@microcosmmoney/auth-core 1.1.1 → 1.2.1

package/dist/client.d.ts

@@ -16,6 +16,7 @@ export declare class MicrocosmAuthClient {
     getAccessToken(): Promise<string | null>;
     getApiClient(): ApiClient;
     onAuthStateChange(callback: (user: User | null) => void): () => void;
+    private handleTokenExpired;
     private fetchUserProfile;
     private mapProfileToUser;
     private resolveRedirectUri;

package/dist/client.js

@@ -23,6 +23,7 @@ class MicrocosmAuthClient {
         this.apiClient = new api_client_1.ApiClient(this.tokenManager);
         if (this.config.autoRefresh && this.tokenManager.hasValidToken()) {
             this.tokenManager.scheduleRefresh();
+            this.tokenManager.startMonitor(() => this.handleTokenExpired());
         }
         this.log('Initialized', { clientId: this.config.clientId });
     }
@@ -62,7 +63,8 @@ class MicrocosmAuthClient {
             throw new Error('Missing authorization code');
         }
         const savedState = this.storage.get(storage_1.STORAGE_KEYS.OAUTH_STATE);
-        if (state && savedState && state !== savedState) {
+        if (!state || !savedState || state !== savedState) {
+            this.storage.remove(storage_1.STORAGE_KEYS.OAUTH_STATE);
             throw new Error('Invalid state parameter (possible CSRF)');
         }
         this.storage.remove(storage_1.STORAGE_KEYS.OAUTH_STATE);
@@ -77,12 +79,17 @@ class MicrocosmAuthClient {
             throw new Error(errorData.error_description || errorData.error || 'Token exchange failed');
         }
         const tokenData = await tokenResponse.json();
+        const MAX_EXPIRY = 86400;
+        const expiresIn = Math.min(Math.max(Number(tokenData.expires_in) || 3600, 60), MAX_EXPIRY);
         const tokens = {
             accessToken: tokenData.access_token,
             refreshToken: tokenData.refresh_token,
-            expiresAt: Date.now() + (tokenData.expires_in || 3600) * 1000,
+            expiresAt: Date.now() + expiresIn * 1000,
         };
         this.tokenManager.setTokens(tokens);
+        if (this.config.autoRefresh) {
+            this.tokenManager.startMonitor(() => this.handleTokenExpired());
+        }
         const user = await this.fetchUserProfile(tokens.accessToken);
         this.storage.set(storage_1.STORAGE_KEYS.USER, JSON.stringify(user));
         this.notifyListeners(user);
@@ -90,6 +97,7 @@ class MicrocosmAuthClient {
         return user;
     }
     async logout() {
+        this.tokenManager.stopMonitor();
         this.tokenManager.clear();
         this.storage.remove(storage_1.STORAGE_KEYS.USER);
         this.notifyListeners(null);
@@ -123,6 +131,12 @@ class MicrocosmAuthClient {
         this.listeners.add(callback);
         return () => this.listeners.delete(callback);
     }
+    handleTokenExpired() {
+        this.tokenManager.stopMonitor();
+        this.storage.remove(storage_1.STORAGE_KEYS.USER);
+        this.notifyListeners(null);
+        this.log('Token expired, session cleared');
+    }
     async fetchUserProfile(accessToken) {
         const response = await fetch(this.config.profileUri, {
             headers: { Authorization: `Bearer ${accessToken}` },

package/dist/token-manager.d.ts

@@ -5,14 +5,19 @@ export declare class TokenManager {
     private storage;
     private refreshTimer;
     private refreshPromise;
+    private monitorInterval;
+    private onTokenExpired;
     constructor(config: ResolvedConfig, storage: Storage);
     setTokens(data: TokenData): void;
     getAccessToken(): Promise<string | null>;
     getRawAccessToken(): string | null;
     hasValidToken(): boolean;
     isExpired(): boolean;
+    startMonitor(onExpired: () => void): void;
+    stopMonitor(): void;
     clear(): void;
     scheduleRefresh(): void;
+    private handleVisibilityChange;
     private refreshToken;
     private doRefresh;
 }

package/dist/token-manager.js

@@ -2,10 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenManager = void 0;
 const storage_1 = require("./storage");
+const TOKEN_CHECK_INTERVAL_MS = 30000;
 class TokenManager {
     constructor(config, storage) {
         this.refreshTimer = null;
         this.refreshPromise = null;
+        this.monitorInterval = null;
+        this.onTokenExpired = null;
+        this.handleVisibilityChange = async () => {
+            if (document.visibilityState !== 'visible')
+                return;
+            if (!this.storage.get(storage_1.STORAGE_KEYS.REFRESH_TOKEN))
+                return;
+            if (!this.isExpired())
+                return;
+            const newToken = await this.getAccessToken();
+            if (!newToken) {
+                this.onTokenExpired?.();
+            }
+        };
         this.config = config;
         this.storage = storage;
     }
@@ -38,6 +53,34 @@ class TokenManager {
         const expiresAt = parseInt(this.storage.get(storage_1.STORAGE_KEYS.EXPIRES_AT) || '0', 10);
         return Date.now() >= expiresAt;
     }
+    startMonitor(onExpired) {
+        this.onTokenExpired = onExpired;
+        if (this.monitorInterval)
+            return;
+        this.monitorInterval = setInterval(async () => {
+            if (!this.storage.get(storage_1.STORAGE_KEYS.REFRESH_TOKEN))
+                return;
+            if (!this.isExpired())
+                return;
+            const newToken = await this.getAccessToken();
+            if (!newToken) {
+                this.onTokenExpired?.();
+            }
+        }, TOKEN_CHECK_INTERVAL_MS);
+        if (typeof document !== 'undefined') {
+            document.addEventListener('visibilitychange', this.handleVisibilityChange);
+        }
+    }
+    stopMonitor() {
+        if (this.monitorInterval) {
+            clearInterval(this.monitorInterval);
+            this.monitorInterval = null;
+        }
+        if (typeof document !== 'undefined') {
+            document.removeEventListener('visibilitychange', this.handleVisibilityChange);
+        }
+        this.onTokenExpired = null;
+    }
     clear() {
         if (this.refreshTimer) {
             clearTimeout(this.refreshTimer);
@@ -85,22 +128,27 @@ class TokenManager {
             });
             if (!response.ok) {
                 this.clear();
+                this.onTokenExpired?.();
                 return null;
             }
             const contentType = response.headers.get('content-type');
             if (!contentType?.includes('application/json')) {
                 this.clear();
+                this.onTokenExpired?.();
                 return null;
             }
             const data = await response.json();
             if (!data.access_token) {
                 this.clear();
+                this.onTokenExpired?.();
                 return null;
             }
+            const MAX_EXPIRY = 86400;
+            const expiresIn = Math.min(Math.max(Number(data.expires_in) || 3600, 60), MAX_EXPIRY);
             this.setTokens({
                 accessToken: data.access_token,
                 refreshToken: data.refresh_token || refreshToken,
-                expiresAt: Date.now() + (data.expires_in || 3600) * 1000,
+                expiresAt: Date.now() + expiresIn * 1000,
             });
             return data.access_token;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microcosmmoney/auth-core",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Microcosm OAuth 2.0 authentication core library",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",