@insforge/sdk 1.0.1-refresh.8 → 1.0.1-refresh.9

package/dist/index.mjs

@@ -140,6 +140,7 @@ var HttpClient = class {
 var TOKEN_KEY = "insforge-auth-token";
 var USER_KEY = "insforge-auth-user";
 var AUTH_FLAG_COOKIE = "isAuthenticated";
+var CSRF_TOKEN_COOKIE = "insforge_csrf_token";
 function hasAuthCookie() {
   if (typeof document === "undefined") return false;
   return document.cookie.split(";").some(
@@ -155,6 +156,21 @@ function clearAuthCookie() {
   if (typeof document === "undefined") return;
   document.cookie = `${AUTH_FLAG_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
 }
+function getCsrfToken() {
+  if (typeof document === "undefined") return null;
+  const match = document.cookie.split(";").find((c) => c.trim().startsWith(`${CSRF_TOKEN_COOKIE}=`));
+  if (!match) return null;
+  return match.split("=")[1] || null;
+}
+function setCsrfToken(token) {
+  if (typeof document === "undefined") return;
+  const maxAge = 7 * 24 * 60 * 60;
+  document.cookie = `${CSRF_TOKEN_COOKIE}=${token}; path=/; max-age=${maxAge}; SameSite=Lax`;
+}
+function clearCsrfToken() {
+  if (typeof document === "undefined") return;
+  document.cookie = `${CSRF_TOKEN_COOKIE}=; path=/; max-age=0; SameSite=Lax`;
+}
 var TokenManager = class {
   constructor(storage) {
     // In-memory storage
@@ -423,8 +439,12 @@ var Auth = class {
     }
     if (hasAuthCookie()) {
       try {
+        const csrfToken = getCsrfToken();
         const response = await this.http.post(
-          "/api/auth/refresh"
+          "/api/auth/refresh",
+          {
+            headers: csrfToken ? { "X-CSRF-Token": csrfToken } : {}
+          }
         );
         if (response.accessToken) {
           this.tokenManager.setMemoryMode();
@@ -433,6 +453,9 @@ var Auth = class {
           if (response.user) {
             this.tokenManager.setUser(response.user);
           }
+          if (response.csrfToken) {
+            setCsrfToken(response.csrfToken);
+          }
           return { isLoggedIn: true };
         }
       } catch (error) {
@@ -448,6 +471,7 @@ var Auth = class {
           }
           if (error.statusCode === 401 || error.statusCode === 403) {
             clearAuthCookie();
+            clearCsrfToken();
             return { isLoggedIn: false };
           }
         }
@@ -477,6 +501,7 @@ var Auth = class {
       const userId = params.get("user_id");
       const email = params.get("email");
       const name = params.get("name");
+      const csrfToken = params.get("csrf_token");
       if (accessToken && userId && email) {
         const session = {
           accessToken,
@@ -494,11 +519,15 @@ var Auth = class {
         this.http.setAuthToken(accessToken);
         this.tokenManager.saveSession(session);
         setAuthCookie();
+        if (csrfToken) {
+          setCsrfToken(csrfToken);
+        }
         const url = new URL(window.location.href);
         url.searchParams.delete("access_token");
         url.searchParams.delete("user_id");
         url.searchParams.delete("email");
         url.searchParams.delete("name");
+        url.searchParams.delete("csrf_token");
         if (params.has("error")) {
           url.searchParams.delete("error");
         }
@@ -522,6 +551,9 @@ var Auth = class {
         this.tokenManager.saveSession(session);
         setAuthCookie();
         this.http.setAuthToken(response.accessToken);
+        if (response.csrfToken) {
+          setCsrfToken(response.csrfToken);
+        }
       }
       return {
         data: response,
@@ -555,6 +587,9 @@ var Auth = class {
         this.tokenManager.saveSession(session);
         setAuthCookie();
         this.http.setAuthToken(response.accessToken);
+        if (response.csrfToken) {
+          setCsrfToken(response.csrfToken);
+        }
       }
       return {
         data: response,
@@ -620,6 +655,7 @@ var Auth = class {
       this.tokenManager.clearSession();
       this.http.setAuthToken(null);
       clearAuthCookie();
+      clearCsrfToken();
       return { error: null };
     } catch (error) {
       return {
@@ -949,6 +985,9 @@ var Auth = class {
         this.tokenManager.saveSession(session);
         this.http.setAuthToken(response.accessToken);
         setAuthCookie();
+        if (response.csrfToken) {
+          setCsrfToken(response.csrfToken);
+        }
       }
       return {
         data: response,