@ethlete/query 6.0.0-next.44 → 6.0.0-next.45

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ethlete/query
 
+## 6.0.0-next.45
+
+### Patch Changes
+
+- [`cd8956e`](https://github.com/ethlete-io/ethdk/commit/cd8956ed2303074e4de564e6a2763e385acb17ee) Thanks [@TomTomB](https://github.com/TomTomB)! - Query: `withPersistentAuth` no longer leaves a second auth cookie behind on a subdomain, and logout removes the one it wrote.
+
 ## 6.0.0-next.44
 
 ### Patch Changes

package/fesm2022/ethlete-query.mjs

@@ -2,7 +2,7 @@ import * as i0 from '@angular/core';
 import { inject, Injector, effect, DestroyRef, InjectionToken, EnvironmentInjector, ElementRef, ErrorHandler, createEnvironmentInjector, untracked, signal, linkedSignal, computed, runInInjectionContext, isDevMode, PLATFORM_ID, resource, DOCUMENT, VERSION, makeEnvironmentProviders, provideEnvironmentInitializer, ApplicationRef, assertInInjectionContext, ChangeDetectorRef, ViewContainerRef, TemplateRef, Input, Directive, input, Pipe, ViewEncapsulation, Component, NgZone } from '@angular/core';
 import { UrlTree, Router, RedirectCommand, ActivatedRoute } from '@angular/router';
 import { Observable, defer, from, filter, Subject, Subscription, throwError, of, timer, switchMap, tap, retry, catchError, EMPTY as EMPTY$1, take, takeUntil, finalize, mergeMap, toArray, map, race, NEVER, merge, takeWhile, firstValueFrom, concatMap, fromEvent, throttleTime, interval, startWith, pairwise, BehaviorSubject, combineLatest, ReplaySubject, shareReplay, skip, withLatestFrom, debounceTime } from 'rxjs';
-import { defineStaticProvider, RuntimeError, clamp, randomId, defineRootProvider, isObject, injectUnsavedChangesCoordinator, injectRoute, getCookie, deleteCookie, setCookie, CORE_VERSION, createDestroy, computedTillTruthy, defineProvider, toProvideFn, toInjectFn, nextFrame, injectQueryParams, injectQueryParamChanges, clone, equal, ET_PROPERTY_REMOVED, previousSignalValue } from '@ethlete/core';
+import { defineStaticProvider, RuntimeError, clamp, randomId, defineRootProvider, isObject, injectUnsavedChangesCoordinator, injectRoute, getCookie, setCookie, deleteCookie, getDomain, CORE_VERSION, createDestroy, computedTillTruthy, defineProvider, toProvideFn, toInjectFn, nextFrame, injectQueryParams, injectQueryParamChanges, clone, equal, ET_PROPERTY_REMOVED, previousSignalValue } from '@ethlete/core';
 import { HttpClient, HttpEventType, HttpErrorResponse, HttpResponse, HttpHeaders, HttpStatusCode } from '@angular/common/http';
 import { toObservable, takeUntilDestroyed, toSignal } from '@angular/core/rxjs-interop';
 import { getActiveConsumer, setActiveConsumer } from '@angular/core/primitives/signals';
@@ -6755,7 +6755,41 @@ const createPersistentAuthFeature = (config, context) => {
     ...(ngDevMode ? [{ debugName: "rememberMeSignal" }] : /* istanbul ignore next */ []));
     const cookieDomain = () => config.cookie?.domain ?? null;
     const cookiePath = () => config.cookie?.path ?? '/';
-    const removeCookie = () => deleteCookie(cookieName, cookiePath(), cookieDomain());
+    const cookieExpiry = (rememberMe) => (rememberMe ? (config.cookie?.expiresInDays ?? 30) : null);
+    const writeCookie = (encryptedToken, expiresInDays) => setCookie(cookieName, encryptedToken, expiresInDays, cookieDomain(), cookiePath(), config.cookie?.sameSite ?? 'lax');
+    // A browser keeps one cookie per name and scope, and `document.cookie` names no scope: a host-only
+    // cookie and one on the registrable domain both show up, oldest first. Only this config's scope may
+    // survive, or a cookie written under the other domain default shadows ours on every read and
+    // outlives logout.
+    const removeOtherScopeCookie = () => {
+        const configuredDomain = cookieDomain();
+        if (configuredDomain) {
+            deleteCookie(cookieName, cookiePath(), null);
+            return;
+        }
+        const registrableDomain = getDomain();
+        if (registrableDomain) {
+            deleteCookie(cookieName, cookiePath(), registrableDomain);
+        }
+    };
+    const removeCookie = () => {
+        deleteCookie(cookieName, cookiePath(), cookieDomain());
+        removeOtherScopeCookie();
+    };
+    // Runs before `tryLogin` reads the cookie, so the token an older version left in the other scope
+    // still starts a session instead of being dropped.
+    const adoptOtherScopeCookie = () => {
+        if (context.isTabLocalSession())
+            return;
+        const carriedToken = getCookie(cookieName);
+        if (!carriedToken)
+            return;
+        removeOtherScopeCookie();
+        if (getCookie(cookieName))
+            return;
+        writeCookie(carriedToken, cookieExpiry(rememberMeSignal()));
+    };
+    adoptOtherScopeCookie();
     effect(() => {
         const token = refreshToken();
         const rememberMe = rememberMeSignal();
@@ -6770,8 +6804,8 @@ const createPersistentAuthFeature = (config, context) => {
         // that actually end a session instead, below.
         if (!token)
             return;
-        const expiresInDays = rememberMe ? (config.cookie?.expiresInDays ?? 30) : null;
-        setCookie(cookieName, encryptToken(token), expiresInDays, cookieDomain(), cookiePath(), config.cookie?.sameSite ?? 'lax');
+        removeOtherScopeCookie();
+        writeCookie(encryptToken(token), cookieExpiry(rememberMe));
     });
     effect(() => {
         const endCause = context.sessionEndCause();
@@ -9662,7 +9696,7 @@ const armQueryDevtoolsOverrideTransfer = (recorder, ops) => {
 
 // Generated from package.json by tools/scripts/generate-version.js - do not edit.
 /** The version of `@ethlete/query` this build was cut from. */
-const QUERY_VERSION = '6.0.0-next.44';
+const QUERY_VERSION = '6.0.0-next.45';
 
 /** How deep a schema is expanded before a nested branch is given up on. */
 const MAX_DEPTH = 12;