@djangocfg/api 2.1.602 → 2.1.604

package/dist/index.d.cts

@@ -61,6 +61,11 @@ declare const auth: {
      *  the mode is module state and resets on reload, so a later switch strands
      *  whatever was written after it. */
     setStorageMode(mode: StorageMode): void;
+    /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps
+     *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */
+    setCookieDomain(domain: "auto" | string | null): void;
+    /** The `Domain` the session cookie is written with; `null` = host-only. */
+    getCookieDomain(): string | null;
     getToken(): string | null;
     setToken(token: string | null): void;
     getRefreshToken(): string | null;
@@ -2601,6 +2606,16 @@ interface StorageOptions {
     readonly families?: Readonly<Record<string, FamilySpec>>;
     /** Cookie lifetime for the `cookie` store. Default 30 days. */
     readonly cookieMaxAgeSeconds?: number;
+    /**
+     * Cookie `Domain`. `'auto'` (default): the registrable domain of the page, so every subdomain
+     * shares the cookie (`example.com` for `my.example.com`). A string forces a domain; `false`
+     * keeps cookies host-only.
+     */
+    readonly cookieDomain?: 'auto' | string | false;
+}
+interface WriteOptions {
+    /** Cookie store: lifetime of this write. Default: the owner's `cookieMaxAgeSeconds`. */
+    readonly maxAgeSeconds?: number;
 }
 interface GuardedStorage {
     readonly owner: string;
@@ -2612,7 +2627,7 @@ interface GuardedStorage {
     isValid(key: string): boolean;
     read(key: string, store?: KeyStore): string | null;
     /** True when the value reached the browser's storage; false means it is held in memory for this page only. */
-    write(key: string, value: string, store?: KeyStore): boolean;
+    write(key: string, value: string, store?: KeyStore, options?: WriteOptions): boolean;
     /** Removes the key. */
     remove(key: string, store?: KeyStore): void;
     readJSON<T>(key: string, store?: KeyStore): T | null;
@@ -2623,6 +2638,10 @@ interface GuardedStorage {
     clearAll(options?: {
         all?: boolean;
     }): void;
+    /** Cookie store: change the `Domain` policy (`'auto'`, a domain, or `false` for host-only cookies). */
+    setCookieDomain(domain: 'auto' | string | false): void;
+    /** The `Domain` cookies are written with right now; `null` means host-only. */
+    cookieDomain(): string | null;
     /** Cross-tab: calls `listener` with the new value when ANOTHER tab changes `key`. Cookies fire no events. */
     onChange(key: string, listener: (value: string | null) => void, store?: Exclude<KeyStore, 'cookie'>): () => void;
 }

package/dist/index.d.ts

@@ -61,6 +61,11 @@ declare const auth: {
      *  the mode is module state and resets on reload, so a later switch strands
      *  whatever was written after it. */
     setStorageMode(mode: StorageMode): void;
+    /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps
+     *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */
+    setCookieDomain(domain: "auto" | string | null): void;
+    /** The `Domain` the session cookie is written with; `null` = host-only. */
+    getCookieDomain(): string | null;
     getToken(): string | null;
     setToken(token: string | null): void;
     getRefreshToken(): string | null;
@@ -2601,6 +2606,16 @@ interface StorageOptions {
     readonly families?: Readonly<Record<string, FamilySpec>>;
     /** Cookie lifetime for the `cookie` store. Default 30 days. */
     readonly cookieMaxAgeSeconds?: number;
+    /**
+     * Cookie `Domain`. `'auto'` (default): the registrable domain of the page, so every subdomain
+     * shares the cookie (`example.com` for `my.example.com`). A string forces a domain; `false`
+     * keeps cookies host-only.
+     */
+    readonly cookieDomain?: 'auto' | string | false;
+}
+interface WriteOptions {
+    /** Cookie store: lifetime of this write. Default: the owner's `cookieMaxAgeSeconds`. */
+    readonly maxAgeSeconds?: number;
 }
 interface GuardedStorage {
     readonly owner: string;
@@ -2612,7 +2627,7 @@ interface GuardedStorage {
     isValid(key: string): boolean;
     read(key: string, store?: KeyStore): string | null;
     /** True when the value reached the browser's storage; false means it is held in memory for this page only. */
-    write(key: string, value: string, store?: KeyStore): boolean;
+    write(key: string, value: string, store?: KeyStore, options?: WriteOptions): boolean;
     /** Removes the key. */
     remove(key: string, store?: KeyStore): void;
     readJSON<T>(key: string, store?: KeyStore): T | null;
@@ -2623,6 +2638,10 @@ interface GuardedStorage {
     clearAll(options?: {
         all?: boolean;
     }): void;
+    /** Cookie store: change the `Domain` policy (`'auto'`, a domain, or `false` for host-only cookies). */
+    setCookieDomain(domain: 'auto' | string | false): void;
+    /** The `Domain` cookies are written with right now; `null` means host-only. */
+    cookieDomain(): string | null;
     /** Cross-tab: calls `listener` with the new value when ANOTHER tab changes `key`. Cookies fire no events. */
     onChange(key: string, listener: (value: string | null) => void, store?: Exclude<KeyStore, 'cookie'>): () => void;
 }

package/dist/index.mjs

@@ -82,8 +82,8 @@ var NetworkError = class extends Error {
 var k = /* @__PURE__ */ __name((key, store, personal) => ({ key, store, personal }), "k");
 var f = /* @__PURE__ */ __name((prefix, store, personal) => ({ prefix, store, personal }), "f");
 var CFG_KEYS = {
-  accessToken: k("cfg.auth.access_token", "local", true),
-  refreshToken: k("cfg.auth.refresh_token", "local", true),
+  accessToken: k("cfg.auth.access_token", "cookie", true),
+  refreshToken: k("cfg.auth.refresh_token", "cookie", true),
   apiKey: k("cfg.auth.api_key", "local", true),
   email: k("cfg.auth.email", "local", false),
   emailTs: k("cfg.auth.email_ts", "local", false),
@@ -118,6 +118,31 @@ function normalizeSegment(raw) {
 }
 __name(normalizeSegment, "normalizeSegment");
 var hasWindow = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
+var domainByHost = /* @__PURE__ */ new Map();
+function detectCookieDomain() {
+  if (!hasWindow() || typeof document === "undefined") return null;
+  const host = window.location.hostname.toLowerCase();
+  if (!host || !host.includes(".") || host.includes(":") || /^[0-9.]+$/.test(host)) return null;
+  const cached = domainByHost.get(host);
+  if (cached !== void 0) return cached;
+  const labels = host.split(".");
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  let found = null;
+  try {
+    for (let i = labels.length - 2; i >= 0 && found === null; i -= 1) {
+      const candidate = labels.slice(i).join(".");
+      const probe = "cfg_probe_" + Math.random().toString(36).slice(2);
+      document.cookie = probe + "=1; Domain=" + candidate + "; Path=/; Max-Age=30; SameSite=Lax" + secure;
+      if (document.cookie.includes(probe + "=1")) found = candidate;
+      document.cookie = probe + "=; Domain=" + candidate + "; Path=/; Max-Age=0; SameSite=Lax" + secure;
+    }
+  } catch {
+    found = null;
+  }
+  domainByHost.set(host, found);
+  return found;
+}
+__name(detectCookieDomain, "detectCookieDomain");
 function nativeStorage(store) {
   if (!hasWindow()) return null;
   try {
@@ -143,6 +168,12 @@ function createStorage(owner, options = {}) {
   const prefix = `${owner}.`;
   const pattern = owner === "cfg" ? /^cfg(\.[a-z0-9_]+)+$/ : new RegExp(`^(cfg|${owner})(\\.[a-z0-9_]+)+$`);
   const cookieMaxAge = options.cookieMaxAgeSeconds ?? 60 * 60 * 24 * 30;
+  let cookiePolicy = options.cookieDomain ?? "auto";
+  const resolveCookieDomain = /* @__PURE__ */ __name(() => cookiePolicy === false ? null : cookiePolicy === "auto" ? detectCookieDomain() : cookiePolicy, "resolveCookieDomain");
+  const expireCookie = /* @__PURE__ */ __name((key, domain) => {
+    const secure = window.location.protocol === "https:" ? "; Secure" : "";
+    document.cookie = encodeURIComponent(key) + "=; Path=/; Max-Age=0; SameSite=Lax" + (domain ? "; Domain=" + domain : "") + secure;
+  }, "expireCookie");
   const specs = Object.values(options.keys ?? {});
   const families = Object.values(options.families ?? {});
   const specByKey = /* @__PURE__ */ new Map();
@@ -179,12 +210,15 @@ function createStorage(owner, options = {}) {
     return memory[store].get(key) ?? null;
   }
   __name(rawGet, "rawGet");
-  function rawSet(store, key, value) {
+  function rawSet(store, key, value, maxAgeSeconds) {
     if (!hasWindow()) return false;
     try {
       if (store === "cookie") {
         const secure = window.location.protocol === "https:" ? "; Secure" : "";
-        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${cookieMaxAge}; SameSite=Lax${secure}`;
+        const domain = resolveCookieDomain();
+        const domainPart = domain ? `; Domain=${domain}` : "";
+        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;
+        if (domain) expireCookie(key, null);
         if (rawGet("cookie", key) === value && !memory.cookie.has(key)) return true;
         memory.cookie.set(key, value);
         return false;
@@ -205,8 +239,9 @@ function createStorage(owner, options = {}) {
     if (!hasWindow()) return;
     try {
       if (store === "cookie") {
-        const secure = window.location.protocol === "https:" ? "; Secure" : "";
-        document.cookie = `${encodeURIComponent(key)}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+        expireCookie(key, null);
+        const domain = resolveCookieDomain();
+        if (domain) expireCookie(key, domain);
       } else {
         nativeStorage(store)?.removeItem(key);
       }
@@ -255,10 +290,10 @@ function createStorage(owner, options = {}) {
       const target = resolveStore(key, store);
       return rawGet(target, key);
     },
-    write(key, value, store) {
+    write(key, value, store, writeOptions) {
       assertOwned(key);
       const target = resolveStore(key, store);
-      return rawSet(target, key, value);
+      return rawSet(target, key, value, writeOptions?.maxAgeSeconds);
     },
     remove(key, store) {
       assertOwned(key);
@@ -296,6 +331,10 @@ function createStorage(owner, options = {}) {
         for (const name of cookieNames()) if (name.startsWith(prefix)) rawRemove("cookie", name);
       }
     },
+    setCookieDomain(domain) {
+      cookiePolicy = domain;
+    },
+    cookieDomain: resolveCookieDomain,
     onChange(key, listener, store = "local") {
       assertValid(key);
       if (!hasWindow()) return () => {
@@ -322,6 +361,11 @@ var REFRESH_KEY = "cfg.auth.refresh_token";
 var API_KEY_KEY = "cfg.auth.api_key";
 var storage = true ? cfgStorage : createStorage2("cfg");
 var isBrowser = typeof window !== "undefined";
+function secondsUntilExp(token) {
+  const exp = jwtExpMs(token);
+  return exp === null ? void 0 : Math.max(1, Math.floor((exp - Date.now()) / 1e3));
+}
+__name(secondsUntilExp, "secondsUntilExp");
 var STORE_OF = {
   localStorage: "local",
   sessionStorage: "session",
@@ -333,13 +377,31 @@ function backendFor(mode) {
     get: /* @__PURE__ */ __name((key) => storage.read(key, store), "get"),
     set(key, value) {
       if (value === null) storage.remove(key, store);
-      else storage.write(key, value, store);
+      else storage.write(key, value, store, store === "cookie" && key === REFRESH_KEY ? { maxAgeSeconds: secondsUntilExp(value) } : void 0);
     }
   };
 }
 __name(backendFor, "backendFor");
-var _storageMode = "localStorage";
+var _storageMode = "cookie";
 var _storage = backendFor(_storageMode);
+var _apiKeyStore = backendFor("localStorage");
+function adoptLegacySession() {
+  if (!isBrowser || _storageMode !== "cookie") return;
+  try {
+    if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;
+    const legacy = backendFor("localStorage");
+    const access = legacy.get(ACCESS_KEY);
+    const refresh = legacy.get(REFRESH_KEY);
+    if (access === null && refresh === null) return;
+    if (access !== null) _storage.set(ACCESS_KEY, access);
+    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);
+    legacy.set(ACCESS_KEY, null);
+    legacy.set(REFRESH_KEY, null);
+  } catch {
+  }
+}
+__name(adoptLegacySession, "adoptLegacySession");
+adoptLegacySession();
 function detectLocale() {
   try {
     if (typeof document === "undefined") return null;
@@ -484,6 +546,14 @@ function ensureStorageSync() {
     }
   });
   window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
+  window.addEventListener("focus", () => notifySessionChanged());
+  document.addEventListener("visibilitychange", () => {
+    if (document.visibilityState === "visible") notifySessionChanged();
+  });
+  try {
+    window.cookieStore?.addEventListener("change", () => notifySessionChanged());
+  } catch {
+  }
 }
 __name(ensureStorageSync, "ensureStorageSync");
 var SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;
@@ -517,6 +587,17 @@ var auth = {
     _storage = backendFor(mode);
     notifySessionChanged();
   },
+  // ── Shared cookie domain ──────────────────────────────────────────
+  /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps
+   *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */
+  setCookieDomain(domain) {
+    storage.setCookieDomain(domain === null ? false : domain);
+    notifySessionChanged();
+  },
+  /** The `Domain` the session cookie is written with; `null` = host-only. */
+  getCookieDomain() {
+    return storage.cookieDomain();
+  },
   // ── Bearer token ──────────────────────────────────────────────────
   getToken() {
     return _storage.get(ACCESS_KEY);
@@ -603,18 +684,18 @@ var auth = {
   },
   // ── API key ───────────────────────────────────────────────────────
   getApiKey() {
-    return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
+    return _apiKeyOverride ?? _apiKeyStore.get(API_KEY_KEY) ?? defaultApiKey();
   },
   setApiKey(key) {
     _apiKeyOverride = key;
   },
   setApiKeyPersist(key) {
     _apiKeyOverride = key;
-    _storage.set(API_KEY_KEY, key);
+    _apiKeyStore.set(API_KEY_KEY, key);
   },
   clearApiKey() {
     _apiKeyOverride = null;
-    _storage.set(API_KEY_KEY, null);
+    _apiKeyStore.set(API_KEY_KEY, null);
   },
   // ── Locale ────────────────────────────────────────────────────────
   getLocale() {