@explorins/pers-sdk-react-native 2.1.18 → 2.1.19

package/dist/index.js

@@ -9588,7 +9588,113 @@ class AuthTokenManager {
         const token = await this.getRefreshToken();
         return !!token;
     }
+    /**
+     * Clears only the refresh token.
+     * Used when DPoP keys are regenerated, invalidating the token binding.
+     */
+    async clearRefreshToken() {
+        this.cache.refreshToken = null;
+        await this.storage.remove(AUTH_STORAGE_KEYS.REFRESH_TOKEN);
+    }
+}
+
+class IndexedDBTokenStorage {
+    constructor() {
+        this.supportsObjects = true;
+        this.dbPromise = null;
+        if (typeof indexedDB === 'undefined') {
+            console.warn('IndexedDB is not available in this environment');
+        }
+    }
+    getDB() {
+        if (this.dbPromise)
+            return this.dbPromise;
+        this.dbPromise = new Promise((resolve, reject) => {
+            if (typeof indexedDB === 'undefined') {
+                return reject(new Error('IndexedDB not supported'));
+            }
+            const request = indexedDB.open(IndexedDBTokenStorage.DB_NAME, IndexedDBTokenStorage.DB_VERSION);
+            request.onupgradeneeded = (event) => {
+                const db = event.target.result;
+                if (!db.objectStoreNames.contains(IndexedDBTokenStorage.STORE_NAME)) {
+                    db.createObjectStore(IndexedDBTokenStorage.STORE_NAME);
+                }
+            };
+            request.onsuccess = (event) => {
+                resolve(event.target.result);
+            };
+            request.onerror = (event) => {
+                reject(event.target.error);
+            };
+        });
+        return this.dbPromise;
+    }
+    async get(key) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readonly');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.get(key);
+                request.onsuccess = () => resolve(request.result || null);
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to get key', key, e);
+            return null;
+        }
+    }
+    async set(key, value) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.put(value, key);
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.error('[IndexedDBTokenStorage] Failed to set key', key, e);
+            throw e;
+        }
+    }
+    async remove(key) {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.delete(key);
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to remove key', key, e);
+        }
+    }
+    async clear() {
+        try {
+            const db = await this.getDB();
+            return new Promise((resolve, reject) => {
+                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
+                const request = store.clear();
+                request.onsuccess = () => resolve();
+                request.onerror = () => reject(request.error);
+            });
+        }
+        catch (e) {
+            console.warn('[IndexedDBTokenStorage] Failed to clear storage', e);
+        }
+    }
 }
+IndexedDBTokenStorage.DB_NAME = 'pers-sdk-storage';
+IndexedDBTokenStorage.STORE_NAME = 'auth-tokens';
+IndexedDBTokenStorage.DB_VERSION = 1;
 
 class WebDPoPCryptoProvider {
     get crypto() {
@@ -9724,13 +9830,30 @@ const DPOP_STORAGE_KEYS = {
     PRIVATE: 'pers_dpop_private_key'
 };
 class DPoPManager {
-    constructor(storage, cryptoProvider) {
+    constructor(storage, cryptoProvider, callbacks) {
         this.storage = storage;
         this.memoryKeyPair = null;
         this.cryptoProvider = cryptoProvider || new WebDPoPCryptoProvider();
+        this.callbacks = callbacks || {};
+    }
+    /**
+     * Checks if DPoP keys exist in storage without generating new ones.
+     * Useful for detecting if a key regeneration would be needed.
+     */
+    async hasStoredKeys() {
+        if (this.memoryKeyPair)
+            return true;
+        const storedPublic = await this.storage.get(DPOP_STORAGE_KEYS.PUBLIC);
+        const storedPrivate = await this.storage.get(DPOP_STORAGE_KEYS.PRIVATE);
+        return !!(storedPublic && storedPrivate);
     }
     /**
      * Ensures a DPoP key pair exists, loading from storage or generating new one.
+     *
+     * IMPORTANT: If keys are regenerated (not loaded from storage), this will
+     * invalidate any refresh tokens bound to the old keys. The onKeysRegenerated
+     * callback should clear the refresh token to prevent "DPoP proof does not
+     * match refresh token binding" errors.
      */
     async ensureKeyPair() {
         if (this.memoryKeyPair)
@@ -9746,10 +9869,12 @@ class DPoPManager {
                 return this.memoryKeyPair;
             }
             catch (e) {
-                console.warn('Corrupted DPoP keys in storage, regenerating.');
+                console.warn('[DPoPManager] Corrupted DPoP keys in storage, regenerating.');
             }
         }
         // Generate new key pair
+        // IMPORTANT: This invalidates any existing refresh tokens bound to the old keys
+        console.info('[DPoPManager] Generating new DPoP key pair');
         // Adaptation: If storage supports raw objects (like IndexedDB or Native Keychain),
         // we can generate Non-Extractable keys for maximum security.
         // If storage is text-only (LocalStorage), we must use Extractable keys to serialize them.
@@ -9761,6 +9886,15 @@ class DPoPManager {
         await this.storage.set(DPOP_STORAGE_KEYS.PUBLIC, keyPair.publicKey);
         await this.storage.set(DPOP_STORAGE_KEYS.PRIVATE, keyPair.privateKey);
         this.memoryKeyPair = keyPair;
+        // Notify that keys were regenerated - refresh tokens bound to old keys are now invalid
+        if (this.callbacks.onKeysRegenerated) {
+            try {
+                this.callbacks.onKeysRegenerated();
+            }
+            catch (e) {
+                console.warn('[DPoPManager] onKeysRegenerated callback failed:', e);
+            }
+        }
         return keyPair;
     }
     /**
@@ -9814,16 +9948,48 @@ class DefaultAuthProvider {
         this.config = config;
         this.authTypeCache = null;
         this.authType = config.authType || exports.AccountOwnerType.USER;
+        // Determine if DPoP can be enabled (requires IndexedDB for key persistence)
+        const canUseDPoP = this.canEnableDPoP();
+        this.dpopEnabled = !!(config.dpop?.enabled && canUseDPoP);
+        if (config.dpop?.enabled && !canUseDPoP) {
+            console.warn('[DefaultAuthProvider] DPoP disabled: IndexedDB not available. CryptoKey persistence requires IndexedDB.');
+        }
         const storage = config.storage || this.createStorage();
         this.tokenManager = new AuthTokenManager(storage);
-        if (config.dpop?.enabled) {
-            this.dpopManager = new DPoPManager(storage, config.dpop.cryptoProvider);
+        if (this.dpopEnabled) {
+            this.dpopManager = new DPoPManager(storage, config.dpop?.cryptoProvider, {
+                // When DPoP keys are regenerated (corrupted/missing), the refresh token
+                // bound to the old keys becomes invalid. Clear it to prevent
+                // "DPoP proof does not match refresh token binding" errors.
+                onKeysRegenerated: () => {
+                    console.info('[DefaultAuthProvider] DPoP keys regenerated, clearing invalid refresh token');
+                    this.tokenManager.clearRefreshToken().catch(err => {
+                        console.warn('[DefaultAuthProvider] Failed to clear refresh token:', err);
+                    });
+                }
+            });
         }
     }
+    canEnableDPoP() {
+        // DPoP requires IndexedDB for proper CryptoKey persistence
+        // LocalStorage cannot serialize CryptoKey objects correctly
+        return typeof window !== 'undefined' && typeof indexedDB !== 'undefined';
+    }
     createStorage() {
-        return typeof window === 'undefined' || typeof localStorage === 'undefined'
-            ? new MemoryTokenStorage()
-            : new LocalStorageTokenStorage();
+        // Server-side: use memory storage
+        if (typeof window === 'undefined') {
+            return new MemoryTokenStorage();
+        }
+        // Browser with DPoP enabled: use IndexedDB for CryptoKey persistence
+        if (this.dpopEnabled) {
+            return new IndexedDBTokenStorage();
+        }
+        // Browser without DPoP: use LocalStorage
+        if (typeof localStorage !== 'undefined') {
+            return new LocalStorageTokenStorage();
+        }
+        // Fallback
+        return new MemoryTokenStorage();
     }
     getToken() {
         return this.tokenManager.getAccessToken();
@@ -9905,10 +10071,9 @@ class DefaultAuthProvider {
     async hasValidToken() {
         return this.tokenManager.hasAccessToken();
     }
-    async setAuthType(authType) {
-        // Auth type is derived from JWT, so this is a no-op
-        // The authType in JWT is the source of truth
-        // This method exists to satisfy the ExtendedTokenStorageProvider interface
+    async setAuthType(_authType) {
+        // No-op: authType is derived from JWT payload via getAuthType()
+        // @see getAuthType() - reads accountType directly from JWT
     }
     async getAuthType() {
         // Read from JWT instead of separate storage for single source of truth
@@ -9949,12 +10114,14 @@ class DefaultAuthProvider {
  * Exported for consumers who need version info.
  * Used internally for X-SDK-Version header.
  *
+ * Version is injected at build time via @rollup/plugin-replace
+ *
  * @module @explorins/pers-sdk/core
  */
 /** SDK package name */
-const SDK_NAME = '@explorins/pers-sdk';
-/** SDK version - TODO: Load dynamically from package.json */
-const SDK_VERSION = '2.1.1';
+const SDK_NAME = "@explorins/pers-sdk";
+/** SDK version - injected from package.json at build time */
+const SDK_VERSION = "2.1.27";
 /** Full SDK identifier for headers */
 const SDK_USER_AGENT = `${SDK_NAME}/${SDK_VERSION}`;
 
@@ -10884,7 +11051,14 @@ class AuthManager {
      */
     async loginWithRawData(rawUserData) {
         const authService = this.apiClient.getAuthService();
-        return authService.loginUserWithRawData(rawUserData);
+        const result = await authService.loginUserWithRawData(rawUserData);
+        this.events?.emitSuccess({
+            domain: 'authentication',
+            type: 'login_success',
+            userMessage: 'Successfully logged in',
+            details: { user: result.user }
+        });
+        return result;
     }
     /**
      * Get current authenticated user
@@ -18859,104 +19033,6 @@ function createPersSDK(httpClient, config) {
     return new PersSDK(httpClient, config);
 }
 
-class IndexedDBTokenStorage {
-    constructor() {
-        this.supportsObjects = true;
-        this.dbPromise = null;
-        if (typeof indexedDB === 'undefined') {
-            console.warn('IndexedDB is not available in this environment');
-        }
-    }
-    getDB() {
-        if (this.dbPromise)
-            return this.dbPromise;
-        this.dbPromise = new Promise((resolve, reject) => {
-            if (typeof indexedDB === 'undefined') {
-                return reject(new Error('IndexedDB not supported'));
-            }
-            const request = indexedDB.open(IndexedDBTokenStorage.DB_NAME, IndexedDBTokenStorage.DB_VERSION);
-            request.onupgradeneeded = (event) => {
-                const db = event.target.result;
-                if (!db.objectStoreNames.contains(IndexedDBTokenStorage.STORE_NAME)) {
-                    db.createObjectStore(IndexedDBTokenStorage.STORE_NAME);
-                }
-            };
-            request.onsuccess = (event) => {
-                resolve(event.target.result);
-            };
-            request.onerror = (event) => {
-                reject(event.target.error);
-            };
-        });
-        return this.dbPromise;
-    }
-    async get(key) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readonly');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.get(key);
-                request.onsuccess = () => resolve(request.result || null);
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to get key', key, e);
-            return null;
-        }
-    }
-    async set(key, value) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.put(value, key);
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.error('[IndexedDBTokenStorage] Failed to set key', key, e);
-            throw e;
-        }
-    }
-    async remove(key) {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.delete(key);
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to remove key', key, e);
-        }
-    }
-    async clear() {
-        try {
-            const db = await this.getDB();
-            return new Promise((resolve, reject) => {
-                const transaction = db.transaction(IndexedDBTokenStorage.STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(IndexedDBTokenStorage.STORE_NAME);
-                const request = store.clear();
-                request.onsuccess = () => resolve();
-                request.onerror = () => reject(request.error);
-            });
-        }
-        catch (e) {
-            console.warn('[IndexedDBTokenStorage] Failed to clear storage', e);
-        }
-    }
-}
-IndexedDBTokenStorage.DB_NAME = 'pers-sdk-storage';
-IndexedDBTokenStorage.STORE_NAME = 'auth-tokens';
-IndexedDBTokenStorage.DB_VERSION = 1;
-
 /**
  * Environment Detection Utility
  * Detects runtime environment for platform-specific behaviors
@@ -19282,11 +19358,19 @@ class ReactNativeSecureStorage {
  * React Native Unified Auth Provider
  *
  * Creates a platform-specific auth provider that automatically selects the appropriate storage:
- * - Web: Uses LocalStorageTokenStorage from core SDK
+ * - Web: Uses IndexedDBTokenStorage for DPoP (CryptoKey persistence) or LocalStorage
  * - Mobile: Uses AsyncStorage-based storage
  */
 // Use React Native's built-in platform detection
 const isWebPlatform = reactNative.Platform.OS === 'web';
+/**
+ * Check if IndexedDB is available (web environments only)
+ * Uses globalThis to avoid TypeScript errors in React Native context
+ */
+function hasIndexedDB() {
+    return typeof globalThis !== 'undefined' &&
+        typeof globalThis.indexedDB !== 'undefined';
+}
 /**
  * Create a React Native auth provider with platform-appropriate storage
  *
@@ -19304,9 +19388,29 @@ function createReactNativeAuthProvider(projectKey, config = {}) {
     }
     const { keyPrefix = `pers_${projectKey.slice(0, 8)}_`, debug = false, customStorage, authType = exports.AccountOwnerType.USER, dpop } = config;
     // Platform-specific storage selection
-    const tokenStorage = customStorage || (isWebPlatform
-        ? new LocalStorageTokenStorage()
-        : new ReactNativeSecureStorage(keyPrefix));
+    // Web with DPoP: Use IndexedDB for CryptoKey persistence
+    // Web without DPoP or no IndexedDB: Use LocalStorage
+    // Mobile: Use ReactNativeSecureStorage
+    let tokenStorage;
+    if (customStorage) {
+        tokenStorage = customStorage;
+    }
+    else if (isWebPlatform) {
+        // On web, prefer IndexedDB when DPoP is enabled for proper CryptoKey persistence
+        const dpopEnabled = dpop?.enabled ?? true;
+        if (dpopEnabled && hasIndexedDB()) {
+            tokenStorage = new IndexedDBTokenStorage();
+        }
+        else {
+            if (dpopEnabled && !hasIndexedDB()) {
+                console.warn('[ReactNativeAuthProvider] DPoP requested but IndexedDB not available. Falling back to LocalStorage (DPoP will be disabled by DefaultAuthProvider).');
+            }
+            tokenStorage = new LocalStorageTokenStorage();
+        }
+    }
+    else {
+        tokenStorage = new ReactNativeSecureStorage(keyPrefix);
+    }
     // Prepare DPoP config ensuring enabled is boolean (default true)
     const dpopConfig = dpop ? {
         enabled: dpop.enabled ?? true,