@myrjfa/state 2.2.0 → 2.3.2

package/dist/lib/userAtom.d.ts

@@ -1,26 +1,31 @@
+import { type AuthSessionStatus } from './authSessionPolicy';
 export declare const storageInitializedAtom: import("jotai").PrimitiveAtom<boolean> & {
     init: boolean;
 };
 export declare const userAtom: import("jotai").WritableAtom<{
-    isActive: boolean;
-    country: string;
-    rating: number;
-    ratingCount: number;
-    reviewCount: number;
     username: string;
+    email: string;
     firstName: string;
     lastName: string;
-    email: string;
-    password: string;
     phoneNumber: string;
+    password: string;
     countryCode: string;
+    country: string;
     gender: "male" | "female" | "other";
+    rating: number;
+    ratingCount: number;
+    reviewCount: number;
     joinedDate: Date;
+    isActive: boolean;
     lastActive: Date;
     verifiedEmail: boolean;
     verifiedMobile: boolean;
-    role: "host" | "admin" | "user" | "hr" | "sales";
-    id?: string | undefined;
+    role: string;
+    baseAccountType?: "user" | "host" | undefined;
+    legacyRole?: string | undefined;
+    staffProfileId?: string | null | undefined;
+    accountType?: "user" | "host" | "staff" | undefined;
+    _id?: string | undefined;
     location?: string | undefined;
     pinCode?: string | undefined;
     dob?: Date | undefined;
@@ -32,6 +37,9 @@ export declare const userAtom: import("jotai").WritableAtom<{
     accessToken?: string | undefined;
     refreshToken?: string | undefined;
     verifiedIdCard?: boolean | undefined;
+    permissions?: string[] | undefined;
+    baseUserId?: string | null | undefined;
+    baseHostId?: string | null | undefined;
     socialLinks?: Partial<Record<"instagram" | "linkedin" | "youtube" | "googleBusiness", string>> | undefined;
     userResume?: string | undefined;
     skills?: {
@@ -41,6 +49,7 @@ export declare const userAtom: import("jotai").WritableAtom<{
     wishlist?: string[] | undefined;
     favBlogs?: string[] | undefined;
     favPackages?: string[] | undefined;
+    id?: string | undefined;
     selfie?: string | undefined;
     selfieAction?: string | undefined;
     jobCount?: number | undefined;
@@ -49,12 +58,12 @@ export declare const userAtom: import("jotai").WritableAtom<{
     panCard?: string | undefined;
     verifiedBusiness?: "true" | "false" | "inProgress" | undefined;
     properties?: {
+        country: string;
         type: string;
         name: string;
+        address: string;
         city: string;
         state: string;
-        country: string;
-        address: string;
         pinCode?: string | undefined;
         registrationNumber?: string | undefined;
     }[] | undefined;
@@ -64,25 +73,29 @@ export declare const userAtom: import("jotai").WritableAtom<{
     businessApiVerificationStatus?: "pending" | "verified" | "failed" | undefined;
     businessVerificationDenialReason?: string | undefined;
 } | null, [{
-    isActive: boolean;
-    country: string;
-    rating: number;
-    ratingCount: number;
-    reviewCount: number;
     username: string;
+    email: string;
     firstName: string;
     lastName: string;
-    email: string;
-    password: string;
     phoneNumber: string;
+    password: string;
     countryCode: string;
+    country: string;
     gender: "male" | "female" | "other";
+    rating: number;
+    ratingCount: number;
+    reviewCount: number;
     joinedDate: Date;
+    isActive: boolean;
     lastActive: Date;
     verifiedEmail: boolean;
     verifiedMobile: boolean;
-    role: "host" | "admin" | "user" | "hr" | "sales";
-    id?: string | undefined;
+    role: string;
+    baseAccountType?: "user" | "host" | undefined;
+    legacyRole?: string | undefined;
+    staffProfileId?: string | null | undefined;
+    accountType?: "user" | "host" | "staff" | undefined;
+    _id?: string | undefined;
     location?: string | undefined;
     pinCode?: string | undefined;
     dob?: Date | undefined;
@@ -94,6 +107,9 @@ export declare const userAtom: import("jotai").WritableAtom<{
     accessToken?: string | undefined;
     refreshToken?: string | undefined;
     verifiedIdCard?: boolean | undefined;
+    permissions?: string[] | undefined;
+    baseUserId?: string | null | undefined;
+    baseHostId?: string | null | undefined;
     socialLinks?: Partial<Record<"instagram" | "linkedin" | "youtube" | "googleBusiness", string>> | undefined;
     userResume?: string | undefined;
     skills?: {
@@ -103,6 +119,7 @@ export declare const userAtom: import("jotai").WritableAtom<{
     wishlist?: string[] | undefined;
     favBlogs?: string[] | undefined;
     favPackages?: string[] | undefined;
+    id?: string | undefined;
     selfie?: string | undefined;
     selfieAction?: string | undefined;
     jobCount?: number | undefined;
@@ -111,12 +128,12 @@ export declare const userAtom: import("jotai").WritableAtom<{
     panCard?: string | undefined;
     verifiedBusiness?: "true" | "false" | "inProgress" | undefined;
     properties?: {
+        country: string;
         type: string;
         name: string;
+        address: string;
         city: string;
         state: string;
-        country: string;
-        address: string;
         pinCode?: string | undefined;
         registrationNumber?: string | undefined;
     }[] | undefined;
@@ -126,25 +143,29 @@ export declare const userAtom: import("jotai").WritableAtom<{
     businessApiVerificationStatus?: "pending" | "verified" | "failed" | undefined;
     businessVerificationDenialReason?: string | undefined;
 } | typeof import("jotai/utils").RESET | ((prev: {
-    isActive: boolean;
-    country: string;
-    rating: number;
-    ratingCount: number;
-    reviewCount: number;
     username: string;
+    email: string;
     firstName: string;
     lastName: string;
-    email: string;
-    password: string;
     phoneNumber: string;
+    password: string;
     countryCode: string;
+    country: string;
     gender: "male" | "female" | "other";
+    rating: number;
+    ratingCount: number;
+    reviewCount: number;
     joinedDate: Date;
+    isActive: boolean;
     lastActive: Date;
     verifiedEmail: boolean;
     verifiedMobile: boolean;
-    role: "host" | "admin" | "user" | "hr" | "sales";
-    id?: string | undefined;
+    role: string;
+    baseAccountType?: "user" | "host" | undefined;
+    legacyRole?: string | undefined;
+    staffProfileId?: string | null | undefined;
+    accountType?: "user" | "host" | "staff" | undefined;
+    _id?: string | undefined;
     location?: string | undefined;
     pinCode?: string | undefined;
     dob?: Date | undefined;
@@ -156,6 +177,9 @@ export declare const userAtom: import("jotai").WritableAtom<{
     accessToken?: string | undefined;
     refreshToken?: string | undefined;
     verifiedIdCard?: boolean | undefined;
+    permissions?: string[] | undefined;
+    baseUserId?: string | null | undefined;
+    baseHostId?: string | null | undefined;
     socialLinks?: Partial<Record<"instagram" | "linkedin" | "youtube" | "googleBusiness", string>> | undefined;
     userResume?: string | undefined;
     skills?: {
@@ -165,6 +189,7 @@ export declare const userAtom: import("jotai").WritableAtom<{
     wishlist?: string[] | undefined;
     favBlogs?: string[] | undefined;
     favPackages?: string[] | undefined;
+    id?: string | undefined;
     selfie?: string | undefined;
     selfieAction?: string | undefined;
     jobCount?: number | undefined;
@@ -173,12 +198,12 @@ export declare const userAtom: import("jotai").WritableAtom<{
     panCard?: string | undefined;
     verifiedBusiness?: "true" | "false" | "inProgress" | undefined;
     properties?: {
+        country: string;
         type: string;
         name: string;
+        address: string;
         city: string;
         state: string;
-        country: string;
-        address: string;
         pinCode?: string | undefined;
         registrationNumber?: string | undefined;
     }[] | undefined;
@@ -188,25 +213,118 @@ export declare const userAtom: import("jotai").WritableAtom<{
     businessApiVerificationStatus?: "pending" | "verified" | "failed" | undefined;
     businessVerificationDenialReason?: string | undefined;
 } | null) => {
-    isActive: boolean;
+    username: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+    phoneNumber: string;
+    password: string;
+    countryCode: string;
     country: string;
+    gender: "male" | "female" | "other";
     rating: number;
     ratingCount: number;
     reviewCount: number;
+    joinedDate: Date;
+    isActive: boolean;
+    lastActive: Date;
+    verifiedEmail: boolean;
+    verifiedMobile: boolean;
+    role: string;
+    baseAccountType?: "user" | "host" | undefined;
+    legacyRole?: string | undefined;
+    staffProfileId?: string | null | undefined;
+    accountType?: "user" | "host" | "staff" | undefined;
+    _id?: string | undefined;
+    location?: string | undefined;
+    pinCode?: string | undefined;
+    dob?: Date | undefined;
+    profilePic?: string | undefined;
+    blogsCount?: number | undefined;
+    userBio?: string | undefined;
+    userIdCard?: string | undefined;
+    watchHistory?: string[] | undefined;
+    accessToken?: string | undefined;
+    refreshToken?: string | undefined;
+    verifiedIdCard?: boolean | undefined;
+    permissions?: string[] | undefined;
+    baseUserId?: string | null | undefined;
+    baseHostId?: string | null | undefined;
+    socialLinks?: Partial<Record<"instagram" | "linkedin" | "youtube" | "googleBusiness", string>> | undefined;
+    userResume?: string | undefined;
+    skills?: {
+        skill: string;
+        skillExpertise: number;
+    }[] | undefined;
+    wishlist?: string[] | undefined;
+    favBlogs?: string[] | undefined;
+    favPackages?: string[] | undefined;
+    id?: string | undefined;
+    selfie?: string | undefined;
+    selfieAction?: string | undefined;
+    jobCount?: number | undefined;
+    travelPackageCount?: number | undefined;
+    gstNumber?: string | undefined;
+    panCard?: string | undefined;
+    verifiedBusiness?: "true" | "false" | "inProgress" | undefined;
+    properties?: {
+        country: string;
+        type: string;
+        name: string;
+        address: string;
+        city: string;
+        state: string;
+        pinCode?: string | undefined;
+        registrationNumber?: string | undefined;
+    }[] | undefined;
+    businessDocument?: string | undefined;
+    businessIdType?: "PAN" | "GST" | "Udyam" | "PersonalPAN" | undefined;
+    businessIdNumber?: string | undefined;
+    businessApiVerificationStatus?: "pending" | "verified" | "failed" | undefined;
+    businessVerificationDenialReason?: string | undefined;
+} | typeof import("jotai/utils").RESET | null) | null], void>;
+export declare const isLoggedInAtom: import("jotai").WritableAtom<boolean, [boolean | typeof import("jotai/utils").RESET | ((prev: boolean) => boolean | typeof import("jotai/utils").RESET)], void>;
+/**
+ * Changes whenever a login/logout boundary occurs.
+ *
+ * Background session requests capture this value. Responses belonging to an
+ * older revision must not clear a newer authenticated state.
+ */
+export declare const authRevisionAtom: import("jotai").PrimitiveAtom<number> & {
+    init: number;
+};
+export type { AuthSessionStatus } from './authSessionPolicy';
+/** Backend reconciliation state for the currently persisted identity. */
+export declare const authSessionStatusAtom: import("jotai").PrimitiveAtom<AuthSessionStatus> & {
+    init: AuthSessionStatus;
+};
+/**
+ * Atomically commits a successful login to the active Jotai store.
+ */
+export declare const commitLoginAtom: import("jotai").WritableAtom<null, [authenticatedUser: {
     username: string;
+    email: string;
     firstName: string;
     lastName: string;
-    email: string;
-    password: string;
     phoneNumber: string;
+    password: string;
     countryCode: string;
+    country: string;
     gender: "male" | "female" | "other";
+    rating: number;
+    ratingCount: number;
+    reviewCount: number;
     joinedDate: Date;
+    isActive: boolean;
     lastActive: Date;
     verifiedEmail: boolean;
     verifiedMobile: boolean;
-    role: "host" | "admin" | "user" | "hr" | "sales";
-    id?: string | undefined;
+    role: string;
+    baseAccountType?: "user" | "host" | undefined;
+    legacyRole?: string | undefined;
+    staffProfileId?: string | null | undefined;
+    accountType?: "user" | "host" | "staff" | undefined;
+    _id?: string | undefined;
     location?: string | undefined;
     pinCode?: string | undefined;
     dob?: Date | undefined;
@@ -218,6 +336,9 @@ export declare const userAtom: import("jotai").WritableAtom<{
     accessToken?: string | undefined;
     refreshToken?: string | undefined;
     verifiedIdCard?: boolean | undefined;
+    permissions?: string[] | undefined;
+    baseUserId?: string | null | undefined;
+    baseHostId?: string | null | undefined;
     socialLinks?: Partial<Record<"instagram" | "linkedin" | "youtube" | "googleBusiness", string>> | undefined;
     userResume?: string | undefined;
     skills?: {
@@ -227,6 +348,7 @@ export declare const userAtom: import("jotai").WritableAtom<{
     wishlist?: string[] | undefined;
     favBlogs?: string[] | undefined;
     favPackages?: string[] | undefined;
+    id?: string | undefined;
     selfie?: string | undefined;
     selfieAction?: string | undefined;
     jobCount?: number | undefined;
@@ -235,12 +357,12 @@ export declare const userAtom: import("jotai").WritableAtom<{
     panCard?: string | undefined;
     verifiedBusiness?: "true" | "false" | "inProgress" | undefined;
     properties?: {
+        country: string;
         type: string;
         name: string;
+        address: string;
         city: string;
         state: string;
-        country: string;
-        address: string;
         pinCode?: string | undefined;
         registrationNumber?: string | undefined;
     }[] | undefined;
@@ -249,9 +371,23 @@ export declare const userAtom: import("jotai").WritableAtom<{
     businessIdNumber?: string | undefined;
     businessApiVerificationStatus?: "pending" | "verified" | "failed" | undefined;
     businessVerificationDenialReason?: string | undefined;
-} | typeof import("jotai/utils").RESET | null) | null], void>;
-export declare const isLoggedInAtom: import("jotai").WritableAtom<boolean, [boolean | typeof import("jotai/utils").RESET | ((prev: boolean) => boolean | typeof import("jotai/utils").RESET)], void>;
+}], void> & {
+    init: null;
+};
 export declare const userLoadingAtom: import("jotai").Atom<boolean>;
+export declare const resetAuthStateAtom: import("jotai").WritableAtom<null, [], void> & {
+    init: null;
+};
+/**
+ * Clears provisional browser identity while keeping public auth controls
+ * disabled until the backend cookie/device cleanup request has settled.
+ */
+export declare const beginAuthCleanupAtom: import("jotai").WritableAtom<null, [], void> & {
+    init: null;
+};
+export declare const finishAuthCleanupAtom: import("jotai").WritableAtom<null, [expectedRevision: number], void> & {
+    init: null;
+};
 export declare const initializeAuthSessionAtom: import("jotai").WritableAtom<null, [], Promise<void>> & {
     init: null;
 };

package/dist/lib/userAtom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userAtom.d.ts","sourceRoot":"","sources":["../../src/lib/userAtom.ts"],"names":[],"mappings":"AA6EA,eAAO,MAAM,sBAAsB;;CAAuB,CAAC;AAW3D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAQpB,CAAC;AAEF,eAAO,MAAM,cAAc,iKAA6C,CAAC;AAGzE,eAAO,MAAM,eAAe,+BAM1B,CAAC;AAGH,eAAO,MAAM,yBAAyB;;CA+CrC,CAAC;AAGF,wBAAgB,cAAc,SAS7B"}
+{"version":3,"file":"userAtom.d.ts","sourceRoot":"","sources":["../../src/lib/userAtom.ts"],"names":[],"mappings":"AAMA,OAAO,EAIH,KAAK,iBAAiB,EACzB,MAAM,qBAAqB,CAAC;AA0D7B,eAAO,MAAM,sBAAsB;;CAAuB,CAAC;AAG3D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAQpB,CAAC;AAEF,eAAO,MAAM,cAAc,iKAA6C,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;CAAU,CAAC;AAExC,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;CAA0C,CAAC;AAE7E;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAS3B,CAAC;AAGF,eAAO,MAAM,eAAe,+BAS1B,CAAC;AAGH,eAAO,MAAM,kBAAkB;;CAY7B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;CAU/B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;CAMjC,CAAC;AAGF,eAAO,MAAM,yBAAyB;;CAiCrC,CAAC;AAEF,wBAAgB,cAAc,SAY7B"}

package/dist/lib/userAtom.js

@@ -2,23 +2,14 @@
 import CryptoJS from 'crypto-js';
 import { atom, getDefaultStore } from 'jotai';
 import { atomWithStorage } from 'jotai/utils';
-import { getCurrentUser } from './actions/actions';
+import { clearSessionCookies } from './actions/auth';
+import { canFinishAuthCleanup, clearCacheMissSessionBoundary, isAuthSessionPending, } from './authSessionPolicy';
 const STORAGE_KEY = process.env.NEXT_PUBLIC_USER_KEY;
 const LOGIN_KEY = process.env.NEXT_PUBLIC_LOGIN_KEY;
 const SECRET_KEY = process.env.NEXT_PUBLIC_RACE;
 const EXPIRY_DAYS = 90;
 const EXPIRY_MS = EXPIRY_DAYS * 24 * 60 * 60 * 1000;
-const AUTH_BOOTSTRAP_TIMEOUT_MS = 3000;
 const store = getDefaultStore();
-function withTimeout(promise, timeoutMs) {
-    let timeoutId;
-    const timeout = new Promise((_, reject) => {
-        timeoutId = setTimeout(() => {
-            reject(new Error('Auth session initialization timed out'));
-        }, timeoutMs);
-    });
-    return Promise.race([promise, timeout]).finally(() => clearTimeout(timeoutId));
-}
 // 🔐 Encryption
 const encrypt = (data) => CryptoJS.AES.encrypt(JSON.stringify(data), SECRET_KEY).toString();
 const decrypt = (cipher) => {
@@ -45,14 +36,14 @@ const getWithExpiry = (key) => {
             return null;
         const { value, expiry } = data;
         if (Date.now() > expiry) {
-            resetAuthState();
+            localStorage.removeItem(key);
             return null;
         }
         return value;
     }
     catch (e) {
         console.warn('Invalid user data:', e);
-        resetAuthState();
+        localStorage.removeItem(key);
         return null;
     }
 };
@@ -67,12 +58,6 @@ const setWithExpiry = (key, value) => {
 };
 // Storage initialization atom - tracks if we've tried to load from storage
 export const storageInitializedAtom = atom(false);
-storageInitializedAtom.onMount = (setAtom) => {
-    const timeout = setTimeout(() => {
-        setAtom(true);
-    }, AUTH_BOOTSTRAP_TIMEOUT_MS);
-    return () => clearTimeout(timeout);
-};
 // 🍱 Base storage atom (persisted)
 export const userAtom = atomWithStorage(STORAGE_KEY, null, {
     getItem: (key) => getWithExpiry(key),
@@ -80,57 +65,97 @@ export const userAtom = atomWithStorage(STORAGE_KEY, null, {
     removeItem: (key) => localStorage.removeItem(key),
 });
 export const isLoggedInAtom = atomWithStorage(LOGIN_KEY, false);
+/**
+ * Changes whenever a login/logout boundary occurs.
+ *
+ * Background session requests capture this value. Responses belonging to an
+ * older revision must not clear a newer authenticated state.
+ */
+export const authRevisionAtom = atom(0);
+/** Backend reconciliation state for the currently persisted identity. */
+export const authSessionStatusAtom = atom("initializing");
+/**
+ * Atomically commits a successful login to the active Jotai store.
+ */
+export const commitLoginAtom = atom(null, (_get, set, authenticatedUser) => {
+    set(userAtom, authenticatedUser);
+    set(isLoggedInAtom, true);
+    set(storageInitializedAtom, true);
+    set(authSessionStatusAtom, "authenticated");
+    set(authRevisionAtom, (revision) => revision + 1);
+});
 // 🕒 Tracks if user is loading
 export const userLoadingAtom = atom((get) => {
-    // The issue was here - we need to properly track initialization state
     const initialized = get(storageInitializedAtom);
-    // We're loading if we haven't initialized storage yet
-    return !initialized;
+    const sessionStatus = get(authSessionStatusAtom);
+    // Reconciliation is an authentication boundary, not background cosmetic
+    // work. Keep login/register controls unavailable until validation or
+    // cookie cleanup settles so a late Set-Cookie response cannot erase a
+    // newly-created session.
+    return !initialized || isAuthSessionPending(sessionStatus);
+});
+export const resetAuthStateAtom = atom(null, (_get, set) => {
+    if (typeof window === "undefined")
+        return;
+    localStorage.removeItem(STORAGE_KEY);
+    localStorage.removeItem(LOGIN_KEY);
+    // Update the active Jotai store used by the calling React component.
+    set(userAtom, null);
+    set(isLoggedInAtom, false);
+    set(storageInitializedAtom, true);
+    set(authSessionStatusAtom, "signed-out");
+    set(authRevisionAtom, (revision) => revision + 1);
+});
+/**
+ * Clears provisional browser identity while keeping public auth controls
+ * disabled until the backend cookie/device cleanup request has settled.
+ */
+export const beginAuthCleanupAtom = atom(null, (_get, set) => {
+    if (typeof window === "undefined")
+        return;
+    localStorage.removeItem(STORAGE_KEY);
+    localStorage.removeItem(LOGIN_KEY);
+    set(userAtom, null);
+    set(isLoggedInAtom, false);
+    set(storageInitializedAtom, true);
+    set(authSessionStatusAtom, "clearing");
+    set(authRevisionAtom, (revision) => revision + 1);
+});
+export const finishAuthCleanupAtom = atom(null, (get, set, expectedRevision) => {
+    if (!canFinishAuthCleanup(expectedRevision, get(authRevisionAtom)))
+        return;
+    set(authSessionStatusAtom, "signed-out");
 });
 // Initialize storage atom effect
 export const initializeAuthSessionAtom = atom(null, async (get, set) => {
     // Only run in browser
     if (typeof window === 'undefined')
         return;
-    // 1. Validate session (role-aware — host route differs from user route)
-    // const session = await validateSession();
-    // if (session.success) {
-    // Session validated successfully
-    // } else {
-    //     resetAuthState();
-    //     set(storageInitializedAtom, true);
-    //     return;
-    // }
-    // NOTE: if validateSession fails we do NOT reset — we just fall through
-    // to cache/API. A failed ping could mean the backend is temporarily down,
-    // the user is a host (different endpoint), etc. We only clear state if we
-    // POSITIVELY know the user is logged out (getCurrentUser fails).
-    // 2. Try cache (localStorage)
+    // Try the local identity cache first. It remains provisional until the
+    // backend confirms that the cookies belong to the same actor.
     const userData = getWithExpiry(STORAGE_KEY);
     if (userData) {
-        set(userAtom, userData);
-        set(isLoggedInAtom, true);
-        set(storageInitializedAtom, true);
+        set(commitLoginAtom, userData);
+        set(authSessionStatusAtom, "validating");
         return;
     }
-    // 3. If cache miss: fetch user from backend using session cookie
+    // Missing persisted identity is always a cleanup boundary. The endpoint
+    // is idempotent for a fresh guest and revokes stale cookie-only sessions.
+    set(beginAuthCleanupAtom);
+    const cleanupRevision = get(authRevisionAtom);
     try {
-        // This endpoint can hit DB or another cache as needed
-        const remoteUser = await withTimeout(getCurrentUser(), AUTH_BOOTSTRAP_TIMEOUT_MS);
-        if (remoteUser) {
-            set(userAtom, remoteUser);
-            set(isLoggedInAtom, true);
-            setWithExpiry(STORAGE_KEY, remoteUser); // Write to local cache for next time
-        }
-        else {
-            resetAuthState();
-        }
+        await clearCacheMissSessionBoundary({
+            cleanupRevision,
+            getCurrentRevision: () => get(authRevisionAtom),
+            clearSession: clearSessionCookies,
+        });
     }
     catch {
-        resetAuthState();
+        // clearSessionCookies is bounded. Local signed-out state is still
+        // published only after the cleanup attempt has settled.
     }
     finally {
-        set(storageInitializedAtom, true);
+        set(finishAuthCleanupAtom, cleanupRevision);
     }
 });
 export function resetAuthState() {
@@ -142,4 +167,7 @@ export function resetAuthState() {
     localStorage.removeItem(LOGIN_KEY);
     store.set(userAtom, null);
     store.set(isLoggedInAtom, false);
+    store.set(storageInitializedAtom, true);
+    store.set(authSessionStatusAtom, "signed-out");
+    store.set(authRevisionAtom, (revision) => revision + 1);
 }

package/dist/lib/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAQ,MAAM,MAAM,CAAC;AAG7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,eAAO,MAAM,UAAU,UAA2C,CAAC;AAEnE,wBAAgB,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,UAEzC;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,GAAG,SAAS,WAGjD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG9D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWvD;AAGD,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,WACO,CAAC;AAEhE,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,WAKrC,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,MAAM,WACE,CAAC;AAE3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAcjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAM5D;AAED,eAAO,MAAM,eAAe,GAAI,MAAM,IAAI,WAczC,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAM,UAItE;AAGD,wBAAgB,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,IAAI,GACL,EAAE;IACD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;;;;;;;;;;;;;;;;;;;;;;;EA8BA;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,eAAO,MAAM,eAAe,UAA0D,CAAC;AAEvF,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,EAAE,CAanD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAQ,MAAM,MAAM,CAAC;AAG7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,eAAO,MAAM,UAAU,UAA4E,CAAC;AAEpG,wBAAgB,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,UAEzC;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,GAAG,SAAS,WAGjD,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG9D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWvD;AAGD,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,WACO,CAAC;AAEhE,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,WAKrC,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,MAAM,MAAM,WACE,CAAC;AAE3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAcjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAM5D;AAED,eAAO,MAAM,eAAe,GAAI,MAAM,IAAI,WAczC,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAM,UAItE;AAGD,wBAAgB,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,IAAI,GACL,EAAE;IACD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;;;;;;;;;;;;;;;;;;;;;;;EA8BA;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,eAAO,MAAM,eAAe,UAA0D,CAAC;AAEvF,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,EAAE,CAanD"}

package/dist/lib/utils.js

@@ -5,7 +5,7 @@ import he from "he";
 import { twMerge } from "tailwind-merge";
 export const MAX_IMAGE_SIZE_MB = 5;
 export const MAX_PDF_SIZE_MB = 10;
-export const validRoles = ["host", "user", "admin", "hr", "sales"];
+export const validRoles = ["host", "user", "admin", "hr", "sales", "developer", "customer_support"];
 export function cn(...inputs) {
     return twMerge(clsx(inputs));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myrjfa/state",
-  "version": "2.2.0",
+  "version": "2.3.2",
   "type": "module",
   "exports": {
     "./dist/*": "./dist/*.js"
@@ -55,6 +55,8 @@
   "license": "MIT",
   "scripts": {
     "build": "tsc",
-    "dev": "tsc --watch"
+    "dev": "tsc --watch",
+    "test:authorization": "node --test tests/authorization.test.mjs",
+    "test:auth-session": "node --experimental-strip-types --test tests/authSessionPolicy.test.mjs"
   }
 }