@marsaude/devtools-shell 0.1.2 → 0.1.4

package/fesm2022/marsaude-devtools-shell.mjs

@@ -641,7 +641,7 @@ const DEVTOOLS_CONFIG = new InjectionToken('DEVTOOLS_CONFIG');
 /**
  * Plain localStorage wrapper owned by the package. DevTools-internal keys are
  * prefixed `DEVTOOLS_`; the *active app session* keys (`JWT_TOKEN`,
- * `JWT_REFRESH_TOKEN`, `APP_USER`) are written deliberately so the host patient
+ * `JWT_REFRESH_TOKEN`, `EGRET_USER`) are written deliberately so the host patient
  * app consumes them — that is the only intentional touch-point with the host.
  */
 class DevtoolsStorage {
@@ -1352,32 +1352,30 @@ const RECAPTCHA_SCRIPT_ID = 'dc-recaptcha-v2-invisible';
  * the `grecaptcha` API. The host only passes `recaptchaSiteKey`; the package
  * injects the script itself so nothing depends on the host having it loaded.
  */
+const RECAPTCHA_ONLOAD_CB = '__dcRecaptchaOnload';
 function ensureRecaptchaScript() {
     const w = window;
     if (w.grecaptcha?.render)
         return Promise.resolve(w.grecaptcha);
     return new Promise((resolve, reject) => {
-        const onReady = () => {
-            if (w.grecaptcha?.render)
-                resolve(w.grecaptcha);
-            else
-                reject(new Error('grecaptcha unavailable after script load'));
-        };
+        // The script tag's own `load` event fires before grecaptcha.render is ready.
+        // The library's own `onload=` callback (passed in the URL) only fires once
+        // the API is fully initialized — that's the reliable readiness signal.
+        w[RECAPTCHA_ONLOAD_CB] = () => resolve(w.grecaptcha);
         const existing = document.getElementById(RECAPTCHA_SCRIPT_ID);
         if (existing) {
             if (w.grecaptcha?.render)
                 return resolve(w.grecaptcha);
-            existing.addEventListener('load', onReady, { once: true });
             existing.addEventListener('error', () => reject(new Error('reCAPTCHA script failed to load')), { once: true });
-            return;
+            return; // the pending onload callback above will resolve us
         }
         const script = document.createElement('script');
         script.id = RECAPTCHA_SCRIPT_ID;
-        // `render=explicit` so we control the (invisible) widget creation ourselves.
-        script.src = 'https://www.google.com/recaptcha/api.js?render=explicit';
+        // `onload=` => library calls us when ready; `render=explicit` => we create
+        // the (invisible) widget ourselves.
+        script.src = `https://www.google.com/recaptcha/api.js?onload=${RECAPTCHA_ONLOAD_CB}&render=explicit`;
         script.async = true;
         script.defer = true;
-        script.onload = onReady;
         script.onerror = () => reject(new Error('reCAPTCHA script failed to load'));
         document.head.appendChild(script);
     });
@@ -1564,10 +1562,11 @@ const devtoolsHttpInterceptor = (req, next) => {
 const SESSIONS_KEY = 'DEVTOOLS_SESSIONS';
 const ACTIVE_KEY = 'DEVTOOLS_ACTIVE';
 // The active app session — read by the HOST patient app. This is the ONE
-// intentional touch-point with the host.
+// intentional touch-point with the host, so these keys MUST match the host's
+// JwtAuthService exactly and must never change.
 const JWT_TOKEN = 'JWT_TOKEN';
 const JWT_REFRESH_TOKEN = 'JWT_REFRESH_TOKEN';
-const APP_USER = 'APP_USER';
+const APP_USER = 'EGRET_USER';
 /**
  * Manages the *active app session* that the host patient app consumes, letting
  * the QA switch it between the fixed admin (the DevTools identity) and any saved
@@ -1603,7 +1602,11 @@ class DevtoolsSessionService {
         this.storage.set(SESSIONS_KEY, next);
         return full;
     }
-    /** Write a stored session into the host's active-session keys. */
+    /**
+     * Write a stored session into the host's active-session keys and reload so the
+     * host app re-reads it (it only reads these keys at bootstrap). Covers both a
+     * fresh login and switching between users.
+     */
     switchTo(id) {
         const session = id === 'admin' ? this.admin() : this._sessions().find((s) => s.id === id) ?? null;
         if (!session)
@@ -1613,6 +1616,12 @@ class DevtoolsSessionService {
         this.storage.set(APP_USER, session.profile ?? null);
         this.activeId.set(id);
         this.storage.set(ACTIVE_KEY, id);
+        try {
+            window.location.reload();
+        }
+        catch {
+            /* non-browser env — ignore */
+        }
         return session;
     }
     removeSession(id) {