@opexa/portal-sdk 0.59.75 → 0.59.77

package/dist/index.cjs

@@ -4500,7 +4500,7 @@ var AuthService = class {
   }
   async createSession(input, version = 1) {
     const headers = new Headers(this.headers);
-    if (version === 3) {
+    if (version === 3 || version === 4) {
       const fingerprint = await getFingerPrint();
       if (fingerprint) {
         headers.append("Fingerprint", fingerprint);
@@ -4538,14 +4538,12 @@ var AuthService = class {
       headers.set("test-pass", input.testPass);
     }
     try {
-      const res = await fetch(
-        `${this.url}${version === 3 ? "/v3/sessions" : "/sessions"}`,
-        {
-          method: "POST",
-          headers,
-          body: JSON.stringify(input)
-        }
-      );
+      const res = await fetch(`${this.url}${version !== 1 ? `/v${version}/sessions` : "/sessions"}`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(input),
+        ...version === 4 && { credentials: "include" }
+      });
       const data = await res.json();
       if (res.ok) {
         return {
@@ -4626,14 +4624,26 @@ var AuthService = class {
     }
     throw new Error("Invalid input 'type'");
   }
-  async refreshSession(refreshToken) {
+  async refreshSession(refreshToken, version = 1) {
     const headers = new Headers(this.headers);
-    headers.append("Authorization", `Bearer ${refreshToken}`);
+    if (version !== 4) {
+      headers.append("Authorization", `Bearer ${refreshToken}`);
+    }
+    if (version === 3 || version === 4) {
+      const fingerprint = await getFingerPrint();
+      if (fingerprint) {
+        headers.append("Fingerprint", fingerprint);
+      }
+    }
     try {
-      const res = await fetch(`${this.url}/session:refresh`, {
-        method: "POST",
-        headers
-      });
+      const res = await fetch(
+        `${this.url}${version !== 1 ? `/v${version}/session/refresh` : "/session:refresh"}`,
+        {
+          method: "POST",
+          headers,
+          ...version === 4 && { credentials: "include" }
+        }
+      );
       const data = await res.json();
       if (res.ok) {
         return {
@@ -4670,14 +4680,20 @@ var AuthService = class {
       };
     }
   }
-  async destroySession(accessToken) {
+  async destroySession(accessToken, version = 1) {
     const headers = new Headers(this.headers);
-    headers.append("Authorization", `Bearer ${accessToken}`);
+    if (version !== 4) {
+      headers.append("Authorization", `Bearer ${accessToken}`);
+    }
     try {
-      const res = await fetch(`${this.url}/session`, {
-        method: "DELETE",
-        headers
-      });
+      const res = await fetch(
+        `${this.url}${version !== 1 ? `/v${version}/session` : "/session"}`,
+        {
+          method: "DELETE",
+          headers,
+          ...version === 4 && { credentials: "include" }
+        }
+      );
       return res.ok ? { ok: true } : { ok: false, error: statusCodeToOperationError(res.status) };
     } catch {
       return { ok: false, error: statusCodeToOperationError(500) };
@@ -7103,6 +7119,13 @@ var SessionManagerCookie = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -7114,6 +7137,29 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      cookies__default.default.set(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session }),
+        { expires: subMinutes(addDays(now, 15), 2).getTime() }
+      );
+      return;
+    }
+    cookies__default.default.set(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      }),
+      { expires: subMinutes(addDays(now, 30), 2).getTime() }
+    );
+  }
   async create(input, version = 1) {
     if (input.type === "MAYA") {
       localStorage.setItem(this.platformStorageKey, "MAYA");
@@ -7140,16 +7186,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      cookies__default.default.set(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        }),
-        { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -7158,18 +7195,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now2, 30), 2).getTime()
-          }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7186,16 +7212,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7207,16 +7224,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7234,16 +7242,7 @@ var SessionManagerCookie = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    cookies__default.default.set(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      }),
-      {}
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -7252,21 +7251,10 @@ var SessionManagerCookie = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        cookies__default.default.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now, 30), 2).getTime()
-          }
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -7293,7 +7281,11 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -7311,7 +7303,10 @@ var SessionManagerCookie = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7333,7 +7328,8 @@ var SessionManagerCookie = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -7371,11 +7367,18 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7397,7 +7400,8 @@ var SessionManagerCookie = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -7418,15 +7422,70 @@ var SessionManagerCookie = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        cookies__default.default.remove(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return;
     }
+    let version = 1;
+    const val = cookies__default.default.get(this.storageKey);
+    if (val) {
+      try {
+        const stored = JSON.parse(val);
+        version = stored.version ?? 1;
+      } catch {
+      }
+    }
     const res = await this.get();
     if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken);
+      await this.authService.destroySession(res.data.accessToken, version);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     cookies__default.default.remove(this.storageKey);
   }
   async verify() {
@@ -7472,6 +7531,13 @@ var SessionManager = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -7487,6 +7553,27 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      localStorage.setItem(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session })
+      );
+      return;
+    }
+    localStorage.setItem(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      })
+    );
+  }
   async create(input, version = 1) {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -7523,15 +7610,7 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      localStorage.setItem(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        })
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -7540,15 +7619,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7566,15 +7637,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7586,15 +7649,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -7612,15 +7667,7 @@ var SessionManager = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    localStorage.setItem(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      })
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -7629,18 +7676,10 @@ var SessionManager = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
       } else {
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          })
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -7667,7 +7706,11 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -7685,7 +7728,10 @@ var SessionManager = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7707,7 +7753,8 @@ var SessionManager = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -7743,11 +7790,18 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -7769,7 +7823,8 @@ var SessionManager = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -7788,15 +7843,70 @@ var SessionManager = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        localStorage.removeItem(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return;
     }
+    let version = 1;
+    const val = localStorage.getItem(this.storageKey);
+    if (val) {
+      try {
+        const stored = JSON.parse(val);
+        version = stored.version ?? 1;
+      } catch {
+      }
+    }
     const res = await this.get();
     if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken);
+      await this.authService.destroySession(res.data.accessToken, version);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     localStorage.removeItem(this.storageKey);
   }
   async verify() {