@opexa/portal-sdk 0.59.95 → 0.59.97

package/dist/index.js

@@ -1,4 +1,4 @@
-import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint } from './chunk-RCMZBLLX.js';
+import { CmsPortalService, GameService, ExtensionService, FileService, WalletService, AccountService, ReportService, PortalService, TriggerService, AuthService, getFingerPrint, isIOSPlatform } from './chunk-MJLXQ6HC.js';
 import { GraphQLClient, isPlainObject } from './chunk-7APXFZ5G.js';
 import './chunk-WVFSGB7Y.js';
 import { ObjectId } from '@opexa/object-id';
@@ -336,6 +336,48 @@ function pollable(func, config) {
   };
 }
 
+// src/sdk/refresh-token-store.ts
+var PreferencesRefreshTokenStore = class {
+  constructor(key, logger) {
+    this.key = key;
+    this.logger = logger;
+  }
+  async preferences() {
+    const { Preferences } = await import('@capacitor/preferences');
+    return Preferences;
+  }
+  async get() {
+    if (!isIOSPlatform()) return null;
+    try {
+      const { value } = await (await this.preferences()).get({ key: this.key });
+      return value ?? null;
+    } catch (err) {
+      this.logger.error(`Failed to read the refresh token: ${err}`);
+      return null;
+    }
+  }
+  async set(token) {
+    if (!isIOSPlatform()) return;
+    try {
+      await (await this.preferences()).set({ key: this.key, value: token });
+    } catch (err) {
+      this.logger.error(`Failed to persist the refresh token: ${err}`);
+    }
+  }
+  async remove() {
+    if (!isIOSPlatform()) return;
+    try {
+      await (await this.preferences()).remove({ key: this.key });
+    } catch (err) {
+      this.logger.error(`Failed to clear the refresh token: ${err}`);
+    }
+  }
+};
+function createRefreshTokenStore(logger, sessionPrefix) {
+  const key = sessionPrefix ? `${sessionPrefix}/session/refresh-token` : "session/refresh-token";
+  return new PreferencesRefreshTokenStore(key, logger);
+}
+
 // src/sdk/session-manager.ts
 var SessionManager = class {
   logger;
@@ -345,17 +387,23 @@ var SessionManager = class {
   walletService;
   _refreshing = false;
   /*
-   * v4 access tokens are never persisted (localStorage/cookie) so that an
-   * XSS-readable storage layer never holds a live access token. They only
-   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   * v4 access tokens live in memory only, so an XSS-readable storage layer
+   * never holds a live one. Re-minted from the HttpOnly cookie, or from
+   * `refreshTokenStore` on iOS.
    */
   v4AccessToken = null;
   v4AccessTokenExpiresAt = null;
   v4RefreshPromise = null;
+  invalidReason = null;
+  refreshTokenStore;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
     this.logger = config.logger;
+    this.refreshTokenStore = createRefreshTokenStore(
+      config.logger,
+      config.sessionPrefix
+    );
     if (config.sessionPrefix) {
       this.storageKey = `${config.sessionPrefix}/${this.storageKey}`;
       this.platformStorageKey = `${config.sessionPrefix}/${this.platformStorageKey}`;
@@ -367,7 +415,7 @@ var SessionManager = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  persist(data, version) {
+  async persist(data, version) {
     const now = /* @__PURE__ */ new Date();
     if (version === 4) {
       if (!data.session || !data.accessToken) {
@@ -378,12 +426,17 @@ var SessionManager = class {
       }
       this.v4AccessToken = data.accessToken;
       this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
+      this.invalidReason = null;
+      if (data.refreshToken) {
+        await this.refreshTokenStore.set(data.refreshToken);
+      }
       localStorage.setItem(
         this.storageKey,
         JSON.stringify({ version, session: data.session })
       );
       return true;
     }
+    this.invalidReason = null;
     localStorage.setItem(
       this.storageKey,
       JSON.stringify({
@@ -440,7 +493,8 @@ var SessionManager = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      if (!this.persist(r1.data, version)) return this.malformedResponseError();
+      if (!await this.persist(r1.data, version))
+        return this.malformedResponseError();
       return {
         ok: true,
         data: null
@@ -449,7 +503,7 @@ var SessionManager = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -468,7 +522,7 @@ var SessionManager = class {
         version
       );
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -481,7 +535,7 @@ var SessionManager = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        if (!this.persist(res2.data, version))
+        if (!await this.persist(res2.data, version))
           return this.malformedResponseError();
         return {
           ok: true,
@@ -500,7 +554,8 @@ var SessionManager = class {
         }
       };
     }
-    if (!this.persist(res.data, version)) return this.malformedResponseError();
+    if (!await this.persist(res.data, version))
+      return this.malformedResponseError();
     return {
       ok: true,
       data: null
@@ -511,7 +566,7 @@ var SessionManager = class {
     if (res.ok) {
       if (this.isServer) {
         this.logger.warn("'localStorage' is not available on the server.");
-      } else if (!this.persist(res.data, 1)) {
+      } else if (!await this.persist(res.data, 1)) {
         return this.malformedResponseError();
       }
       return { ok: true };
@@ -607,6 +662,20 @@ var SessionManager = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
   async refresh() {
     if (this.isServer) {
       this.logger.warn("'localStorage' is not available on the server.");
@@ -676,20 +745,6 @@ var SessionManager = class {
       };
     }
   }
-  async getV4(session) {
-    const now = /* @__PURE__ */ new Date();
-    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
-      return {
-        ok: true,
-        data: {
-          session,
-          accessToken: this.v4AccessToken,
-          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
-        }
-      };
-    }
-    return await this.refreshV4(session);
-  }
   async refreshV4(session) {
     if (this.v4RefreshPromise) return await this.v4RefreshPromise;
     this.v4RefreshPromise = this.requestV4Refresh(session);
@@ -701,21 +756,48 @@ var SessionManager = class {
   }
   async requestV4Refresh(session) {
     this.logger.info("Refreshing session...");
+    let refreshToken;
+    if (isIOSPlatform()) {
+      refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (!refreshToken) {
+        this.logger.warn("No stored refresh token. Session expired.");
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = "REFRESH_TOKEN_EXPIRED";
+        localStorage.removeItem(this.storageKey);
+        return {
+          ok: false,
+          error: {
+            name: "SessionExpiredError",
+            message: "Session expired."
+          }
+        };
+      }
+    }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(void 0, 4);
-    this.refreshing = false;
+    const res = await this.authService.refreshSession(refreshToken, 4);
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
-      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError") {
+      const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
+      if (terminal) {
         this.v4AccessToken = null;
         this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION";
+        localStorage.removeItem(this.storageKey);
       }
+      this.refreshing = false;
+      if (terminal) await this.refreshTokenStore.remove();
       return {
         ok: false,
         error: res.error
       };
     }
+    this.refreshing = false;
     this.logger.success("Session refreshed!");
+    this.invalidReason = null;
+    if (res.data.refreshToken) {
+      await this.refreshTokenStore.set(res.data.refreshToken);
+    }
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 4).getTime();
@@ -748,6 +830,8 @@ var SessionManager = class {
     }
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
+    this.invalidReason = null;
+    await this.refreshTokenStore.remove();
     localStorage.removeItem(this.storageKey);
   }
   async verify() {
@@ -755,6 +839,9 @@ var SessionManager = class {
       this.logger.warn("'localStorage' is not available on the server.");
       return { valid: true };
     }
+    if (this.invalidReason) {
+      return { valid: false, reason: this.invalidReason };
+    }
     const val = localStorage.getItem(this.storageKey);
     if (val) {
       try {
@@ -769,11 +856,13 @@ var SessionManager = class {
     }
     const s = await this.get();
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
+      this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
     const v = await this.authService.verifySession(s.data.accessToken);
     if (!v) {
+      this.invalidReason = "INVALID_SESSION";
       localStorage.removeItem(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
@@ -781,16 +870,17 @@ var SessionManager = class {
   async verifyV4(session) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
-      return res.ok ? { valid: true } : {
-        valid: false,
-        reason: res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION"
-      };
+      if (res.ok) return { valid: true };
+      if (!this.invalidReason) return { valid: true };
+      return { valid: false, reason: this.invalidReason };
     }
     const v = await this.authService.verifySession(this.v4AccessToken);
     if (!v) {
       localStorage.removeItem(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
+      this.invalidReason = "INVALID_SESSION";
+      await this.refreshTokenStore.remove();
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -820,16 +910,20 @@ var SessionManagerCookie = class {
   walletService;
   _refreshing = false;
   /*
-   * v4 access tokens are never persisted (localStorage/cookie) so that an
-   * XSS-readable storage layer never holds a live access token. They only
-   * live in memory and get re-minted from the HttpOnly refresh cookie.
+   * v4 access tokens live in memory only, so an XSS-readable storage layer
+   * never holds a live one. Re-minted from the HttpOnly cookie, or from
+   * `refreshTokenStore` on iOS.
    */
   v4AccessToken = null;
   v4AccessTokenExpiresAt = null;
+  v4RefreshPromise = null;
+  invalidReason = null;
+  refreshTokenStore;
   constructor(config) {
     this.authService = config.authService;
     this.walletService = config.walletService;
     this.logger = config.logger;
+    this.refreshTokenStore = createRefreshTokenStore(config.logger);
   }
   get refreshing() {
     return this._refreshing;
@@ -837,15 +931,19 @@ var SessionManagerCookie = class {
   set refreshing(value) {
     this._refreshing = value;
   }
-  persist(data, version) {
+  async persist(data, version) {
     const now = /* @__PURE__ */ new Date();
+    this.invalidReason = null;
     if (version === 4) {
       this.v4AccessToken = data.accessToken ?? null;
       this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
+      if (data.refreshToken) {
+        await this.refreshTokenStore.set(data.refreshToken);
+      }
       cookies.set(
         this.storageKey,
         JSON.stringify({ version, session: data.session }),
-        { expires: subMinutes(addDays(now, 15), 2).getTime() }
+        { expires: subMinutes(addDays(now, 15), 2) }
       );
       return;
     }
@@ -857,7 +955,7 @@ var SessionManagerCookie = class {
         accessTokenExpiresAt: addMinutes(now, 8).getTime(),
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       }),
-      { expires: subMinutes(addDays(now, 30), 2).getTime() }
+      { expires: subMinutes(addDays(now, 30), 2) }
     );
   }
   async create(input, version = 1) {
@@ -886,7 +984,7 @@ var SessionManagerCookie = class {
         maxAttempt: 5
       })();
       if (!r1.ok) return r1;
-      this.persist(r1.data, version);
+      await this.persist(r1.data, version);
       return {
         ok: true,
         data: null
@@ -895,7 +993,7 @@ var SessionManagerCookie = class {
     if (input.type === "MOBILE_NUMBER") {
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -912,7 +1010,7 @@ var SessionManagerCookie = class {
         version
       );
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -924,7 +1022,7 @@ var SessionManagerCookie = class {
       localStorage.setItem(this.platformStorageKey, "CABINET");
       const res2 = await this.authService.createSession(input, version);
       if (res2.ok) {
-        this.persist(res2.data, version);
+        await this.persist(res2.data, version);
         return {
           ok: true,
           data: null
@@ -942,7 +1040,7 @@ var SessionManagerCookie = class {
         }
       };
     }
-    this.persist(res.data, version);
+    await this.persist(res.data, version);
     return {
       ok: true,
       data: null
@@ -954,7 +1052,7 @@ var SessionManagerCookie = class {
       if (this.isServer) {
         this.logger.warn("'client cookies' is not available on the server.");
       } else {
-        this.persist(res.data, 1);
+        await this.persist(res.data, 1);
       }
       return { ok: true };
     } else {
@@ -1034,7 +1132,7 @@ var SessionManagerCookie = class {
           refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
         };
         cookies.set(this.storageKey, JSON.stringify(obj), {
-          expires: subMinutes(addDays(now, 30), 2).getTime()
+          expires: subMinutes(addDays(now, 30), 2)
         });
       }
       return {
@@ -1051,6 +1149,20 @@ var SessionManagerCookie = class {
       };
     }
   }
+  async getV4(session) {
+    const now = /* @__PURE__ */ new Date();
+    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
+      return {
+        ok: true,
+        data: {
+          session,
+          accessToken: this.v4AccessToken,
+          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
+        }
+      };
+    }
+    return await this.refreshV4(session);
+  }
   async refresh() {
     if (this.isServer) {
       this.logger.warn("'client cookies' is not available on the server.");
@@ -1106,7 +1218,7 @@ var SessionManagerCookie = class {
         refreshTokenExpiresAt: subMinutes(addDays(now, 30), 2).getTime()
       };
       cookies.set(this.storageKey, JSON.stringify(obj), {
-        expires: subMinutes(addDays(now, 30), 2).getTime()
+        expires: subMinutes(addDays(now, 30), 2)
       });
       return {
         ok: true,
@@ -1122,37 +1234,59 @@ var SessionManagerCookie = class {
       };
     }
   }
-  async getV4(session) {
-    const now = /* @__PURE__ */ new Date();
-    if (this.v4AccessToken && this.v4AccessTokenExpiresAt && !isAfter(now, new Date(this.v4AccessTokenExpiresAt))) {
-      return {
-        ok: true,
-        data: {
-          session,
-          accessToken: this.v4AccessToken,
-          accessTokenExpiresAt: this.v4AccessTokenExpiresAt
-        }
-      };
+  async refreshV4(session) {
+    if (this.v4RefreshPromise) return await this.v4RefreshPromise;
+    this.v4RefreshPromise = this.requestV4Refresh(session);
+    try {
+      return await this.v4RefreshPromise;
+    } finally {
+      this.v4RefreshPromise = null;
     }
-    return await this.refreshV4(session);
   }
-  async refreshV4(session) {
+  async requestV4Refresh(session) {
     this.logger.info("Refreshing session...");
+    let refreshToken;
+    if (isIOSPlatform()) {
+      refreshToken = await this.refreshTokenStore.get() ?? void 0;
+      if (!refreshToken) {
+        this.logger.warn("No stored refresh token. Session expired.");
+        this.v4AccessToken = null;
+        this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = "REFRESH_TOKEN_EXPIRED";
+        cookies.remove(this.storageKey);
+        return {
+          ok: false,
+          error: {
+            name: "SessionExpiredError",
+            message: "Session expired."
+          }
+        };
+      }
+    }
     this.refreshing = true;
-    const res = await this.authService.refreshSession(void 0, 4);
-    this.refreshing = false;
+    const res = await this.authService.refreshSession(refreshToken, 4);
     if (!res.ok) {
       this.logger.error(`Failed to refresh session: ${res.error.message}`);
-      if (res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError") {
+      const terminal = res.error.name === "InvalidTokenError" || res.error.name === "AccountBlacklistedError" || res.error.name === "VerificationLockedError" || res.error.name === "SessionExpiredError";
+      if (terminal) {
         this.v4AccessToken = null;
         this.v4AccessTokenExpiresAt = null;
+        this.invalidReason = res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION";
+        cookies.remove(this.storageKey);
       }
+      this.refreshing = false;
+      if (terminal) await this.refreshTokenStore.remove();
       return {
         ok: false,
         error: res.error
       };
     }
+    this.refreshing = false;
     this.logger.success("Session refreshed!");
+    this.invalidReason = null;
+    if (res.data.refreshToken) {
+      await this.refreshTokenStore.set(res.data.refreshToken);
+    }
     const now = /* @__PURE__ */ new Date();
     this.v4AccessToken = res.data.accessToken;
     this.v4AccessTokenExpiresAt = addMinutes(now, 5).getTime();
@@ -1185,6 +1319,8 @@ var SessionManagerCookie = class {
     }
     this.v4AccessToken = null;
     this.v4AccessTokenExpiresAt = null;
+    this.invalidReason = null;
+    await this.refreshTokenStore.remove();
     cookies.remove(this.storageKey);
   }
   async verify() {
@@ -1192,6 +1328,9 @@ var SessionManagerCookie = class {
       this.logger.warn("'client cookies' is not available on the server.");
       return { valid: true };
     }
+    if (this.invalidReason) {
+      return { valid: false, reason: this.invalidReason };
+    }
     const val = cookies.get(this.storageKey);
     if (val) {
       try {
@@ -1206,11 +1345,13 @@ var SessionManagerCookie = class {
     }
     const s = await this.get();
     if (s.error?.name === "InvalidTokenError" || s.error?.name === "SessionExpiredError" || s.error?.name === "AccountBlacklistedError") {
+      this.invalidReason = "INVALID_SESSION";
       return { valid: false, reason: "INVALID_SESSION" };
     }
     if (!s.data) return { valid: true };
     const v = await this.authService.verifySession(s.data.accessToken);
     if (!v) {
+      this.invalidReason = "INVALID_SESSION";
       cookies.remove(this.storageKey);
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
@@ -1218,16 +1359,17 @@ var SessionManagerCookie = class {
   async verifyV4(session) {
     if (!this.v4AccessToken || !this.v4AccessTokenExpiresAt || isAfter(/* @__PURE__ */ new Date(), new Date(this.v4AccessTokenExpiresAt))) {
       const res = await this.refreshV4(session);
-      return res.ok ? { valid: true } : {
-        valid: false,
-        reason: res.error.name === "SessionExpiredError" ? "REFRESH_TOKEN_EXPIRED" : "INVALID_SESSION"
-      };
+      if (res.ok) return { valid: true };
+      if (!this.invalidReason) return { valid: true };
+      return { valid: false, reason: this.invalidReason };
     }
     const v = await this.authService.verifySession(this.v4AccessToken);
     if (!v) {
       cookies.remove(this.storageKey);
       this.v4AccessToken = null;
       this.v4AccessTokenExpiresAt = null;
+      this.invalidReason = "INVALID_SESSION";
+      await this.refreshTokenStore.remove();
     }
     return v ? { valid: true } : { valid: false, reason: "INVALID_SESSION" };
   }
@@ -3532,9 +3674,18 @@ var Sdk = class {
     let counter = 0;
     let timeout = null;
     let isForeground = true;
+    let stopped = false;
     const listener = App.addListener("appStateChange", ({ isActive }) => {
       isForeground = isActive;
     });
+    const stop = () => {
+      stopped = true;
+      if (timeout) {
+        clearTimeout(timeout);
+        timeout = null;
+      }
+      listener.then((handle) => handle.remove());
+    };
     const assignTimeout = () => {
       const duration = counter <= 0 ? interval * 0.5 : interval;
       return setTimeout(async () => {
@@ -3543,10 +3694,13 @@ var Sdk = class {
           try {
             res = await this.sessionManager.verify();
           } catch {
-            res = { valid: false, reason: "INVALID_SESSION" };
+            res = null;
           }
-          if (!res.valid) {
+          if (stopped) return;
+          if (res && !res.valid) {
+            stop();
             await input.onInvalid(res.reason ?? "INVALID_SESSION");
+            return;
           }
         }
         counter += 1;
@@ -3555,10 +3709,7 @@ var Sdk = class {
     };
     timeout = assignTimeout();
     return function unsubscribe() {
-      if (timeout) {
-        clearTimeout(timeout);
-      }
-      listener.then((handle) => handle.remove());
+      stop();
     };
   }
   async session() {