@oxyhq/auth 1.1.4 → 2.0.0

package/dist/cjs/hooks/useSessionSocket.js

@@ -9,63 +9,76 @@ const socket_io_client_1 = __importDefault(require("socket.io-client"));
 const sonner_1 = require("sonner");
 const core_1 = require("@oxyhq/core");
 const core_2 = require("@oxyhq/core");
+const WebOxyProvider_1 = require("../WebOxyProvider");
+const react_query_1 = require("@tanstack/react-query");
+const useServicesQueries_1 = require("./queries/useServicesQueries");
+const queryKeys_1 = require("./queries/queryKeys");
 const debug = (0, core_2.createDebugLogger)('SessionSocket');
-function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, onRemoteSignOut, onSessionRemoved }) {
+function useSessionSocket(options) {
+    const { user, activeSessionId, oxyServices, signOut, clearSessionState } = (0, WebOxyProvider_1.useWebOxy)();
+    const queryClient = (0, react_query_1.useQueryClient)();
+    const userId = user?.id ?? null;
+    const baseURL = oxyServices.getBaseURL();
+    // Derive currentDeviceId from sessions query
+    const { data: sessions } = (0, useServicesQueries_1.useSessions)(userId ?? undefined);
+    const currentDeviceId = (0, react_1.useMemo)(() => {
+        if (!sessions || !activeSessionId)
+            return null;
+        const active = sessions.find((s) => s.sessionId === activeSessionId);
+        return active?.deviceId ?? null;
+    }, [sessions, activeSessionId]);
     const socketRef = (0, react_1.useRef)(null);
-    const joinedRoomRef = (0, react_1.useRef)(null);
-    // Store callbacks in refs to avoid re-joining when they change
-    const refreshSessionsRef = (0, react_1.useRef)(refreshSessions);
-    const logoutRef = (0, react_1.useRef)(logout);
+    // Store callbacks and values in refs to avoid reconnecting when they change
     const clearSessionStateRef = (0, react_1.useRef)(clearSessionState);
-    const onRemoteSignOutRef = (0, react_1.useRef)(onRemoteSignOut);
-    const onSessionRemovedRef = (0, react_1.useRef)(onSessionRemoved);
+    const onRemoteSignOutRef = (0, react_1.useRef)(options?.onRemoteSignOut);
+    const onSessionRemovedRef = (0, react_1.useRef)(options?.onSessionRemoved);
     const activeSessionIdRef = (0, react_1.useRef)(activeSessionId);
     const currentDeviceIdRef = (0, react_1.useRef)(currentDeviceId);
-    // Update refs when callbacks change
+    const queryClientRef = (0, react_1.useRef)(queryClient);
+    // Update refs when values change
     (0, react_1.useEffect)(() => {
-        refreshSessionsRef.current = refreshSessions;
-        logoutRef.current = logout;
         clearSessionStateRef.current = clearSessionState;
-        onRemoteSignOutRef.current = onRemoteSignOut;
-        onSessionRemovedRef.current = onSessionRemoved;
+        onRemoteSignOutRef.current = options?.onRemoteSignOut;
+        onSessionRemovedRef.current = options?.onSessionRemoved;
         activeSessionIdRef.current = activeSessionId;
         currentDeviceIdRef.current = currentDeviceId;
-    }, [refreshSessions, logout, clearSessionState, onRemoteSignOut, onSessionRemoved, activeSessionId, currentDeviceId]);
+        queryClientRef.current = queryClient;
+    }, [clearSessionState, options?.onRemoteSignOut, options?.onSessionRemoved, activeSessionId, currentDeviceId, queryClient]);
     (0, react_1.useEffect)(() => {
         if (!userId || !baseURL) {
             // Clean up if userId or baseURL becomes invalid
-            if (socketRef.current && joinedRoomRef.current) {
-                socketRef.current.emit('leave', { userId: joinedRoomRef.current });
-                joinedRoomRef.current = null;
+            if (socketRef.current) {
+                socketRef.current.disconnect();
+                socketRef.current = null;
             }
             return;
         }
-        const roomId = `user:${userId}`;
-        // Only create socket if it doesn't exist
-        if (!socketRef.current) {
-            socketRef.current = (0, socket_io_client_1.default)(baseURL, {
-                transports: ['websocket'],
-            });
+        // Disconnect previous socket if switching users
+        if (socketRef.current) {
+            socketRef.current.disconnect();
+            socketRef.current = null;
         }
+        // Connect with auth token; use callback so reconnections get a fresh token
+        socketRef.current = (0, socket_io_client_1.default)(baseURL, {
+            transports: ['websocket'],
+            auth: (cb) => {
+                const token = oxyServices.getAccessToken();
+                cb({ token: token ?? '' });
+            },
+        });
         const socket = socketRef.current;
-        // Only join if we haven't already joined this room
-        if (joinedRoomRef.current !== roomId) {
-            // Leave previous room if switching users
-            if (joinedRoomRef.current) {
-                socket.emit('leave', { userId: joinedRoomRef.current });
-            }
-            socket.emit('join', { userId: roomId });
-            joinedRoomRef.current = roomId;
-            debug.log('Emitting join for room:', roomId);
-        }
-        // Set up event handlers (only once per socket instance)
+        // Server auto-joins the user to `user:<userId>` room on connection
         const handleConnect = () => {
             debug.log('Socket connected:', socket.id);
         };
+        const refreshSessions = () => {
+            (0, queryKeys_1.invalidateSessionQueries)(queryClientRef.current);
+            return Promise.resolve();
+        };
         const handleSessionUpdate = async (data) => {
             debug.log('Received session_update:', data);
             const currentActiveSessionId = activeSessionIdRef.current;
-            const currentDeviceId = currentDeviceIdRef.current;
+            const deviceId = currentDeviceIdRef.current;
             // Handle different event types
             if (data.type === 'session_removed') {
                 // Track removed session
@@ -80,8 +93,6 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     else {
                         sonner_1.toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since session was already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -92,13 +103,7 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     }
                 }
                 else {
-                    // Otherwise, just refresh the sessions list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            core_1.logger.debug('Failed to refresh sessions after session_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else if (data.type === 'device_removed') {
@@ -109,15 +114,13 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     }
                 }
                 // If the removed deviceId matches the current device, immediately clear state
-                if (data.deviceId && data.deviceId === currentDeviceId) {
+                if (data.deviceId && data.deviceId === deviceId) {
                     if (onRemoteSignOutRef.current) {
                         onRemoteSignOutRef.current();
                     }
                     else {
                         sonner_1.toast.info('This device has been removed. You have been signed out.');
                     }
-                    // Use clearSessionState since sessions were already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -128,13 +131,7 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     }
                 }
                 else {
-                    // Otherwise, refresh sessions and device list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            core_1.logger.debug('Failed to refresh sessions after device_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else if (data.type === 'sessions_removed') {
@@ -152,8 +149,6 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     else {
                         sonner_1.toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since sessions were already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -164,23 +159,12 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     }
                 }
                 else {
-                    // Otherwise, refresh sessions list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            core_1.logger.debug('Failed to refresh sessions after sessions_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else {
-                // For other event types (e.g., session_created), refresh sessions (with error handling)
-                refreshSessionsRef.current().catch((error) => {
-                    // Log but don't throw - refresh errors shouldn't break the socket handler
-                    if (__DEV__) {
-                        core_1.logger.debug('Failed to refresh sessions after session_update', { component: 'useSessionSocket' }, error);
-                    }
-                });
+                // For other event types (e.g., session_created), refresh sessions
+                refreshSessions();
                 // If the current session was logged out (legacy behavior), handle it specially
                 if (data.sessionId === currentActiveSessionId) {
                     if (onRemoteSignOutRef.current) {
@@ -189,8 +173,6 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
                     else {
                         sonner_1.toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since session was already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -205,11 +187,8 @@ function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSes
         return () => {
             socket.off('connect', handleConnect);
             socket.off('session_update', handleSessionUpdate);
-            // Only leave on unmount if we're still in this room
-            if (joinedRoomRef.current === roomId) {
-                socket.emit('leave', { userId: roomId });
-                joinedRoomRef.current = null;
-            }
+            socket.disconnect();
+            socketRef.current = null;
         };
     }, [userId, baseURL]); // Only depend on userId and baseURL - callbacks are in refs
 }

package/dist/esm/hooks/useSessionSocket.js

@@ -1,65 +1,78 @@
-import { useEffect, useRef } from 'react';
+import { useEffect, useRef, useMemo } from 'react';
 import io from 'socket.io-client';
 import { toast } from 'sonner';
 import { logger } from '@oxyhq/core';
 import { createDebugLogger } from '@oxyhq/core';
+import { useWebOxy } from '../WebOxyProvider';
+import { useQueryClient } from '@tanstack/react-query';
+import { useSessions } from './queries/useServicesQueries';
+import { invalidateSessionQueries } from './queries/queryKeys';
 const debug = createDebugLogger('SessionSocket');
-export function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, onRemoteSignOut, onSessionRemoved }) {
+export function useSessionSocket(options) {
+    const { user, activeSessionId, oxyServices, signOut, clearSessionState } = useWebOxy();
+    const queryClient = useQueryClient();
+    const userId = user?.id ?? null;
+    const baseURL = oxyServices.getBaseURL();
+    // Derive currentDeviceId from sessions query
+    const { data: sessions } = useSessions(userId ?? undefined);
+    const currentDeviceId = useMemo(() => {
+        if (!sessions || !activeSessionId)
+            return null;
+        const active = sessions.find((s) => s.sessionId === activeSessionId);
+        return active?.deviceId ?? null;
+    }, [sessions, activeSessionId]);
     const socketRef = useRef(null);
-    const joinedRoomRef = useRef(null);
-    // Store callbacks in refs to avoid re-joining when they change
-    const refreshSessionsRef = useRef(refreshSessions);
-    const logoutRef = useRef(logout);
+    // Store callbacks and values in refs to avoid reconnecting when they change
     const clearSessionStateRef = useRef(clearSessionState);
-    const onRemoteSignOutRef = useRef(onRemoteSignOut);
-    const onSessionRemovedRef = useRef(onSessionRemoved);
+    const onRemoteSignOutRef = useRef(options?.onRemoteSignOut);
+    const onSessionRemovedRef = useRef(options?.onSessionRemoved);
     const activeSessionIdRef = useRef(activeSessionId);
     const currentDeviceIdRef = useRef(currentDeviceId);
-    // Update refs when callbacks change
+    const queryClientRef = useRef(queryClient);
+    // Update refs when values change
     useEffect(() => {
-        refreshSessionsRef.current = refreshSessions;
-        logoutRef.current = logout;
         clearSessionStateRef.current = clearSessionState;
-        onRemoteSignOutRef.current = onRemoteSignOut;
-        onSessionRemovedRef.current = onSessionRemoved;
+        onRemoteSignOutRef.current = options?.onRemoteSignOut;
+        onSessionRemovedRef.current = options?.onSessionRemoved;
         activeSessionIdRef.current = activeSessionId;
         currentDeviceIdRef.current = currentDeviceId;
-    }, [refreshSessions, logout, clearSessionState, onRemoteSignOut, onSessionRemoved, activeSessionId, currentDeviceId]);
+        queryClientRef.current = queryClient;
+    }, [clearSessionState, options?.onRemoteSignOut, options?.onSessionRemoved, activeSessionId, currentDeviceId, queryClient]);
     useEffect(() => {
         if (!userId || !baseURL) {
             // Clean up if userId or baseURL becomes invalid
-            if (socketRef.current && joinedRoomRef.current) {
-                socketRef.current.emit('leave', { userId: joinedRoomRef.current });
-                joinedRoomRef.current = null;
+            if (socketRef.current) {
+                socketRef.current.disconnect();
+                socketRef.current = null;
             }
             return;
         }
-        const roomId = `user:${userId}`;
-        // Only create socket if it doesn't exist
-        if (!socketRef.current) {
-            socketRef.current = io(baseURL, {
-                transports: ['websocket'],
-            });
+        // Disconnect previous socket if switching users
+        if (socketRef.current) {
+            socketRef.current.disconnect();
+            socketRef.current = null;
         }
+        // Connect with auth token; use callback so reconnections get a fresh token
+        socketRef.current = io(baseURL, {
+            transports: ['websocket'],
+            auth: (cb) => {
+                const token = oxyServices.getAccessToken();
+                cb({ token: token ?? '' });
+            },
+        });
         const socket = socketRef.current;
-        // Only join if we haven't already joined this room
-        if (joinedRoomRef.current !== roomId) {
-            // Leave previous room if switching users
-            if (joinedRoomRef.current) {
-                socket.emit('leave', { userId: joinedRoomRef.current });
-            }
-            socket.emit('join', { userId: roomId });
-            joinedRoomRef.current = roomId;
-            debug.log('Emitting join for room:', roomId);
-        }
-        // Set up event handlers (only once per socket instance)
+        // Server auto-joins the user to `user:<userId>` room on connection
         const handleConnect = () => {
             debug.log('Socket connected:', socket.id);
         };
+        const refreshSessions = () => {
+            invalidateSessionQueries(queryClientRef.current);
+            return Promise.resolve();
+        };
         const handleSessionUpdate = async (data) => {
             debug.log('Received session_update:', data);
             const currentActiveSessionId = activeSessionIdRef.current;
-            const currentDeviceId = currentDeviceIdRef.current;
+            const deviceId = currentDeviceIdRef.current;
             // Handle different event types
             if (data.type === 'session_removed') {
                 // Track removed session
@@ -74,8 +87,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     else {
                         toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since session was already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -86,13 +97,7 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     }
                 }
                 else {
-                    // Otherwise, just refresh the sessions list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            logger.debug('Failed to refresh sessions after session_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else if (data.type === 'device_removed') {
@@ -103,15 +108,13 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     }
                 }
                 // If the removed deviceId matches the current device, immediately clear state
-                if (data.deviceId && data.deviceId === currentDeviceId) {
+                if (data.deviceId && data.deviceId === deviceId) {
                     if (onRemoteSignOutRef.current) {
                         onRemoteSignOutRef.current();
                     }
                     else {
                         toast.info('This device has been removed. You have been signed out.');
                     }
-                    // Use clearSessionState since sessions were already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -122,13 +125,7 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     }
                 }
                 else {
-                    // Otherwise, refresh sessions and device list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            logger.debug('Failed to refresh sessions after device_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else if (data.type === 'sessions_removed') {
@@ -146,8 +143,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     else {
                         toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since sessions were already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -158,23 +153,12 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     }
                 }
                 else {
-                    // Otherwise, refresh sessions list (with error handling)
-                    refreshSessionsRef.current().catch((error) => {
-                        // Silently handle errors from refresh - they're expected if sessions were removed
-                        if (__DEV__) {
-                            logger.debug('Failed to refresh sessions after sessions_removed', { component: 'useSessionSocket' }, error);
-                        }
-                    });
+                    refreshSessions();
                 }
             }
             else {
-                // For other event types (e.g., session_created), refresh sessions (with error handling)
-                refreshSessionsRef.current().catch((error) => {
-                    // Log but don't throw - refresh errors shouldn't break the socket handler
-                    if (__DEV__) {
-                        logger.debug('Failed to refresh sessions after session_update', { component: 'useSessionSocket' }, error);
-                    }
-                });
+                // For other event types (e.g., session_created), refresh sessions
+                refreshSessions();
                 // If the current session was logged out (legacy behavior), handle it specially
                 if (data.sessionId === currentActiveSessionId) {
                     if (onRemoteSignOutRef.current) {
@@ -183,8 +167,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
                     else {
                         toast.info('You have been signed out remotely.');
                     }
-                    // Use clearSessionState since session was already removed server-side
-                    // Await to ensure storage cleanup completes before continuing
                     try {
                         await clearSessionStateRef.current();
                     }
@@ -199,11 +181,8 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
         return () => {
             socket.off('connect', handleConnect);
             socket.off('session_update', handleSessionUpdate);
-            // Only leave on unmount if we're still in this room
-            if (joinedRoomRef.current === roomId) {
-                socket.emit('leave', { userId: roomId });
-                joinedRoomRef.current = null;
-            }
+            socket.disconnect();
+            socketRef.current = null;
         };
     }, [userId, baseURL]); // Only depend on userId and baseURL - callbacks are in refs
 }

package/dist/types/hooks/useSessionSocket.d.ts

@@ -1,13 +1,5 @@
-interface UseSessionSocketProps {
-    userId: string | null | undefined;
-    activeSessionId: string | null | undefined;
-    currentDeviceId: string | null | undefined;
-    refreshSessions: () => Promise<void>;
-    logout: () => Promise<void>;
-    clearSessionState: () => Promise<void>;
-    baseURL: string;
+export interface UseSessionSocketOptions {
     onRemoteSignOut?: () => void;
     onSessionRemoved?: (sessionId: string) => void;
 }
-export declare function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, onRemoteSignOut, onSessionRemoved }: UseSessionSocketProps): void;
-export {};
+export declare function useSessionSocket(options?: UseSessionSocketOptions): void;

package/dist/types/index.d.ts

@@ -31,6 +31,7 @@ export { useUpdateProfile, useUploadAvatar, useUpdateAccountSettings, useUpdateP
 export { createProfileMutation, createGenericMutation, } from './hooks/mutations/mutationFactory';
 export type { ProfileMutationConfig, GenericMutationConfig, } from './hooks/mutations/mutationFactory';
 export { useSessionSocket } from './hooks/useSessionSocket';
+export type { UseSessionSocketOptions } from './hooks/useSessionSocket';
 export { useAssets, setOxyAssetInstance } from './hooks/useAssets';
 export { useFileDownloadUrl, setOxyFileUrlInstance } from './hooks/useFileDownloadUrl';
 export { useFollow, useFollowerCounts } from './hooks/useFollow';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/auth",
-  "version": "1.1.4",
+  "version": "2.0.0",
   "description": "OxyHQ Web Authentication SDK — headless auth with React hooks for Next.js, Vite, and web apps",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/hooks/useSessionSocket.ts

@@ -1,85 +1,91 @@
-import { useEffect, useRef } from 'react';
+import { useEffect, useRef, useMemo } from 'react';
 import io from 'socket.io-client';
 import { toast } from 'sonner';
 import { logger } from '@oxyhq/core';
 import { createDebugLogger } from '@oxyhq/core';
+import { useWebOxy } from '../WebOxyProvider';
+import { useQueryClient } from '@tanstack/react-query';
+import { useSessions } from './queries/useServicesQueries';
+import { invalidateSessionQueries } from './queries/queryKeys';
 
 const debug = createDebugLogger('SessionSocket');
 
-interface UseSessionSocketProps {
-  userId: string | null | undefined;
-  activeSessionId: string | null | undefined;
-  currentDeviceId: string | null | undefined;
-  refreshSessions: () => Promise<void>;
-  logout: () => Promise<void>;
-  clearSessionState: () => Promise<void>;
-  baseURL: string;
+export interface UseSessionSocketOptions {
   onRemoteSignOut?: () => void;
   onSessionRemoved?: (sessionId: string) => void;
 }
 
-export function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, onRemoteSignOut, onSessionRemoved }: UseSessionSocketProps) {
+export function useSessionSocket(options?: UseSessionSocketOptions) {
+  const { user, activeSessionId, oxyServices, signOut, clearSessionState } = useWebOxy();
+  const queryClient = useQueryClient();
+
+  const userId = user?.id ?? null;
+  const baseURL = oxyServices.getBaseURL();
+
+  // Derive currentDeviceId from sessions query
+  const { data: sessions } = useSessions(userId ?? undefined);
+  const currentDeviceId = useMemo(() => {
+    if (!sessions || !activeSessionId) return null;
+    const active = sessions.find((s) => s.sessionId === activeSessionId);
+    return active?.deviceId ?? null;
+  }, [sessions, activeSessionId]);
+
   const socketRef = useRef<any>(null);
-  const joinedRoomRef = useRef<string | null>(null);
-  
-  // Store callbacks in refs to avoid re-joining when they change
-  const refreshSessionsRef = useRef(refreshSessions);
-  const logoutRef = useRef(logout);
+
+  // Store callbacks and values in refs to avoid reconnecting when they change
   const clearSessionStateRef = useRef(clearSessionState);
-  const onRemoteSignOutRef = useRef(onRemoteSignOut);
-  const onSessionRemovedRef = useRef(onSessionRemoved);
+  const onRemoteSignOutRef = useRef(options?.onRemoteSignOut);
+  const onSessionRemovedRef = useRef(options?.onSessionRemoved);
   const activeSessionIdRef = useRef(activeSessionId);
   const currentDeviceIdRef = useRef(currentDeviceId);
+  const queryClientRef = useRef(queryClient);
 
-  // Update refs when callbacks change
+  // Update refs when values change
   useEffect(() => {
-    refreshSessionsRef.current = refreshSessions;
-    logoutRef.current = logout;
     clearSessionStateRef.current = clearSessionState;
-    onRemoteSignOutRef.current = onRemoteSignOut;
-    onSessionRemovedRef.current = onSessionRemoved;
+    onRemoteSignOutRef.current = options?.onRemoteSignOut;
+    onSessionRemovedRef.current = options?.onSessionRemoved;
     activeSessionIdRef.current = activeSessionId;
     currentDeviceIdRef.current = currentDeviceId;
-  }, [refreshSessions, logout, clearSessionState, onRemoteSignOut, onSessionRemoved, activeSessionId, currentDeviceId]);
+    queryClientRef.current = queryClient;
+  }, [clearSessionState, options?.onRemoteSignOut, options?.onSessionRemoved, activeSessionId, currentDeviceId, queryClient]);
 
   useEffect(() => {
     if (!userId || !baseURL) {
       // Clean up if userId or baseURL becomes invalid
-      if (socketRef.current && joinedRoomRef.current) {
-        socketRef.current.emit('leave', { userId: joinedRoomRef.current });
-        joinedRoomRef.current = null;
+      if (socketRef.current) {
+        socketRef.current.disconnect();
+        socketRef.current = null;
       }
       return;
     }
 
-    const roomId = `user:${userId}`;
-    
-    // Only create socket if it doesn't exist
-    if (!socketRef.current) {
-      socketRef.current = io(baseURL, {
-        transports: ['websocket'],
-      });
+    // Disconnect previous socket if switching users
+    if (socketRef.current) {
+      socketRef.current.disconnect();
+      socketRef.current = null;
     }
-    const socket = socketRef.current;
 
-    // Only join if we haven't already joined this room
-    if (joinedRoomRef.current !== roomId) {
-      // Leave previous room if switching users
-      if (joinedRoomRef.current) {
-        socket.emit('leave', { userId: joinedRoomRef.current });
-      }
-      
-      socket.emit('join', { userId: roomId });
-      joinedRoomRef.current = roomId;
-      
-      debug.log('Emitting join for room:', roomId);
-    }
+    // Connect with auth token; use callback so reconnections get a fresh token
+    socketRef.current = io(baseURL, {
+      transports: ['websocket'],
+      auth: (cb: (data: { token: string }) => void) => {
+        const token = oxyServices.getAccessToken();
+        cb({ token: token ?? '' });
+      },
+    });
+    const socket = socketRef.current;
 
-    // Set up event handlers (only once per socket instance)
+    // Server auto-joins the user to `user:<userId>` room on connection
     const handleConnect = () => {
       debug.log('Socket connected:', socket.id);
     };
 
+    const refreshSessions = () => {
+      invalidateSessionQueries(queryClientRef.current);
+      return Promise.resolve();
+    };
+
     const handleSessionUpdate = async (data: {
       type: string;
       sessionId?: string;
@@ -87,17 +93,17 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
       sessionIds?: string[]
     }) => {
       debug.log('Received session_update:', data);
-      
+
       const currentActiveSessionId = activeSessionIdRef.current;
-      const currentDeviceId = currentDeviceIdRef.current;
-      
+      const deviceId = currentDeviceIdRef.current;
+
       // Handle different event types
       if (data.type === 'session_removed') {
         // Track removed session
         if (data.sessionId && onSessionRemovedRef.current) {
           onSessionRemovedRef.current(data.sessionId);
         }
-        
+
         // If the removed sessionId matches the current activeSessionId, immediately clear state
         if (data.sessionId === currentActiveSessionId) {
           if (onRemoteSignOutRef.current) {
@@ -105,8 +111,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
           } else {
             toast.info('You have been signed out remotely.');
           }
-          // Use clearSessionState since session was already removed server-side
-          // Await to ensure storage cleanup completes before continuing
           try {
             await clearSessionStateRef.current();
           } catch (error) {
@@ -115,13 +119,7 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
             }
           }
         } else {
-          // Otherwise, just refresh the sessions list (with error handling)
-          refreshSessionsRef.current().catch((error) => {
-            // Silently handle errors from refresh - they're expected if sessions were removed
-            if (__DEV__) {
-              logger.debug('Failed to refresh sessions after session_removed', { component: 'useSessionSocket' }, error as unknown);
-            }
-          });
+          refreshSessions();
         }
       } else if (data.type === 'device_removed') {
         // Track all removed sessions from this device
@@ -130,16 +128,14 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
             onSessionRemovedRef.current(sessionId);
           }
         }
-        
+
         // If the removed deviceId matches the current device, immediately clear state
-        if (data.deviceId && data.deviceId === currentDeviceId) {
+        if (data.deviceId && data.deviceId === deviceId) {
           if (onRemoteSignOutRef.current) {
             onRemoteSignOutRef.current();
           } else {
             toast.info('This device has been removed. You have been signed out.');
           }
-          // Use clearSessionState since sessions were already removed server-side
-          // Await to ensure storage cleanup completes before continuing
           try {
             await clearSessionStateRef.current();
           } catch (error) {
@@ -148,13 +144,7 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
             }
           }
         } else {
-          // Otherwise, refresh sessions and device list (with error handling)
-          refreshSessionsRef.current().catch((error) => {
-            // Silently handle errors from refresh - they're expected if sessions were removed
-            if (__DEV__) {
-              logger.debug('Failed to refresh sessions after device_removed', { component: 'useSessionSocket' }, error as unknown);
-            }
-          });
+          refreshSessions();
         }
       } else if (data.type === 'sessions_removed') {
         // Track all removed sessions
@@ -163,7 +153,7 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
             onSessionRemovedRef.current(sessionId);
           }
         }
-        
+
         // If the current activeSessionId is in the removed sessionIds list, immediately clear state
         if (data.sessionIds && currentActiveSessionId && data.sessionIds.includes(currentActiveSessionId)) {
           if (onRemoteSignOutRef.current) {
@@ -171,8 +161,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
           } else {
             toast.info('You have been signed out remotely.');
           }
-          // Use clearSessionState since sessions were already removed server-side
-          // Await to ensure storage cleanup completes before continuing
           try {
             await clearSessionStateRef.current();
           } catch (error) {
@@ -181,23 +169,12 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
             }
           }
         } else {
-          // Otherwise, refresh sessions list (with error handling)
-          refreshSessionsRef.current().catch((error) => {
-            // Silently handle errors from refresh - they're expected if sessions were removed
-            if (__DEV__) {
-              logger.debug('Failed to refresh sessions after sessions_removed', { component: 'useSessionSocket' }, error as unknown);
-            }
-          });
+          refreshSessions();
         }
       } else {
-        // For other event types (e.g., session_created), refresh sessions (with error handling)
-        refreshSessionsRef.current().catch((error) => {
-          // Log but don't throw - refresh errors shouldn't break the socket handler
-          if (__DEV__) {
-            logger.debug('Failed to refresh sessions after session_update', { component: 'useSessionSocket' }, error as unknown);
-          }
-        });
-        
+        // For other event types (e.g., session_created), refresh sessions
+        refreshSessions();
+
         // If the current session was logged out (legacy behavior), handle it specially
         if (data.sessionId === currentActiveSessionId) {
           if (onRemoteSignOutRef.current) {
@@ -205,8 +182,6 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
           } else {
             toast.info('You have been signed out remotely.');
           }
-          // Use clearSessionState since session was already removed server-side
-          // Await to ensure storage cleanup completes before continuing
           try {
             await clearSessionStateRef.current();
           } catch (error) {
@@ -222,12 +197,8 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
     return () => {
       socket.off('connect', handleConnect);
       socket.off('session_update', handleSessionUpdate);
-      
-      // Only leave on unmount if we're still in this room
-      if (joinedRoomRef.current === roomId) {
-        socket.emit('leave', { userId: roomId });
-        joinedRoomRef.current = null;
-      }
+      socket.disconnect();
+      socketRef.current = null;
     };
   }, [userId, baseURL]); // Only depend on userId and baseURL - callbacks are in refs
-} 
+}

package/src/index.ts

@@ -90,6 +90,7 @@ export type {
 
 // --- Custom Hooks ---
 export { useSessionSocket } from './hooks/useSessionSocket';
+export type { UseSessionSocketOptions } from './hooks/useSessionSocket';
 export { useAssets, setOxyAssetInstance } from './hooks/useAssets';
 export { useFileDownloadUrl, setOxyFileUrlInstance } from './hooks/useFileDownloadUrl';
 export { useFollow, useFollowerCounts } from './hooks/useFollow';