@myrjfa/state 3.0.9 → 3.0.11

package/dist/lib/userAtom.js

@@ -2,8 +2,7 @@
 import CryptoJS from 'crypto-js';
 import { atom, getDefaultStore } from 'jotai';
 import { atomWithStorage } from 'jotai/utils';
-import { clearSessionCookies } from './actions/auth';
-import { canFinishAuthCleanup, clearCacheMissSessionBoundary, isAuthSessionPending, } from './authSessionPolicy';
+import { canFinishAuthCleanup, isAuthSessionPending, } from './authSessionPolicy';
 const STORAGE_KEY = process.env.NEXT_PUBLIC_USER_KEY;
 const LOGIN_KEY = process.env.NEXT_PUBLIC_LOGIN_KEY;
 const SECRET_KEY = process.env.NEXT_PUBLIC_RACE;
@@ -35,11 +34,16 @@ const getWithExpiry = (key) => {
         if (!data)
             return null;
         const { value, expiry } = data;
+        if (!value || !value._id || typeof value.firstName !== 'string' || !Number.isFinite(expiry))
+            return null;
         if (Date.now() > expiry) {
             localStorage.removeItem(key);
             return null;
         }
-        return value;
+        const safe = { ...value };
+        for (const field of ['devices', 'password', 'accessToken', 'refreshToken', 'emailOtp', 'resetPasswordToken'])
+            delete safe[field];
+        return safe;
     }
     catch (e) {
         console.warn('Invalid user data:', e);
@@ -131,32 +135,19 @@ export const initializeAuthSessionAtom = atom(null, async (get, set) => {
     // Only run in browser
     if (typeof window === 'undefined')
         return;
-    // Try the local identity cache first. It remains provisional until the
-    // backend confirms that the cookies belong to the same actor.
     const userData = getWithExpiry(STORAGE_KEY);
     if (userData) {
-        set(commitLoginAtom, userData);
-        set(authSessionStatusAtom, "validating");
-        return;
-    }
-    // Missing persisted identity is always a cleanup boundary. The endpoint
-    // is idempotent for a fresh guest and revokes stale cookie-only sessions.
-    set(beginAuthCleanupAtom);
-    const cleanupRevision = get(authRevisionAtom);
-    try {
-        await clearCacheMissSessionBoundary({
-            cleanupRevision,
-            getCurrentRevision: () => get(authRevisionAtom),
-            clearSession: clearSessionCookies,
-        });
-    }
-    catch {
-        // clearSessionCookies is bounded. Local signed-out state is still
-        // published only after the cleanup attempt has settled.
+        const safe = { ...userData };
+        delete safe.devices;
+        set(userAtom, safe);
+        set(isLoggedInAtom, true);
     }
-    finally {
-        set(finishAuthCleanupAtom, cleanupRevision);
+    else {
+        set(userAtom, null);
+        set(isLoggedInAtom, false);
     }
+    set(storageInitializedAtom, true);
+    set(authSessionStatusAtom, "validating");
 });
 export function resetAuthState() {
     if (typeof window === 'undefined') {

package/dist/lib/utils/authCookies.d.ts

@@ -0,0 +1,3 @@
+/** Must match backend AUTH_COOKIE_PREFIX; cookie domain alone cannot isolate UAT. */
+export declare function authCookieName(name: string): string;
+//# sourceMappingURL=authCookies.d.ts.map

package/dist/lib/utils/authCookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCookies.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/authCookies.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/lib/utils/authCookies.js

@@ -0,0 +1,4 @@
+/** Must match backend AUTH_COOKIE_PREFIX; cookie domain alone cannot isolate UAT. */
+export function authCookieName(name) {
+    return `${process.env.NEXT_PUBLIC_AUTH_COOKIE_PREFIX || ''}${name}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myrjfa/state",
-  "version": "3.0.9",
+  "version": "3.0.11",
   "type": "module",
   "exports": {
     "./dist/*": "./dist/*.js"
@@ -14,7 +14,6 @@
   ],
   "dependencies": {
     "@tanstack/react-query": "^5.89.0",
-    "@types/socket.io-client": "^3.0.0",
     "cheerio": "^1.0.0",
     "clsx": "^2.1.1",
     "crypto-js": "^4.2.0",