@insforge/sdk 1.0.1-refresh.4 → 1.0.1-refresh.5

package/dist/index.d.mts

@@ -146,8 +146,9 @@ interface SessionStorageStrategy {
  * Secure Session Storage Strategy
  *
  * Stores access token in memory only (cleared on page refresh).
- * Refresh token is stored in httpOnly cookie by the backend.
- * The `isAuthenticated` cookie is set by the backend to signal that a refresh token exists.
+ * Refresh token is stored in httpOnly cookie by the backend (on backend domain).
+ * The `isAuthenticated` cookie is set by the SDK on the frontend domain to signal
+ * that a secure session exists and token refresh should be attempted on page reload.
  *
  * Security benefits:
  * - Access token not accessible to XSS attacks (in memory only)
@@ -281,12 +282,17 @@ declare class Auth {
     private database;
     constructor(http: HttpClient, tokenManager: TokenManager);
     /**
-     * Check if the isAuthenticated cookie flag exists
+     * Set the isAuthenticated cookie flag on the frontend domain
+     * This is managed by SDK, not backend, to work in cross-origin scenarios
      */
-    private hasAuthenticatedCookie;
+    private setAuthenticatedCookie;
+    /**
+     * Clear the isAuthenticated cookie flag from the frontend domain
+     */
+    private clearAuthenticatedCookie;
     /**
      * Switch to SecureSessionStorage (cookie-based auth)
-     * Called when we detect backend supports secure cookie mode
+     * Called when backend returns sessionMode: 'secure'
      * @internal
      */
     _switchToSecureStorage(): void;
@@ -297,11 +303,11 @@ declare class Auth {
      */
     _switchToLocalStorage(): void;
     /**
-     * Detect storage strategy after successful auth
-     * Checks for isAuthenticated cookie to determine backend mode
+     * Detect storage strategy based on backend response
+     * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
      * @internal
      */
-    private _detectStorageAfterAuth;
+    private _detectStorageFromResponse;
     /**
    * Automatically detect and handle OAuth callback parameters in the URL
    * This runs on initialization to seamlessly complete the OAuth flow

package/dist/index.d.ts

@@ -146,8 +146,9 @@ interface SessionStorageStrategy {
  * Secure Session Storage Strategy
  *
  * Stores access token in memory only (cleared on page refresh).
- * Refresh token is stored in httpOnly cookie by the backend.
- * The `isAuthenticated` cookie is set by the backend to signal that a refresh token exists.
+ * Refresh token is stored in httpOnly cookie by the backend (on backend domain).
+ * The `isAuthenticated` cookie is set by the SDK on the frontend domain to signal
+ * that a secure session exists and token refresh should be attempted on page reload.
  *
  * Security benefits:
  * - Access token not accessible to XSS attacks (in memory only)
@@ -281,12 +282,17 @@ declare class Auth {
     private database;
     constructor(http: HttpClient, tokenManager: TokenManager);
     /**
-     * Check if the isAuthenticated cookie flag exists
+     * Set the isAuthenticated cookie flag on the frontend domain
+     * This is managed by SDK, not backend, to work in cross-origin scenarios
      */
-    private hasAuthenticatedCookie;
+    private setAuthenticatedCookie;
+    /**
+     * Clear the isAuthenticated cookie flag from the frontend domain
+     */
+    private clearAuthenticatedCookie;
     /**
      * Switch to SecureSessionStorage (cookie-based auth)
-     * Called when we detect backend supports secure cookie mode
+     * Called when backend returns sessionMode: 'secure'
      * @internal
      */
     _switchToSecureStorage(): void;
@@ -297,11 +303,11 @@ declare class Auth {
      */
     _switchToLocalStorage(): void;
     /**
-     * Detect storage strategy after successful auth
-     * Checks for isAuthenticated cookie to determine backend mode
+     * Detect storage strategy based on backend response
+     * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
      * @internal
      */
-    private _detectStorageAfterAuth;
+    private _detectStorageFromResponse;
     /**
    * Automatically detect and handle OAuth callback parameters in the URL
    * This runs on initialization to seamlessly complete the OAuth flow

package/dist/index.js

@@ -267,7 +267,7 @@ var SecureSessionStorage = class {
     if (this.accessToken) return false;
     return this.hasAuthFlag();
   }
-  // --- Private: Auth Flag Cookie Detection (read-only) ---
+  // --- Private: Auth Flag Cookie Detection (SDK-managed on frontend domain) ---
   hasAuthFlag() {
     if (typeof document === "undefined") return false;
     return document.cookie.split(";").some(
@@ -531,17 +531,24 @@ var Auth = class {
     this.detectAuthCallback();
   }
   /**
-   * Check if the isAuthenticated cookie flag exists
+   * Set the isAuthenticated cookie flag on the frontend domain
+   * This is managed by SDK, not backend, to work in cross-origin scenarios
    */
-  hasAuthenticatedCookie() {
-    if (typeof document === "undefined") return false;
-    return document.cookie.split(";").some(
-      (c) => c.trim().startsWith(`${AUTH_FLAG_COOKIE}=`)
-    );
+  setAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    const maxAge = 7 * 24 * 60 * 60;
+    document.cookie = `${AUTH_FLAG_COOKIE}=true; path=/; max-age=${maxAge}; SameSite=Lax`;
+  }
+  /**
+   * Clear the isAuthenticated cookie flag from the frontend domain
+   */
+  clearAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    document.cookie = `${AUTH_FLAG_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
   }
   /**
    * Switch to SecureSessionStorage (cookie-based auth)
-   * Called when we detect backend supports secure cookie mode
+   * Called when backend returns sessionMode: 'secure'
    * @internal
    */
   _switchToSecureStorage() {
@@ -552,6 +559,7 @@ var Auth = class {
       localStorage.removeItem(TOKEN_KEY);
       localStorage.removeItem(USER_KEY);
     }
+    this.setAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
@@ -565,17 +573,18 @@ var Auth = class {
     if (this.tokenManager.getStrategyId() === "local") return;
     const currentSession = this.tokenManager.getSession();
     this.tokenManager.setStrategy(new LocalSessionStorage());
+    this.clearAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
   }
   /**
-   * Detect storage strategy after successful auth
-   * Checks for isAuthenticated cookie to determine backend mode
+   * Detect storage strategy based on backend response
+   * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
    * @internal
    */
-  _detectStorageAfterAuth() {
-    if (this.hasAuthenticatedCookie()) {
+  _detectStorageFromResponse(sessionMode) {
+    if (sessionMode === "secure") {
       this._switchToSecureStorage();
     }
   }
@@ -592,8 +601,9 @@ var Auth = class {
       const userId = params.get("user_id");
       const email = params.get("email");
       const name = params.get("name");
+      const sessionMode = params.get("session_mode");
       if (accessToken && userId && email) {
-        this._detectStorageAfterAuth();
+        this._detectStorageFromResponse(sessionMode || void 0);
         const session = {
           accessToken,
           user: {
@@ -614,6 +624,7 @@ var Auth = class {
         url.searchParams.delete("user_id");
         url.searchParams.delete("email");
         url.searchParams.delete("name");
+        url.searchParams.delete("session_mode");
         if (params.has("error")) {
           url.searchParams.delete("error");
         }
@@ -629,6 +640,8 @@ var Auth = class {
   async signUp(request) {
     try {
       const response = await this.http.post("/api/auth/users", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken && response.user) {
         const session = {
           accessToken: response.accessToken,
@@ -638,7 +651,6 @@ var Auth = class {
           this.tokenManager.saveSession(session);
         }
         this.http.setAuthToken(response.accessToken);
-        this._detectStorageAfterAuth();
       }
       return {
         data: response,
@@ -664,6 +676,8 @@ var Auth = class {
   async signInWithPassword(request) {
     try {
       const response = await this.http.post("/api/auth/sessions", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       const session = {
         accessToken: response.accessToken || "",
         user: response.user || {
@@ -679,7 +693,6 @@ var Auth = class {
         this.tokenManager.saveSession(session);
       }
       this.http.setAuthToken(response.accessToken || "");
-      this._detectStorageAfterAuth();
       return {
         data: response,
         error: null
@@ -746,6 +759,7 @@ var Auth = class {
       }
       this.tokenManager.clearSession();
       this.http.setAuthToken(null);
+      this.clearAuthenticatedCookie();
       return { error: null };
     } catch (error) {
       return {
@@ -769,6 +783,7 @@ var Auth = class {
         "/api/auth/refresh"
       );
       if (response.accessToken) {
+        this._detectStorageFromResponse(response.sessionMode);
         this.tokenManager.setAccessToken(response.accessToken);
         this.http.setAuthToken(response.accessToken);
         if (response.user) {
@@ -786,6 +801,7 @@ var Auth = class {
         if (error.statusCode === 401 || error.statusCode === 403) {
           this.tokenManager.clearSession();
           this.http.setAuthToken(null);
+          this.clearAuthenticatedCookie();
         }
         throw error;
       }
@@ -1119,6 +1135,8 @@ var Auth = class {
         "/api/auth/email/verify",
         request
       );
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken) {
         const session = {
           accessToken: response.accessToken,