  * Update stored tokens.
  * Also updates the Svelte auth store if available.
+ *
+ * Note: The read-modify-write on localStorage is not atomic across tabs —
+ * concurrent refreshes in two tabs are last-write-wins. The `storage` event
+ * listener (set up via `initCrossTabSync`) propagates whichever write landed
+ * last, so tabs converge on the same tokens.
  */
 declare function updateStoredTokens(accessToken: string, refreshToken: string): void;
 /**
@@ -50,6 +59,10 @@ declare function updateStoredTokens(accessToken: string, refreshToken: string):
 declare function clearStoredAuth(): void;
 /**
  * Helper to extract data from CHAPI response wrapper.
+ *
+ * WARNING: The final fallback returns `response as T` without runtime
+ * validation. Callers should validate the shape of the returned data
+ * at trust boundaries (e.g., after network requests).
  */
 declare function extractData<T>(response: {
     data?: {
@@ -304,7 +317,10 @@ declare function getAvailableMethods(response: LoginResponse): string[];
  * JWT Utilities
  *
  * Simple JWT decoder utilities for extracting payload data.
- * Note: These functions do NOT verify signatures - they only extract payloads.
+ *
+ * SECURITY: These functions do NOT verify signatures — they only extract payloads.
+ * Permissions and roles decoded from JWTs are for **UI display only**.
+ * All authorization decisions MUST be enforced server-side.
  */
 interface JWTPayload {
     /** Subject (usually user ID) */
@@ -323,6 +339,10 @@ interface JWTPayload {
 /**
  * Decode a JWT token and extract its payload.
  *
+ * **SECURITY:** No signature verification is performed. The returned claims
+ * (including `roles` and `permissions`) are for client-side UI hints only.
+ * Never use these claims for authorization without server-side verification.
+ *
  * @param token - The JWT token string
  * @returns The decoded payload, or null if decoding fails
  *

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-GOKAXJJS.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-U5E4T4NS.js';
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-EM7PUNZB.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-MPPV5S7S.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-2QYFVJEM.js';
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-6NTZVDLW.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { m as ApiKey, A as AuthConfig, f as AuthState, v as ChangePasswordData, C as CreateApiKeyRequest, n as CreateApiKeyResponse, D as Device, s as LinkedAccount, L as LoginCredentials, h as LoginResponse, j as LogoutResponse, p as MFAChallengeData, M as MFASetupResponse, o as MFAStatus, P as Pagination, u as ProfileUpdateData, R as RegisterData, k as RegisterResponse, w as ResetPasswordData, S as SSOConfig, t as SecurityEvent, l as Session, e as StorageAdapter, U as User, q as UserPreferences, g as getConfig, b as getDefaultStorage, d as getFetch, c as getStorage, i as initAuth, a as isInitialized, r as resetConfig } from './types-CKcLRCI_.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as User, p as UserPreferences, q as createMemoryStorage, r as createSessionStorage, s as getConfig, t as getDefaultStorage, u as getFetch, v as getStorage, w as initAuth, x as isInitialized, y as resetConfig } from './types-Di6SR1q5.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, api, apiRequest, authApi, clearStoredAuth, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, updateStoredTokens } from './core/index.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, c as getAvatarFallback, g as getDisplayName, e as getGreeting, d as getUserEmail, b as getUserInitials, i as isRoleDeniedError } from './user-utils-Bi3-FHxY.js';
+export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-C-JbXqbj.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-RKHRCHOI.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-GOKAXJJS.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-TUFSFAAI.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-U5E4T4NS.js';
-export { decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-EM7PUNZB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-UG4GSPGL.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-MPPV5S7S.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-CPFM7JEI.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-2QYFVJEM.js';
+export { createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-6NTZVDLW.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { f as AuthState, U as User, A as AuthConfig } from '../types-CKcLRCI_.js';
-export { i as initAuth, a as isInitialized } from '../types-CKcLRCI_.js';
-import { a as authService } from '../user-utils-Bi3-FHxY.js';
-export { R as RoleDeniedError, f as formatUserRoles, c as getAvatarFallback, g as getDisplayName, e as getGreeting, d as getUserEmail, b as getUserInitials, i as isRoleDeniedError } from '../user-utils-Bi3-FHxY.js';
+import { b as AuthState, U as User, a as AuthConfig } from '../types-Di6SR1q5.js';
+export { w as initAuth, x as isInitialized } from '../types-Di6SR1q5.js';
+import { a as authService } from '../user-utils-C-JbXqbj.js';
+export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-C-JbXqbj.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-RKHRCHOI.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-GOKAXJJS.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-TUFSFAAI.js';
-import '../chunk-U5E4T4NS.js';
-export { initAuth, isInitialized } from '../chunk-EM7PUNZB.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-UG4GSPGL.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-MPPV5S7S.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-CPFM7JEI.js';
+import '../chunk-2QYFVJEM.js';
+export { initAuth, isInitialized } from '../chunk-6NTZVDLW.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { U as User, h as LoginResponse, j as LogoutResponse, k as RegisterResponse, M as MFASetupResponse, o as MFAStatus, l as Session, D as Device, m as ApiKey, s as LinkedAccount, t as SecurityEvent, q as UserPreferences, e as StorageAdapter, f as AuthState, A as AuthConfig } from '../types-CKcLRCI_.js';
+import { U as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, p as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-Di6SR1q5.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { initAuth, resetConfig, isTokenExpired, decodeJWT } from '../chunk-EM7PUNZB.js';
+import { initAuth, resetConfig, isTokenExpired, decodeJWT } from '../chunk-6NTZVDLW.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/dist/{types-CKcLRCI_.d.ts → types-Di6SR1q5.d.ts}

@@ -50,6 +50,8 @@ interface AuthConfig {
      * ```
      */
     onSessionExpired?: (currentPath: string) => void;
+    /** Request timeout in milliseconds (default: 30000) */
+    requestTimeout?: number;
     /** SSO configuration */
     sso?: SSOConfig;
     /**
@@ -103,8 +105,29 @@ declare function resetConfig(): void;
 /**
  * Get the default storage adapter.
  * Returns localStorage in browser, or a no-op adapter in SSR.
+ *
+ * SECURITY NOTE: localStorage persists tokens (including the long-lived
+ * refresh token) where any XSS on the page can read them. It is the default
+ * for cross-tab session continuity, but consider the safer alternatives:
+ * `createSessionStorage()` (per-tab, cleared on close),
+ * `createMemoryStorage()` (never persisted, lost on reload), or an
+ * httpOnly-cookie flow on your backend so tokens never reach JS at all.
+ * Pass the adapter via `initAuth({ storage: ... })`.
  */
 declare function getDefaultStorage(): StorageAdapter;
+/**
+ * Storage adapter backed by sessionStorage: tokens live per-tab and are
+ * cleared when the tab closes. Safer than localStorage against persistent
+ * token theft, at the cost of cross-tab session continuity.
+ * Falls back to no-op in SSR.
+ */
+declare function createSessionStorage(): StorageAdapter;
+/**
+ * In-memory storage adapter: tokens are never persisted and are lost on
+ * page reload (the user re-authenticates or a silent SSO flow restores the
+ * session). The safest JS-side option against token exfiltration.
+ */
+declare function createMemoryStorage(): StorageAdapter;
 /**
  * Get the storage adapter from config or use default.
  */
@@ -172,6 +195,12 @@ interface LogoutResponse {
     message?: string;
     ssoLogout?: boolean;
     logoutUrl?: string;
+    /**
+     * Set when the server-side logout call failed. `success` stays true so
+     * callers clear local state, but the server session may still be alive —
+     * check this to warn the user or retry revocation.
+     */
+    serverError?: string;
 }
 interface RegisterResponse {
     message: string;
@@ -318,4 +347,4 @@ interface ResetPasswordData {
     newPassword: string;
 }
 
-export { type AuthConfig as A, type CreateApiKeyRequest as C, type Device as D, type LoginCredentials as L, type MFASetupResponse as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type User as U, isInitialized as a, getDefaultStorage as b, getStorage as c, getFetch as d, type StorageAdapter as e, type AuthState as f, getConfig as g, type LoginResponse as h, initAuth as i, type LogoutResponse as j, type RegisterResponse as k, type Session as l, type ApiKey as m, type CreateApiKeyResponse as n, type MFAStatus as o, type MFAChallengeData as p, type UserPreferences as q, resetConfig as r, type LinkedAccount as s, type SecurityEvent as t, type ProfileUpdateData as u, type ChangePasswordData as v, type ResetPasswordData as w };
+export { type ApiKey as A, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type User as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type UserPreferences as p, createMemoryStorage as q, createSessionStorage as r, getConfig as s, getDefaultStorage as t, getFetch as u, getStorage as v, initAuth as w, isInitialized as x, resetConfig as y };

package/dist/{user-utils-Bi3-FHxY.d.ts → user-utils-C-JbXqbj.d.ts}

@@ -1,4 +1,4 @@
-import { L as LoginCredentials, h as LoginResponse, j as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, u as ProfileUpdateData, l as Session, m as ApiKey, C as CreateApiKeyRequest, n as CreateApiKeyResponse, o as MFAStatus, M as MFASetupResponse, p as MFAChallengeData, D as Device, q as UserPreferences, s as LinkedAccount, t as SecurityEvent, P as Pagination } from './types-CKcLRCI_.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, U as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, p as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-Di6SR1q5.js';
 
 /**
  * Auth Service
@@ -411,4 +411,4 @@ declare function formatUserRoles(user: User | null | undefined, options?: {
     capitalize?: boolean;
 }): string;
 
-export { AuthService as A, type LoginOptions as L, type MFAVerifyOptions as M, RoleDeniedError as R, authService as a, getUserInitials as b, getAvatarFallback as c, getUserEmail as d, getGreeting as e, formatUserRoles as f, getDisplayName as g, isRoleDeniedError as i };
+export { AuthService as A, type LoginOptions as L, type MFAVerifyOptions as M, RoleDeniedError as R, authService as a, getDisplayName as b, getGreeting as c, getUserEmail as d, getUserInitials as e, formatUserRoles as f, getAvatarFallback as g, isRoleDeniedError as i };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "0.1.53",
+  "version": "0.1.56",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",
@@ -31,8 +31,9 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "clean": "rm -rf dist",
-    "typecheck": "tsc --noEmit"
+    "clean": "node ../../scripts/rm.mjs dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   },
   "keywords": [
     "authentication",

package/dist/auth.svelte-JXZ7XEE5.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-TUFSFAAI.js';
-import './chunk-U5E4T4NS.js';
-import './chunk-EM7PUNZB.js';