@insforge/sdk 1.0.1-refresh.4 → 1.0.1-refresh.6

package/dist/index.d.mts

@@ -146,8 +146,9 @@ interface SessionStorageStrategy {
  * Secure Session Storage Strategy
  *
  * Stores access token in memory only (cleared on page refresh).
- * Refresh token is stored in httpOnly cookie by the backend.
- * The `isAuthenticated` cookie is set by the backend to signal that a refresh token exists.
+ * Refresh token is stored in httpOnly cookie by the backend (on backend domain).
+ * The `isAuthenticated` cookie is set by the SDK on the frontend domain to signal
+ * that a secure session exists and token refresh should be attempted on page reload.
  *
  * Security benefits:
  * - Access token not accessible to XSS attacks (in memory only)
@@ -281,12 +282,17 @@ declare class Auth {
     private database;
     constructor(http: HttpClient, tokenManager: TokenManager);
     /**
-     * Check if the isAuthenticated cookie flag exists
+     * Set the isAuthenticated cookie flag on the frontend domain
+     * This is managed by SDK, not backend, to work in cross-origin scenarios
      */
-    private hasAuthenticatedCookie;
+    private setAuthenticatedCookie;
+    /**
+     * Clear the isAuthenticated cookie flag from the frontend domain
+     */
+    private clearAuthenticatedCookie;
     /**
      * Switch to SecureSessionStorage (cookie-based auth)
-     * Called when we detect backend supports secure cookie mode
+     * Called when backend returns sessionMode: 'secure'
      * @internal
      */
     _switchToSecureStorage(): void;
@@ -297,11 +303,11 @@ declare class Auth {
      */
     _switchToLocalStorage(): void;
     /**
-     * Detect storage strategy after successful auth
-     * Checks for isAuthenticated cookie to determine backend mode
+     * Detect storage strategy based on backend response
+     * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
      * @internal
      */
-    private _detectStorageAfterAuth;
+    private _detectStorageFromResponse;
     /**
    * Automatically detect and handle OAuth callback parameters in the URL
    * This runs on initialization to seamlessly complete the OAuth flow

package/dist/index.d.ts

@@ -146,8 +146,9 @@ interface SessionStorageStrategy {
  * Secure Session Storage Strategy
  *
  * Stores access token in memory only (cleared on page refresh).
- * Refresh token is stored in httpOnly cookie by the backend.
- * The `isAuthenticated` cookie is set by the backend to signal that a refresh token exists.
+ * Refresh token is stored in httpOnly cookie by the backend (on backend domain).
+ * The `isAuthenticated` cookie is set by the SDK on the frontend domain to signal
+ * that a secure session exists and token refresh should be attempted on page reload.
  *
  * Security benefits:
  * - Access token not accessible to XSS attacks (in memory only)
@@ -281,12 +282,17 @@ declare class Auth {
     private database;
     constructor(http: HttpClient, tokenManager: TokenManager);
     /**
-     * Check if the isAuthenticated cookie flag exists
+     * Set the isAuthenticated cookie flag on the frontend domain
+     * This is managed by SDK, not backend, to work in cross-origin scenarios
      */
-    private hasAuthenticatedCookie;
+    private setAuthenticatedCookie;
+    /**
+     * Clear the isAuthenticated cookie flag from the frontend domain
+     */
+    private clearAuthenticatedCookie;
     /**
      * Switch to SecureSessionStorage (cookie-based auth)
-     * Called when we detect backend supports secure cookie mode
+     * Called when backend returns sessionMode: 'secure'
      * @internal
      */
     _switchToSecureStorage(): void;
@@ -297,11 +303,11 @@ declare class Auth {
      */
     _switchToLocalStorage(): void;
     /**
-     * Detect storage strategy after successful auth
-     * Checks for isAuthenticated cookie to determine backend mode
+     * Detect storage strategy based on backend response
+     * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
      * @internal
      */
-    private _detectStorageAfterAuth;
+    private _detectStorageFromResponse;
     /**
    * Automatically detect and handle OAuth callback parameters in the URL
    * This runs on initialization to seamlessly complete the OAuth flow

package/dist/index.js

@@ -267,7 +267,7 @@ var SecureSessionStorage = class {
     if (this.accessToken) return false;
     return this.hasAuthFlag();
   }
-  // --- Private: Auth Flag Cookie Detection (read-only) ---
+  // --- Private: Auth Flag Cookie Detection (SDK-managed on frontend domain) ---
   hasAuthFlag() {
     if (typeof document === "undefined") return false;
     return document.cookie.split(";").some(
@@ -531,27 +531,41 @@ var Auth = class {
     this.detectAuthCallback();
   }
   /**
-   * Check if the isAuthenticated cookie flag exists
+   * Set the isAuthenticated cookie flag on the frontend domain
+   * This is managed by SDK, not backend, to work in cross-origin scenarios
    */
-  hasAuthenticatedCookie() {
-    if (typeof document === "undefined") return false;
-    return document.cookie.split(";").some(
-      (c) => c.trim().startsWith(`${AUTH_FLAG_COOKIE}=`)
-    );
+  setAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    const maxAge = 7 * 24 * 60 * 60;
+    document.cookie = `${AUTH_FLAG_COOKIE}=true; path=/; max-age=${maxAge}; SameSite=Lax`;
+  }
+  /**
+   * Clear the isAuthenticated cookie flag from the frontend domain
+   */
+  clearAuthenticatedCookie() {
+    if (typeof document === "undefined") return;
+    document.cookie = `${AUTH_FLAG_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
   }
   /**
    * Switch to SecureSessionStorage (cookie-based auth)
-   * Called when we detect backend supports secure cookie mode
+   * Called when backend returns sessionMode: 'secure'
    * @internal
    */
   _switchToSecureStorage() {
-    if (this.tokenManager.getStrategyId() === "secure") return;
+    console.log("[InsForge:Auth] _switchToSecureStorage() called, current strategy:", this.tokenManager.getStrategyId());
+    if (this.tokenManager.getStrategyId() === "secure") {
+      console.log("[InsForge:Auth] _switchToSecureStorage() - already in secure mode, skipping");
+      return;
+    }
     const currentSession = this.tokenManager.getSession();
     this.tokenManager.setStrategy(new SecureSessionStorage());
     if (typeof localStorage !== "undefined") {
+      console.log("[InsForge:Auth] _switchToSecureStorage() - clearing localStorage");
       localStorage.removeItem(TOKEN_KEY);
       localStorage.removeItem(USER_KEY);
     }
+    console.log("[InsForge:Auth] _switchToSecureStorage() - setting isAuthenticated cookie");
+    this.setAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
@@ -565,17 +579,19 @@ var Auth = class {
     if (this.tokenManager.getStrategyId() === "local") return;
     const currentSession = this.tokenManager.getSession();
     this.tokenManager.setStrategy(new LocalSessionStorage());
+    this.clearAuthenticatedCookie();
     if (currentSession) {
       this.tokenManager.saveSession(currentSession);
     }
   }
   /**
-   * Detect storage strategy after successful auth
-   * Checks for isAuthenticated cookie to determine backend mode
+   * Detect storage strategy based on backend response
+   * @param sessionMode - The sessionMode returned by backend ('secure' or undefined)
    * @internal
    */
-  _detectStorageAfterAuth() {
-    if (this.hasAuthenticatedCookie()) {
+  _detectStorageFromResponse(sessionMode) {
+    console.log("[InsForge:Auth] _detectStorageFromResponse() - sessionMode:", sessionMode);
+    if (sessionMode === "secure") {
       this._switchToSecureStorage();
     }
   }
@@ -592,8 +608,9 @@ var Auth = class {
       const userId = params.get("user_id");
       const email = params.get("email");
       const name = params.get("name");
+      const sessionMode = params.get("session_mode");
       if (accessToken && userId && email) {
-        this._detectStorageAfterAuth();
+        this._detectStorageFromResponse(sessionMode || void 0);
         const session = {
           accessToken,
           user: {
@@ -614,6 +631,7 @@ var Auth = class {
         url.searchParams.delete("user_id");
         url.searchParams.delete("email");
         url.searchParams.delete("name");
+        url.searchParams.delete("session_mode");
         if (params.has("error")) {
           url.searchParams.delete("error");
         }
@@ -629,6 +647,8 @@ var Auth = class {
   async signUp(request) {
     try {
       const response = await this.http.post("/api/auth/users", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken && response.user) {
         const session = {
           accessToken: response.accessToken,
@@ -638,7 +658,6 @@ var Auth = class {
           this.tokenManager.saveSession(session);
         }
         this.http.setAuthToken(response.accessToken);
-        this._detectStorageAfterAuth();
       }
       return {
         data: response,
@@ -664,6 +683,8 @@ var Auth = class {
   async signInWithPassword(request) {
     try {
       const response = await this.http.post("/api/auth/sessions", request);
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       const session = {
         accessToken: response.accessToken || "",
         user: response.user || {
@@ -679,7 +700,6 @@ var Auth = class {
         this.tokenManager.saveSession(session);
       }
       this.http.setAuthToken(response.accessToken || "");
-      this._detectStorageAfterAuth();
       return {
         data: response,
         error: null
@@ -737,17 +757,25 @@ var Auth = class {
    * In modern mode, also calls backend to clear the refresh token cookie
    */
   async signOut() {
+    console.log("[InsForge:Auth] signOut() called");
+    console.log("[InsForge:Auth] signOut() stack trace:", new Error().stack);
     try {
       if (this.tokenManager.getStrategyId() === "secure") {
+        console.log("[InsForge:Auth] signOut() - calling backend /api/auth/logout");
         try {
           await this.http.post("/api/auth/logout");
-        } catch {
+          console.log("[InsForge:Auth] signOut() - backend logout successful");
+        } catch (e) {
+          console.log("[InsForge:Auth] signOut() - backend logout failed (ignored):", e);
         }
       }
       this.tokenManager.clearSession();
       this.http.setAuthToken(null);
+      this.clearAuthenticatedCookie();
+      console.log("[InsForge:Auth] signOut() - completed");
       return { error: null };
     } catch (error) {
+      console.error("[InsForge:Auth] signOut() - error:", error);
       return {
         error: new InsForgeError(
           "Failed to sign out",
@@ -764,16 +792,20 @@ var Auth = class {
    * @returns New access token or throws an error
    */
   async refreshToken() {
+    console.log("[InsForge:Auth] refreshToken() called");
     try {
       const response = await this.http.post(
         "/api/auth/refresh"
       );
+      console.log("[InsForge:Auth] refreshToken() - response received, hasAccessToken:", !!response.accessToken);
       if (response.accessToken) {
+        this._detectStorageFromResponse(response.sessionMode);
         this.tokenManager.setAccessToken(response.accessToken);
         this.http.setAuthToken(response.accessToken);
         if (response.user) {
           this.tokenManager.setUser(response.user);
         }
+        console.log("[InsForge:Auth] refreshToken() - success");
         return response.accessToken;
       }
       throw new InsForgeError(
@@ -782,10 +814,13 @@ var Auth = class {
         "REFRESH_FAILED"
       );
     } catch (error) {
+      console.error("[InsForge:Auth] refreshToken() - error:", error);
       if (error instanceof InsForgeError) {
         if (error.statusCode === 401 || error.statusCode === 403) {
+          console.log("[InsForge:Auth] refreshToken() - clearing session due to 401/403");
           this.tokenManager.clearSession();
           this.http.setAuthToken(null);
+          this.clearAuthenticatedCookie();
         }
         throw error;
       }
@@ -841,12 +876,17 @@ var Auth = class {
    * to refresh the session if no access token is available (e.g., after page reload).
    */
   async getCurrentUser() {
+    console.log("[InsForge:Auth] getCurrentUser() called");
     try {
       let accessToken = this.tokenManager.getAccessToken();
-      if (!accessToken && this.tokenManager.shouldAttemptRefresh()) {
+      const shouldRefresh = this.tokenManager.shouldAttemptRefresh();
+      console.log("[InsForge:Auth] getCurrentUser() - hasAccessToken:", !!accessToken, "shouldAttemptRefresh:", shouldRefresh);
+      if (!accessToken && shouldRefresh) {
+        console.log("[InsForge:Auth] getCurrentUser() - attempting refresh");
         try {
           accessToken = await this.refreshToken();
         } catch (error) {
+          console.log("[InsForge:Auth] getCurrentUser() - refresh failed:", error);
           if (error instanceof InsForgeError && (error.statusCode === 401 || error.statusCode === 403)) {
             return { data: null, error };
           }
@@ -854,14 +894,17 @@ var Auth = class {
         }
       }
       if (!accessToken) {
+        console.log("[InsForge:Auth] getCurrentUser() - no access token, returning null");
         return { data: null, error: null };
       }
       this.http.setAuthToken(accessToken);
+      console.log("[InsForge:Auth] getCurrentUser() - fetching user from API");
       const authResponse = await this.http.get("/api/auth/sessions/current");
       const { data: profile, error: profileError } = await this.database.from("users").select("*").eq("id", authResponse.user.id).single();
       if (profileError && profileError.code !== "PGRST116") {
         return { data: null, error: profileError };
       }
+      console.log("[InsForge:Auth] getCurrentUser() - success");
       return {
         data: {
           user: authResponse.user,
@@ -870,8 +913,12 @@ var Auth = class {
         error: null
       };
     } catch (error) {
+      console.error("[InsForge:Auth] getCurrentUser() - catch error:", error);
       if (error instanceof InsForgeError && error.statusCode === 401) {
-        await this.signOut();
+        console.log("[InsForge:Auth] getCurrentUser() - 401 error, clearing local session only (NOT calling signOut)");
+        this.tokenManager.clearSession();
+        this.http.setAuthToken(null);
+        this.clearAuthenticatedCookie();
         return { data: null, error: null };
       }
       if (error instanceof InsForgeError) {
@@ -1119,6 +1166,8 @@ var Auth = class {
         "/api/auth/email/verify",
         request
       );
+      const sessionMode = response.sessionMode;
+      this._detectStorageFromResponse(sessionMode);
       if (response.accessToken) {
         const session = {
           accessToken: response.accessToken,
@@ -1677,9 +1726,14 @@ function hasAuthenticatedCookie() {
 }
 var InsForgeClient = class {
   constructor(config = {}) {
+    console.log("[InsForge:Client] Initializing SDK");
     this.http = new HttpClient(config);
     this.tokenManager = new TokenManager(config.storage);
-    if (hasAuthenticatedCookie()) {
+    const hasAuthCookie = hasAuthenticatedCookie();
+    console.log("[InsForge:Client] hasAuthenticatedCookie:", hasAuthCookie);
+    console.log("[InsForge:Client] document.cookie:", typeof document !== "undefined" ? document.cookie : "N/A (SSR)");
+    if (hasAuthCookie) {
+      console.log("[InsForge:Client] Switching to SecureSessionStorage");
       this.tokenManager.setStrategy(new SecureSessionStorage());
     }
     if (config.edgeFunctionToken) {
@@ -1691,25 +1745,31 @@ var InsForgeClient = class {
       });
     }
     this.http.setRefreshCallback(async () => {
+      console.log("[InsForge:Client] HTTP 401 refresh callback triggered");
       try {
         return await this.auth.refreshToken();
-      } catch {
+      } catch (e) {
+        console.log("[InsForge:Client] Refresh callback failed:", e);
         if (this.tokenManager.getStrategyId() === "secure") {
+          console.log("[InsForge:Client] Falling back to LocalSessionStorage");
           this.auth._switchToLocalStorage();
         }
         return null;
       }
     });
     const existingSession = this.tokenManager.getSession();
+    console.log("[InsForge:Client] existingSession:", !!existingSession, "strategyId:", this.tokenManager.getStrategyId());
     if (existingSession?.accessToken) {
       this.http.setAuthToken(existingSession.accessToken);
     } else if (this.tokenManager.getStrategyId() === "secure") {
+      console.log("[InsForge:Client] Secure mode, no session in memory - will refresh on first API call");
     }
     this.auth = new Auth(this.http, this.tokenManager);
     this.database = new Database(this.http, this.tokenManager);
     this.storage = new Storage(this.http);
     this.ai = new AI(this.http);
     this.functions = new Functions(this.http);
+    console.log("[InsForge:Client] SDK initialized");
   }
   /**
    * Get the underlying HTTP client for custom requests