@opexa/portal-sdk 0.59.75 → 0.59.77

package/dist/index.js

@@ -1,6 +1,6 @@
-import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint } from './chunk-UT6VBXJ4.js';
-import { GraphQLClient, isPlainObject } from './chunk-5WRVWQBT.js';
-import './chunk-ROBGEUSE.js';
+import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint } from './chunk-3WS4U4B7.js';
+import { GraphQLClient, isPlainObject } from './chunk-7APXFZ5G.js';
+import './chunk-WVFSGB7Y.js';
 import { ObjectId } from '@opexa/object-id';
 export { ObjectId } from '@opexa/object-id';
 import { Capacitor } from '@capacitor/core';
@@ -343,6 +343,13 @@ var SessionManagerCookie = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -354,6 +361,29 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      cookies.set(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session }),
+        { expires: subMinutes(addDays(now, 15), 2).getTime() }
+      );
+      return;
+    }
+    cookies.set(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      }),
+      { expires: subMinutes(addDays(now, 30), 2).getTime() }
+    );
+  }
   async create(input, version = 1) {
     if (input.type === "MAYA") {
       localStorage.setItem(this.platformStorageKey, "MAYA");
@@ -380,16 +410,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      cookies.set(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        }),
-        { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -398,18 +419,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now2, 30), 2).getTime()
-          }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -426,16 +436,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -447,16 +448,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        cookies.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          }),
-          { expires: subMinutes(addDays(now2, 30), 2).getTime() }
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -474,16 +466,7 @@ var SessionManagerCookie = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    cookies.set(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      }),
-      {}
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -492,21 +475,10 @@ var SessionManagerCookie = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        cookies.set(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          }),
-          {
-            expires: subMinutes(addDays(now, 30), 2).getTime()
-          }
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -533,7 +505,11 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -551,7 +527,10 @@ var SessionManagerCookie = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -573,7 +552,8 @@ var SessionManagerCookie = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -611,11 +591,18 @@ var SessionManagerCookie = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -637,7 +624,8 @@ var SessionManagerCookie = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -658,15 +646,70 @@ var SessionManagerCookie = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        cookies.remove(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
       return;
     }
+    let version = 1;
+    const val = cookies.get(this.storageKey);
+    if (val) {
+      try {
+        const stored = JSON.parse(val);
+        version = stored.version ?? 1;
+      } catch {
+      }
+    }
     const res = await this.get();
     if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken);
+      await this.authService.destroySession(res.data.accessToken, version);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     cookies.remove(this.storageKey);
   }
   async verify() {
@@ -712,6 +755,13 @@ var SessionManager = class {
   authService;
   walletService;
   _refreshing = false;
+  /*
+   * v4 access tokens are never persisted (localStorage/cookie) so that an
+   * XSS-readable storage layer never holds a live access token. They only
+   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   */
+  v4AccessToken = null;
+  v4AccessTokenExpiresAt = null;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
@@ -727,6 +777,27 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
+  persist(data, version) {
+    const now = /* @__PURE__ */ new Date();
+    if (version === 4) {
+      this.v4AccessToken = data.accessToken ?? null;
+      this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      localStorage.setItem(
+        this.storageKey,
+        JSON.stringify({ version, session: data.session })
+      );
+      return;
+    }
+    localStorage.setItem(
+      this.storageKey,
+      JSON.stringify({
+        version,
+        ...data,
+        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
+        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
+      })
+    );
+  }
   async create(input, version = 1) {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -763,15 +834,7 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      const now2 = /* @__PURE__ */ new Date();
-      localStorage.setItem(
-        this.storageKey,
-        JSON.stringify({
-          ...r1.data,
-          accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-          refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-        })
-      );
+      this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -780,15 +843,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -806,15 +861,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -826,15 +873,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        const now2 = /* @__PURE__ */ new Date();
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res2.data,
-            accessTokenExpiresAt: addMinutes(now2, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now2, 30), 2).getTime()
-          })
-        );
+        this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -852,15 +891,7 @@ var SessionManager = class {
         }
       };
     }
-    const now = /* @__PURE__ */ new Date();
-    localStorage.setItem(
-      this.storageKey,
-      JSON.stringify({
-        ...res.data,
-        accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-        refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-      })
-    );
+    this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -869,18 +900,10 @@ var SessionManager = class {
   async createFromAuthenticator(input) {
     const res = await this.authService.authenticate(input);
     if (res.ok) {
-      const now = /* @__PURE__ */ new Date();
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
       } else {
-        localStorage.setItem(
-          this.storageKey,
-          JSON.stringify({
-            ...res.data,
-            accessTokenExpiresAt: addMinutes(now, 8).getTime(),
-            refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
-          })
-        );
+        this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -907,7 +930,11 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.getV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       const accessTokenExpiresAt = new Date(obj.accessTokenExpiresAt);
       const refreshTokenExpiresAt = new Date(obj.refreshTokenExpiresAt);
@@ -925,7 +952,10 @@ var SessionManager = class {
       if (isAfter(now, accessTokenExpiresAt)) {
         this.logger.info("Refreshing session...");
         this.refreshing = true;
-        const res = await this.authService.refreshSession(obj.refreshToken);
+        const res = await this.authService.refreshSession(
+          obj.refreshToken,
+          obj.version ?? 1
+        );
         this.refreshing = false;
         if (!res.ok) {
           this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -947,7 +977,8 @@ var SessionManager = class {
         now = /* @__PURE__ */ new Date();
         obj = {
           ...obj,
-          ...res.data,
+          accessToken: res.data.accessToken,
+          refreshToken: res.data.refreshToken ?? obj.refreshToken,
           accessTokenExpiresAt: addMinutes(now, 8).getTime(),
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
@@ -983,11 +1014,18 @@ var SessionManager = class {
       };
     }
     try {
-      let obj = JSON.parse(val);
+      const stored = JSON.parse(val);
+      if (stored.version === 4) {
+        return await this.refreshV4(stored.session);
+      }
+      let obj = stored;
       let now = /* @__PURE__ */ new Date();
       this.logger.info("Refreshing session...");
       this.refreshing = true;
-      const res = await this.authService.refreshSession(obj.refreshToken);
+      const res = await this.authService.refreshSession(
+        obj.refreshToken,
+        obj.version ?? 1
+      );
       this.refreshing = false;
       if (!res.ok) {
         this.logger.error(`Failed to refresh session: ${res.error.message}`);
@@ -1009,7 +1047,8 @@ var SessionManager = class {
       now = /* @__PURE__ */ new Date();
       obj = {
         ...obj,
-        ...res.data,
+        accessToken: res.data.accessToken,
+        refreshToken: res.data.refreshToken ?? obj.refreshToken,
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
@@ -1028,15 +1067,70 @@ var SessionManager = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
+  async refreshV4(session) {
+    this.logger.info("Refreshing session...");
+    this.refreshing = true;
+    const res = await this.authService.refreshSession(void 0, 4);
+    this.refreshing = false;
+    if (!res.ok) {
+      this.logger.error(`Failed to refresh session: ${res.error.message}`);
+      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError") {
+        localStorage.removeItem(this.storageKey);
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+      }
+      return {
+        ok: false,
+        error: res.error
+      };
+    }
+    this.logger.success("Session refreshed!");
+    const now = /* @__PURE__ */ new Date();
+    this.v4AccessToken = res.data.accessToken;
+    this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+    return {
+      ok: true,
+      data: {
+        session,
+        accessToken: this.v4AccessToken,
+        accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+      }
+    };
+  }
   async destroy() {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
       return;
     }
+    let version = 1;
+    const val = localStorage.getItem(this.storageKey);
+    if (val) {
+      try {
+        const stored = JSON.parse(val);
+        version = stored.version ?? 1;
+      } catch {
+      }
+    }
     const res = await this.get();
     if (res.data?.accessToken) {
-      await this.authService.destroySession(res.data.accessToken);
+      await this.authService.destroySession(res.data.accessToken, version);
     }
+    this.v4AccessToken = null;
+    this.v4AccessTokenExpiresAt = null;
     localStorage.removeItem(this.storageKey);
   }
   async verify() {