@djangocfg/api 2.1.603 → 2.1.605

package/dist/auth.mjs

@@ -96,8 +96,8 @@ var APIError = class extends Error {
 var k = /* @__PURE__ */ __name((key, store, personal) => ({ key, store, personal }), "k");
 var f = /* @__PURE__ */ __name((prefix, store, personal) => ({ prefix, store, personal }), "f");
 var CFG_KEYS = {
-  accessToken: k("cfg.auth.access_token", "local", true),
-  refreshToken: k("cfg.auth.refresh_token", "local", true),
+  accessToken: k("cfg.auth.access_token", "cookie", true),
+  refreshToken: k("cfg.auth.refresh_token", "cookie", true),
   apiKey: k("cfg.auth.api_key", "local", true),
   email: k("cfg.auth.email", "local", false),
   emailTs: k("cfg.auth.email_ts", "local", false),
@@ -132,6 +132,31 @@ function normalizeSegment(raw) {
 }
 __name(normalizeSegment, "normalizeSegment");
 var hasWindow = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
+var domainByHost = /* @__PURE__ */ new Map();
+function detectCookieDomain() {
+  if (!hasWindow() || typeof document === "undefined") return null;
+  const host = window.location.hostname.toLowerCase();
+  if (!host || !host.includes(".") || host.includes(":") || /^[0-9.]+$/.test(host)) return null;
+  const cached = domainByHost.get(host);
+  if (cached !== void 0) return cached;
+  const labels = host.split(".");
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  let found = null;
+  try {
+    for (let i = labels.length - 2; i >= 0 && found === null; i -= 1) {
+      const candidate = labels.slice(i).join(".");
+      const probe = "cfg_probe_" + Math.random().toString(36).slice(2);
+      document.cookie = probe + "=1; Domain=" + candidate + "; Path=/; Max-Age=30; SameSite=Lax" + secure;
+      if (document.cookie.includes(probe + "=1")) found = candidate;
+      document.cookie = probe + "=; Domain=" + candidate + "; Path=/; Max-Age=0; SameSite=Lax" + secure;
+    }
+  } catch {
+    found = null;
+  }
+  domainByHost.set(host, found);
+  return found;
+}
+__name(detectCookieDomain, "detectCookieDomain");
 function nativeStorage(store) {
   if (!hasWindow()) return null;
   try {
@@ -157,6 +182,12 @@ function createStorage(owner, options = {}) {
   const prefix = `${owner}.`;
   const pattern = owner === "cfg" ? /^cfg(\.[a-z0-9_]+)+$/ : new RegExp(`^(cfg|${owner})(\\.[a-z0-9_]+)+$`);
   const cookieMaxAge = options.cookieMaxAgeSeconds ?? 60 * 60 * 24 * 30;
+  let cookiePolicy = options.cookieDomain ?? "auto";
+  const resolveCookieDomain = /* @__PURE__ */ __name(() => cookiePolicy === false ? null : cookiePolicy === "auto" ? detectCookieDomain() : cookiePolicy, "resolveCookieDomain");
+  const expireCookie = /* @__PURE__ */ __name((key, domain) => {
+    const secure = window.location.protocol === "https:" ? "; Secure" : "";
+    document.cookie = encodeURIComponent(key) + "=; Path=/; Max-Age=0; SameSite=Lax" + (domain ? "; Domain=" + domain : "") + secure;
+  }, "expireCookie");
   const specs = Object.values(options.keys ?? {});
   const families = Object.values(options.families ?? {});
   const specByKey = /* @__PURE__ */ new Map();
@@ -193,12 +224,15 @@ function createStorage(owner, options = {}) {
     return memory[store].get(key) ?? null;
   }
   __name(rawGet, "rawGet");
-  function rawSet(store, key, value) {
+  function rawSet(store, key, value, maxAgeSeconds) {
     if (!hasWindow()) return false;
     try {
       if (store === "cookie") {
         const secure = window.location.protocol === "https:" ? "; Secure" : "";
-        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${cookieMaxAge}; SameSite=Lax${secure}`;
+        const domain = resolveCookieDomain();
+        const domainPart = domain ? `; Domain=${domain}` : "";
+        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;
+        if (domain) expireCookie(key, null);
         if (rawGet("cookie", key) === value && !memory.cookie.has(key)) return true;
         memory.cookie.set(key, value);
         return false;
@@ -219,8 +253,9 @@ function createStorage(owner, options = {}) {
     if (!hasWindow()) return;
     try {
       if (store === "cookie") {
-        const secure = window.location.protocol === "https:" ? "; Secure" : "";
-        document.cookie = `${encodeURIComponent(key)}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+        expireCookie(key, null);
+        const domain = resolveCookieDomain();
+        if (domain) expireCookie(key, domain);
       } else {
         nativeStorage(store)?.removeItem(key);
       }
@@ -269,10 +304,10 @@ function createStorage(owner, options = {}) {
       const target = resolveStore(key, store);
       return rawGet(target, key);
     },
-    write(key, value, store) {
+    write(key, value, store, writeOptions) {
       assertOwned(key);
       const target = resolveStore(key, store);
-      return rawSet(target, key, value);
+      return rawSet(target, key, value, writeOptions?.maxAgeSeconds);
     },
     remove(key, store) {
       assertOwned(key);
@@ -310,6 +345,10 @@ function createStorage(owner, options = {}) {
         for (const name of cookieNames()) if (name.startsWith(prefix)) rawRemove("cookie", name);
       }
     },
+    setCookieDomain(domain) {
+      cookiePolicy = domain;
+    },
+    cookieDomain: resolveCookieDomain,
     onChange(key, listener, store = "local") {
       assertValid(key);
       if (!hasWindow()) return () => {
@@ -336,6 +375,11 @@ var REFRESH_KEY = "cfg.auth.refresh_token";
 var API_KEY_KEY = "cfg.auth.api_key";
 var storage = true ? cfgStorage : createStorage2("cfg");
 var isBrowser = typeof window !== "undefined";
+function secondsUntilExp(token) {
+  const exp = jwtExpMs(token);
+  return exp === null ? void 0 : Math.max(1, Math.floor((exp - Date.now()) / 1e3));
+}
+__name(secondsUntilExp, "secondsUntilExp");
 var STORE_OF = {
   localStorage: "local",
   sessionStorage: "session",
@@ -347,13 +391,31 @@ function backendFor(mode) {
     get: /* @__PURE__ */ __name((key) => storage.read(key, store), "get"),
     set(key, value) {
       if (value === null) storage.remove(key, store);
-      else storage.write(key, value, store);
+      else storage.write(key, value, store, store === "cookie" && key === REFRESH_KEY ? { maxAgeSeconds: secondsUntilExp(value) } : void 0);
     }
   };
 }
 __name(backendFor, "backendFor");
-var _storageMode = "localStorage";
+var _storageMode = "cookie";
 var _storage = backendFor(_storageMode);
+var _apiKeyStore = backendFor("localStorage");
+function adoptLegacySession() {
+  if (!isBrowser || _storageMode !== "cookie") return;
+  try {
+    if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;
+    const legacy = backendFor("localStorage");
+    const access = legacy.get(ACCESS_KEY);
+    const refresh = legacy.get(REFRESH_KEY);
+    if (access === null && refresh === null) return;
+    if (access !== null) _storage.set(ACCESS_KEY, access);
+    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);
+    legacy.set(ACCESS_KEY, null);
+    legacy.set(REFRESH_KEY, null);
+  } catch {
+  }
+}
+__name(adoptLegacySession, "adoptLegacySession");
+adoptLegacySession();
 function detectLocale() {
   try {
     if (typeof document === "undefined") return null;
@@ -498,6 +560,14 @@ function ensureStorageSync() {
     }
   });
   window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
+  window.addEventListener("focus", () => notifySessionChanged());
+  document.addEventListener("visibilitychange", () => {
+    if (document.visibilityState === "visible") notifySessionChanged();
+  });
+  try {
+    window.cookieStore?.addEventListener("change", () => notifySessionChanged());
+  } catch {
+  }
 }
 __name(ensureStorageSync, "ensureStorageSync");
 var SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;
@@ -531,6 +601,17 @@ var auth = {
     _storage = backendFor(mode);
     notifySessionChanged();
   },
+  // ── Shared cookie domain ──────────────────────────────────────────
+  /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps
+   *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */
+  setCookieDomain(domain) {
+    storage.setCookieDomain(domain === null ? false : domain);
+    notifySessionChanged();
+  },
+  /** The `Domain` the session cookie is written with; `null` = host-only. */
+  getCookieDomain() {
+    return storage.cookieDomain();
+  },
   // ── Bearer token ──────────────────────────────────────────────────
   getToken() {
     return _storage.get(ACCESS_KEY);
@@ -617,18 +698,18 @@ var auth = {
   },
   // ── API key ───────────────────────────────────────────────────────
   getApiKey() {
-    return _apiKeyOverride ?? _storage.get(API_KEY_KEY) ?? defaultApiKey();
+    return _apiKeyOverride ?? _apiKeyStore.get(API_KEY_KEY) ?? defaultApiKey();
   },
   setApiKey(key) {
     _apiKeyOverride = key;
   },
   setApiKeyPersist(key) {
     _apiKeyOverride = key;
-    _storage.set(API_KEY_KEY, key);
+    _apiKeyStore.set(API_KEY_KEY, key);
   },
   clearApiKey() {
     _apiKeyOverride = null;
-    _storage.set(API_KEY_KEY, null);
+    _apiKeyStore.set(API_KEY_KEY, null);
   },
   // ── Locale ────────────────────────────────────────────────────────
   getLocale() {
@@ -4299,6 +4380,30 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
   };
 }, "useDeleteAccount");
 
+// src/auth/hooks/legacyStorage.ts
+var LEGACY_TOKEN_KEYS = [
+  "cfg.auth.access_token",
+  "cfg.auth.refresh_token",
+  "auth_token",
+  "refresh_token",
+  "access_token"
+];
+function purgeLegacyTokenStorage() {
+  const removed = [];
+  try {
+    if (typeof window === "undefined") return removed;
+    for (const key of LEGACY_TOKEN_KEYS) {
+      if (window.localStorage.getItem(key) !== null) {
+        window.localStorage.removeItem(key);
+        removed.push(key);
+      }
+    }
+  } catch {
+  }
+  return removed;
+}
+__name(purgeLegacyTokenStorage, "purgeLegacyTokenStorage");
+
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
@@ -4671,6 +4776,10 @@ __name(hasApiOrigin, "hasApiOrigin");
 var AccountsContext = createContext(void 0);
 function AccountsProvider({ children }) {
   const [profile, setProfile] = useState10(() => {
+    if (!auth.isAuthenticated()) {
+      clearProfileCache();
+      return void 0;
+    }
     const cached = getCachedProfile();
     return cached || void 0;
   });
@@ -4871,6 +4980,10 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         authLogger.warn("Dead session in storage \u2014 clearing");
         auth.clearSession();
         clearProfileCache();
+      } else if (!hasTokens && !auth.isAuthenticated()) {
+        clearProfileCache();
+        purgeLegacyTokenStorage();
+        if (accountsRef.current.profile) accountsRef.current.logout();
       }
       setProfileSettled(true);
       return;