@feelflow/ffid-sdk 5.12.0 → 5.13.0

package/dist/{chunk-AOJDV3UO.cjs → chunk-JFFRO2Q5.cjs}

@@ -124,6 +124,9 @@ function normalizeUserinfo(raw) {
   return {
     sub: raw.sub,
     email: raw.email,
+    // #3791: undefined → undefined を保つ（false に丸めない）。古い FFID は wire に
+    // 含めないため、consumer は undefined を「未確認」ではなく「不明」として扱える。
+    emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
     companyName: raw.company_name ?? null,
@@ -379,6 +382,9 @@ function createVerifyAccessToken(deps) {
     const base = {
       sub: introspectResponse.sub,
       email: introspectResponse.email ?? null,
+      // #3791: preserve undefined (do NOT coerce to false) so introspect-strategy
+      // callers can distinguish "verified" / "not verified" / "older server".
+      email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
       company_name: introspectResponse.company_name ?? null,
@@ -934,7 +940,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.12.0";
+var SDK_VERSION = "5.13.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1006,9 +1012,20 @@ function createOAuthTokenMethods(deps) {
     logger,
     errorCodes
   } = deps;
-  async function exchangeCodeForTokens(code, codeVerifier) {
+  async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
+    if (opts?.expectedState !== void 0 || opts?.actualState !== void 0) {
+      if (opts?.expectedState !== opts?.actualState) {
+        logger.error("Token exchange aborted: OAuth state mismatch or omitted (possible CSRF)");
+        return {
+          error: {
+            code: errorCodes.STATE_MISMATCH_ERROR,
+            message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          }
+        };
+      }
+    }
     const effectiveRedirectUri = resolvedRedirectUri ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : null);
     if (!effectiveRedirectUri) {
       logger.error("redirectUri is required for token exchange in SSR environments. Set config.redirectUri explicitly.");
@@ -1492,6 +1509,102 @@ function base64UrlEncode(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/auth/state.ts
+var STATE_STORAGE_KEY = "ffid_oauth_state";
+var STATE_FALLBACK_STORAGE_KEY = "ffid_oauth_state_fb";
+var STATE_FALLBACK_TIMESTAMP_KEY = "ffid_oauth_state_fb_ts";
+var OAUTH_STATE_MAX_AGE_MS = 5 * 60 * 1e3;
+function storeState(state, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeState: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
+  try {
+    window.sessionStorage.setItem(STATE_STORAGE_KEY, state);
+    sessionStored = true;
+  } catch (error) {
+    logger?.warn("storeState: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(STATE_FALLBACK_STORAGE_KEY, state);
+    window.localStorage.setItem(STATE_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeState: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
+}
+function retrieveState(logger) {
+  if (typeof window === "undefined") return null;
+  let sessionState = null;
+  try {
+    sessionState = window.sessionStorage.getItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  if (sessionState) {
+    cleanupStateStorage(logger);
+    return sessionState;
+  }
+  let fallbackState = null;
+  let fallbackTimestamp = null;
+  try {
+    fallbackState = window.localStorage.getItem(STATE_FALLBACK_STORAGE_KEY);
+    fallbackTimestamp = window.localStorage.getItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage fallback \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    cleanupStateStorage(logger);
+    return null;
+  }
+  if (!fallbackState || !fallbackTimestamp) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  const ts = Number(fallbackTimestamp);
+  const age = Date.now() - ts;
+  if (!Number.isFinite(ts) || age < 0 || age > OAUTH_STATE_MAX_AGE_MS) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  logger?.warn(
+    "retrieveState: sessionStorage was empty, recovered OAuth state from localStorage fallback"
+  );
+  cleanupStateStorage(logger);
+  return fallbackState;
+}
+function isStateStorageAvailable() {
+  if (typeof window === "undefined") return false;
+  const probeKey = "__ffid_oauth_state_probe__";
+  try {
+    window.sessionStorage.setItem(probeKey, "1");
+    window.sessionStorage.removeItem(probeKey);
+    return true;
+  } catch {
+  }
+  try {
+    window.localStorage.setItem(probeKey, "1");
+    window.localStorage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanupStateStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(STATE_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -1623,6 +1736,7 @@ function createRedirectMethods(deps) {
     const recentCount = getRecentRedirectCount(authorizeKey, now, logger);
     if (recentCount >= REDIRECT_LOOP_THRESHOLD) {
       cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.warn("[FFID SDK] redirect loop detected \u2014 \u81EA\u52D5\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u505C\u6B62\u3057\u307E\u3057\u305F", {
         authorizeKey,
         recentCount,
@@ -1646,6 +1760,11 @@ function createRedirectMethods(deps) {
       return { success: false, error: errorMessage };
     }
     const state = generateRandomState();
+    if (!storeState(state, logger)) {
+      logger.error(
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+      );
+    }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
       response_type: "code",
@@ -2435,7 +2554,8 @@ var FFID_ERROR_CODES = {
   TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
   TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
   NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR"
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
@@ -2953,6 +3073,99 @@ function createFFIDClient(config) {
     redirectUri: resolvedRedirectUri
   };
 }
+
+// src/client/callback.ts
+var CALLBACK_ERROR_CODES = {
+  /** Stored state missing or did not match the callback `state` (CSRF guard) */
+  STATE_MISMATCH: "STATE_MISMATCH_ERROR",
+  /**
+   * Web storage is unavailable, so `state` could never be persisted across the
+   * OAuth bounce. An environment issue (e.g. iOS private mode), not an attack —
+   * surfaced distinctly so callers don't mistake it for a CSRF mismatch.
+   */
+  STATE_UNAVAILABLE: "STATE_STORAGE_UNAVAILABLE",
+  /** Callback URL had no `code` param */
+  MISSING_CODE: "MISSING_AUTHORIZATION_CODE",
+  /** SSR with no `options.url` — cannot resolve callback params */
+  CALLBACK_URL_UNAVAILABLE: "CALLBACK_URL_UNAVAILABLE"
+};
+function extractSearchParams(source) {
+  try {
+    return new URL(source).searchParams;
+  } catch {
+    const queryStart = source.indexOf("?");
+    const query = queryStart >= 0 ? source.slice(queryStart + 1) : source;
+    return new URLSearchParams(query);
+  }
+}
+function cleanCallbackUrlParams(logger) {
+  try {
+    const cleanUrl = new URL(window.location.href);
+    cleanUrl.searchParams.delete("code");
+    cleanUrl.searchParams.delete("state");
+    window.history.replaceState({}, "", cleanUrl.toString());
+  } catch (error) {
+    logger.warn("handleRedirectCallback: URL \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+async function handleRedirectCallback(client, options) {
+  const { logger } = client;
+  const hasWindow = typeof window !== "undefined";
+  const source = options?.url ?? (hasWindow ? window.location.search : null);
+  if (source === null) {
+    logger.warn("handleRedirectCallback: SSR \u74B0\u5883\u3067\u306F options.url \u304C\u5FC5\u8981\u3067\u3059");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.CALLBACK_URL_UNAVAILABLE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002SSR \u74B0\u5883\u3067\u306F options.url \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+      )
+    };
+  }
+  const params = extractSearchParams(source);
+  const code = params.get("code");
+  const urlState = params.get("state");
+  if (!code) {
+    logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.MISSING_CODE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u306B\u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u305B\u3093"
+      )
+    };
+  }
+  const storedState = retrieveState(logger);
+  if (storedState !== null || urlState !== null) {
+    const stateMatches = storedState !== null && storedState === urlState;
+    if (!stateMatches) {
+      if (storedState === null && !isStateStorageAvailable()) {
+        logger.error(
+          "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
+        );
+        return {
+          error: client.createError(
+            CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
+            "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
+          )
+        };
+      }
+      logger.error(
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      );
+      return {
+        error: client.createError(
+          CALLBACK_ERROR_CODES.STATE_MISMATCH,
+          "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        )
+      };
+    }
+  }
+  const verifier = retrieveCodeVerifier(logger);
+  const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
+  if (!result.error && hasWindow) {
+    cleanCallbackUrlParams(logger);
+  }
+  return result;
+}
 var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 var TOKEN_REFRESH_RATIO = 0.8;
 var FFIDContext = react.createContext(null);
@@ -3127,8 +3340,7 @@ function FFIDProvider({
     const code = urlParams.get("code");
     if (!code) return;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    const codeVerifier = retrieveCodeVerifier(client.logger);
-    client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
+    handleRedirectCallback(client).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);
@@ -3136,10 +3348,6 @@ function FFIDProvider({
         setIsLoading(false);
         return;
       }
-      const cleanUrl = new URL(window.location.href);
-      cleanUrl.searchParams.delete("code");
-      cleanUrl.searchParams.delete("state");
-      window.history.replaceState({}, "", cleanUrl.toString());
       client.logger.debug("Token exchange successful, refreshing session");
       return refresh();
     }).catch((err) => {
@@ -4957,18 +5165,22 @@ exports.FFIDUserMenu = FFIDUserMenu;
 exports.FFID_ANNOUNCEMENTS_ERROR_CODES = FFID_ANNOUNCEMENTS_ERROR_CODES;
 exports.FFID_INQUIRY_CATEGORIES = FFID_INQUIRY_CATEGORIES;
 exports.FFID_INQUIRY_CATEGORIES_SITE_2026 = FFID_INQUIRY_CATEGORIES_SITE_2026;
+exports.cleanupStateStorage = cleanupStateStorage;
 exports.computeEffectiveStatusFromSession = computeEffectiveStatusFromSession;
 exports.createFFIDAnnouncementsClient = createFFIDAnnouncementsClient;
 exports.createFFIDClient = createFFIDClient;
 exports.createTokenStore = createTokenStore;
 exports.generateCodeChallenge = generateCodeChallenge;
 exports.generateCodeVerifier = generateCodeVerifier;
+exports.handleRedirectCallback = handleRedirectCallback;
 exports.hasAccessFromUserinfo = hasAccessFromUserinfo;
 exports.isBlockedFromUserinfo = isBlockedFromUserinfo;
 exports.isFFIDInquiryCategorySite2026 = isFFIDInquiryCategorySite2026;
 exports.normalizeRedirectUri = normalizeRedirectUri;
 exports.retrieveCodeVerifier = retrieveCodeVerifier;
+exports.retrieveState = retrieveState;
 exports.storeCodeVerifier = storeCodeVerifier;
+exports.storeState = storeState;
 exports.useFFID = useFFID;
 exports.useFFIDAnnouncements = useFFIDAnnouncements;
 exports.useFFIDContext = useFFIDContext;

package/dist/{chunk-KB2JG64Z.js → chunk-RATTQIKM.js}

@@ -122,6 +122,9 @@ function normalizeUserinfo(raw) {
   return {
     sub: raw.sub,
     email: raw.email,
+    // #3791: undefined → undefined を保つ（false に丸めない）。古い FFID は wire に
+    // 含めないため、consumer は undefined を「未確認」ではなく「不明」として扱える。
+    emailVerified: raw.email_verified,
     name: raw.name,
     picture: raw.picture,
     companyName: raw.company_name ?? null,
@@ -377,6 +380,9 @@ function createVerifyAccessToken(deps) {
     const base = {
       sub: introspectResponse.sub,
       email: introspectResponse.email ?? null,
+      // #3791: preserve undefined (do NOT coerce to false) so introspect-strategy
+      // callers can distinguish "verified" / "not verified" / "older server".
+      email_verified: introspectResponse.email_verified,
       name: introspectResponse.name ?? null,
       picture: introspectResponse.picture ?? null,
       company_name: introspectResponse.company_name ?? null,
@@ -932,7 +938,7 @@ function createProfileMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.12.0";
+var SDK_VERSION = "5.13.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1004,9 +1010,20 @@ function createOAuthTokenMethods(deps) {
     logger,
     errorCodes
   } = deps;
-  async function exchangeCodeForTokens(code, codeVerifier) {
+  async function exchangeCodeForTokens(code, codeVerifier, opts) {
     const url = `${baseUrl}${OAUTH_TOKEN_ENDPOINT}`;
     logger.debug("Exchanging code for tokens:", url);
+    if (opts?.expectedState !== void 0 || opts?.actualState !== void 0) {
+      if (opts?.expectedState !== opts?.actualState) {
+        logger.error("Token exchange aborted: OAuth state mismatch or omitted (possible CSRF)");
+        return {
+          error: {
+            code: errorCodes.STATE_MISMATCH_ERROR,
+            message: "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+          }
+        };
+      }
+    }
     const effectiveRedirectUri = resolvedRedirectUri ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : null);
     if (!effectiveRedirectUri) {
       logger.error("redirectUri is required for token exchange in SSR environments. Set config.redirectUri explicitly.");
@@ -1490,6 +1507,102 @@ function base64UrlEncode(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/auth/state.ts
+var STATE_STORAGE_KEY = "ffid_oauth_state";
+var STATE_FALLBACK_STORAGE_KEY = "ffid_oauth_state_fb";
+var STATE_FALLBACK_TIMESTAMP_KEY = "ffid_oauth_state_fb_ts";
+var OAUTH_STATE_MAX_AGE_MS = 5 * 60 * 1e3;
+function storeState(state, logger) {
+  if (typeof window === "undefined") {
+    logger?.warn("storeState: storage is not available in SSR context");
+    return false;
+  }
+  let sessionStored = false;
+  try {
+    window.sessionStorage.setItem(STATE_STORAGE_KEY, state);
+    sessionStored = true;
+  } catch (error) {
+    logger?.warn("storeState: sessionStorage \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  let localStored = false;
+  try {
+    window.localStorage.setItem(STATE_FALLBACK_STORAGE_KEY, state);
+    window.localStorage.setItem(STATE_FALLBACK_TIMESTAMP_KEY, String(Date.now()));
+    localStored = true;
+  } catch (error) {
+    logger?.warn("storeState: localStorage fallback \u3078\u306E\u4FDD\u5B58\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  return sessionStored || localStored;
+}
+function retrieveState(logger) {
+  if (typeof window === "undefined") return null;
+  let sessionState = null;
+  try {
+    sessionState = window.sessionStorage.getItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  if (sessionState) {
+    cleanupStateStorage(logger);
+    return sessionState;
+  }
+  let fallbackState = null;
+  let fallbackTimestamp = null;
+  try {
+    fallbackState = window.localStorage.getItem(STATE_FALLBACK_STORAGE_KEY);
+    fallbackTimestamp = window.localStorage.getItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage fallback \u304B\u3089\u306E\u53D6\u5F97\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    cleanupStateStorage(logger);
+    return null;
+  }
+  if (!fallbackState || !fallbackTimestamp) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  const ts = Number(fallbackTimestamp);
+  const age = Date.now() - ts;
+  if (!Number.isFinite(ts) || age < 0 || age > OAUTH_STATE_MAX_AGE_MS) {
+    cleanupStateStorage(logger);
+    return null;
+  }
+  logger?.warn(
+    "retrieveState: sessionStorage was empty, recovered OAuth state from localStorage fallback"
+  );
+  cleanupStateStorage(logger);
+  return fallbackState;
+}
+function isStateStorageAvailable() {
+  if (typeof window === "undefined") return false;
+  const probeKey = "__ffid_oauth_state_probe__";
+  try {
+    window.sessionStorage.setItem(probeKey, "1");
+    window.sessionStorage.removeItem(probeKey);
+    return true;
+  } catch {
+  }
+  try {
+    window.localStorage.setItem(probeKey, "1");
+    window.localStorage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanupStateStorage(logger) {
+  try {
+    window.sessionStorage.removeItem(STATE_STORAGE_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: sessionStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+  try {
+    window.localStorage.removeItem(STATE_FALLBACK_STORAGE_KEY);
+    window.localStorage.removeItem(STATE_FALLBACK_TIMESTAMP_KEY);
+  } catch (error) {
+    logger?.warn("retrieveState: localStorage \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+
 // src/client/redirect.ts
 var OAUTH_AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize";
 var AUTH_LOGOUT_ENDPOINT = "/api/v1/auth/logout";
@@ -1621,6 +1734,7 @@ function createRedirectMethods(deps) {
     const recentCount = getRecentRedirectCount(authorizeKey, now, logger);
     if (recentCount >= REDIRECT_LOOP_THRESHOLD) {
       cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.warn("[FFID SDK] redirect loop detected \u2014 \u81EA\u52D5\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u505C\u6B62\u3057\u307E\u3057\u305F", {
         authorizeKey,
         recentCount,
@@ -1644,6 +1758,11 @@ function createRedirectMethods(deps) {
       return { success: false, error: errorMessage };
     }
     const state = generateRandomState();
+    if (!storeState(state, logger)) {
+      logger.error(
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+      );
+    }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
       response_type: "code",
@@ -2433,7 +2552,8 @@ var FFID_ERROR_CODES = {
   TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
   TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
   NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR"
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
 };
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
@@ -2951,6 +3071,99 @@ function createFFIDClient(config) {
     redirectUri: resolvedRedirectUri
   };
 }
+
+// src/client/callback.ts
+var CALLBACK_ERROR_CODES = {
+  /** Stored state missing or did not match the callback `state` (CSRF guard) */
+  STATE_MISMATCH: "STATE_MISMATCH_ERROR",
+  /**
+   * Web storage is unavailable, so `state` could never be persisted across the
+   * OAuth bounce. An environment issue (e.g. iOS private mode), not an attack —
+   * surfaced distinctly so callers don't mistake it for a CSRF mismatch.
+   */
+  STATE_UNAVAILABLE: "STATE_STORAGE_UNAVAILABLE",
+  /** Callback URL had no `code` param */
+  MISSING_CODE: "MISSING_AUTHORIZATION_CODE",
+  /** SSR with no `options.url` — cannot resolve callback params */
+  CALLBACK_URL_UNAVAILABLE: "CALLBACK_URL_UNAVAILABLE"
+};
+function extractSearchParams(source) {
+  try {
+    return new URL(source).searchParams;
+  } catch {
+    const queryStart = source.indexOf("?");
+    const query = queryStart >= 0 ? source.slice(queryStart + 1) : source;
+    return new URLSearchParams(query);
+  }
+}
+function cleanCallbackUrlParams(logger) {
+  try {
+    const cleanUrl = new URL(window.location.href);
+    cleanUrl.searchParams.delete("code");
+    cleanUrl.searchParams.delete("state");
+    window.history.replaceState({}, "", cleanUrl.toString());
+  } catch (error) {
+    logger.warn("handleRedirectCallback: URL \u306E\u30AF\u30EA\u30FC\u30F3\u30A2\u30C3\u30D7\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+  }
+}
+async function handleRedirectCallback(client, options) {
+  const { logger } = client;
+  const hasWindow = typeof window !== "undefined";
+  const source = options?.url ?? (hasWindow ? window.location.search : null);
+  if (source === null) {
+    logger.warn("handleRedirectCallback: SSR \u74B0\u5883\u3067\u306F options.url \u304C\u5FC5\u8981\u3067\u3059");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.CALLBACK_URL_UNAVAILABLE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002SSR \u74B0\u5883\u3067\u306F options.url \u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+      )
+    };
+  }
+  const params = extractSearchParams(source);
+  const code = params.get("code");
+  const urlState = params.get("state");
+  if (!code) {
+    logger.warn("handleRedirectCallback: \u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093");
+    return {
+      error: client.createError(
+        CALLBACK_ERROR_CODES.MISSING_CODE,
+        "\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF URL \u306B\u8A8D\u53EF\u30B3\u30FC\u30C9\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u305B\u3093"
+      )
+    };
+  }
+  const storedState = retrieveState(logger);
+  if (storedState !== null || urlState !== null) {
+    const stateMatches = storedState !== null && storedState === urlState;
+    if (!stateMatches) {
+      if (storedState === null && !isStateStorageAvailable()) {
+        logger.error(
+          "handleRedirectCallback: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 CSRF \u691C\u8A3C\u304C\u3067\u304D\u307E\u305B\u3093\uFF08iOS private mode \u7B49\uFF09"
+        );
+        return {
+          error: client.createError(
+            CALLBACK_ERROR_CODES.STATE_UNAVAILABLE,
+            "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u308B storage \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u8A8D\u8A3C\u3092\u5B8C\u4E86\u3067\u304D\u307E\u305B\u3093\u3002\u30D6\u30E9\u30A6\u30B6\u306E\u30D7\u30E9\u30A4\u30D9\u30FC\u30C8\u30E2\u30FC\u30C9\u3084\u30B9\u30C8\u30EC\u30FC\u30B8\u8A2D\u5B9A\u3092\u3054\u78BA\u8A8D\u304F\u3060\u3055\u3044"
+          )
+        };
+      }
+      logger.error(
+        "handleRedirectCallback: OAuth state mismatch or omitted (possible CSRF) \u2014 \u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      );
+      return {
+        error: client.createError(
+          CALLBACK_ERROR_CODES.STATE_MISMATCH,
+          "OAuth state \u304C\u4E00\u81F4\u3057\u307E\u305B\u3093\u3002CSRF \u306E\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u8A8D\u8A3C\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+        )
+      };
+    }
+  }
+  const verifier = retrieveCodeVerifier(logger);
+  const result = await client.exchangeCodeForTokens(code, verifier ?? void 0);
+  if (!result.error && hasWindow) {
+    cleanCallbackUrlParams(logger);
+  }
+  return result;
+}
 var DEFAULT_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 var TOKEN_REFRESH_RATIO = 0.8;
 var FFIDContext = createContext(null);
@@ -3125,8 +3338,7 @@ function FFIDProvider({
     const code = urlParams.get("code");
     if (!code) return;
     client.logger.debug("Authorization code detected, exchanging for tokens");
-    const codeVerifier = retrieveCodeVerifier(client.logger);
-    client.exchangeCodeForTokens(code, codeVerifier ?? void 0).then((result) => {
+    handleRedirectCallback(client).then((result) => {
       if (result.error) {
         client.logger.error("Token exchange failed:", result.error);
         setError(result.error);
@@ -3134,10 +3346,6 @@ function FFIDProvider({
         setIsLoading(false);
         return;
       }
-      const cleanUrl = new URL(window.location.href);
-      cleanUrl.searchParams.delete("code");
-      cleanUrl.searchParams.delete("state");
-      window.history.replaceState({}, "", cleanUrl.toString());
       client.logger.debug("Token exchange successful, refreshing session");
       return refresh();
     }).catch((err) => {
@@ -4938,4 +5146,4 @@ function FFIDInquiryForm({
   );
 }
 
-export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, storeCodeVerifier, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };
+export { ACCESS_GRANTING_EFFECTIVE_STATUSES, BLOCKING_EFFECTIVE_STATUSES, DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES, EFFECTIVE_SUBSCRIPTION_STATUSES, FFIDAnnouncementBadge, FFIDAnnouncementList, FFIDInquiryForm, FFIDLoginButton, FFIDOrganizationSwitcher, FFIDProvider, FFIDSDKError, FFIDSubscriptionBadge, FFIDUserMenu, FFID_ANNOUNCEMENTS_ERROR_CODES, FFID_INQUIRY_CATEGORIES, FFID_INQUIRY_CATEGORIES_SITE_2026, cleanupStateStorage, computeEffectiveStatusFromSession, createFFIDAnnouncementsClient, createFFIDClient, createTokenStore, generateCodeChallenge, generateCodeVerifier, handleRedirectCallback, hasAccessFromUserinfo, isBlockedFromUserinfo, isFFIDInquiryCategorySite2026, normalizeRedirectUri, retrieveCodeVerifier, retrieveState, storeCodeVerifier, storeState, useFFID, useFFIDAnnouncements, useFFIDContext, useSubscription, withSubscription };

package/dist/components/index.cjs

@@ -1,34 +1,34 @@
 'use strict';
 
-var chunkAOJDV3UO_cjs = require('../chunk-AOJDV3UO.cjs');
+var chunkJFFRO2Q5_cjs = require('../chunk-JFFRO2Q5.cjs');
 
 
 
 Object.defineProperty(exports, "FFIDAnnouncementBadge", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDAnnouncementBadge; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDAnnouncementBadge; }
 });
 Object.defineProperty(exports, "FFIDAnnouncementList", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDAnnouncementList; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDAnnouncementList; }
 });
 Object.defineProperty(exports, "FFIDInquiryForm", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDInquiryForm; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDInquiryForm; }
 });
 Object.defineProperty(exports, "FFIDLoginButton", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDLoginButton; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDLoginButton; }
 });
 Object.defineProperty(exports, "FFIDOrganizationSwitcher", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDOrganizationSwitcher; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDOrganizationSwitcher; }
 });
 Object.defineProperty(exports, "FFIDSubscriptionBadge", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDSubscriptionBadge; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDSubscriptionBadge; }
 });
 Object.defineProperty(exports, "FFIDUserMenu", {
   enumerable: true,
-  get: function () { return chunkAOJDV3UO_cjs.FFIDUserMenu; }
+  get: function () { return chunkJFFRO2Q5_cjs.FFIDUserMenu; }
 });