@classic-homes/auth 1.0.0 → 1.0.2

package/dist/auth.svelte-FUE2KVI4.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-GWOTYGQI.js';
+import './chunk-7DW44JGU.js';
+import './chunk-S4TOKARB.js';

package/dist/{chunk-ILRNO4WH.js → chunk-6VABYYP2.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-VVREZ25E.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-QBTMNWJH.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-O47YKG2F.js';
+import { authService } from './chunk-LIRO3PU2.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-GWOTYGQI.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-S4TOKARB.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {

package/dist/{chunk-2N2MDCWL.js → chunk-7DW44JGU.js}

@@ -1,4 +1,4 @@
-import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-O47YKG2F.js';
+import { getConfig, getStorage, getFetch, isValidRedirectUrl } from './chunk-S4TOKARB.js';
 
 // src/core/client.ts
 var isRefreshing = false;
@@ -14,17 +14,23 @@ function subscribeTokenRefresh(cb) {
     if (idx > -1) refreshSubscribers.splice(idx, 1);
   };
 }
-function onTokenRefreshed(token) {
+function flushRefreshSubscribers(token, terminal = false) {
   const subs = refreshSubscribers;
   refreshSubscribers = [];
   subs.forEach((cb) => {
     try {
-      cb(token);
+      cb(token, terminal);
     } catch (e) {
       console.error("Token refresh subscriber error:", e);
     }
   });
 }
+function onTokenRefreshed(token) {
+  flushRefreshSubscribers(token);
+}
+function onTokenRefreshFailed(terminal) {
+  flushRefreshSubscribers(null, terminal);
+}
 function getAccessToken() {
   const config = getConfig();
   const storage = getStorage();
@@ -71,7 +77,7 @@ function updateStoredTokens(accessToken, refreshToken) {
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
   storage.setItem(storageKey, JSON.stringify(parsed));
-  import('./auth.svelte-J62VV4TA.js').then(({ authStore }) => {
+  import('./auth.svelte-FUE2KVI4.js').then(({ authStore }) => {
     authStore.updateTokens(accessToken, refreshToken);
   }).catch(() => {
   });
@@ -83,12 +89,21 @@ function clearStoredAuth() {
   storage.removeItem(config.storageKey ?? "classic_auth");
   storage.removeItem(getSessionTokenKey());
 }
+async function expireSession() {
+  clearStoredAuth();
+  try {
+    const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
+    authStore.handleSessionExpired();
+  } catch {
+  }
+  getConfig().onLogout?.();
+}
 async function refreshAccessToken() {
   const refreshToken = getRefreshToken();
   const config = getConfig();
   const fetchFn = getFetch();
   if (!refreshToken) {
-    return false;
+    return "rejected";
   }
   const timeoutMs = config.requestTimeout ?? 3e4;
   const controller = new AbortController();
@@ -109,13 +124,13 @@ async function refreshAccessToken() {
         try {
           apiResponse = await response.json();
         } catch {
-          return false;
+          return "unavailable";
         }
       } else {
         try {
           apiResponse = await response.json();
         } catch {
-          return false;
+          return "unavailable";
         }
       }
       const data = apiResponse?.data;
@@ -124,15 +139,20 @@ async function refreshAccessToken() {
         const newRefreshToken = tokens.refreshToken ?? refreshToken;
         updateStoredTokens(tokens.accessToken, newRefreshToken);
         onTokenRefreshed(tokens.accessToken);
-        return true;
+        return "refreshed";
       }
+      return "unavailable";
     }
+    if (response.status >= 500) {
+      return "unavailable";
+    }
+    return "rejected";
   } catch (error) {
     config.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+    return "unavailable";
   } finally {
     clearTimeout(timeoutId);
   }
-  return false;
 }
 function extractData(response) {
   if (response && typeof response === "object" && "data" in response) {
@@ -188,25 +208,27 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && typeof window !== "undefined") {
       if (isRetry) {
-        clearStoredAuth();
-        config.onLogout?.();
+        await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
       }
       if (!isRefreshing) {
         isRefreshing = true;
-        let refreshed = false;
+        let refreshResult = "unavailable";
         try {
-          refreshed = await refreshAccessToken();
+          refreshResult = await refreshAccessToken();
         } finally {
           isRefreshing = false;
         }
-        if (refreshed) {
+        if (refreshResult === "refreshed") {
           return apiRequestInternal(endpoint, options, true);
-        } else {
-          clearStoredAuth();
-          config.onLogout?.();
+        }
+        if (refreshResult === "rejected") {
+          onTokenRefreshFailed(true);
+          await expireSession();
           throw new Error("Authentication failed. Please sign in again.");
         }
+        onTokenRefreshFailed(false);
+        throw new Error("Authentication service unavailable. Please try again.");
       } else {
         const REFRESH_TIMEOUT_MS = 3e4;
         return new Promise((resolve, reject) => {
@@ -220,11 +242,19 @@ async function apiRequestInternal(endpoint, options, isRetry) {
           }, REFRESH_TIMEOUT_MS);
           let unsubscribe = null;
           try {
-            unsubscribe = subscribeTokenRefresh(() => {
+            unsubscribe = subscribeTokenRefresh((token, terminal) => {
               if (!settled) {
                 settled = true;
                 clearTimeout(refreshTimeoutId);
-                apiRequestInternal(endpoint, options, true).then(resolve).catch(reject);
+                if (token) {
+                  apiRequestInternal(endpoint, options, true).then(resolve).catch(reject);
+                } else {
+                  reject(
+                    new Error(
+                      terminal ? "Authentication failed. Please sign in again." : "Authentication service unavailable. Please try again."
+                    )
+                  );
+                }
               }
             });
           } catch (subscribeError) {

package/dist/{chunk-QBTMNWJH.js → chunk-GWOTYGQI.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-2N2MDCWL.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-O47YKG2F.js';
+import { authApi } from './chunk-7DW44JGU.js';
+import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-S4TOKARB.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;

package/dist/{chunk-VVREZ25E.js → chunk-LIRO3PU2.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-2N2MDCWL.js';
-import { getUserRoles, hasAnyRole } from './chunk-O47YKG2F.js';
+import { authApi } from './chunk-7DW44JGU.js';
+import { getUserRoles, hasAnyRole } from './chunk-S4TOKARB.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -59,7 +59,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-J62VV4TA.js');
+        const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -243,7 +243,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-J62VV4TA.js');
+        const { authStore } = await import('./auth.svelte-FUE2KVI4.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-O47YKG2F.js → chunk-S4TOKARB.js}

@@ -120,7 +120,7 @@ function isTokenExpired(token) {
     return true;
   }
   const CLOCK_SKEW_MS = 3e4;
-  return payload.exp * 1e3 < Date.now() - CLOCK_SKEW_MS;
+  return payload.exp * 1e3 < Date.now() + CLOCK_SKEW_MS;
 }
 function getTokenRemainingTime(token) {
   const payload = decodeJWT(token);

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-VVREZ25E.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-2N2MDCWL.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-O47YKG2F.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-LIRO3PU2.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from '../chunk-7DW44JGU.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-S4TOKARB.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-ILRNO4WH.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-VVREZ25E.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-QBTMNWJH.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-2N2MDCWL.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-O47YKG2F.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-6VABYYP2.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-LIRO3PU2.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-GWOTYGQI.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, updateStoredTokens } from './chunk-7DW44JGU.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-S4TOKARB.js';

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-ILRNO4WH.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-VVREZ25E.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-QBTMNWJH.js';
-import '../chunk-2N2MDCWL.js';
-export { initAuth, isInitialized } from '../chunk-O47YKG2F.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-6VABYYP2.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-LIRO3PU2.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-GWOTYGQI.js';
+import '../chunk-7DW44JGU.js';
+export { initAuth, isInitialized } from '../chunk-S4TOKARB.js';

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-O47YKG2F.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-S4TOKARB.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-J62VV4TA.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-QBTMNWJH.js';
-import './chunk-2N2MDCWL.js';
-import './chunk-O47YKG2F.js';