@kedaruma/revlm-client 1.0.45 → 1.0.48

package/dist/index.d.mts

@@ -181,7 +181,6 @@ type RevlmOptions = {
     provisionalAuthDomain?: string;
     autoSetToken?: boolean;
     autoRefreshOn401?: boolean;
-    strictRefreshCookie?: boolean;
 };
 type RevlmResponse<T = any> = {
     ok: boolean;
@@ -201,7 +200,7 @@ declare class Revlm {
     private provisionalAuthDomain;
     private autoSetToken;
     private autoRefreshOn401;
-    private strictRefreshCookie;
+    private cookieCheckPromise?;
     constructor(baseUrl: string, opts?: RevlmOptions);
     setToken(token: string): void;
     getToken(): string | undefined;
@@ -213,6 +212,9 @@ declare class Revlm {
     private parseResponse;
     private request;
     private shouldSkipAuthRetry;
+    private shouldSkipCookieCheck;
+    private decodeJwtPayload;
+    private logTokenTtl;
     private signIfNeeded;
     private requestWithRetry;
     login(authId: string, password: string): Promise<LoginResponse>;
@@ -224,6 +226,7 @@ declare class Revlm {
     }): Promise<RevlmResponse<any>>;
     revlmGate(payload: any): Promise<RevlmResponse<any>>;
     db(dbName: string): RevlmDBDatabase;
+    private ensureCookieSupport;
 }
 
 declare class MongoDBService {

package/dist/index.d.ts

@@ -181,7 +181,6 @@ type RevlmOptions = {
     provisionalAuthDomain?: string;
     autoSetToken?: boolean;
     autoRefreshOn401?: boolean;
-    strictRefreshCookie?: boolean;
 };
 type RevlmResponse<T = any> = {
     ok: boolean;
@@ -201,7 +200,7 @@ declare class Revlm {
     private provisionalAuthDomain;
     private autoSetToken;
     private autoRefreshOn401;
-    private strictRefreshCookie;
+    private cookieCheckPromise?;
     constructor(baseUrl: string, opts?: RevlmOptions);
     setToken(token: string): void;
     getToken(): string | undefined;
@@ -213,6 +212,9 @@ declare class Revlm {
     private parseResponse;
     private request;
     private shouldSkipAuthRetry;
+    private shouldSkipCookieCheck;
+    private decodeJwtPayload;
+    private logTokenTtl;
     private signIfNeeded;
     private requestWithRetry;
     login(authId: string, password: string): Promise<LoginResponse>;
@@ -224,6 +226,7 @@ declare class Revlm {
     }): Promise<RevlmResponse<any>>;
     revlmGate(payload: any): Promise<RevlmResponse<any>>;
     db(dbName: string): RevlmDBDatabase;
+    private ensureCookieSupport;
 }
 
 declare class MongoDBService {

package/dist/index.js

@@ -156,7 +156,7 @@ var Revlm = class {
   provisionalAuthDomain;
   autoSetToken;
   autoRefreshOn401;
-  strictRefreshCookie;
+  cookieCheckPromise;
   constructor(baseUrl, opts = {}) {
     if (!baseUrl) throw new Error("baseUrl is required");
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -167,7 +167,6 @@ var Revlm = class {
     this.provisionalAuthDomain = opts.provisionalAuthDomain || "";
     this.autoSetToken = opts.autoSetToken ?? true;
     this.autoRefreshOn401 = opts.autoRefreshOn401 || false;
-    this.strictRefreshCookie = opts.strictRefreshCookie || false;
     if (!this.fetchImpl) {
       throw new Error("No fetch implementation available. Provide fetchImpl in options or run in Node 18+ with global fetch.");
     }
@@ -237,11 +236,55 @@ var Revlm = class {
     const pathname = path.startsWith("http") ? new URL(path).pathname : path;
     return pathname.includes("/login") || pathname.includes("/provisional-login") || pathname.includes("/refresh-token") || pathname.includes("/verify-token");
   }
+  shouldSkipCookieCheck(path) {
+    const pathname = path.startsWith("http") ? new URL(path).pathname : path;
+    return pathname.includes("/cookie-check");
+  }
+  decodeJwtPayload(token) {
+    if (!token) return null;
+    const parts = token.split(".");
+    const payloadPart = parts[1];
+    if (!payloadPart) return null;
+    const raw = payloadPart.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = raw.length % 4 ? "=".repeat(4 - raw.length % 4) : "";
+    const base64 = raw + pad;
+    let jsonText = null;
+    if (typeof atob === "function") {
+      jsonText = atob(base64);
+    } else if (typeof Buffer !== "undefined") {
+      jsonText = Buffer.from(base64, "base64").toString("utf8");
+    }
+    if (!jsonText) return null;
+    try {
+      const payload = JSON.parse(jsonText);
+      return { exp: payload?.exp, iat: payload?.iat };
+    } catch {
+      return null;
+    }
+  }
+  logTokenTtl(event, path, tokenOverride) {
+    const token = tokenOverride || this._token;
+    if (!token) return;
+    const payload = this.decodeJwtPayload(token);
+    if (!payload || typeof payload.exp !== "number") return;
+    const now = Math.floor(Date.now() / 1e3);
+    const ttlSec = payload.exp - now;
+    console.log("### token ttl", {
+      event,
+      path,
+      ttlSec,
+      exp: payload.exp,
+      iat: payload.iat
+    });
+  }
   async signIfNeeded(_url, _method, headers, _body) {
     return { signedUrl: _url, signedHeaders: headers };
   }
   async requestWithRetry(path, method = "POST", body, opts = { allowAuthRetry: false, retrying: false }) {
     const { allowAuthRetry, retrying } = opts;
+    if (!this.shouldSkipCookieCheck(path)) {
+      await this.ensureCookieSupport();
+    }
     const url = path.startsWith("http") ? path : `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
     const hasBody = body !== void 0;
     const headers = this.makeHeaders(hasBody);
@@ -263,6 +306,7 @@ var Revlm = class {
         out.error = parsed?.reason || parsed?.message || "Unknown error";
       }
       if (allowAuthRetry && !retrying && res.status === 401 && !this.shouldSkipAuthRetry(path)) {
+        const beforePayload = this.decodeJwtPayload(this._token || "");
         const refreshRes = await this.refreshToken();
         if (!refreshRes.ok) {
           console.warn("### refresh failed:", {
@@ -270,16 +314,35 @@ var Revlm = class {
             status: refreshRes.status,
             error: refreshRes.error
           });
-        }
-        if (this.strictRefreshCookie && !refreshRes.ok && refreshRes.reason === "no_refresh_secret") {
-          throw new Error("Refresh cookie missing. Provide a cookie-aware fetch implementation for Node/RN.");
+          if (refreshRes.reason === "no_refresh_secret") {
+            const missingError = new Error("Refresh cookie missing. Provide a cookie-aware fetch implementation for Node/RN.");
+            missingError.revlmReason = "no_refresh_secret";
+            throw missingError;
+          }
         }
         if (refreshRes && refreshRes.ok && refreshRes.token) {
+          const afterPayload = this.decodeJwtPayload(refreshRes.token);
+          const now = Math.floor(Date.now() / 1e3);
+          const oldExp = beforePayload?.exp;
+          const newExp = afterPayload?.exp;
+          console.log("### refresh success", {
+            path,
+            oldExp,
+            newExp,
+            oldTtlSec: typeof oldExp === "number" ? oldExp - now : void 0,
+            newTtlSec: typeof newExp === "number" ? newExp - now : void 0
+          });
           return this.requestWithRetry(path, method, body, { allowAuthRetry: false, retrying: true });
         }
       }
+      if (out.ok && !this.shouldSkipCookieCheck(path)) {
+        this.logTokenTtl("request_ok", path);
+      }
       return out;
     } catch (err) {
+      if (err && err.revlmReason === "no_refresh_secret") {
+        throw err;
+      }
       return { ok: false, error: err?.message || String(err) };
     }
   }
@@ -295,6 +358,7 @@ var Revlm = class {
     if (!this.provisionalEnabled) {
       throw new Error("provisional login is disabled by client configuration");
     }
+    await this.ensureCookieSupport();
     if (!authId) throw new Error("authId is required");
     const provisionalClient = new import_revlm_shared.AuthClient({ secretMaster: this.provisionalAuthSecretMaster, authDomain: this.provisionalAuthDomain });
     const provisionalPassword = await provisionalClient.producePassword(String(Date.now() * 1e3));
@@ -321,6 +385,23 @@ var Revlm = class {
   db(dbName) {
     return new RevlmDBDatabase(dbName, this);
   }
+  async ensureCookieSupport() {
+    if (this.cookieCheckPromise) return this.cookieCheckPromise;
+    this.cookieCheckPromise = (async () => {
+      const first = await this.requestWithRetry("/cookie-check", "POST", void 0, { allowAuthRetry: false, retrying: false });
+      console.log("### cookie check", { step: "first", ok: first.ok, reason: first.reason, status: first.status });
+      if (first.ok) return;
+      if (first.reason !== "cookie_missing") {
+        throw new Error(`Cookie check failed: ${first.reason || first.error || "unknown_error"}`);
+      }
+      const second = await this.requestWithRetry("/cookie-check", "POST", void 0, { allowAuthRetry: false, retrying: false });
+      console.log("### cookie check", { step: "second", ok: second.ok, reason: second.reason, status: second.status });
+      if (!second.ok) {
+        throw new Error("Cookie support missing. Provide a cookie-aware fetch implementation for Node/RN.");
+      }
+    })();
+    return this.cookieCheckPromise;
+  }
 };
 var MongoDBService = class {
   _revlm;

package/dist/index.mjs

@@ -113,7 +113,7 @@ var Revlm = class {
   provisionalAuthDomain;
   autoSetToken;
   autoRefreshOn401;
-  strictRefreshCookie;
+  cookieCheckPromise;
   constructor(baseUrl, opts = {}) {
     if (!baseUrl) throw new Error("baseUrl is required");
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -124,7 +124,6 @@ var Revlm = class {
     this.provisionalAuthDomain = opts.provisionalAuthDomain || "";
     this.autoSetToken = opts.autoSetToken ?? true;
     this.autoRefreshOn401 = opts.autoRefreshOn401 || false;
-    this.strictRefreshCookie = opts.strictRefreshCookie || false;
     if (!this.fetchImpl) {
       throw new Error("No fetch implementation available. Provide fetchImpl in options or run in Node 18+ with global fetch.");
     }
@@ -194,11 +193,55 @@ var Revlm = class {
     const pathname = path.startsWith("http") ? new URL(path).pathname : path;
     return pathname.includes("/login") || pathname.includes("/provisional-login") || pathname.includes("/refresh-token") || pathname.includes("/verify-token");
   }
+  shouldSkipCookieCheck(path) {
+    const pathname = path.startsWith("http") ? new URL(path).pathname : path;
+    return pathname.includes("/cookie-check");
+  }
+  decodeJwtPayload(token) {
+    if (!token) return null;
+    const parts = token.split(".");
+    const payloadPart = parts[1];
+    if (!payloadPart) return null;
+    const raw = payloadPart.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = raw.length % 4 ? "=".repeat(4 - raw.length % 4) : "";
+    const base64 = raw + pad;
+    let jsonText = null;
+    if (typeof atob === "function") {
+      jsonText = atob(base64);
+    } else if (typeof Buffer !== "undefined") {
+      jsonText = Buffer.from(base64, "base64").toString("utf8");
+    }
+    if (!jsonText) return null;
+    try {
+      const payload = JSON.parse(jsonText);
+      return { exp: payload?.exp, iat: payload?.iat };
+    } catch {
+      return null;
+    }
+  }
+  logTokenTtl(event, path, tokenOverride) {
+    const token = tokenOverride || this._token;
+    if (!token) return;
+    const payload = this.decodeJwtPayload(token);
+    if (!payload || typeof payload.exp !== "number") return;
+    const now = Math.floor(Date.now() / 1e3);
+    const ttlSec = payload.exp - now;
+    console.log("### token ttl", {
+      event,
+      path,
+      ttlSec,
+      exp: payload.exp,
+      iat: payload.iat
+    });
+  }
   async signIfNeeded(_url, _method, headers, _body) {
     return { signedUrl: _url, signedHeaders: headers };
   }
   async requestWithRetry(path, method = "POST", body, opts = { allowAuthRetry: false, retrying: false }) {
     const { allowAuthRetry, retrying } = opts;
+    if (!this.shouldSkipCookieCheck(path)) {
+      await this.ensureCookieSupport();
+    }
     const url = path.startsWith("http") ? path : `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
     const hasBody = body !== void 0;
     const headers = this.makeHeaders(hasBody);
@@ -220,6 +263,7 @@ var Revlm = class {
         out.error = parsed?.reason || parsed?.message || "Unknown error";
       }
       if (allowAuthRetry && !retrying && res.status === 401 && !this.shouldSkipAuthRetry(path)) {
+        const beforePayload = this.decodeJwtPayload(this._token || "");
         const refreshRes = await this.refreshToken();
         if (!refreshRes.ok) {
           console.warn("### refresh failed:", {
@@ -227,16 +271,35 @@ var Revlm = class {
             status: refreshRes.status,
             error: refreshRes.error
           });
-        }
-        if (this.strictRefreshCookie && !refreshRes.ok && refreshRes.reason === "no_refresh_secret") {
-          throw new Error("Refresh cookie missing. Provide a cookie-aware fetch implementation for Node/RN.");
+          if (refreshRes.reason === "no_refresh_secret") {
+            const missingError = new Error("Refresh cookie missing. Provide a cookie-aware fetch implementation for Node/RN.");
+            missingError.revlmReason = "no_refresh_secret";
+            throw missingError;
+          }
         }
         if (refreshRes && refreshRes.ok && refreshRes.token) {
+          const afterPayload = this.decodeJwtPayload(refreshRes.token);
+          const now = Math.floor(Date.now() / 1e3);
+          const oldExp = beforePayload?.exp;
+          const newExp = afterPayload?.exp;
+          console.log("### refresh success", {
+            path,
+            oldExp,
+            newExp,
+            oldTtlSec: typeof oldExp === "number" ? oldExp - now : void 0,
+            newTtlSec: typeof newExp === "number" ? newExp - now : void 0
+          });
           return this.requestWithRetry(path, method, body, { allowAuthRetry: false, retrying: true });
         }
       }
+      if (out.ok && !this.shouldSkipCookieCheck(path)) {
+        this.logTokenTtl("request_ok", path);
+      }
       return out;
     } catch (err) {
+      if (err && err.revlmReason === "no_refresh_secret") {
+        throw err;
+      }
       return { ok: false, error: err?.message || String(err) };
     }
   }
@@ -252,6 +315,7 @@ var Revlm = class {
     if (!this.provisionalEnabled) {
       throw new Error("provisional login is disabled by client configuration");
     }
+    await this.ensureCookieSupport();
     if (!authId) throw new Error("authId is required");
     const provisionalClient = new AuthClient({ secretMaster: this.provisionalAuthSecretMaster, authDomain: this.provisionalAuthDomain });
     const provisionalPassword = await provisionalClient.producePassword(String(Date.now() * 1e3));
@@ -278,6 +342,23 @@ var Revlm = class {
   db(dbName) {
     return new RevlmDBDatabase(dbName, this);
   }
+  async ensureCookieSupport() {
+    if (this.cookieCheckPromise) return this.cookieCheckPromise;
+    this.cookieCheckPromise = (async () => {
+      const first = await this.requestWithRetry("/cookie-check", "POST", void 0, { allowAuthRetry: false, retrying: false });
+      console.log("### cookie check", { step: "first", ok: first.ok, reason: first.reason, status: first.status });
+      if (first.ok) return;
+      if (first.reason !== "cookie_missing") {
+        throw new Error(`Cookie check failed: ${first.reason || first.error || "unknown_error"}`);
+      }
+      const second = await this.requestWithRetry("/cookie-check", "POST", void 0, { allowAuthRetry: false, retrying: false });
+      console.log("### cookie check", { step: "second", ok: second.ok, reason: second.reason, status: second.status });
+      if (!second.ok) {
+        throw new Error("Cookie support missing. Provide a cookie-aware fetch implementation for Node/RN.");
+      }
+    })();
+    return this.cookieCheckPromise;
+  }
 };
 var MongoDBService = class {
   _revlm;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kedaruma/revlm-client",
-  "version": "1.0.45",
+  "version": "1.0.48",
   "private": false,
   "description": "TypeScript client SDK for talking to the Revlm server replacement for MongoDB Realm.",
   "keywords": [