@hexclave/js 1.0.5 → 1.0.8

package/src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts

@@ -3,8 +3,39 @@
 // THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
 //===========================================
 import { describe, expect, it, vi } from "vitest";
+import { AccessToken } from "@hexclave/shared/dist/sessions";
+import { Store } from "@hexclave/shared/dist/utils/stores";
 import { StackClientApp } from "../interfaces/client-app";
 
+function createAccessTokenString(refreshTokenId: string): string {
+  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  return [
+    encode({ alg: "none", typ: "JWT" }),
+    encode({
+      sub: "user-id",
+      exp: nowSeconds + 60,
+      iat: nowSeconds,
+      iss: "https://api.example.test",
+      aud: "project-id",
+      project_id: "project-id",
+      branch_id: "main",
+      refresh_token_id: refreshTokenId,
+      role: "authenticated",
+      name: null,
+      email: null,
+      email_verified: false,
+      selected_team_id: null,
+      signed_up_at: nowSeconds,
+      is_anonymous: false,
+      is_restricted: false,
+      restricted_reason: null,
+      requires_totp_mfa: false,
+    }),
+    "",
+  ].join(".");
+}
+
 function createMockDocument(): Document {
   const cookieJar = new Map<string, string>();
   return {
@@ -23,12 +54,13 @@ function createMockDocument(): Document {
 
 describe("StackClientApp cross-domain auth", () => {
   it("uses the fresh post-auth refresh token when minting a cross-domain handoff", async () => {
+    const freshAccessToken = createAccessTokenString("fresh-refresh-token-id");
     const clientApp = new StackClientApp({
       baseUrl: "http://localhost:12345",
       projectId: "00000000-0000-4000-8000-000000000000",
       publishableClientKey: "stack-pk-test",
       tokenStore: {
-        accessToken: "stale-access-token",
+        accessToken: createAccessTokenString("stale-refresh-token-id"),
         refreshToken: "stale-refresh-token",
       },
       redirectMethod: "none",
@@ -37,24 +69,43 @@ describe("StackClientApp cross-domain auth", () => {
 
     const clientInterface = Reflect.get(clientApp, "_interface");
     const originalSendClientRequest = Reflect.get(clientInterface, "sendClientRequest");
+    const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
     const capturedRefreshTokens: string[] = [];
+    const capturedAccessTokenRefreshTokenIds: string[] = [];
+    const refreshedRawRefreshTokens: string[] = [];
 
     Reflect.set(clientInterface, "sendClientRequest", async (_path: unknown, _requestOptions: unknown, session: unknown) => {
       const getRefreshToken = Reflect.get(session ?? {}, "getRefreshToken");
+      const getOrFetchLikelyValidTokens = Reflect.get(session ?? {}, "getOrFetchLikelyValidTokens");
       if (typeof getRefreshToken !== "function") {
         throw new Error("Expected cross-domain auth to pass a session to the client interface.");
       }
+      if (typeof getOrFetchLikelyValidTokens !== "function") {
+        throw new Error("Expected cross-domain auth to pass a session with token accessors.");
+      }
       const refreshToken = getRefreshToken.call(session);
       const refreshTokenString = Reflect.get(refreshToken ?? {}, "token");
       if (typeof refreshTokenString !== "string") {
         throw new Error("Expected cross-domain auth to pass a refresh-token-backed session.");
       }
       capturedRefreshTokens.push(refreshTokenString);
+      const tokens = await getOrFetchLikelyValidTokens.call(session, 0, null);
+      capturedAccessTokenRefreshTokenIds.push(tokens.accessToken.payload.refresh_token_id);
       return {
         ok: true,
         json: async () => ({ redirect_url: "https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state" }),
       };
     });
+    Reflect.set(clientInterface, "fetchNewAccessToken", async (refreshToken: unknown) => {
+      const refreshTokenString = Reflect.get(refreshToken ?? {}, "token");
+      if (typeof refreshTokenString !== "string") {
+        throw new Error("Expected refresh token while fetching a new access token.");
+      }
+      refreshedRawRefreshTokens.push(refreshTokenString);
+      return AccessToken.createIfValid(freshAccessToken) ?? (() => {
+        throw new Error("Expected test access token to be valid");
+      })();
+    });
 
     try {
       const createCrossDomainAuthRedirectUrl = Reflect.get(clientApp, "_createCrossDomainAuthRedirectUrl");
@@ -68,15 +119,18 @@ describe("StackClientApp cross-domain auth", () => {
         codeChallenge: "abcdefghijklmnopqrstuvwxyzABCDEFG_0123456789-._~",
         afterCallbackRedirectUrl: "https://example.com/account-settings",
         overrideTokenStoreInit: {
-          accessToken: "fresh-access-token",
+          accessToken: createAccessTokenString("fresh-stale-refresh-token-id"),
           refreshToken: "fresh-refresh-token",
         },
       })).resolves.toBe("https://example.com/handler/oauth-callback?code=handoff-code&state=handoff-state");
     } finally {
       Reflect.set(clientInterface, "sendClientRequest", originalSendClientRequest);
+      Reflect.set(clientInterface, "fetchNewAccessToken", originalFetchNewAccessToken);
     }
 
+    expect(refreshedRawRefreshTokens).toEqual(["fresh-refresh-token"]);
     expect(capturedRefreshTokens).toEqual(["fresh-refresh-token"]);
+    expect(capturedAccessTokenRefreshTokenIds).toEqual(["fresh-refresh-token-id"]);
   });
 
   it("uses a fresh nested OAuth state while preserving the outer cross-domain return state", async () => {
@@ -105,7 +159,7 @@ describe("StackClientApp cross-domain auth", () => {
     const previousWindow = globalThis.window;
     const previousDocument = globalThis.document;
     let redirectedUrl = "";
-    vi.spyOn(clientApp as any, "_getCurrentRefreshTokenIdIfSignedIn").mockResolvedValue(null);
+    vi.spyOn(clientApp as any, "_fetchCurrentRefreshTokenIdIfSignedIn").mockResolvedValue(null);
     vi.spyOn(clientApp as any, "_getCrossDomainHandoffParamsForRedirect").mockResolvedValue({
       state: "fresh-nested-state",
       codeChallenge: "fresh-nested-code-challenge",
@@ -138,4 +192,263 @@ describe("StackClientApp cross-domain auth", () => {
     expect(redirectUri.searchParams.get("hexclave_cross_domain_code_challenge")).toBe(outerCodeChallenge);
     expect(redirectUri.searchParams.get("hexclave_cross_domain_after_callback_redirect_url")).toBe("https://demo.stack-auth.com/");
   });
+
+  it("clears a stale target-domain session before deferring to the source-domain session", async () => {
+    const projectId = "00000000-0000-4000-8000-000000000006";
+    const hostedAccessToken = createAccessTokenString("hosted-old-refresh-token-id");
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId,
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "window",
+      urls: {
+        default: { type: "hosted" },
+      },
+      noAutomaticPrefetch: true,
+    });
+    const tokenStore = Reflect.get(clientApp, "_memoryTokenStore");
+    if (!(tokenStore instanceof Store)) {
+      throw new Error("Expected StackClientApp to use a memory token store in this test.");
+    }
+    tokenStore.set({
+      refreshToken: "hosted-old-refresh-token",
+      accessToken: hostedAccessToken,
+    });
+
+    const currentUrl = new URL(`https://${projectId}.example-stack-hosted.test/handler/sign-in`);
+    currentUrl.searchParams.set("stack_nested_cross_domain_auth_refresh_token_id", "source-anonymous-refresh-token-id");
+    currentUrl.searchParams.set("stack_nested_cross_domain_auth_callback_url", "https://demo.stack-auth.com/handler/oauth-callback");
+    currentUrl.searchParams.set("hexclave_cross_domain_state", "outer-state");
+    currentUrl.searchParams.set("hexclave_cross_domain_code_challenge", "outer-code-challenge");
+    currentUrl.searchParams.set("hexclave_cross_domain_after_callback_redirect_url", "https://demo.stack-auth.com/app");
+
+    const previousWindow = globalThis.window;
+    const previousDocument = globalThis.document;
+    let redirectedUrl = "";
+    const clientInterface = Reflect.get(clientApp, "_interface");
+    const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
+    Reflect.set(clientInterface, "fetchNewAccessToken", async () => {
+      return AccessToken.createIfValid(hostedAccessToken) ?? (() => {
+        throw new Error("Expected test access token to be valid");
+      })();
+    });
+    vi.spyOn(clientApp as any, "_isTrusted").mockResolvedValue(true);
+
+    globalThis.document = createMockDocument();
+    globalThis.window = {
+      location: {
+        href: currentUrl.toString(),
+        replace: (url: string) => {
+          redirectedUrl = url;
+          throw new Error("INTENTIONAL_TEST_ABORT");
+        },
+      },
+    } as any;
+
+    try {
+      await expect((clientApp as any)._maybeHandleNestedCrossDomainAuth()).rejects.toThrowError("INTENTIONAL_TEST_ABORT");
+    } finally {
+      Reflect.set(clientInterface, "fetchNewAccessToken", originalFetchNewAccessToken);
+      globalThis.window = previousWindow;
+      globalThis.document = previousDocument;
+    }
+
+    expect(tokenStore.get()).toEqual({
+      refreshToken: null,
+      accessToken: null,
+    });
+    expect(new URL(redirectedUrl).origin).toBe("https://demo.stack-auth.com");
+  });
+
+  it("uses the latest browser refresh cookie before computing nested cross-domain session IDs", async () => {
+    const projectId = "00000000-0000-4000-8000-000000000007";
+    const previousWindow = globalThis.window;
+    const previousDocument = globalThis.document;
+
+    globalThis.document = createMockDocument();
+    globalThis.window = {
+      location: {
+        href: "https://demo.stack-auth.com/",
+        protocol: "https:",
+        hostname: "demo.stack-auth.com",
+      },
+    } as any;
+
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId,
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "cookie",
+      redirectMethod: "none",
+      noAutomaticPrefetch: true,
+    });
+    const clientInterface = Reflect.get(clientApp, "_interface");
+    const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
+    const refreshedRawRefreshTokens: string[] = [];
+
+    try {
+      const getBrowserCookieTokenStore = Reflect.get(clientApp, "_getBrowserCookieTokenStore");
+      if (typeof getBrowserCookieTokenStore !== "function") {
+        throw new Error("Expected StackClientApp to expose _getBrowserCookieTokenStore in tests.");
+      }
+      const tokenStore = getBrowserCookieTokenStore.call(clientApp);
+      tokenStore.set({
+        refreshToken: "old-refresh-token",
+        accessToken: createAccessTokenString("old-refresh-token-id"),
+      });
+
+      document.cookie = `__Host-hexclave-refresh-${projectId}--default=${JSON.stringify({
+        refresh_token: "new-refresh-token",
+        updated_at_millis: 1,
+      })}`;
+      Reflect.set(clientInterface, "fetchNewAccessToken", async (refreshToken: unknown) => {
+        const refreshTokenString = Reflect.get(refreshToken ?? {}, "token");
+        if (typeof refreshTokenString !== "string") {
+          throw new Error("Expected refresh token while fetching a new access token.");
+        }
+        refreshedRawRefreshTokens.push(refreshTokenString);
+        return AccessToken.createIfValid(createAccessTokenString("new-refresh-token-id")) ?? (() => {
+          throw new Error("Expected test access token to be valid");
+        })();
+      });
+
+      const fetchCurrentRefreshTokenIdIfSignedIn = Reflect.get(clientApp, "_fetchCurrentRefreshTokenIdIfSignedIn");
+      if (typeof fetchCurrentRefreshTokenIdIfSignedIn !== "function") {
+        throw new Error("Expected StackClientApp to expose _fetchCurrentRefreshTokenIdIfSignedIn in tests.");
+      }
+      await expect(fetchCurrentRefreshTokenIdIfSignedIn.call(clientApp, {
+        awaitPendingAuthResolutions: false,
+      })).resolves.toBe("new-refresh-token-id");
+    } finally {
+      Reflect.set(clientInterface, "fetchNewAccessToken", originalFetchNewAccessToken);
+      globalThis.window = previousWindow;
+      globalThis.document = previousDocument;
+    }
+
+    expect(refreshedRawRefreshTokens).toEqual(["new-refresh-token"]);
+  });
+
+  it("uses direct sign-out instead of hosted sign-out redirects when code execution is available", async () => {
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId: "00000000-0000-4000-8000-000000000003",
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "window",
+      urls: {
+        handler: "/handler",
+        signOut: { type: "hosted" },
+      },
+      noAutomaticPrefetch: true,
+    });
+    const signOutSpy = vi.spyOn(clientApp, "signOut").mockRejectedValue(new Error("INTENTIONAL_TEST_ABORT"));
+
+    try {
+      await expect(clientApp.redirectToSignOut()).rejects.toThrowError("INTENTIONAL_TEST_ABORT");
+      expect(signOutSpy).toHaveBeenCalledWith();
+    } finally {
+      signOutSpy.mockRestore();
+    }
+  });
+
+  it("keeps default hosted signOut() on the source domain when afterSignOut is not configured", async () => {
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId: "00000000-0000-4000-8000-000000000004",
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "window",
+      urls: {
+        default: { type: "hosted" },
+      },
+      noAutomaticPrefetch: true,
+    });
+    const currentHref = "https://demo.stack-auth.com/settings?tab=profile";
+
+    const clientInterface = Reflect.get(clientApp, "_interface");
+    const originalSignOut = Reflect.get(clientInterface, "signOut");
+    Reflect.set(clientInterface, "signOut", async () => {});
+    const previousWindow = globalThis.window;
+    const previousDocument = globalThis.document;
+    let redirectedUrl = "";
+
+    globalThis.document = createMockDocument();
+    globalThis.window = {
+      location: {
+        href: currentHref,
+        replace: (url: string) => {
+          redirectedUrl = url;
+          throw new Error("INTENTIONAL_TEST_ABORT");
+        },
+      },
+    } as any;
+
+    try {
+      const signOut = Reflect.get(clientApp, "_signOut");
+      if (typeof signOut !== "function") {
+        throw new Error("Expected StackClientApp to expose _signOut in tests.");
+      }
+      await expect(signOut.call(clientApp, Reflect.get(clientInterface, "createSession").call(clientInterface, {
+        refreshToken: null,
+      }))).rejects.toThrowError("INTENTIONAL_TEST_ABORT");
+    } finally {
+      Reflect.set(clientInterface, "signOut", originalSignOut);
+      globalThis.window = previousWindow;
+      globalThis.document = previousDocument;
+    }
+
+    expect(redirectedUrl).toBe("/settings?tab=profile");
+  });
+
+  it("ignores stale session callbacks after a newer refresh token owns the token store", async () => {
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId: "00000000-0000-4000-8000-000000000005",
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "none",
+      noAutomaticPrefetch: true,
+    });
+    const oldAccessToken = createAccessTokenString("old-refresh-token-id");
+    const refreshedOldAccessToken = createAccessTokenString("refreshed-old-refresh-token-id");
+    const newAccessToken = createAccessTokenString("new-refresh-token-id");
+    const tokenStore = new Store({
+      refreshToken: "old-refresh-token",
+      accessToken: oldAccessToken,
+    });
+    const clientInterface = Reflect.get(clientApp, "_interface");
+    const originalFetchNewAccessToken = Reflect.get(clientInterface, "fetchNewAccessToken");
+    Reflect.set(clientInterface, "fetchNewAccessToken", async () => {
+      return AccessToken.createIfValid(refreshedOldAccessToken) ?? (() => {
+        throw new Error("Expected test access token to be valid");
+      })();
+    });
+
+    try {
+      const getSessionFromTokenStore = Reflect.get(clientApp, "_getSessionFromTokenStore");
+      if (typeof getSessionFromTokenStore !== "function") {
+        throw new Error("Expected StackClientApp to expose _getSessionFromTokenStore in tests.");
+      }
+      const oldSession = getSessionFromTokenStore.call(clientApp, tokenStore);
+      tokenStore.set({
+        refreshToken: "new-refresh-token",
+        accessToken: newAccessToken,
+      });
+
+      await oldSession.fetchNewTokens();
+      expect(tokenStore.get()).toEqual({
+        refreshToken: "new-refresh-token",
+        accessToken: newAccessToken,
+      });
+
+      oldSession.markInvalid();
+      expect(tokenStore.get()).toEqual({
+        refreshToken: "new-refresh-token",
+        accessToken: newAccessToken,
+      });
+    } finally {
+      Reflect.set(clientInterface, "fetchNewAccessToken", originalFetchNewAccessToken);
+    }
+  });
 });

package/src/lib/hexclave-app/apps/implementations/client-app-impl.ts

@@ -39,14 +39,14 @@ import { Store, storeLock } from "@hexclave/shared/dist/utils/stores";
 import { deindent, mergeScopeStrings } from "@hexclave/shared/dist/utils/strings";
 import type { TurnstileAction } from "@hexclave/shared/dist/utils/turnstile";
 import { BotChallengeExecutionFailedError, BotChallengeUserCancelledError, withBotChallengeFlow } from "@hexclave/shared/dist/utils/turnstile-flow";
-import { createUrlIfValid, isRelative } from "@hexclave/shared/dist/utils/urls";
+import { createUrlIfValid, getRelativePart, isRelative } from "@hexclave/shared/dist/utils/urls";
 import { generateUuid } from "@hexclave/shared/dist/utils/uuids";
 import * as cookie from "cookie";
 import type * as yup from "yup";
 import { constructRedirectUrl } from "../../../../utils/url";
 import { callOAuthCallback, getNewOAuthProviderOrScopeUrl } from "../../../auth";
 import { CookieHelper, createBrowserCookieHelper, createCookieHelper, createPlaceholderCookieHelper, deleteCookie, deleteCookieClient, getCookieClient, isSecure as isSecureCookieContext, saveVerifierAndState, setOrDeleteCookie, setOrDeleteCookieClient } from "../../../cookie";
-import { envVars } from "../../../env";
+import { envVars } from "../../../../generated/env";
 import { ApiKey, ApiKeyCreationOptions, ApiKeyUpdateOptions, apiKeyCreationOptionsToCrud } from "../../api-keys";
 import { ConvexCtx, GetCurrentPartialUserOptions, GetCurrentUserOptions, HandlerUrlOptions, HandlerUrls, OAuthScopesOnSignIn, RedirectMethod, RedirectToOptions, RequestLike, ResolvedHandlerUrls, TokenStoreInit, hexclaveAppInternalsSymbol } from "../../common";
 import { DeprecatedOAuthConnection, OAuthConnection } from "../../connected-accounts";
@@ -776,12 +776,16 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
     return currentUrl.toString();
   }
 
-  protected async _getCurrentRefreshTokenIdIfSignedIn(options?: {
+  protected async _fetchCurrentRefreshTokenIdIfSignedIn(options?: {
     awaitPendingAuthResolutions?: boolean,
     overrideTokenStoreInit?: TokenStoreInit,
   }): Promise<string | null> {
     const session = await this._getSession(options?.overrideTokenStoreInit, options);
-    const tokens = await session.getOrFetchLikelyValidTokens(0, null);
+    // Nested cross-domain auth passes this ID to another origin, which later
+    // asks us to prove the same raw refresh token. A cached access token can be
+    // valid but stale relative to the refresh token, so mint from the refresh
+    // token that owns this session before exposing the ID.
+    const tokens = await session.fetchNewTokens();
     if (tokens?.refreshToken == null) {
       return null;
     }
@@ -799,7 +803,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       return options.url;
     }
 
-    const refreshTokenId = await this._getCurrentRefreshTokenIdIfSignedIn({
+    const refreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({
       awaitPendingAuthResolutions: options.awaitPendingAuthResolutions,
       overrideTokenStoreInit: options.overrideTokenStoreInit,
     });
@@ -854,7 +858,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       if (!await this._isTrusted(afterCallbackRedirectUrl.toString())) {
         throw new Error(`Nested cross-domain auth after-callback redirect URL ${afterCallbackRedirectUrlString} is not trusted.`);
       }
-      const currentRefreshTokenId = await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
+      const currentRefreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
       if (currentRefreshTokenId !== refreshTokenId) {
         throw new Error("Nested cross-domain auth source session does not match the requested refresh token ID.");
       }
@@ -873,8 +877,12 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
     // We are on b.com. Bounce to the trusted callback on a.com with a normal OAuth request
     // shape; a.com will verify the source session and issue the one-time code.
-    const currentRefreshTokenId = await this._getCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
+    const currentRefreshTokenId = await this._fetchCurrentRefreshTokenIdIfSignedIn({ awaitPendingAuthResolutions: false });
     if (currentRefreshTokenId === refreshTokenId) return false;
+    if (currentRefreshTokenId != null) {
+      const session = await this._getSession(undefined, { awaitPendingAuthResolutions: false });
+      session.markInvalid();
+    }
     const callbackUrlString = currentUrl.searchParams.get(nestedCrossDomainAuthQueryParams.callbackUrl);
     if (callbackUrlString == null) {
       throw new HexclaveAssertionError("Nested cross-domain auth URL is missing callback URL");
@@ -1067,6 +1075,13 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       accessToken,
     };
   }
+  private _getCurrentBrowserCookieTokenStoreValue(old: TokenObject | null): TokenObject {
+    const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
+    return {
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null),
+    };
+  }
   protected get _accessTokenCookieName() {
     // The access token, unlike the refresh token, should not depend on the project ID. We never want to store the
     // access token in cookies more than once because of how big it is (there's a limit of 4096 bytes for all cookies
@@ -1209,20 +1224,13 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
     }
 
     if (this._storedBrowserCookieTokenStore === null) {
-      const getCurrentValue = (old: TokenObject | null) => {
-        const tokens = this._getTokensFromCookies(this._getAllBrowserCookies());
-        return {
-          refreshToken: tokens.refreshToken,
-          accessToken: tokens.accessToken ?? (old?.refreshToken === tokens.refreshToken ? old.accessToken : null),
-        };
-      };
-      this._storedBrowserCookieTokenStore = new Store<TokenObject>(getCurrentValue(null));
+      this._storedBrowserCookieTokenStore = new Store<TokenObject>(this._getCurrentBrowserCookieTokenStoreValue(null));
       let hasSucceededInWriting = true;
 
       setInterval(() => {
         if (hasSucceededInWriting) {
           const oldValue = this._storedBrowserCookieTokenStore!.get();
-          const currentValue = getCurrentValue(oldValue);
+          const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
           if (!deepPlainEquals(currentValue, oldValue)) {
             this._storedBrowserCookieTokenStore!.set(currentValue);
           }
@@ -1256,6 +1264,12 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
           }
         }
       });
+    } else {
+      const oldValue = this._storedBrowserCookieTokenStore.get();
+      const currentValue = this._getCurrentBrowserCookieTokenStoreValue(oldValue);
+      if (!deepPlainEquals(currentValue, oldValue)) {
+        this._storedBrowserCookieTokenStore.set(currentValue);
+      }
     }
 
     return this._storedBrowserCookieTokenStore;
@@ -1392,17 +1406,17 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       accessToken: tokenObj.accessToken,
     });
     session.onAccessTokenChange((newAccessToken) => {
-      tokenStore.update((old) => ({
+      tokenStore.update((old) => InternalSession.calculateSessionKey(old) === sessionKey ? {
         ...old,
         accessToken: newAccessToken?.token ?? null
-      }));
+      } : old);
     });
     session.onInvalidate(() => {
-      tokenStore.update((old) => ({
+      tokenStore.update((old) => InternalSession.calculateSessionKey(old) === sessionKey ? {
         ...old,
         accessToken: null,
         refreshToken: null,
-      }));
+      } : old);
     });
 
     let sessionsBySessionKey = this._sessionsByTokenStoreAndSessionKey.get(tokenStore) ?? new Map();
@@ -2294,16 +2308,16 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
   private _getBotChallengeSiteKeys(): { visibleSiteKey: string, invisibleSiteKey: string } | null {
     if (!isBrowserLike()) return null;
 
-    const visibleSiteKey = envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY;
+    const visibleSiteKey = envVars.HEXCLAVE_BOT_CHALLENGE_SITE_KEY;
     if (!visibleSiteKey) {
       if (!this._botChallengeSiteKeysWarned) {
         this._botChallengeSiteKeysWarned = true;
-        console.warn("[stack-auth] NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
+        console.warn("[stack-auth] HEXCLAVE_BOT_CHALLENGE_SITE_KEY is not set — bot challenge fraud protection is disabled. Set the env variable to enable it.");
       }
       return null;
     }
 
-    const invisibleSiteKey = envVars.NEXT_PUBLIC_STACK_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey;
+    const invisibleSiteKey = envVars.HEXCLAVE_BOT_CHALLENGE_INVISIBLE_SITE_KEY ?? visibleSiteKey;
 
     return { visibleSiteKey, invisibleSiteKey };
   }
@@ -2485,6 +2499,11 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
     overrideTokenStoreInit?: TokenStoreInit,
   }): Promise<string> {
     const session = await this._getSession(options.overrideTokenStoreInit, { awaitPendingAuthResolutions: options.awaitPendingAuthResolutions });
+    // The authorize endpoint intentionally verifies that the access token and
+    // raw refresh token describe the same DB session. Force the access token to
+    // be minted from the refresh token we are about to send, instead of reusing
+    // a still-valid cached token from a pre-handoff session snapshot.
+    await session.fetchNewTokens();
     const response = await this._interface.sendClientRequest(
       "/auth/oauth/cross-domain/authorize",
       {
@@ -2611,7 +2630,13 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
 
   async redirectToSignIn(options?: RedirectToOptions) { return await this._redirectToHandler("signIn", options); }
   async redirectToSignUp(options?: RedirectToOptions) { return await this._redirectToHandler("signUp", options); }
-  async redirectToSignOut(options?: RedirectToOptions) { return await this._redirectToHandler("signOut", options); }
+  async redirectToSignOut(options?: RedirectToOptions) {
+    const configuredSignOutTarget = this._urlOptions.signOut ?? this._urlOptions.default;
+    if (typeof configuredSignOutTarget !== "string" && configuredSignOutTarget?.type === "hosted") {
+      return await this.signOut();
+    }
+    return await this._redirectToHandler("signOut", options);
+  }
   async redirectToEmailVerification(options?: RedirectToOptions) { return await this._redirectToHandler("emailVerification", options); }
   async redirectToPasswordReset(options?: RedirectToOptions) { return await this._redirectToHandler("passwordReset", options); }
   async redirectToForgotPassword(options?: RedirectToOptions) { return await this._redirectToHandler("forgotPassword", options); }
@@ -3329,11 +3354,30 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       if (options?.redirectUrl) {
         await this._redirectTo({ url: options.redirectUrl, replace: true });
       } else {
-        await this.redirectToAfterSignOut();
+        await this._redirectToDefaultAfterSignOut();
       }
     });
   }
 
+  protected async _redirectToDefaultAfterSignOut(): Promise<void> {
+    if (this._urlOptions.afterSignOut != null) {
+      await this.redirectToAfterSignOut({ replace: true });
+      return;
+    }
+
+    if (this._urlOptions.home != null) {
+      await this.redirectToHome({ replace: true });
+      return;
+    }
+
+    if (this._urlOptions.default?.type === "hosted" && typeof window !== "undefined") {
+      await this._redirectTo({ url: getRelativePart(new URL(window.location.href)), replace: true });
+      return;
+    }
+
+    await this.redirectToAfterSignOut({ replace: true });
+  }
+
   async signOut(options?: { redirectUrl?: URL | string, tokenStore?: TokenStoreInit }): Promise<void> {
     const user = await this.getUser({ tokenStore: options?.tokenStore ?? undefined as any });
     if (user) {