@dynamic-labs-sdk/client 1.28.0 → 1.29.0

package/dist/index.cjs

@@ -1,9 +1,9 @@
-const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-DD_rZDrQ.cjs');
-const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-OhoRrL_X.cjs');
-const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-DnDhv_Uj.cjs');
-const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-KCtF3oaO.cjs');
-const require_getWalletProviderByKey = require('./getWalletProviderByKey-CnpXHkmq.cjs');
-const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-BjRiou3K.cjs');
+const require_updateAuthFromVerifyResponse = require('./updateAuthFromVerifyResponse-CePaJzru.cjs');
+const require_getNetworkProviderFromNetworkId = require('./getNetworkProviderFromNetworkId-BsmqXKF_.cjs');
+const require_isDynamicWaasEnabled = require('./isDynamicWaasEnabled-DT4jhqkC.cjs');
+const require_isUserOnboardingComplete = require('./isUserOnboardingComplete-DINsEIfi.cjs');
+const require_getWalletProviderByKey = require('./getWalletProviderByKey-BMsrnfN2.cjs');
+const require_isMfaRequiredForAction = require('./isMfaRequiredForAction-9ZrKcsTN.cjs');
 let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
 let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
 let zod_mini = require("zod/mini");
@@ -407,6 +407,40 @@ var ClientAlreadyInitializedError = class extends require_updateAuthFromVerifyRe
 	}
 };
 
+//#endregion
+//#region src/modules/initializeClient/logoutIfSessionPublicKeyMismatched/logoutIfSessionPublicKeyMismatched.ts
+/**
+* Signs the user out when the local session key no longer matches the
+* `sessionPublicKey` claim carried by the current token.
+*
+* The claim is captured once at sign-in and carried forward unchanged on
+* every token refresh (it is not re-derived from the client's current
+* session key). If the local session key is regenerated afterwards — e.g. a
+* re-init racing a token refresh, or storage being partially cleared — every
+* subsequent request keeps signing with the new key while asserting the
+* stale claim, and is rejected server-side with `invalid_nonce_signature`
+* forever, since retrying never re-syncs the claim. Signing out forces a
+* fresh sign-in, which is the only flow that re-captures the claim from the
+* client's current key.
+* @notInstrumented
+*/
+const logoutIfSessionPublicKeyMismatched = async (client) => {
+	const core = require_updateAuthFromVerifyResponse.getCore(client);
+	const { sessionKeys, token } = core.state.get();
+	if (!sessionKeys || !token) return;
+	let tokenSessionPublicKey;
+	try {
+		({sessionPublicKey: tokenSessionPublicKey} = require_updateAuthFromVerifyResponse.decodeJwt(token));
+	} catch (error) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Failed to decode token", error);
+		return;
+	}
+	if (tokenSessionPublicKey && tokenSessionPublicKey !== sessionKeys) {
+		core.logger.error("[logoutIfSessionPublicKeyMismatched] Session key does not match token claim");
+		await require_updateAuthFromVerifyResponse.__logoutWithReason_wrapped({ reason: "session-public-key-mismatch" }, client);
+	}
+};
+
 //#endregion
 //#region src/modules/initializeClient/initializeClient.ts
 /**
@@ -460,6 +494,7 @@ const initializeClient = async (client = require_updateAuthFromVerifyResponse.ge
 			storage: core.storage
 		}).catch(() => require_updateAuthFromVerifyResponse.__logoutWithReason_wrapped({ reason: "keychain-migration-failed" }, client));
 		if (core.state.get().sessionKeys && !await core.keychain.hasKey("session")) await require_updateAuthFromVerifyResponse.__logoutWithReason_wrapped({ reason: "keychain-key-missing" }, client);
+		await logoutIfSessionPublicKeyMismatched(client);
 	}).then(async () => {
 		if (!core.state.get().projectSettings) await require_updateAuthFromVerifyResponse.fetchProjectSettings(client);
 	});