@insforge/sdk 1.0.1-refresh.4 → 1.0.1-refresh.5

package/dist/index.mjs

@@ -228,7 +228,7 @@ var SecureSessionStorage = class {
     if (this.accessToken) return false;
     return this.hasAuthFlag();
   }
-  // --- Private: Auth Flag Cookie Detection (read-only) ---
+  // --- Private: Auth Flag Cookie Detection (SDK-managed on frontend domain) ---
   hasAuthFlag() {
     if (typeof document === "undefined") return false;
     return document.cookie.split(";").some(
@@ -492,17 +492,24 @@ var Auth = class {
     this.detectAuthCallback();
   }
   /**
-   * Check if the isAuthenticated cookie flag exists
+   * Set the isAuthenticated cookie flag on the frontend domain
+   * This is managed by SDK, not backend, to work in cross-origin scenarios
    */
-  hasAuthenticatedCookie() {
-    if (typeof document === "undefined") return false;
-    return document.cookie.split(";").some(
-      (c) => c.trim().startsWith(`${AUTH_FLAG_COOKIE}=`)
-    );
+  setAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    const maxAge = 7 * 24 * 60 * 60;
+    document.cookie = `${AUTH_FLAG_COOKIE}=true; path=/; max-age=${maxAge}; SameSite=Lax`;
+  }
+  /**
+   * Clear the isAuthenticated cookie flag from the frontend domain
+   */
+  clearAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    document.cookie = `${AUTH_FLAG_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
   }
   /**
    * Switch to SecureSessionStorage (cookie-based auth)
-   * Called when we detect backend supports secure cookie mode
+   * Called when backend returns sessionMode: 'secure'
    * @internal
    */
   _switchToSecureStorage() {
@@ -513,6 +520,7 @@ var Auth = class {
       localStorage.removeItem(TOKEN_KEY);
       localStorage.removeItem(USER_KEY);
     }
+    this.setAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
@@ -526,17 +534,18 @@ var Auth = class {
     if (this.tokenManager.getStrategyId() === "local") return;
     const currentSession = this.tokenManager.getSession();
     this.tokenManager.setStrategy(new LocalSessionStorage());
+    this.clearAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
   }
   /**
-   * Detect storage strategy after successful auth
-   * Checks for isAuthenticated cookie to determine backend mode
+   * Detect storage strategy based on backend response
+   * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
    * @internal
    */
-  _detectStorageAfterAuth() {
-    if (this.hasAuthenticatedCookie()) {
+  _detectStorageFromResponse(sessionMode) {
+    if (sessionMode === "secure") {
       this._switchToSecureStorage();
     }
   }
@@ -553,8 +562,9 @@ var Auth = class {
       const userId = params.get("user_id");
       const email = params.get("email");
       const name = params.get("name");
+      const sessionMode = params.get("session_mode");
       if (accessToken && userId && email) {
-        this._detectStorageAfterAuth();
+        this._detectStorageFromResponse(sessionMode || void 0);
         const session = {
           accessToken,
           user: {
@@ -575,6 +585,7 @@ var Auth = class {
         url.searchParams.delete("user_id");
         url.searchParams.delete("email");
         url.searchParams.delete("name");
+        url.searchParams.delete("session_mode");
         if (params.has("error")) {
           url.searchParams.delete("error");
         }
@@ -590,6 +601,8 @@ var Auth = class {
   async signUp(request) {
     try {
       const response = await this.http.post("/api/auth/users", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken && response.user) {
         const session = {
           accessToken: response.accessToken,
@@ -599,7 +612,6 @@ var Auth = class {
           this.tokenManager.saveSession(session);
         }
         this.http.setAuthToken(response.accessToken);
-        this._detectStorageAfterAuth();
       }
       return {
         data: response,
@@ -625,6 +637,8 @@ var Auth = class {
   async signInWithPassword(request) {
     try {
       const response = await this.http.post("/api/auth/sessions", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       const session = {
         accessToken: response.accessToken || "",
         user: response.user || {
@@ -640,7 +654,6 @@ var Auth = class {
         this.tokenManager.saveSession(session);
       }
       this.http.setAuthToken(response.accessToken || "");
-      this._detectStorageAfterAuth();
       return {
         data: response,
         error: null
@@ -707,6 +720,7 @@ var Auth = class {
       }
       this.tokenManager.clearSession();
       this.http.setAuthToken(null);
+      this.clearAuthenticatedCookie();
       return { error: null };
     } catch (error) {
       return {
@@ -730,6 +744,7 @@ var Auth = class {
         "/api/auth/refresh"
       );
       if (response.accessToken) {
+        this._detectStorageFromResponse(response.sessionMode);
         this.tokenManager.setAccessToken(response.accessToken);
         this.http.setAuthToken(response.accessToken);
         if (response.user) {
@@ -747,6 +762,7 @@ var Auth = class {
         if (error.statusCode === 401 || error.statusCode === 403) {
           this.tokenManager.clearSession();
           this.http.setAuthToken(null);
+          this.clearAuthenticatedCookie();
         }
         throw error;
       }
@@ -1080,6 +1096,8 @@ var Auth = class {
         "/api/auth/email/verify",
         request
       );
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken) {
         const session = {
           accessToken: response.accessToken,