@ethora/chat-component-rn 26.7.10 → 26.8.1

package/lib/commonjs/helpers/secureUserStorage.js

@@ -1,75 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.secureUserStorage = secureUserStorage;
-var _useLocalStorage = require("../hooks/useLocalStorage");
-var _LOCAL_STORAGE = require("./constants/LOCAL_STORAGE");
-var _secureKeyValue = require("./secureKeyValue");
-// Keychain (iOS) / Keystore-backed EncryptedSharedPreferences (Android)
-// keys for the four live bearer credentials on `User`. Deliberately one
-// key per field rather than one JSON blob: expo-secure-store historically
-// caps a single value's size on Android, and four short JWTs each stay
-// comfortably under that ceiling where one combined blob might not.
-const SECRET_KEYS = {
-  token: 'ethora_auth_token',
-  refreshToken: 'ethora_auth_refresh_token',
-  xmppPassword: 'ethora_auth_xmpp_password',
-  fileToken: 'ethora_auth_file_token'
-};
-const SECRET_FIELDS = Object.keys(SECRET_KEYS);
-
-/**
- * Persisted-user storage, split across two backends behind the exact
- * same `{ get, set, remove }` shape `asyncLocalStorage<User>(...)`
- * already exposed — every existing call site swaps in by changing only
- * the constructor call, `get()`/`set()`/`remove()` keep returning/taking
- * a complete `User`.
- *
- * The four live credentials (REST access + refresh token, XMPP
- * password, secure-media fileToken) never touch plain AsyncStorage:
- * they go through `secureGet`/`secureSet`/`secureRemove` (platform
- * Keychain/Keystore, falling back to namespaced AsyncStorage only when
- * the host hasn't installed the optional `expo-secure-store` peer dep).
- * Everything else on `User` — name, avatar, ids, xmppUsername, wallet
- * address, none of it a bearer credential — keeps living under the
- * existing `ETHORA_USER` AsyncStorage key, unchanged.
- */
-function secureUserStorage() {
-  const get = async () => {
-    const profile = await (0, _useLocalStorage.asyncLocalStorage)(_LOCAL_STORAGE.localStorageConstants.ETHORA_USER).get();
-    if (!profile) {
-      return null;
-    }
-    const secretValues = await Promise.all(SECRET_FIELDS.map(field => (0, _secureKeyValue.secureGet)(SECRET_KEYS[field])));
-    const merged = {
-      ...profile
-    };
-    SECRET_FIELDS.forEach((field, i) => {
-      merged[field] = secretValues[i] || '';
-    });
-    return merged;
-  };
-  const set = async user => {
-    const profile = {
-      ...user
-    };
-    for (const field of SECRET_FIELDS) {
-      profile[field] = '';
-    }
-    await Promise.all([(0, _useLocalStorage.asyncLocalStorage)(_LOCAL_STORAGE.localStorageConstants.ETHORA_USER).set(profile), ...SECRET_FIELDS.map(field => {
-      const value = user?.[field];
-      return value ? (0, _secureKeyValue.secureSet)(SECRET_KEYS[field], value) : (0, _secureKeyValue.secureRemove)(SECRET_KEYS[field]);
-    })]);
-  };
-  const remove = async () => {
-    await Promise.all([(0, _useLocalStorage.asyncLocalStorage)(_LOCAL_STORAGE.localStorageConstants.ETHORA_USER).remove(), ...SECRET_FIELDS.map(field => (0, _secureKeyValue.secureRemove)(SECRET_KEYS[field]))]);
-  };
-  return {
-    get,
-    set,
-    remove
-  };
-}
-//# sourceMappingURL=secureUserStorage.js.map

package/lib/commonjs/helpers/secureUserStorage.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_useLocalStorage","require","_LOCAL_STORAGE","_secureKeyValue","SECRET_KEYS","token","refreshToken","xmppPassword","fileToken","SECRET_FIELDS","Object","keys","secureUserStorage","get","profile","asyncLocalStorage","localStorageConstants","ETHORA_USER","secretValues","Promise","all","map","field","secureGet","merged","forEach","i","set","user","value","secureSet","secureRemove","remove"],"sourceRoot":"../../../src","sources":["helpers/secureUserStorage.ts"],"mappings":";;;;;;AACA,IAAAA,gBAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,eAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA,MAAMG,WAAW,GAAG;EAClBC,KAAK,EAAE,mBAAmB;EAC1BC,YAAY,EAAE,2BAA2B;EACzCC,YAAY,EAAE,2BAA2B;EACzCC,SAAS,EAAE;AACb,CAAU;AAGV,MAAMC,aAAa,GAAGC,MAAM,CAACC,IAAI,CAACP,WAAW,CAAkB;;AAE/D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASQ,iBAAiBA,CAAA,EAAG;EAClC,MAAMC,GAAG,GAAG,MAAAA,CAAA,KAAkC;IAC5C,MAAMC,OAAO,GAAG,MAAM,IAAAC,kCAAiB,EACrCC,oCAAqB,CAACC,WACxB,CAAC,CAACJ,GAAG,CAAC,CAAC;IACP,IAAI,CAACC,OAAO,EAAE;MAAC,OAAO,IAAI;IAAC;IAE3B,MAAMI,YAAY,GAAG,MAAMC,OAAO,CAACC,GAAG,CACpCX,aAAa,CAACY,GAAG,CAAEC,KAAK,IAAK,IAAAC,yBAAS,EAACnB,WAAW,CAACkB,KAAK,CAAC,CAAC,CAC5D,CAAC;IAED,MAAME,MAAY,GAAG;MAAE,GAAGV;IAAQ,CAAC;IACnCL,aAAa,CAACgB,OAAO,CAAC,CAACH,KAAK,EAAEI,CAAC,KAAK;MACjCF,MAAM,CAASF,KAAK,CAAC,GAAGJ,YAAY,CAACQ,CAAC,CAAC,IAAI,EAAE;IAChD,CAAC,CAAC;IACF,OAAOF,MAAM;EACf,CAAC;EAED,MAAMG,GAAG,GAAG,MAAOC,IAAU,IAAoB;IAC/C,MAAMd,OAAY,GAAG;MAAE,GAAGc;IAAK,CAAC;IAChC,KAAK,MAAMN,KAAK,IAAIb,aAAa,EAAE;MACjCK,OAAO,CAACQ,KAAK,CAAC,GAAG,EAAE;IACrB;IAEA,MAAMH,OAAO,CAACC,GAAG,CAAC,CAChB,IAAAL,kCAAiB,EAAOC,oCAAqB,CAACC,WAAW,CAAC,CAACU,GAAG,CAACb,OAAO,CAAC,EACvE,GAAGL,aAAa,CAACY,GAAG,CAAEC,KAAK,IAAK;MAC9B,MAAMO,KAAK,GAAGD,IAAI,GAAGN,KAAK,CAAuB;MACjD,OAAOO,KAAK,GACR,IAAAC,yBAAS,EAAC1B,WAAW,CAACkB,KAAK,CAAC,EAAEO,KAAK,CAAC,GACpC,IAAAE,4BAAY,EAAC3B,WAAW,CAACkB,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;EACJ,CAAC;EAED,MAAMU,MAAM,GAAG,MAAAA,CAAA,KAA2B;IACxC,MAAMb,OAAO,CAACC,GAAG,CAAC,CAChB,IAAAL,kCAAiB,EAACC,oCAAqB,CAACC,WAAW,CAAC,CAACe,MAAM,CAAC,CAAC,EAC7D,GAAGvB,aAAa,CAACY,GAAG,CAAEC,KAAK,IAAK,IAAAS,4BAAY,EAAC3B,WAAW,CAACkB,KAAK,CAAC,CAAC,CAAC,CAClE,CAAC;EACJ,CAAC;EAED,OAAO;IAAET,GAAG;IAAEc,GAAG;IAAEK;EAAO,CAAC;AAC7B","ignoreList":[]}

package/lib/commonjs/helpers/shallowEqual.js

@@ -1,36 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = void 0;
-exports.shallowEqual = shallowEqual;
-/**
- * One-level shallow equality for plain objects. Used to avoid re-dispatching
- * config into redux on every render just because the host passed a fresh
- * object literal with the same values (e.g. `<Chat config={{...}} />`
- * re-created inline) — reference equality alone would fire far too often,
- * and a deep/JSON comparison risks throwing on non-serializable fields
- * (functions, React elements) that configs legitimately carry.
- */
-function shallowEqual(a, b) {
-  if (a === b) {
-    return true;
-  }
-  if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) {
-    return false;
-  }
-  const aKeys = Object.keys(a);
-  const bKeys = Object.keys(b);
-  if (aKeys.length !== bKeys.length) {
-    return false;
-  }
-  for (const key of aKeys) {
-    if (a[key] !== b[key]) {
-      return false;
-    }
-  }
-  return true;
-}
-var _default = exports.default = shallowEqual;
-//# sourceMappingURL=shallowEqual.js.map

package/lib/commonjs/helpers/shallowEqual.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["shallowEqual","a","b","aKeys","Object","keys","bKeys","length","key","_default","exports","default"],"sourceRoot":"../../../src","sources":["helpers/shallowEqual.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,YAAYA,CAACC,CAAU,EAAEC,CAAU,EAAW;EAC5D,IAAID,CAAC,KAAKC,CAAC,EAAE;IAAC,OAAO,IAAI;EAAC;EAC1B,IACE,OAAOD,CAAC,KAAK,QAAQ,IACrB,OAAOC,CAAC,KAAK,QAAQ,IACrBD,CAAC,KAAK,IAAI,IACVC,CAAC,KAAK,IAAI,EACV;IACA,OAAO,KAAK;EACd;EACA,MAAMC,KAAK,GAAGC,MAAM,CAACC,IAAI,CAACJ,CAA4B,CAAC;EACvD,MAAMK,KAAK,GAAGF,MAAM,CAACC,IAAI,CAACH,CAA4B,CAAC;EACvD,IAAIC,KAAK,CAACI,MAAM,KAAKD,KAAK,CAACC,MAAM,EAAE;IAAC,OAAO,KAAK;EAAC;EACjD,KAAK,MAAMC,GAAG,IAAIL,KAAK,EAAE;IACvB,IACGF,CAAC,CAA6BO,GAAG,CAAC,KAClCN,CAAC,CAA6BM,GAAG,CAAC,EACnC;MACA,OAAO,KAAK;IACd;EACF;EACA,OAAO,IAAI;AACb;AAAC,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAEcX,YAAY","ignoreList":[]}

package/lib/commonjs/helpers/sheetGestures.js

@@ -1,32 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.shouldDismissOnDrag = exports.shouldClaimVerticalDrag = exports.DISMISS_VELOCITY = exports.DISMISS_DISTANCE = void 0;
-/** @format */
-
-/**
- * Shared thresholds for the drag-to-dismiss gesture on bottom sheets (the
- * attach sheet, the profile headers, the room-list menu). Kept in one
- * place so a pull feels identical wherever the user does it — and so the
- * numbers are unit-testable without a touch event.
- */
-
-/** Drag past this many points and letting go dismisses the sheet. */
-const DISMISS_DISTANCE = exports.DISMISS_DISTANCE = 90;
-/** …or flick faster than this, however short the drag. */
-const DISMISS_VELOCITY = exports.DISMISS_VELOCITY = 0.8;
-
-/**
- * Claim a drag only once it is clearly a downward pull, so a tap on a row
- * still registers and a horizontal swipe stays with whatever scrolls
- * sideways inside the sheet.
- */
-const shouldClaimVerticalDrag = (dy, dx) => dy > 6 && Math.abs(dy) > Math.abs(dx) * 1.5;
-
-/** Far enough / fast enough to let go of the sheet. */
-exports.shouldClaimVerticalDrag = shouldClaimVerticalDrag;
-const shouldDismissOnDrag = (dy, vy) => dy > DISMISS_DISTANCE || vy > DISMISS_VELOCITY;
-exports.shouldDismissOnDrag = shouldDismissOnDrag;
-//# sourceMappingURL=sheetGestures.js.map

package/lib/commonjs/helpers/sheetGestures.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["DISMISS_DISTANCE","exports","DISMISS_VELOCITY","shouldClaimVerticalDrag","dy","dx","Math","abs","shouldDismissOnDrag","vy"],"sourceRoot":"../../../src","sources":["helpers/sheetGestures.ts"],"mappings":";;;;;;AAAA;;AAEA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACO,MAAMA,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,EAAE;AAClC;AACO,MAAME,gBAAgB,GAAAD,OAAA,CAAAC,gBAAA,GAAG,GAAG;;AAEnC;AACA;AACA;AACA;AACA;AACO,MAAMC,uBAAuB,GAAGA,CAACC,EAAU,EAAEC,EAAU,KAC5DD,EAAE,GAAG,CAAC,IAAIE,IAAI,CAACC,GAAG,CAACH,EAAE,CAAC,GAAGE,IAAI,CAACC,GAAG,CAACF,EAAE,CAAC,GAAG,GAAG;;AAE7C;AAAAJ,OAAA,CAAAE,uBAAA,GAAAA,uBAAA;AACO,MAAMK,mBAAmB,GAAGA,CAACJ,EAAU,EAAEK,EAAU,KACxDL,EAAE,GAAGJ,gBAAgB,IAAIS,EAAE,GAAGP,gBAAgB;AAACD,OAAA,CAAAO,mBAAA,GAAAA,mBAAA","ignoreList":[]}

package/lib/commonjs/hooks/useFileToken.js

@@ -1,10 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.useFileToken = void 0;
-var _reactRedux = require("react-redux");
-const useFileToken = () => (0, _reactRedux.useSelector)(state => state.chatSettingStore.user?.fileToken || '');
-exports.useFileToken = useFileToken;
-//# sourceMappingURL=useFileToken.js.map

package/lib/commonjs/hooks/useFileToken.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_reactRedux","require","useFileToken","useSelector","state","chatSettingStore","user","fileToken","exports"],"sourceRoot":"../../../src","sources":["hooks/useFileToken.ts"],"mappings":";;;;;;AAAA,IAAAA,WAAA,GAAAC,OAAA;AAGO,MAAMC,YAAY,GAAGA,CAAA,KAC1B,IAAAC,uBAAW,EACRC,KAAgB,IAAKA,KAAK,CAACC,gBAAgB,CAACC,IAAI,EAAEC,SAAS,IAAI,EAClE,CAAC;AAACC,OAAA,CAAAN,YAAA,GAAAA,YAAA","ignoreList":[]}

package/lib/commonjs/networking/authRefresh.js

@@ -1,332 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.RefreshFatalError = void 0;
-exports.__resetAuthRefreshStateForTests = __resetAuthRefreshStateForTests;
-exports.parseRefreshErrorCode = exports.isRefreshFatalError = void 0;
-exports.refreshAuthTokens = refreshAuthTokens;
-exports.refreshAuthTokensQuietly = refreshAuthTokensQuietly;
-var _apiClient = _interopRequireDefault(require("./apiClient"));
-var _roomStore = require("../roomStore");
-var _chatSettingsSlice = require("../roomStore/chatSettingsSlice");
-var _secureUserStorage = require("../helpers/secureUserStorage");
-var _devLogger = require("../utils/devLogger");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-/**
- * THE single refresh-token rotation point for the SDK.
- *
- * The backend now runs refresh-token ROTATION with REUSE DETECTION:
- * every successful `/users/login/refresh` burns the presented refresh
- * token and issues a new one. Presenting an already-rotated token is
- * indistinguishable, server-side, from a stolen token — so it is
- * treated as theft and (once the backend leaves monitor mode and
- * enables enforcing mode) kills the whole token family.
- *
- * That puts three hard obligations on the client:
- *
- *   1. Persist the NEW refreshToken from every response, immediately,
- *      before any other logic can throw and drop it on the floor.
- *   2. Never rotate concurrently. Two parallel refreshes both start
- *      from the same token; the loser presents a burned one and looks
- *      like an attacker. React Native is single-process, so a shared
- *      in-flight promise is the whole lock — no Web Locks needed (the
- *      web build of this component does need them, see its own
- *      `authRefresh.ts`).
- *   3. Route EVERY refresh path through here. One "side" refresh
- *      elsewhere in the codebase breaks the scheme for everyone.
- *
- * Callers must also stop treating 401 as "log out". Two of the four
- * refresh error codes are race signals, not auth failures — see
- * `RefreshErrorCode` below and `RefreshFatalError`.
- */
-
-/**
- * Thrown when the session is genuinely dead and the caller must do a
- * hard logout (clear storage, drop XMPP, send the user to login).
- *
- * Anything else this module rejects with — network errors, 5xx, an
- * unrecognised 401 — is NOT fatal and must NOT trigger a logout.
- */
-class RefreshFatalError extends Error {
-  constructor(code, message) {
-    super(message || `Refresh failed: ${code}`);
-    this.name = 'RefreshFatalError';
-    this.code = code;
-    // Required for `instanceof` to survive TS's ES5 class-extends-builtin
-    // downlevelling, which RN's babel preset still applies.
-    Object.setPrototypeOf(this, RefreshFatalError.prototype);
-  }
-}
-exports.RefreshFatalError = RefreshFatalError;
-const isRefreshFatalError = error => error instanceof RefreshFatalError || error?.name === 'RefreshFatalError';
-exports.isRefreshFatalError = isRefreshFatalError;
-const REFRESH_ENDPOINT = '/v1/users/login/refresh';
-
-/** `REFRESH_IN_PROGRESS` retry budget, per backend guidance (~300ms x 2-3). */
-const IN_PROGRESS_MAX_ATTEMPTS = 3;
-const IN_PROGRESS_BASE_DELAY_MS = 300;
-/**
- * Jitter matters: after a network blip every client in the app retries
- * on the same schedule and would hammer the rotation mutex in lockstep.
- */
-const IN_PROGRESS_JITTER_MS = 150;
-const KNOWN_CODES = ['REFRESH_IN_PROGRESS', 'REFRESH_TOKEN_ALREADY_ROTATED', 'REFRESH_TOKEN_REUSE_DETECTED', 'REFRESH_TOKEN_NOT_FOUND'];
-const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
-const inProgressDelay = attempt => IN_PROGRESS_BASE_DELAY_MS * attempt + Math.floor(Math.random() * IN_PROGRESS_JITTER_MS);
-
-/**
- * All four codes come back as HTTP 401, so the status alone tells us
- * nothing — the code in the body is the only signal.
- *
- * TODO(backend-confirm): the exact location of `code` in the payload is
- * not documented yet. Until it is, probe every shape the API uses
- * elsewhere and take the first hit. Once confirmed, collapse this to
- * the single real path.
- */
-const parseRefreshErrorCode = error => {
-  const response = error?.response;
-  if (!response) {
-    return null;
-  }
-  const data = response.data;
-  const candidates = [data?.code, data?.error?.code, data?.errors?.[0]?.code, data?.error, data?.message, response.headers?.['x-error-code']];
-  for (const candidate of candidates) {
-    if (typeof candidate !== 'string') {
-      continue;
-    }
-    const match = KNOWN_CODES.find(code => candidate.includes(code));
-    if (match) {
-      return match;
-    }
-  }
-  return null;
-};
-exports.parseRefreshErrorCode = parseRefreshErrorCode;
-const getStoreUser = () => _roomStore.store.getState().chatSettingStore?.user || {};
-
-/**
- * The refresh token as of RIGHT NOW. Read at the moment of use, never
- * captured ahead of time — that is the single-process equivalent of the
- * web build's "re-read inside the lock".
- *
- * Redux is the source of truth in RN (one process, one store);
- * AsyncStorage is only consulted as a cold-start fallback, before
- * `resolveInitBeforeLoadUser` has hydrated the store.
- */
-const readCurrentRefreshToken = async () => {
-  const fromStore = getStoreUser().refreshToken;
-  if (fromStore) {
-    return fromStore;
-  }
-  const stored = await (0, _secureUserStorage.secureUserStorage)().get();
-  return stored?.refreshToken || '';
-};
-
-/**
- * Persist BEFORE resolving. The dispatch updates redux (and, until
- * phase 6 lands, fires its own best-effort AsyncStorage write); the
- * awaited write below is the one that actually guarantees the rotated
- * token survives the app being killed a moment later. Losing it means
- * the next launch presents a burned token — i.e. looks like theft.
- */
-const persistTokens = async result => {
-  _roomStore.store.dispatch((0, _chatSettingsSlice.refreshTokens)({
-    token: result.token,
-    refreshToken: result.refreshToken,
-    xmppPassword: result.xmppPassword,
-    fileToken: result.fileToken
-  }));
-  try {
-    // Write the post-dispatch snapshot rather than a read-modify-write
-    // merge, so this can't race the reducer's own write back to a
-    // stale copy of the surrounding user fields.
-    await (0, _secureUserStorage.secureUserStorage)().set(_roomStore.store.getState().chatSettingStore.user);
-  } catch (error) {
-    (0, _devLogger.pushLog)('warn', 'authRefresh: failed to persist rotated tokens', error);
-  }
-};
-
-/**
- * A rotation that happened somewhere we didn't drive — currently only
- * reachable via the ALREADY_ROTATED recovery path, kept separate so the
- * web build and this one stay structurally identical.
- */
-const adoptStoredTokens = async () => {
-  const stored = await (0, _secureUserStorage.secureUserStorage)().get();
-  if (!stored?.refreshToken || !stored?.token) {
-    return null;
-  }
-  const user = getStoreUser();
-  if (user.refreshToken !== stored.refreshToken) {
-    _roomStore.store.dispatch((0, _chatSettingsSlice.refreshTokens)({
-      token: stored.token,
-      refreshToken: stored.refreshToken
-    }));
-  }
-  return {
-    token: stored.token,
-    refreshToken: stored.refreshToken,
-    xmppPassword: stored.xmppPassword,
-    fileToken: stored.fileToken
-  };
-};
-
-/** Host-supplied rotation, mirrors `IConfig['refreshTokens']['refreshFunction']`. */
-
-const runConsumerRefresh = async refreshFunction => {
-  const refreshed = await refreshFunction();
-  if (!refreshed?.accessToken) {
-    throw new Error('Custom refresh function did not return an access token');
-  }
-  if (!refreshed.refreshToken) {
-    // Not fatal — some hosts still run non-rotating backends — but on a
-    // rotating one this silently keeps a burned token around, which is
-    // exactly the failure the new scheme punishes.
-    (0, _devLogger.pushLog)('warn', 'authRefresh: custom refreshFunction returned no refreshToken; ' + 'keeping the existing one. On a rotating backend this will be ' + 'seen as token reuse.');
-  }
-  const result = {
-    token: refreshed.accessToken,
-    refreshToken: refreshed.refreshToken || (await readCurrentRefreshToken()) || '',
-    xmppPassword: refreshed.xmppPassword,
-    fileToken: refreshed.fileToken
-  };
-  await persistTokens(result);
-  return result;
-};
-const requestRotation = async refreshToken => {
-  const response = await _apiClient.default.post(REFRESH_ENDPOINT, {}, {
-    headers: {
-      Authorization: refreshToken
-    }
-  });
-  const result = {
-    token: response?.data?.token || '',
-    refreshToken: response?.data?.refreshToken || '',
-    wsToken: response?.data?.wsToken,
-    xmppPassword: response?.data?.xmppPassword,
-    fileToken: response?.data?.fileToken
-  };
-  if (!result.token || !result.refreshToken) {
-    throw new Error('Refresh response did not contain both tokens');
-  }
-
-  // Persist first, resolve second. Every early return between here and
-  // the caller is a chance to lose the rotation.
-  await persistTokens(result);
-  return result;
-};
-const performRefresh = async overrideToken => {
-  const consumerRefresh = _roomStore.store.getState().chatSettingStore?.config?.refreshTokens?.refreshFunction;
-  if (consumerRefresh) {
-    // A configured host function wins unconditionally — including over
-    // an explicit bootstrap token. Hosts that embed this SDK often own
-    // the Ethora refresh token themselves (their own storage, their own
-    // rotation) and only hand us a copy; rotating it here would burn
-    // THEIR token behind their back and leave them holding a dead one.
-    //
-    // It still has to be serialised — it hits the same backend mutex —
-    // hence running it inside the shared in-flight promise.
-    return runConsumerRefresh(consumerRefresh);
-  }
-  for (let attempt = 1; attempt <= IN_PROGRESS_MAX_ATTEMPTS; attempt++) {
-    const refreshToken = overrideToken || (await readCurrentRefreshToken());
-    if (!refreshToken) {
-      // Deliberately NOT fatal: a missing token mid-bootstrap must not
-      // nuke a session that is still being hydrated.
-      throw new Error('Refresh token is missing');
-    }
-    try {
-      return await requestRotation(refreshToken);
-    } catch (error) {
-      const code = parseRefreshErrorCode(error);
-      if (code === 'REFRESH_IN_PROGRESS') {
-        if (attempt < IN_PROGRESS_MAX_ATTEMPTS) {
-          await sleep(inProgressDelay(attempt));
-          continue;
-        }
-        // Budget spent. Whoever holds the mutex has very likely
-        // finished and written a newer token — take it if so. Skipped
-        // for an explicit token: it may belong to a different session
-        // than whatever is currently in storage.
-        const adopted = overrideToken ? null : await adoptStoredTokens();
-        if (adopted && adopted.refreshToken !== refreshToken) {
-          return adopted;
-        }
-        throw error;
-      }
-      if (code === 'REFRESH_TOKEN_ALREADY_ROTATED') {
-        // Our copy is stale. If something already wrote a newer token,
-        // this is a benign race — use it. Otherwise the session really
-        // is unrecoverable.
-        const adopted = overrideToken ? null : await adoptStoredTokens();
-        if (adopted && adopted.refreshToken !== refreshToken) {
-          return adopted;
-        }
-        throw new RefreshFatalError(code);
-      }
-      if (code === 'REFRESH_TOKEN_REUSE_DETECTED' || code === 'REFRESH_TOKEN_NOT_FOUND') {
-        throw new RefreshFatalError(code);
-      }
-
-      // Network error, 5xx, plain 401 without a code — pass through
-      // untouched. The caller must not log out on these.
-      throw error;
-    }
-  }
-
-  // Unreachable: the loop either returns or throws.
-  throw new Error('Refresh attempts exhausted');
-};
-let inflight = null;
-let lastRotationAt = 0;
-const QUIET_ROTATION_MIN_INTERVAL_MS = 5 * 60 * 1000;
-
-/**
- * Rotate the tokens. Concurrent callers share ONE request — this is the
- * lock the new backend scheme requires.
- *
- * Rejects with `RefreshFatalError` when the session is dead (caller
- * should hard-logout) and with a plain error otherwise (caller should
- * surface the failure and leave the session alone).
- */
-function refreshAuthTokens(options) {
-  if (inflight) {
-    // Whatever that rotation produces is at least as fresh as anything
-    // this caller could have asked for.
-    return inflight;
-  }
-  inflight = performRefresh(options?.refreshToken).then(result => {
-    lastRotationAt = Date.now();
-    return result;
-  }).finally(() => {
-    inflight = null;
-  });
-  return inflight;
-}
-
-/**
- * Fire-and-forget variant for call sites that only want "make sure the
- * tokens are fresh" and have no meaningful error handling — chat
- * bootstrap, XMPP reconnect. Never rejects.
- */
-
-async function refreshAuthTokensQuietly(options) {
-  if (!options?.force && Date.now() - lastRotationAt < QUIET_ROTATION_MIN_INTERVAL_MS) {
-    return null;
-  }
-  try {
-    return await refreshAuthTokens();
-  } catch (error) {
-    (0, _devLogger.pushLog)(isRefreshFatalError(error) ? 'error' : 'warn', 'authRefresh: background refresh failed', error);
-    return null;
-  }
-}
-
-/** Test seam — drops any shared in-flight promise between cases. */
-function __resetAuthRefreshStateForTests() {
-  inflight = null;
-  lastRotationAt = 0;
-}
-//# sourceMappingURL=authRefresh.js.map

package/lib/commonjs/networking/authRefresh.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_apiClient","_interopRequireDefault","require","_roomStore","_chatSettingsSlice","_secureUserStorage","_devLogger","e","__esModule","default","RefreshFatalError","Error","constructor","code","message","name","Object","setPrototypeOf","prototype","exports","isRefreshFatalError","error","REFRESH_ENDPOINT","IN_PROGRESS_MAX_ATTEMPTS","IN_PROGRESS_BASE_DELAY_MS","IN_PROGRESS_JITTER_MS","KNOWN_CODES","sleep","ms","Promise","resolve","setTimeout","inProgressDelay","attempt","Math","floor","random","parseRefreshErrorCode","response","data","candidates","errors","headers","candidate","match","find","includes","getStoreUser","store","getState","chatSettingStore","user","readCurrentRefreshToken","fromStore","refreshToken","stored","secureUserStorage","get","persistTokens","result","dispatch","refreshTokens","token","xmppPassword","fileToken","set","pushLog","adoptStoredTokens","runConsumerRefresh","refreshFunction","refreshed","accessToken","requestRotation","http","post","Authorization","wsToken","performRefresh","overrideToken","consumerRefresh","config","adopted","inflight","lastRotationAt","QUIET_ROTATION_MIN_INTERVAL_MS","refreshAuthTokens","options","then","Date","now","finally","refreshAuthTokensQuietly","force","__resetAuthRefreshStateForTests"],"sourceRoot":"../../../src","sources":["networking/authRefresh.ts"],"mappings":";;;;;;;;;;AAAA,IAAAA,UAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AAA6C,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAG7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,iBAAiB,SAASC,KAAK,CAAC;EAG3CC,WAAWA,CAACC,IAAsB,EAAEC,OAAgB,EAAE;IACpD,KAAK,CAACA,OAAO,IAAI,mBAAmBD,IAAI,EAAE,CAAC;IAC3C,IAAI,CAACE,IAAI,GAAG,mBAAmB;IAC/B,IAAI,CAACF,IAAI,GAAGA,IAAI;IAChB;IACA;IACAG,MAAM,CAACC,cAAc,CAAC,IAAI,EAAEP,iBAAiB,CAACQ,SAAS,CAAC;EAC1D;AACF;AAACC,OAAA,CAAAT,iBAAA,GAAAA,iBAAA;AAEM,MAAMU,mBAAmB,GAC9BC,KAAc,IAEdA,KAAK,YAAYX,iBAAiB,IACjCW,KAAK,EAAwBN,IAAI,KAAK,mBAAmB;AAACI,OAAA,CAAAC,mBAAA,GAAAA,mBAAA;AAE7D,MAAME,gBAAgB,GAAG,yBAAyB;;AAElD;AACA,MAAMC,wBAAwB,GAAG,CAAC;AAClC,MAAMC,yBAAyB,GAAG,GAAG;AACrC;AACA;AACA;AACA;AACA,MAAMC,qBAAqB,GAAG,GAAG;AAEjC,MAAMC,WAA+B,GAAG,CACtC,qBAAqB,EACrB,+BAA+B,EAC/B,8BAA8B,EAC9B,yBAAyB,CAC1B;AAED,MAAMC,KAAK,GAAIC,EAAU,IACvB,IAAIC,OAAO,CAAQC,OAAO,IAAKC,UAAU,CAACD,OAAO,EAAEF,EAAE,CAAC,CAAC;AAEzD,MAAMI,eAAe,GAAIC,OAAe,IACtCT,yBAAyB,GAAGS,OAAO,GACnCC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAGX,qBAAqB,CAAC;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMY,qBAAqB,GAChChB,KAAc,IACc;EAC5B,MAAMiB,QAAQ,GAAIjB,KAAK,EAAUiB,QAAQ;EACzC,IAAI,CAACA,QAAQ,EAAE;IACb,OAAO,IAAI;EACb;EAEA,MAAMC,IAAI,GAAGD,QAAQ,CAACC,IAAI;EAC1B,MAAMC,UAAU,GAAG,CACjBD,IAAI,EAAE1B,IAAI,EACV0B,IAAI,EAAElB,KAAK,EAAER,IAAI,EACjB0B,IAAI,EAAEE,MAAM,GAAG,CAAC,CAAC,EAAE5B,IAAI,EACvB0B,IAAI,EAAElB,KAAK,EACXkB,IAAI,EAAEzB,OAAO,EACbwB,QAAQ,CAACI,OAAO,GAAG,cAAc,CAAC,CACnC;EAED,KAAK,MAAMC,SAAS,IAAIH,UAAU,EAAE;IAClC,IAAI,OAAOG,SAAS,KAAK,QAAQ,EAAE;MACjC;IACF;IACA,MAAMC,KAAK,GAAGlB,WAAW,CAACmB,IAAI,CAAEhC,IAAI,IAAK8B,SAAS,CAACG,QAAQ,CAACjC,IAAI,CAAC,CAAC;IAClE,IAAI+B,KAAK,EAAE;MACT,OAAOA,KAAK;IACd;EACF;EAEA,OAAO,IAAI;AACb,CAAC;AAACzB,OAAA,CAAAkB,qBAAA,GAAAA,qBAAA;AAEF,MAAMU,YAAY,GAAGA,CAAA,KAClBC,gBAAK,CAACC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEC,IAAI,IAAsB,CAAC,CAAC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,uBAAuB,GAAG,MAAAA,CAAA,KAA6B;EAC3D,MAAMC,SAAS,GAAGN,YAAY,CAAC,CAAC,CAACO,YAAY;EAC7C,IAAID,SAAS,EAAE;IACb,OAAOA,SAAS;EAClB;EAEA,MAAME,MAAM,GAAG,MAAM,IAAAC,oCAAiB,EAAC,CAAC,CAACC,GAAG,CAAC,CAAC;EAC9C,OAAOF,MAAM,EAAED,YAAY,IAAI,EAAE;AACnC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMI,aAAa,GAAG,MAAOC,MAAqB,IAAoB;EACpEX,gBAAK,CAACY,QAAQ,CACZ,IAAAC,gCAAa,EAAC;IACZC,KAAK,EAAEH,MAAM,CAACG,KAAK;IACnBR,YAAY,EAAEK,MAAM,CAACL,YAAY;IACjCS,YAAY,EAAEJ,MAAM,CAACI,YAAY;IACjCC,SAAS,EAAEL,MAAM,CAACK;EACpB,CAAC,CACH,CAAC;EAED,IAAI;IACF;IACA;IACA;IACA,MAAM,IAAAR,oCAAiB,EAAC,CAAC,CAACS,GAAG,CAC3BjB,gBAAK,CAACC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,CAACC,IACpC,CAAC;EACH,CAAC,CAAC,OAAO9B,KAAK,EAAE;IACd,IAAA6C,kBAAO,EAAC,MAAM,EAAE,+CAA+C,EAAE7C,KAAK,CAAC;EACzE;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,MAAM8C,iBAAiB,GAAG,MAAAA,CAAA,KAA2C;EACnE,MAAMZ,MAAM,GAAG,MAAM,IAAAC,oCAAiB,EAAC,CAAC,CAACC,GAAG,CAAC,CAAC;EAC9C,IAAI,CAACF,MAAM,EAAED,YAAY,IAAI,CAACC,MAAM,EAAEO,KAAK,EAAE;IAC3C,OAAO,IAAI;EACb;EAEA,MAAMX,IAAI,GAAGJ,YAAY,CAAC,CAAC;EAC3B,IAAII,IAAI,CAACG,YAAY,KAAKC,MAAM,CAACD,YAAY,EAAE;IAC7CN,gBAAK,CAACY,QAAQ,CACZ,IAAAC,gCAAa,EAAC;MACZC,KAAK,EAAEP,MAAM,CAACO,KAAK;MACnBR,YAAY,EAAEC,MAAM,CAACD;IACvB,CAAC,CACH,CAAC;EACH;EAEA,OAAO;IACLQ,KAAK,EAAEP,MAAM,CAACO,KAAK;IACnBR,YAAY,EAAEC,MAAM,CAACD,YAAY;IACjCS,YAAY,EAAER,MAAM,CAACQ,YAAY;IACjCC,SAAS,EAAET,MAAM,CAACS;EACpB,CAAC;AACH,CAAC;;AAED;;AAQA,MAAMI,kBAAkB,GAAG,MACzBC,eAAkC,IACP;EAC3B,MAAMC,SAAS,GAAG,MAAMD,eAAe,CAAC,CAAC;EAEzC,IAAI,CAACC,SAAS,EAAEC,WAAW,EAAE;IAC3B,MAAM,IAAI5D,KAAK,CAAC,wDAAwD,CAAC;EAC3E;EAEA,IAAI,CAAC2D,SAAS,CAAChB,YAAY,EAAE;IAC3B;IACA;IACA;IACA,IAAAY,kBAAO,EACL,MAAM,EACN,gEAAgE,GAC9D,+DAA+D,GAC/D,sBACJ,CAAC;EACH;EAEA,MAAMP,MAAqB,GAAG;IAC5BG,KAAK,EAAEQ,SAAS,CAACC,WAAW;IAC5BjB,YAAY,EACVgB,SAAS,CAAChB,YAAY,KAAK,MAAMF,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE;IACnEW,YAAY,EAAEO,SAAS,CAACP,YAAY;IACpCC,SAAS,EAAEM,SAAS,CAACN;EACvB,CAAC;EAED,MAAMN,aAAa,CAACC,MAAM,CAAC;EAC3B,OAAOA,MAAM;AACf,CAAC;AAED,MAAMa,eAAe,GAAG,MACtBlB,YAAoB,IACO;EAC3B,MAAMhB,QAAQ,GAAG,MAAMmC,kBAAI,CAACC,IAAI,CAC9BpD,gBAAgB,EAChB,CAAC,CAAC,EACF;IAAEoB,OAAO,EAAE;MAAEiC,aAAa,EAAErB;IAAa;EAAE,CAC7C,CAAC;EAED,MAAMK,MAAqB,GAAG;IAC5BG,KAAK,EAAExB,QAAQ,EAAEC,IAAI,EAAEuB,KAAK,IAAI,EAAE;IAClCR,YAAY,EAAEhB,QAAQ,EAAEC,IAAI,EAAEe,YAAY,IAAI,EAAE;IAChDsB,OAAO,EAAEtC,QAAQ,EAAEC,IAAI,EAAEqC,OAAO;IAChCb,YAAY,EAAEzB,QAAQ,EAAEC,IAAI,EAAEwB,YAAY;IAC1CC,SAAS,EAAE1B,QAAQ,EAAEC,IAAI,EAAEyB;EAC7B,CAAC;EAED,IAAI,CAACL,MAAM,CAACG,KAAK,IAAI,CAACH,MAAM,CAACL,YAAY,EAAE;IACzC,MAAM,IAAI3C,KAAK,CAAC,8CAA8C,CAAC;EACjE;;EAEA;EACA;EACA,MAAM+C,aAAa,CAACC,MAAM,CAAC;EAC3B,OAAOA,MAAM;AACf,CAAC;AAED,MAAMkB,cAAc,GAAG,MACrBC,aAAsB,IACK;EAC3B,MAAMC,eAAe,GACnB/B,gBAAK,CAACC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAE8B,MAAM,EAAEnB,aAAa,EAAEQ,eAAe;EAE3E,IAAIU,eAAe,EAAE;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,OAAOX,kBAAkB,CAACW,eAAe,CAAC;EAC5C;EAEA,KAAK,IAAI9C,OAAO,GAAG,CAAC,EAAEA,OAAO,IAAIV,wBAAwB,EAAEU,OAAO,EAAE,EAAE;IACpE,MAAMqB,YAAY,GAAGwB,aAAa,KAAK,MAAM1B,uBAAuB,CAAC,CAAC,CAAC;IAEvE,IAAI,CAACE,YAAY,EAAE;MACjB;MACA;MACA,MAAM,IAAI3C,KAAK,CAAC,0BAA0B,CAAC;IAC7C;IAEA,IAAI;MACF,OAAO,MAAM6D,eAAe,CAAClB,YAAY,CAAC;IAC5C,CAAC,CAAC,OAAOjC,KAAK,EAAE;MACd,MAAMR,IAAI,GAAGwB,qBAAqB,CAAChB,KAAK,CAAC;MAEzC,IAAIR,IAAI,KAAK,qBAAqB,EAAE;QAClC,IAAIoB,OAAO,GAAGV,wBAAwB,EAAE;UACtC,MAAMI,KAAK,CAACK,eAAe,CAACC,OAAO,CAAC,CAAC;UACrC;QACF;QACA;QACA;QACA;QACA;QACA,MAAMgD,OAAO,GAAGH,aAAa,GAAG,IAAI,GAAG,MAAMX,iBAAiB,CAAC,CAAC;QAChE,IAAIc,OAAO,IAAIA,OAAO,CAAC3B,YAAY,KAAKA,YAAY,EAAE;UACpD,OAAO2B,OAAO;QAChB;QACA,MAAM5D,KAAK;MACb;MAEA,IAAIR,IAAI,KAAK,+BAA+B,EAAE;QAC5C;QACA;QACA;QACA,MAAMoE,OAAO,GAAGH,aAAa,GAAG,IAAI,GAAG,MAAMX,iBAAiB,CAAC,CAAC;QAChE,IAAIc,OAAO,IAAIA,OAAO,CAAC3B,YAAY,KAAKA,YAAY,EAAE;UACpD,OAAO2B,OAAO;QAChB;QACA,MAAM,IAAIvE,iBAAiB,CAACG,IAAI,CAAC;MACnC;MAEA,IACEA,IAAI,KAAK,8BAA8B,IACvCA,IAAI,KAAK,yBAAyB,EAClC;QACA,MAAM,IAAIH,iBAAiB,CAACG,IAAI,CAAC;MACnC;;MAEA;MACA;MACA,MAAMQ,KAAK;IACb;EACF;;EAEA;EACA,MAAM,IAAIV,KAAK,CAAC,4BAA4B,CAAC;AAC/C,CAAC;AAcD,IAAIuE,QAAuC,GAAG,IAAI;AAElD,IAAIC,cAAc,GAAG,CAAC;AACtB,MAAMC,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;;AAEpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAC/BC,OAAwB,EACA;EACxB,IAAIJ,QAAQ,EAAE;IACZ;IACA;IACA,OAAOA,QAAQ;EACjB;EAEAA,QAAQ,GAAGL,cAAc,CAACS,OAAO,EAAEhC,YAAY,CAAC,CAC7CiC,IAAI,CAAE5B,MAAM,IAAK;IAChBwB,cAAc,GAAGK,IAAI,CAACC,GAAG,CAAC,CAAC;IAC3B,OAAO9B,MAAM;EACf,CAAC,CAAC,CACD+B,OAAO,CAAC,MAAM;IACbR,QAAQ,GAAG,IAAI;EACjB,CAAC,CAAC;EAEJ,OAAOA,QAAQ;AACjB;;AAEA;AACA;AACA;AACA;AACA;;AAKO,eAAeS,wBAAwBA,CAC5CL,OAA6B,EACE;EAC/B,IACE,CAACA,OAAO,EAAEM,KAAK,IACfJ,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGN,cAAc,GAAGC,8BAA8B,EAC5D;IACA,OAAO,IAAI;EACb;EACA,IAAI;IACF,OAAO,MAAMC,iBAAiB,CAAC,CAAC;EAClC,CAAC,CAAC,OAAOhE,KAAK,EAAE;IACd,IAAA6C,kBAAO,EACL9C,mBAAmB,CAACC,KAAK,CAAC,GAAG,OAAO,GAAG,MAAM,EAC7C,wCAAwC,EACxCA,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACO,SAASwE,+BAA+BA,CAAA,EAAS;EACtDX,QAAQ,GAAG,IAAI;EACfC,cAAc,GAAG,CAAC;AACpB","ignoreList":[]}