@corbado/observe 1.9.1 → 1.10.1

package/dist/analysis/client.mjs

@@ -62,6 +62,7 @@ import {
 } from "./utils/trusted-device-operation-full.mjs";
 import { ProvideDataOperationFull } from "./utils/provide-data-operation-full.mjs";
 import { PasswordManagerSampler } from "./utils/password-manager-sampler.mjs";
+import { CrossOriginSession, isValidCrossOriginContext } from "./cross-origin-session.mjs";
 var SDK_INFO = {
   name: SDK_NAME,
   version: SDK_VERSION
@@ -161,7 +162,8 @@ var CorbadoTracker = class _CorbadoTracker {
       logger: this.logger,
       url
     });
-    this.sessionId = this.resolveSessionId();
+    this.crossOrigin = this.createCrossOriginSession();
+    this.sessionId = this.resolveSession();
     this.queue = new RequestQueue(
       this.logger,
       transport,
@@ -173,6 +175,7 @@ var CorbadoTracker = class _CorbadoTracker {
         requestConfig: false,
         outboxLockName: namespacedKey(OUTBOX_LOCK_NAME, namespace),
         getDataPolicy: () => this.dataPolicy,
+        getCrossOriginSession: (sessionId) => this.crossOriginSessionMeta(sessionId),
         fixedData: this.fixedData !== void 0 || typeof __CBO_DATA_PMD__ === "boolean" || typeof __CBO_DATA_PRIVATE_MODE__ === "boolean",
         beforeEventBatchSend: (events) => this.attachUndeliveredDeviceInfo(events),
         // The queue is created before the device info manager; both are only called once it exists.
@@ -290,6 +293,10 @@ var CorbadoTracker = class _CorbadoTracker {
   probeSeqs = /* @__PURE__ */ new Map();
   windowObserver;
   passwordManagerSampler;
+  /** Cross-origin session cookie (`fixedDataConfig.crossOriginSession`); undefined when off. */
+  crossOrigin;
+  /** The session this load took from the cross-origin cookie, if any (`meta.crossOriginSession`). */
+  crossOriginAdoptedId;
   /** @internal Shared passive page observation and per-operation context registration. */
   getWindowObserver() {
     return this.windowObserver ??= new SharedWindowObserver(
@@ -526,6 +533,108 @@ var CorbadoTracker = class _CorbadoTracker {
       })
     );
   }
+  /** The cross-origin session cookie when `fixedDataConfig.crossOriginSession` is set and usable here. */
+  createCrossOriginSession() {
+    const option = this.fixedData?.crossOriginSession;
+    if (!option) {
+      return void 0;
+    }
+    try {
+      if (this.isTrackingBlocked()) {
+        return void 0;
+      }
+      return CrossOriginSession.create({
+        projectId: this.options.projectId,
+        cookieDomain: option.cookieDomain,
+        logger: this.logger,
+        inactivityMs: () => this.config.sessionInactivityMs,
+        report: (level, message) => this.reportTelemetry(level, message)
+      });
+    } catch (error) {
+      this.logger.error("Failed to set up the cross-origin session", error);
+      return void 0;
+    }
+  }
+  /**
+   * Last activity of the local session records BEFORE this load rewrites them (both paths, by id), so the
+   * cross-origin boot can tell a session that was active here from one this load just created.
+   */
+  readLocalSessionActivity() {
+    const activity = /* @__PURE__ */ new Map();
+    try {
+      const continuity = this.persistentStorage.getItem(SESSION_CONTINUITY_KEY);
+      if (continuity?.id && typeof continuity.lastActiveAt === "number") {
+        activity.set(continuity.id, continuity.lastActiveAt);
+      }
+      const perTab = this.sessionStorage.getItem(SESSION_STORAGE_KEY);
+      if (perTab && typeof perTab === "object" && perTab.id && typeof perTab.lastActiveAt === "number") {
+        activity.set(perTab.id, Math.max(activity.get(perTab.id) ?? 0, perTab.lastActiveAt));
+      }
+    } catch (error) {
+      this.logger.error("Failed to read local session activity", error);
+    }
+    return activity;
+  }
+  /**
+   * Reconcile the session this load resolved locally with the cross-origin cookie before the first event:
+   * adopt the cookie's session (and persist it locally, so reloads and same-origin tabs follow) or keep
+   * the local one, and continue the seq at or above the cookie's mark. Never throws.
+   */
+  bootCrossOriginSession(localActivity) {
+    try {
+      this.crossOriginAdoptedId = void 0;
+      const now = Date.now();
+      const continuity = this.config.sessionContinuity;
+      const localSeq = continuity ? Math.max(this.seq, this.persistentStorage.getItem(SEQ_STORAGE_KEY) ?? 0) : this.seq;
+      const result = this.crossOrigin?.boot(
+        {
+          sessionId: this.sessionId,
+          lastActiveAt: this.sessionId && localActivity.get(this.sessionId) || 0,
+          seq: localSeq
+        },
+        now
+      );
+      if (!result || !result.sessionId) {
+        return;
+      }
+      if (result.adopted) {
+        this.sessionId = result.sessionId;
+        this.crossOriginAdoptedId = result.sessionId;
+        if (continuity) {
+          this.persistContinuitySession(result.sessionId, now);
+        } else {
+          this.persistPerTabSession(result.sessionId, now);
+        }
+        this.logger.debug("Adopted cross-origin session id", result.sessionId);
+      }
+      this.seq = result.seq;
+      if (continuity) {
+        this.persistentStorage.setItem(SEQ_STORAGE_KEY, result.seq);
+      }
+    } catch (error) {
+      this.logger.error("Failed to apply the cross-origin session", error);
+    }
+  }
+  /**
+   * Resolve the session of this load: locally ({@link resolveSessionId}), then reconciled with the
+   * cross-origin cookie when that option is on. Used at boot and by the recovery in `getSessionId`.
+   */
+  resolveSession() {
+    if (!this.crossOrigin) {
+      return this.resolveSessionId();
+    }
+    const localActivity = this.readLocalSessionActivity();
+    this.sessionId = this.resolveSessionId();
+    this.bootCrossOriginSession(localActivity);
+    return this.sessionId;
+  }
+  /** `meta.crossOriginSession` of a batch of `sessionId`; undefined while the option is off on this page. */
+  crossOriginSessionMeta(sessionId) {
+    if (!this.crossOrigin?.isEnabled()) {
+      return void 0;
+    }
+    return sessionId && sessionId === this.crossOriginAdoptedId ? "adopted" : "own";
+  }
   resolveSessionId() {
     try {
       if (this.config.sessionContinuity) {
@@ -659,7 +768,9 @@ var CorbadoTracker = class _CorbadoTracker {
       if (this.sessionId && now - this.lastActivityWriteAt >= SESSION_ACTIVITY_WRITE_INTERVAL_MS) {
         this.persistPerTabSession(this.sessionId, now);
       }
-      return this.seq++;
+      const current = this.crossOrigin ? this.crossOrigin.claim(this.sessionId, this.seq, now) : this.seq;
+      this.seq = current + 1;
+      return current;
     }
     const allocate = () => {
       const now = Date.now();
@@ -689,7 +800,10 @@ var CorbadoTracker = class _CorbadoTracker {
       if (sessionChanged) {
         this.seq = typeof stored === "number" ? stored : 0;
       }
-      const current = typeof stored === "number" && stored > this.seq ? stored : this.seq;
+      let current = typeof stored === "number" && stored > this.seq ? stored : this.seq;
+      if (this.crossOrigin) {
+        current = this.crossOrigin.claim(this.sessionId, current, now);
+      }
       this.seq = current + 1;
       this.persistentStorage.setItem(SEQ_STORAGE_KEY, this.seq);
       return current;
@@ -1514,16 +1628,6 @@ var CorbadoTracker = class _CorbadoTracker {
       this.logger.error("Failed to flush queue keepalive", error);
     }
   }
-  /**
-   * Whether input trackers run the DOM password-manager scan (`pa-1`..`pa-6` lows): only an explicitly
-   * set `fixedDataConfig.pmd` decides; without `fixedDataConfig` or with `pmd` omitted it always runs
-   * (historical behaviour).
-   *
-   * @internal
-   */
-  isPasswordManagerDomScanEnabled() {
-    return this.fixedData?.pmdExplicit ? this.fixedData.pmd : true;
-  }
   /**
    * Keepalive flush requested by a low-event tracker's `pagehide` teardown. Gated by the
    * server-controlled trigger switch `tlf` (boot-snapshot, default true = historical behavior):
@@ -1780,6 +1884,7 @@ var CorbadoTracker = class _CorbadoTracker {
    * resources are released either way.
    */
   async destroy() {
+    this.crossOrigin?.stop();
     this.configManager?.destroy();
     this.passwordManagerSampler?.destroy();
     this.windowObserver?.destroy();
@@ -1827,7 +1932,7 @@ var CorbadoTracker = class _CorbadoTracker {
    */
   getSessionId() {
     if (!this.sessionId) {
-      const recovered = this.resolveSessionId();
+      const recovered = this.resolveSession();
       if (recovered) {
         this.sessionId = recovered;
         this.queue.setSessionId(recovered);
@@ -1835,6 +1940,69 @@ var CorbadoTracker = class _CorbadoTracker {
     }
     return this.sessionId || void 0;
   }
+  /**
+   * Store an opaque context string with the cross-origin session, for the integration's own use on the
+   * next origin (e.g. a journey id and stage). Requires `fixedDataConfig.crossOriginSession`.
+   *
+   * @remarks
+   * The value travels in the shared cookie only (see {@link CrossOriginSessionConfig}): it is never sent
+   * to Corbado, but the browser sends the cookie with every request to every subdomain of the configured
+   * domain. It belongs to the current session: a tracker that adopts the session reads it with
+   * {@link CorbadoTracker.getCrossOriginContext}, and a new session (inactivity, `resetSession`) starts
+   * without it. At most 128 characters of `A-Z a-z 0-9 . _ ~ -`; never put personal data in it.
+   * `null`, `undefined` or `""` clears it.
+   *
+   * Never throws.
+   *
+   * @param context - The value to store; `null`, `undefined` or `""` clears it.
+   * @returns `true` when the value was accepted and written; `false` when it is invalid or the feature
+   * is off on this page (not configured, cookie blocked, domain mismatch, not HTTPS).
+   *
+   * @example
+   * ```typescript
+   * tracker.setCrossOriginContext(`v1.${journeyId}.passkey.b`);
+   * ```
+   */
+  setCrossOriginContext(context) {
+    try {
+      if (!this.crossOrigin) {
+        return false;
+      }
+      const value = context === null || context === void 0 || context === "" ? void 0 : context;
+      if (value !== void 0 && !isValidCrossOriginContext(value)) {
+        this.logger.debug("Ignoring invalid cross-origin context (expected <= 128 chars of [A-Za-z0-9._~-])");
+        return false;
+      }
+      const seq = this.config.sessionContinuity ? Math.max(this.seq, this.persistentStorage.getItem(SEQ_STORAGE_KEY) ?? 0) : this.seq;
+      const next = this.crossOrigin.setContext(this.sessionId, seq, value);
+      if (next === void 0) {
+        return false;
+      }
+      if (next > this.seq) {
+        this.seq = next;
+        if (this.config.sessionContinuity) {
+          this.persistentStorage.setItem(SEQ_STORAGE_KEY, next);
+        }
+      }
+      return true;
+    } catch (error) {
+      this.logger.error("Failed to set the cross-origin context", error);
+      return false;
+    }
+  }
+  /**
+   * The context string stored with the current cross-origin session (see
+   * {@link CorbadoTracker.setCrossOriginContext}), or `undefined` when none is set, the session has no
+   * context, or the feature is off on this page. Never throws.
+   */
+  getCrossOriginContext() {
+    try {
+      return this.crossOrigin?.getContext(this.sessionId);
+    } catch (error) {
+      this.logger.error("Failed to read the cross-origin context", error);
+      return void 0;
+    }
+  }
   /** @internal */
   resetSession() {
     const newSessionId = uuidv7();
@@ -1847,6 +2015,7 @@ var CorbadoTracker = class _CorbadoTracker {
     this.sessionId = newSessionId;
     this.seq = 0;
     this.queue.setSessionId(newSessionId);
+    this.crossOrigin?.reset(newSessionId);
     this.logger.debug(`Session reset: ${newSessionId}`);
     return newSessionId;
   }

package/dist/analysis/config.mjs

@@ -183,12 +183,12 @@ function resolveFixedDataConfig(raw) {
       return void 0;
     }
     const value = raw;
-    const pmd = value.pmd;
-    const pmdExplicit = typeof pmd === "boolean";
+    const crossOrigin = value.crossOriginSession;
+    const cookieDomain = crossOrigin && typeof crossOrigin === "object" && typeof crossOrigin.cookieDomain === "string" ? crossOrigin.cookieDomain : void 0;
     return {
-      pmd: pmdExplicit ? pmd : false,
-      pmdExplicit,
-      privateMode: asBoolean(value.privateMode, true)
+      pmd: asBoolean(value.pmd, false),
+      privateMode: asBoolean(value.privateMode, true),
+      ...cookieDomain !== void 0 && { crossOriginSession: { cookieDomain } }
     };
   } catch {
     return void 0;