@makefully/adaptfully 5.0.4 → 5.0.6

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## 5.0.6 — 2026-10-07
+
+### Changed
+
+- **`google-auth`** persists the GIS access token in **`localStorage`** by default (was `sessionStorage`), so web sign-in survives browser restarts until explicit logout or Google silent reauth fails. Opt back into tab-only tokens with `config.googleTokenStorage: 'sessionStorage'`. Existing `sessionStorage` tokens are migrated once on read.
+
+## 5.0.5 — 2026-10-06
+
+### Changed
+
+- **`social-auth`** Google login on Capacitor now passes `filterByAuthorizedAccounts: false` (Capgo/Family Link guidance) so Credential Manager does not stick to a stale authorized-account filter that surfaces `[16] Account reauth failed`.
+
 ## 5.0.4 — 2026-10-06
 
 ### Changed

package/README.md

@@ -236,7 +236,8 @@ Optional config keys:
 | Key | Default | Purpose |
 |-----|---------|---------|
 | `googleClientId` | *(required)* | Browser GIS OAuth client id |
-| `googleTokenKey` | `adaptfully_google_token` | `sessionStorage` key for the access token |
+| `googleTokenKey` | `adaptfully_google_token` | Storage key for the GIS access token |
+| `googleTokenStorage` | `localStorage` | `localStorage` (survives browser restart) or `sessionStorage` (tab-only) |
 | `googleScopes` | `openid email profile` | OAuth scopes |
 | `autoLoginStorageKey` | `lastLoggedIn` | Storage key written with the user id on login |
 

package/lib/runtime/auth/google-auth.js

@@ -1,4 +1,4 @@
-/* global google, sessionStorage, window */
+/* global google, localStorage, sessionStorage, window */
 
 (function registerGoogleAuth(ns) {
     const { configValue, getStorage } = ns.auth.helpers;
@@ -6,6 +6,7 @@
     const DEFAULT_SCOPES = 'openid email profile';
     const DEFAULT_TOKEN_KEY = 'adaptfully_google_token';
     const DEFAULT_AUTO_LOGIN_KEY = 'lastLoggedIn';
+    const DEFAULT_TOKEN_STORAGE = 'localStorage';
 
     class GoogleAuthPlugin {
         constructor() {
@@ -32,6 +33,27 @@
             return configValue('googleTokenKey', DEFAULT_TOKEN_KEY);
         }
 
+        /**
+         * Where the GIS access token is persisted.
+         * Default `localStorage` so sign-in survives browser restarts until logout
+         * (or Google silent reauth fails). Use `sessionStorage` for tab-only tokens.
+         */
+        #tokenStorageName() {
+            const raw = configValue('googleTokenStorage', DEFAULT_TOKEN_STORAGE);
+            return raw === 'sessionStorage' ? 'sessionStorage' : 'localStorage';
+        }
+
+        #tokenStore() {
+            try {
+                if (this.#tokenStorageName() === 'sessionStorage') {
+                    return typeof sessionStorage !== 'undefined' ? sessionStorage : null;
+                }
+                return typeof localStorage !== 'undefined' ? localStorage : null;
+            } catch {
+                return null;
+            }
+        }
+
         /**
          * Browser GIS OAuth client id only (`config.googleClientId`).
          * Capacitor / Capgo builds use `platforms.<name>.socialLogin.google.webClientId` instead.
@@ -95,16 +117,91 @@
             this.authenticated = !!(this.user.id && this.user.email);
         }
 
+        #readStoredToken() {
+            const key = this.#tokenKey(),
+                primary = this.#tokenStore();
+            let token = '';
+
+            try {
+                token = (primary && primary.getItem(key)) || '';
+            } catch {
+                token = '';
+            }
+
+            // One-time migrate: older builds kept the token in sessionStorage.
+            if (!token && this.#tokenStorageName() === 'localStorage') {
+                try {
+                    token = (typeof sessionStorage !== 'undefined' && sessionStorage.getItem(key)) || '';
+                    if (token && primary) {
+                        primary.setItem(key, token);
+                        sessionStorage.removeItem(key);
+                    }
+                } catch {
+                    /* ignore quota / private-mode */
+                }
+            }
+
+            return token;
+        }
+
+        #writeStoredToken(token) {
+            const key = this.#tokenKey(),
+                primary = this.#tokenStore();
+
+            try {
+                if (primary) {
+                    primary.setItem(key, token);
+                }
+            } catch {
+                /* ignore */
+            }
+
+            // Drop the legacy session copy so tab-close cannot leave a stale twin.
+            if (this.#tokenStorageName() === 'localStorage') {
+                try {
+                    if (typeof sessionStorage !== 'undefined') {
+                        sessionStorage.removeItem(key);
+                    }
+                } catch {
+                    /* ignore */
+                }
+            }
+        }
+
+        #clearStoredToken() {
+            const key = this.#tokenKey();
+
+            try {
+                this.#tokenStore()?.removeItem(key);
+            } catch {
+                /* ignore */
+            }
+            try {
+                if (typeof sessionStorage !== 'undefined') {
+                    sessionStorage.removeItem(key);
+                }
+            } catch {
+                /* ignore */
+            }
+            try {
+                if (typeof localStorage !== 'undefined') {
+                    localStorage.removeItem(key);
+                }
+            } catch {
+                /* ignore */
+            }
+        }
+
         #clearSession() {
             this.accessToken = '';
             this.user = null;
             this.authenticated = false;
-            sessionStorage.removeItem(this.#tokenKey());
+            this.#clearStoredToken();
         }
 
         #loadStoredToken() {
             if (!this.accessToken) {
-                this.accessToken = sessionStorage.getItem(this.#tokenKey()) || '';
+                this.accessToken = this.#readStoredToken();
             }
         }
 
@@ -126,7 +223,7 @@
                 })
                 .then((data) => {
                     this.accessToken = token;
-                    sessionStorage.setItem(this.#tokenKey(), token);
+                    this.#writeStoredToken(token);
                     this.#applyUserInfo(data);
                     callback();
                 })

package/lib/runtime/auth/social-auth.js

@@ -303,15 +303,21 @@
                 return;
             }
 
-            const options = {
-                scopes: provider === 'google'
-                    ? ['email', 'profile']
-                    : ['email', 'name'],
-            };
+            // Android Capgo defaults / Family Link: never filter to "authorized"
+            // accounts only — that path commonly surfaces [16] Account reauth failed.
+            const options = provider === 'google'
+                ? {
+                    scopes: ['email', 'profile'],
+                    filterByAuthorizedAccounts: false,
+                }
+                : {
+                    scopes: ['email', 'name'],
+                };
 
             console.info('[adaptfully social-auth] login starting', authContext({
                 provider,
                 scopes: options.scopes,
+                filterByAuthorizedAccounts: options.filterByAuthorizedAccounts ?? null,
                 alreadyAuthenticated: this.authenticated,
             }));
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "5.0.4",
+    "version": "5.0.6",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",