@dynamic-labs-wallet/core 1.0.118 → 1.0.120

package/index.cjs

@@ -954,8 +954,23 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.0.118";
+var version = "1.0.120";
 
+/**
+ * Reads the Authorization header off an axios request config, which stores
+ * headers either as a plain object or as an `AxiosHeaders` instance.
+ */ const readAuthorizationHeader = (requestHeaders)=>{
+    if (typeof requestHeaders !== 'object' || requestHeaders === null) {
+        return undefined;
+    }
+    const headers = requestHeaders;
+    var _headers_Authorization;
+    const authorization = (_headers_Authorization = headers['Authorization']) != null ? _headers_Authorization : headers['authorization'];
+    if (typeof authorization !== 'string') {
+        return undefined;
+    }
+    return authorization;
+};
 class BaseClient {
     /**
    * Fire {@link onUnauthorized} whenever a request on this axios instance sees a
@@ -969,27 +984,47 @@ class BaseClient {
    * response/error; it only signals out-of-band, leaving existing error
    * handling unchanged.
    */ installUnauthorizedInterceptor(client) {
-        const fireIfUnauthorized = (status)=>{
-            if (status === 401) {
-                try {
-                    this.onUnauthorized == null ? void 0 : this.onUnauthorized.call(this);
-                } catch (error) {
-                    this.logger.error('[BaseClient] onUnauthorized handler threw', {
-                        error
-                    });
-                }
+        const fireIfUnauthorized = (status, requestHeaders)=>{
+            if (status !== 401) {
+                return;
+            }
+            if (this.isSupersededAuthHeader(requestHeaders)) {
+                this.logger.info('[BaseClient] ignoring 401 for a request that carried a superseded auth token');
+                return;
+            }
+            try {
+                this.onUnauthorized == null ? void 0 : this.onUnauthorized.call(this);
+            } catch (error) {
+                this.logger.error('[BaseClient] onUnauthorized handler threw', {
+                    error
+                });
             }
         };
         client.interceptors.response.use((response)=>{
-            fireIfUnauthorized(response == null ? void 0 : response.status);
+            var _response_config;
+            fireIfUnauthorized(response == null ? void 0 : response.status, response == null ? void 0 : (_response_config = response.config) == null ? void 0 : _response_config.headers);
             return response;
         }, (error)=>{
-            var _error_response;
+            var _error_response, _error_config;
             var _error_response_status;
-            fireIfUnauthorized((_error_response_status = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.status) != null ? _error_response_status : error == null ? void 0 : error.status);
+            fireIfUnauthorized((_error_response_status = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.status) != null ? _error_response_status : error == null ? void 0 : error.status, error == null ? void 0 : (_error_config = error.config) == null ? void 0 : _error_config.headers);
             return Promise.reject(error);
         });
     }
+    /**
+   * Whether a request was sent with an auth token that {@link syncAuthToken} has
+   * since replaced. Its 401 says nothing about the token the client holds now,
+   * so it must not reach {@link onUnauthorized} and log the user out.
+   */ isSupersededAuthHeader(requestHeaders) {
+        if (this.authMode !== AuthMode.HEADER || !this.currentAuthHeader) {
+            return false;
+        }
+        const requestAuthHeader = readAuthorizationHeader(requestHeaders);
+        if (!requestAuthHeader) {
+            return false;
+        }
+        return requestAuthHeader !== this.currentAuthHeader;
+    }
     get forwardMPCClient() {
         if (!this._forwardMpcClient) {
             throw new Error('Forward MPC client is not initialized');
@@ -1007,6 +1042,7 @@ class BaseClient {
             throw new Error('Auth token is required for header authentication');
         }
         const authHeader = `Bearer ${authToken}`;
+        this.currentAuthHeader = authHeader;
         this.apiClient.defaults.headers['Authorization'] = authHeader;
         this.clientRelayApiClient.defaults.headers['Authorization'] = authHeader;
         this.apiClient.defaults.headers.common['Authorization'] = authHeader;
@@ -1033,6 +1069,7 @@ class BaseClient {
         // Only set Authorization header if using header auth mode and token is provided
         if (authMode === AuthMode.HEADER && authToken) {
             headers['Authorization'] = `Bearer ${authToken}`;
+            this.currentAuthHeader = headers['Authorization'];
         }
         headers['x-dyn-wallet-sdk-version'] = version;
         headers['x-dyn-version'] = sdkVersion;

package/index.esm.js

@@ -954,8 +954,23 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.0.118";
+var version = "1.0.120";
 
+/**
+ * Reads the Authorization header off an axios request config, which stores
+ * headers either as a plain object or as an `AxiosHeaders` instance.
+ */ const readAuthorizationHeader = (requestHeaders)=>{
+    if (typeof requestHeaders !== 'object' || requestHeaders === null) {
+        return undefined;
+    }
+    const headers = requestHeaders;
+    var _headers_Authorization;
+    const authorization = (_headers_Authorization = headers['Authorization']) != null ? _headers_Authorization : headers['authorization'];
+    if (typeof authorization !== 'string') {
+        return undefined;
+    }
+    return authorization;
+};
 class BaseClient {
     /**
    * Fire {@link onUnauthorized} whenever a request on this axios instance sees a
@@ -969,27 +984,47 @@ class BaseClient {
    * response/error; it only signals out-of-band, leaving existing error
    * handling unchanged.
    */ installUnauthorizedInterceptor(client) {
-        const fireIfUnauthorized = (status)=>{
-            if (status === 401) {
-                try {
-                    this.onUnauthorized == null ? void 0 : this.onUnauthorized.call(this);
-                } catch (error) {
-                    this.logger.error('[BaseClient] onUnauthorized handler threw', {
-                        error
-                    });
-                }
+        const fireIfUnauthorized = (status, requestHeaders)=>{
+            if (status !== 401) {
+                return;
+            }
+            if (this.isSupersededAuthHeader(requestHeaders)) {
+                this.logger.info('[BaseClient] ignoring 401 for a request that carried a superseded auth token');
+                return;
+            }
+            try {
+                this.onUnauthorized == null ? void 0 : this.onUnauthorized.call(this);
+            } catch (error) {
+                this.logger.error('[BaseClient] onUnauthorized handler threw', {
+                    error
+                });
             }
         };
         client.interceptors.response.use((response)=>{
-            fireIfUnauthorized(response == null ? void 0 : response.status);
+            var _response_config;
+            fireIfUnauthorized(response == null ? void 0 : response.status, response == null ? void 0 : (_response_config = response.config) == null ? void 0 : _response_config.headers);
             return response;
         }, (error)=>{
-            var _error_response;
+            var _error_response, _error_config;
             var _error_response_status;
-            fireIfUnauthorized((_error_response_status = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.status) != null ? _error_response_status : error == null ? void 0 : error.status);
+            fireIfUnauthorized((_error_response_status = error == null ? void 0 : (_error_response = error.response) == null ? void 0 : _error_response.status) != null ? _error_response_status : error == null ? void 0 : error.status, error == null ? void 0 : (_error_config = error.config) == null ? void 0 : _error_config.headers);
             return Promise.reject(error);
         });
     }
+    /**
+   * Whether a request was sent with an auth token that {@link syncAuthToken} has
+   * since replaced. Its 401 says nothing about the token the client holds now,
+   * so it must not reach {@link onUnauthorized} and log the user out.
+   */ isSupersededAuthHeader(requestHeaders) {
+        if (this.authMode !== AuthMode.HEADER || !this.currentAuthHeader) {
+            return false;
+        }
+        const requestAuthHeader = readAuthorizationHeader(requestHeaders);
+        if (!requestAuthHeader) {
+            return false;
+        }
+        return requestAuthHeader !== this.currentAuthHeader;
+    }
     get forwardMPCClient() {
         if (!this._forwardMpcClient) {
             throw new Error('Forward MPC client is not initialized');
@@ -1007,6 +1042,7 @@ class BaseClient {
             throw new Error('Auth token is required for header authentication');
         }
         const authHeader = `Bearer ${authToken}`;
+        this.currentAuthHeader = authHeader;
         this.apiClient.defaults.headers['Authorization'] = authHeader;
         this.clientRelayApiClient.defaults.headers['Authorization'] = authHeader;
         this.apiClient.defaults.headers.common['Authorization'] = authHeader;
@@ -1033,6 +1069,7 @@ class BaseClient {
         // Only set Authorization header if using header auth mode and token is provided
         if (authMode === AuthMode.HEADER && authToken) {
             headers['Authorization'] = `Bearer ${authToken}`;
+            this.currentAuthHeader = headers['Authorization'];
         }
         headers['x-dyn-wallet-sdk-version'] = version;
         headers['x-dyn-version'] = sdkVersion;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dynamic-labs-wallet/core",
-  "version": "1.0.118",
+  "version": "1.0.120",
   "license": "MIT",
   "type": "module",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "^0.16.0",
-    "@dynamic-labs-wallet/primitives": "1.0.118",
+    "@dynamic-labs-wallet/primitives": "1.0.120",
     "axios": "1.16.0",
     "uuid": "11.1.0"
   },

package/src/api/client.d.ts

@@ -13,6 +13,8 @@ export declare class BaseClient {
     protected backupServiceAuthToken?: string;
     /** Notifies the host (via the reverse channel) when a 401 is seen. */
     protected onUnauthorized?: () => void;
+    /** Authorization header this client presents on header-auth requests. */
+    protected currentAuthHeader?: string;
     constructor({ environmentId, baseApiUrl, authToken, backupServiceAuthToken, baseClientKeysharesRelayApiUrl, authMode, sdkVersion, forwardMPCClient, logger, onUnauthorized, }: {
         environmentId: string;
         baseApiUrl?: string;
@@ -43,6 +45,12 @@ export declare class BaseClient {
      * handling unchanged.
      */
     private installUnauthorizedInterceptor;
+    /**
+     * Whether a request was sent with an auth token that {@link syncAuthToken} has
+     * since replaced. Its 401 says nothing about the token the client holds now,
+     * so it must not reach {@link onUnauthorized} and log the user out.
+     */
+    private isSupersededAuthHeader;
     get forwardMPCClient(): ForwardMPCClientV2;
     set forwardMPCClient(forwardMPCClient: ForwardMPCClientV2 | undefined);
     syncAuthToken(authToken: string): void;

package/src/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAWlD,OAAO,EAAE,QAAQ,EAAc,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,qBAAa,UAAU;IACd,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B,EAAE,MAAM,CAAC;IACvC,oBAAoB,EAAE,aAAa,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,SAAS,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAC1C,sEAAsE;IACtE,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;gBAE1B,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,8BAA8B,EAC9B,QAA0B,EAE1B,UAAU,EACV,gBAAgB,EAChB,MAAM,EACN,cAAc,GACf,EAAE;QACD,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;KAC7B;IAmDD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAuBtC,IAAI,gBAAgB,IAAI,kBAAkB,CAKzC;IAED,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAEpE;IAED,aAAa,CAAC,SAAS,EAAE,MAAM;IA2B/B,0BAA0B,CAAC,sBAAsB,EAAE,MAAM;CAW1D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAWlD,OAAO,EAAE,QAAQ,EAAc,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAqBlF,qBAAa,UAAU;IACd,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B,EAAE,MAAM,CAAC;IACvC,oBAAoB,EAAE,aAAa,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,SAAS,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAC1C,sEAAsE;IACtE,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IACtC,yEAAyE;IACzE,SAAS,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAEzB,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,8BAA8B,EAC9B,QAA0B,EAE1B,UAAU,EACV,gBAAgB,EAChB,MAAM,EACN,cAAc,GACf,EAAE;QACD,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;KAC7B;IAoDD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IA8BtC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAa9B,IAAI,gBAAgB,IAAI,kBAAkB,CAKzC;IAED,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,EAEpE;IAED,aAAa,CAAC,SAAS,EAAE,MAAM;IA4B/B,0BAA0B,CAAC,sBAAsB,EAAE,MAAM;CAW1D"}