@mitumba/sdk 1.18.0 → 1.19.0

package/dist/index.mjs

@@ -108,15 +108,25 @@ var APIClient = class {
     this.config = config;
     this.tokenStore = config.tokenStore ?? createTokenStore();
     if (config.token) {
-      this.tokenStore.setTokens(config.token, config.refreshToken ?? "");
+      this.tokenStore.setTokens(config.token, config.refreshToken || "");
     }
   }
   async setToken(token, refreshToken) {
     this.config.token = token;
-    if (refreshToken) {
+    if (refreshToken && refreshToken.length > 0) {
       this.config.refreshToken = refreshToken;
     }
-    await this.tokenStore.setTokens(token, refreshToken ?? this.config.refreshToken ?? "");
+    const effectiveRefresh = refreshToken && refreshToken.length > 0 ? refreshToken : this.config.refreshToken && this.config.refreshToken.length > 0 ? this.config.refreshToken : "";
+    await this.tokenStore.setTokens(token, effectiveRefresh);
+  }
+  /**
+   * Set both tokens explicitly. Requires a valid refresh token.
+   * Preferred over setToken() to avoid dropping the refresh token.
+   */
+  async setSession(tokens) {
+    this.config.token = tokens.access_token;
+    this.config.refreshToken = tokens.refresh_token;
+    await this.tokenStore.setTokens(tokens.access_token, tokens.refresh_token);
   }
   getToken() {
     return this.config.token;
@@ -154,7 +164,7 @@ var APIClient = class {
       const refresh = await this.tokenStore.getRefreshToken();
       if (refresh) this.config.refreshToken = refresh;
     }
-    if (this.config.token && isExpiringSoon(this.config.token, 60) && this.config.refreshToken) {
+    if (this.config.token && isExpiringSoon(this.config.token, 60) && this.config.refreshToken && this.config.refreshToken.length > 0) {
       await this.handleTokenRefresh();
     }
   }
@@ -220,12 +230,20 @@ var APIClient = class {
       }
       break;
     }
-    if (response.status === 401 && this.config.refreshToken && !path.includes("/auth/refresh")) {
-      try {
-        await this.handleTokenRefresh();
-        headers.set("Authorization", `Bearer ${this.config.token}`);
-        response = await fetch(url.toString(), { ...init, headers });
-      } catch {
+    if (response.status === 401 && !path.includes("/auth/refresh") && !path.includes("/auth/login") && !path.includes("/auth/register")) {
+      const hasRefreshToken = this.config.refreshToken && this.config.refreshToken.length > 0;
+      if (hasRefreshToken) {
+        try {
+          await this.handleTokenRefresh();
+          headers.set("Authorization", `Bearer ${this.config.token}`);
+          response = await fetch(url.toString(), { ...init, headers });
+        } catch {
+          if (this.config.onAuthExpired) {
+            this.config.onAuthExpired();
+          }
+          throw new APIError(401, { error: "session_expired", message: "Session expired. Please log in again." });
+        }
+      } else {
         if (this.config.onAuthExpired) {
           this.config.onAuthExpired();
         }
@@ -297,6 +315,9 @@ var APIClient = class {
 };
 
 // src/modules/auth.ts
+function isAuthTokens(result) {
+  return typeof result === "object" && result !== null && "access_token" in result && "refresh_token" in result;
+}
 var AuthModule = class {
   constructor(client) {
     this.client = client;
@@ -304,19 +325,27 @@ var AuthModule = class {
   client;
   /**
    * Register a new account.
-   * If using EmailRegisterInput, returns AuthTokens.
+   * If using EmailRegisterInput, returns AuthTokens (auto-persisted).
    * If using PhoneRegisterInput, returns MessageResponse (OTP sent).
    */
   async register(input, options) {
-    return this.client.post("/auth/register", input, options);
+    const result = await this.client.post("/auth/register", input, options);
+    if (isAuthTokens(result)) {
+      await this.client.setSession(result);
+    }
+    return result;
   }
   /**
    * Log in to an existing account.
-   * If using EmailLoginInput, returns AuthTokens (or TwoFactorRequired if 2FA enabled).
+   * If using EmailLoginInput, returns AuthTokens (auto-persisted) or TwoFactorRequired.
    * If using PhoneLoginInput, returns MessageResponse (OTP sent).
    */
   async login(input, options) {
-    return this.client.post("/auth/login", input, options);
+    const result = await this.client.post("/auth/login", input, options);
+    if (isAuthTokens(result)) {
+      await this.client.setSession(result);
+    }
+    return result;
   }
   /**
    * Send an OTP code to a phone number.
@@ -325,26 +354,31 @@ var AuthModule = class {
     return this.client.post("/auth/otp/send", input, options);
   }
   /**
-   * Verify an OTP code.
+   * Verify an OTP code. Tokens are auto-persisted.
    */
   async verifyOtp(input, options) {
-    return this.client.post("/auth/otp/verify", input, options);
+    const result = await this.client.post("/auth/otp/verify", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
    * Refresh the access token using a refresh token.
    */
   async refresh(input, options) {
-    return this.client.post("/auth/refresh", input, options);
+    const result = await this.client.post("/auth/refresh", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
-   * Revoke the refresh token and log out.
+   * Revoke the refresh token and log out. Clears stored session.
    */
   async logout(input, options) {
-    return this.client.post("/auth/logout", input, options);
+    const result = await this.client.post("/auth/logout", input, options);
+    await this.client.clearToken();
+    return result;
   }
   /**
    * Request a password reset email.
-   * Sends a reset link to the provided email address.
    */
   async forgotPassword(input, options) {
     return this.client.post("/auth/forgot-password", input, options);
@@ -368,28 +402,27 @@ var AuthModule = class {
     return this.client.post("/auth/onboarding/complete", input, options);
   }
   /**
-   * Verify 2FA code during login (when login returns requires_2fa).
+   * Verify 2FA code during login. Tokens are auto-persisted.
    */
   async verify2FA(input, options) {
-    return this.client.post("/auth/2fa/login", input, options);
+    const result = await this.client.post("/auth/2fa/login", input, options);
+    await this.client.setSession(result);
+    return result;
   }
   /**
    * Send a verification code to the user's email.
-   * If unauthenticated, pass the email address.
    */
   async sendVerificationCode(email, options) {
     return this.client.post("/auth/verify-email/send", email ? { email } : void 0, options);
   }
   /**
    * Verify the email with the 6-digit code.
-   * If unauthenticated, pass the email address.
    */
   async verifyEmail(code, email, options) {
     return this.client.post("/auth/verify-email/confirm", email ? { code, email } : { code }, options);
   }
   /**
    * Upgrade the current user to a seller role.
-   * Idempotent — returns success if already a seller.
    */
   async becomeSeller(input, options) {
     return this.client.post("/auth/become-seller", input, options);
@@ -1362,6 +1395,12 @@ var MitumbaClient = class {
   setToken(token, refreshToken) {
     this.api.setToken(token, refreshToken);
   }
+  /**
+   * Set both tokens explicitly. Preferred — prevents dropping the refresh token.
+   */
+  setSession(tokens) {
+    return this.api.setSession(tokens);
+  }
   /**
    * Get the current access token.
    */