@oxyhq/auth 2.0.4 → 2.0.6

package/dist/cjs/hooks/useSessionSocket.js

@@ -60,7 +60,8 @@ function readTokenFromStorage() {
     try {
         return window.localStorage.getItem(LS_ACCESS_TOKEN_KEY);
     }
-    catch {
+    catch (err) {
+        console.warn('[oxy.session-socket] localStorage read failed:', err);
         return null;
     }
 }
@@ -73,12 +74,12 @@ async function getSocketIO() {
         return null;
     _ioLoadAttempted = true;
     try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const mod = await Promise.resolve().then(() => __importStar(require('socket.io-client')));
-        _io = (mod.io ?? mod.default);
+        const mod = (await Promise.resolve().then(() => __importStar(require('socket.io-client'))));
+        _io = mod.io ?? mod.default ?? null;
         return _io;
     }
-    catch {
+    catch (err) {
+        console.warn('[oxy.session-socket] socket.io-client import failed:', err);
         debug.warn('socket.io-client is not installed. useSessionSocket will be disabled. Install it with: bun add socket.io-client');
         return null;
     }
@@ -145,7 +146,7 @@ function useSessionSocket(options) {
             // If no token is available at all, we skip the initial connect and let
             // the storage listener or retry logic connect when a token appears.
             const token = resolveToken();
-            socketRef.current = ioFn(baseURL, {
+            const socket = ioFn(baseURL, {
                 transports: ['websocket'],
                 autoConnect: !!token, // don't auto-connect when there is no token
                 auth: (cb) => {
@@ -162,7 +163,7 @@ function useSessionSocket(options) {
                     cb({ token: resolved });
                 },
             });
-            const socket = socketRef.current;
+            socketRef.current = socket;
             // Server auto-joins the user to `user:<userId>` room on connection
             const handleConnect = () => {
                 debug.log('Socket connected:', socket.id);
@@ -198,110 +199,94 @@ function useSessionSocket(options) {
                 (0, queryKeys_1.invalidateSessionQueries)(queryClientRef.current);
                 return Promise.resolve();
             };
+            const triggerLocalSignOut = async (toastMessage, errorContext) => {
+                if (onRemoteSignOutRef.current) {
+                    onRemoteSignOutRef.current();
+                }
+                else {
+                    sonner_1.toast.info(toastMessage);
+                }
+                // Clear local state since the server has already removed the session.
+                // Await so storage cleanup completes before any subsequent navigation.
+                try {
+                    await clearSessionStateRef.current();
+                }
+                catch (error) {
+                    if (process.env.NODE_ENV !== 'production') {
+                        core_1.logger.error(`Failed to clear session state after ${errorContext}`, error instanceof Error ? error : new Error(String(error)), { component: 'useSessionSocket' });
+                    }
+                }
+            };
             const handleSessionUpdate = async (data) => {
                 debug.log('Received session_update:', data);
                 const currentActiveSessionId = activeSessionIdRef.current;
                 const deviceId = currentDeviceIdRef.current;
-                // Handle different event types
-                if (data.type === 'session_removed') {
-                    // Track removed session
-                    if (data.sessionId && onSessionRemovedRef.current) {
-                        onSessionRemovedRef.current(data.sessionId);
-                    }
-                    // If the removed sessionId matches the current activeSessionId, immediately clear state
-                    if (data.sessionId === currentActiveSessionId) {
-                        if (onRemoteSignOutRef.current) {
-                            onRemoteSignOutRef.current();
-                        }
-                        else {
-                            sonner_1.toast.info('You have been signed out remotely.');
+                // Strict whitelist. Every event type that may sign the user out must
+                // appear in the switch. Anything unknown falls through to `default`,
+                // which only logs in dev. This guards against future server-side event
+                // additions (e.g. `session_created` after a successful sign-in)
+                // accidentally triggering sign-out via a fallback branch that compares
+                // `data.sessionId === currentActiveSessionId` — that branch would match
+                // the user's NEW session id and trigger an instant remote sign-out
+                // toast on every login.
+                switch (data.type) {
+                    case 'session_removed': {
+                        if (data.sessionId && onSessionRemovedRef.current) {
+                            onSessionRemovedRef.current(data.sessionId);
                         }
-                        try {
-                            await clearSessionStateRef.current();
+                        if (data.sessionId && data.sessionId === currentActiveSessionId) {
+                            await triggerLocalSignOut('You have been signed out remotely.', 'session_removed');
                         }
-                        catch (error) {
-                            if (process.env.NODE_ENV !== 'production') {
-                                core_1.logger.error('Failed to clear session state after session_removed', error instanceof Error ? error : new Error(String(error)), { component: 'useSessionSocket' });
-                            }
+                        else {
+                            refreshSessions();
                         }
+                        break;
                     }
-                    else {
-                        refreshSessions();
-                    }
-                }
-                else if (data.type === 'device_removed') {
-                    // Track all removed sessions from this device
-                    if (data.sessionIds && onSessionRemovedRef.current) {
-                        for (const sessionId of data.sessionIds) {
-                            onSessionRemovedRef.current(sessionId);
+                    case 'device_removed': {
+                        if (data.sessionIds && onSessionRemovedRef.current) {
+                            for (const sessionId of data.sessionIds) {
+                                onSessionRemovedRef.current(sessionId);
+                            }
                         }
-                    }
-                    // If the removed deviceId matches the current device, immediately clear state
-                    if (data.deviceId && data.deviceId === deviceId) {
-                        if (onRemoteSignOutRef.current) {
-                            onRemoteSignOutRef.current();
+                        if (data.deviceId && deviceId && data.deviceId === deviceId) {
+                            await triggerLocalSignOut('This device has been removed. You have been signed out.', 'device_removed');
                         }
                         else {
-                            sonner_1.toast.info('This device has been removed. You have been signed out.');
-                        }
-                        try {
-                            await clearSessionStateRef.current();
-                        }
-                        catch (error) {
-                            if (process.env.NODE_ENV !== 'production') {
-                                core_1.logger.error('Failed to clear session state after device_removed', error instanceof Error ? error : new Error(String(error)), { component: 'useSessionSocket' });
-                            }
+                            refreshSessions();
                         }
+                        break;
                     }
-                    else {
-                        refreshSessions();
-                    }
-                }
-                else if (data.type === 'sessions_removed') {
-                    // Track all removed sessions
-                    if (data.sessionIds && onSessionRemovedRef.current) {
-                        for (const sessionId of data.sessionIds) {
-                            onSessionRemovedRef.current(sessionId);
+                    case 'sessions_removed': {
+                        if (data.sessionIds && onSessionRemovedRef.current) {
+                            for (const sessionId of data.sessionIds) {
+                                onSessionRemovedRef.current(sessionId);
+                            }
                         }
-                    }
-                    // If the current activeSessionId is in the removed sessionIds list, immediately clear state
-                    if (data.sessionIds && currentActiveSessionId && data.sessionIds.includes(currentActiveSessionId)) {
-                        if (onRemoteSignOutRef.current) {
-                            onRemoteSignOutRef.current();
+                        if (data.sessionIds &&
+                            currentActiveSessionId &&
+                            data.sessionIds.includes(currentActiveSessionId)) {
+                            await triggerLocalSignOut('You have been signed out remotely.', 'sessions_removed');
                         }
                         else {
-                            sonner_1.toast.info('You have been signed out remotely.');
-                        }
-                        try {
-                            await clearSessionStateRef.current();
-                        }
-                        catch (error) {
-                            if (process.env.NODE_ENV !== 'production') {
-                                core_1.logger.error('Failed to clear session state after sessions_removed', error instanceof Error ? error : new Error(String(error)), { component: 'useSessionSocket' });
-                            }
+                            refreshSessions();
                         }
+                        break;
                     }
-                    else {
+                    case 'session_created':
+                    case 'session_update': {
+                        // Lifecycle event for the current user. Just resync the sessions
+                        // list — never sign out.
                         refreshSessions();
+                        break;
                     }
-                }
-                else {
-                    // For other event types (e.g., session_created), refresh sessions
-                    refreshSessions();
-                    // If the current session was logged out (legacy behavior), handle it specially
-                    if (data.sessionId === currentActiveSessionId) {
-                        if (onRemoteSignOutRef.current) {
-                            onRemoteSignOutRef.current();
-                        }
-                        else {
-                            sonner_1.toast.info('You have been signed out remotely.');
-                        }
-                        try {
-                            await clearSessionStateRef.current();
-                        }
-                        catch (error) {
-                            debug.error('Failed to clear session state after session_update:', error);
+                    default: {
+                        if (process.env.NODE_ENV !== 'production') {
+                            core_1.logger.warn('Unknown session socket event type', {
+                                component: 'useSessionSocket',
+                                type: data.type,
+                            });
                         }
+                        break;
                     }
                 }
             };
@@ -329,12 +314,14 @@ function useSessionSocket(options) {
             if (authRetryTimer) {
                 clearTimeout(authRetryTimer);
             }
-            if (socketRef.current) {
+            const currentSocket = socketRef.current;
+            if (currentSocket) {
                 // Remove cross-tab storage listener
-                if (typeof window !== 'undefined' && socketRef.current.__oxyStorageHandler) {
-                    window.removeEventListener('storage', socketRef.current.__oxyStorageHandler);
+                const storageHandler = currentSocket.__oxyStorageHandler;
+                if (typeof window !== 'undefined' && storageHandler) {
+                    window.removeEventListener('storage', storageHandler);
                 }
-                socketRef.current.disconnect();
+                currentSocket.disconnect();
                 socketRef.current = null;
             }
         };

package/dist/cjs/index.js

@@ -24,8 +24,8 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.useAssets = exports.useSessionSocket = exports.isWebBrowser = exports.useWebSSO = exports.createGenericMutation = exports.createProfileMutation = exports.useRemoveDevice = exports.useUpdateDeviceName = exports.useLogoutAll = exports.useLogoutSession = exports.useSwitchSession = exports.useUploadFile = exports.useUpdatePrivacySettings = exports.useUpdateAccountSettings = exports.useUploadAvatar = exports.useUpdateProfile = exports.useRecentSecurityActivity = exports.useSecurityActivity = exports.useSecurityInfo = exports.useUserDevices = exports.useDeviceSessions = exports.useSession = exports.useSessions = exports.usePrivacySettings = exports.useUsersBySessions = exports.useUserByUsername = exports.useUserById = exports.useCurrentUser = exports.useUserProfiles = exports.useUserProfile = exports.useFollowStore = exports.useAccountLoadingSession = exports.useAccountError = exports.useAccountLoading = exports.useAccounts = exports.useAccountStore = exports.useIsAssetLinked = exports.useAssetUsageCount = exports.useAssetsByEntity = exports.useAssetsByApp = exports.useAssetErrors = exports.useAssetLoading = exports.useUploadProgress = exports.useAsset = exports.useAssetsStore = exports.useAssetStore = exports.useAuthStore = exports.useAuth = exports.useWebOxy = exports.WebOxyProvider = void 0;
-exports.extractErrorMessage = exports.isTimeoutOrNetworkError = exports.isInvalidSessionError = exports.handleAuthError = exports.useFileFiltering = exports.useFollowerCounts = exports.useFollow = exports.setOxyFileUrlInstance = exports.useFileDownloadUrl = exports.setOxyAssetInstance = void 0;
+exports.useDeleteAppData = exports.useSetAppData = exports.useRemoveDevice = exports.useUpdateDeviceName = exports.useLogoutAll = exports.useLogoutSession = exports.useSwitchSession = exports.useUploadFile = exports.useUpdatePrivacySettings = exports.useUpdateAccountSettings = exports.useUploadAvatar = exports.useUpdateProfile = exports.isMissingAppDataEndpointError = exports.appDataQueryKeys = exports.useAppDataNamespace = exports.useAppData = exports.useRecentSecurityActivity = exports.useSecurityActivity = exports.useSecurityInfo = exports.useUserDevices = exports.useDeviceSessions = exports.useSession = exports.useSessions = exports.usePrivacySettings = exports.useUsersBySessions = exports.useUserByUsername = exports.useUserById = exports.useCurrentUser = exports.useUserProfiles = exports.useUserProfile = exports.useFollowStore = exports.useAccountLoadingSession = exports.useAccountError = exports.useAccountLoading = exports.useAccounts = exports.useAccountStore = exports.useIsAssetLinked = exports.useAssetUsageCount = exports.useAssetsByEntity = exports.useAssetsByApp = exports.useAssetErrors = exports.useAssetLoading = exports.useUploadProgress = exports.useAsset = exports.useAssetsStore = exports.useAssetStore = exports.useAuthStore = exports.useAuth = exports.useWebOxy = exports.WebOxyProvider = void 0;
+exports.extractErrorMessage = exports.isTimeoutOrNetworkError = exports.isInvalidSessionError = exports.handleAuthError = exports.useFileFiltering = exports.useFollowerCounts = exports.useFollow = exports.useFileDownloadUrl = exports.setOxyAssetInstance = exports.useAssets = exports.useSessionSocket = exports.isWebBrowser = exports.useWebSSO = exports.createGenericMutation = exports.createProfileMutation = void 0;
 // --- Provider & Hooks ---
 var WebOxyProvider_1 = require("./WebOxyProvider");
 Object.defineProperty(exports, "WebOxyProvider", { enumerable: true, get: function () { return WebOxyProvider_1.WebOxyProvider; } });
@@ -69,6 +69,10 @@ Object.defineProperty(exports, "useUserDevices", { enumerable: true, get: functi
 Object.defineProperty(exports, "useSecurityInfo", { enumerable: true, get: function () { return queries_1.useSecurityInfo; } });
 Object.defineProperty(exports, "useSecurityActivity", { enumerable: true, get: function () { return queries_1.useSecurityActivity; } });
 Object.defineProperty(exports, "useRecentSecurityActivity", { enumerable: true, get: function () { return queries_1.useRecentSecurityActivity; } });
+Object.defineProperty(exports, "useAppData", { enumerable: true, get: function () { return queries_1.useAppData; } });
+Object.defineProperty(exports, "useAppDataNamespace", { enumerable: true, get: function () { return queries_1.useAppDataNamespace; } });
+Object.defineProperty(exports, "appDataQueryKeys", { enumerable: true, get: function () { return queries_1.appDataQueryKeys; } });
+Object.defineProperty(exports, "isMissingAppDataEndpointError", { enumerable: true, get: function () { return queries_1.isMissingAppDataEndpointError; } });
 // --- Mutation Hooks ---
 var mutations_1 = require("./hooks/mutations");
 Object.defineProperty(exports, "useUpdateProfile", { enumerable: true, get: function () { return mutations_1.useUpdateProfile; } });
@@ -81,6 +85,8 @@ Object.defineProperty(exports, "useLogoutSession", { enumerable: true, get: func
 Object.defineProperty(exports, "useLogoutAll", { enumerable: true, get: function () { return mutations_1.useLogoutAll; } });
 Object.defineProperty(exports, "useUpdateDeviceName", { enumerable: true, get: function () { return mutations_1.useUpdateDeviceName; } });
 Object.defineProperty(exports, "useRemoveDevice", { enumerable: true, get: function () { return mutations_1.useRemoveDevice; } });
+Object.defineProperty(exports, "useSetAppData", { enumerable: true, get: function () { return mutations_1.useSetAppData; } });
+Object.defineProperty(exports, "useDeleteAppData", { enumerable: true, get: function () { return mutations_1.useDeleteAppData; } });
 var mutationFactory_1 = require("./hooks/mutations/mutationFactory");
 Object.defineProperty(exports, "createProfileMutation", { enumerable: true, get: function () { return mutationFactory_1.createProfileMutation; } });
 Object.defineProperty(exports, "createGenericMutation", { enumerable: true, get: function () { return mutationFactory_1.createGenericMutation; } });
@@ -95,7 +101,6 @@ Object.defineProperty(exports, "useAssets", { enumerable: true, get: function ()
 Object.defineProperty(exports, "setOxyAssetInstance", { enumerable: true, get: function () { return useAssets_1.setOxyAssetInstance; } });
 var useFileDownloadUrl_1 = require("./hooks/useFileDownloadUrl");
 Object.defineProperty(exports, "useFileDownloadUrl", { enumerable: true, get: function () { return useFileDownloadUrl_1.useFileDownloadUrl; } });
-Object.defineProperty(exports, "setOxyFileUrlInstance", { enumerable: true, get: function () { return useFileDownloadUrl_1.setOxyFileUrlInstance; } });
 var useFollow_1 = require("./hooks/useFollow");
 Object.defineProperty(exports, "useFollow", { enumerable: true, get: function () { return useFollow_1.useFollow; } });
 Object.defineProperty(exports, "useFollowerCounts", { enumerable: true, get: function () { return useFollow_1.useFollowerCounts; } });

package/dist/cjs/utils/sessionHelpers.js

@@ -25,7 +25,9 @@ const mapSessionsToClient = (sessions, fallbackDeviceId, fallbackUserId) => {
 };
 exports.mapSessionsToClient = mapSessionsToClient;
 /**
- * Fetch device sessions with fallback to the legacy session endpoint when needed.
+ * Fetch device sessions, falling back to the per-user session endpoint
+ * if the device endpoint is unavailable (older API versions or disabled
+ * device-grouping feature flag).
  *
  * @param oxyServices - Oxy service instance
  * @param sessionId - Session identifier to fetch

package/dist/cjs/utils/storageHelpers.js

@@ -41,7 +41,8 @@ const MEMORY_STORAGE = () => {
     const store = new Map();
     return {
         async getItem(key) {
-            return store.has(key) ? store.get(key) : null;
+            const value = store.get(key);
+            return value === undefined ? null : value;
         },
         async setItem(key, value) {
             store.set(key, value);
@@ -67,7 +68,8 @@ const createWebStorage = () => {
             try {
                 return window.localStorage.getItem(key);
             }
-            catch {
+            catch (err) {
+                console.warn('[oxy.storage] localStorage.getItem failed:', err);
                 return null;
             }
         },
@@ -75,29 +77,44 @@ const createWebStorage = () => {
             try {
                 window.localStorage.setItem(key, value);
             }
-            catch {
-                // Ignore quota or access issues for now.
+            catch (err) {
+                // Quota exceeded or storage disabled (e.g., Safari private mode).
+                // Surface to logs so it is debuggable, but do not throw so callers
+                // can keep functioning with degraded persistence.
+                console.warn('[oxy.storage] localStorage.setItem failed:', err);
             }
         },
         async removeItem(key) {
             try {
                 window.localStorage.removeItem(key);
             }
-            catch {
-                // Ignore failures.
+            catch (err) {
+                console.warn('[oxy.storage] localStorage.removeItem failed:', err);
             }
         },
         async clear() {
             try {
                 window.localStorage.clear();
             }
-            catch {
-                // Ignore failures.
+            catch (err) {
+                console.warn('[oxy.storage] localStorage.clear failed:', err);
             }
         },
     };
 };
 let asyncStorageInstance = null;
+/**
+ * Type guard verifying that an imported value exposes the AsyncStorage API.
+ */
+const isAsyncStorageLike = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const candidate = value;
+    return (typeof candidate.getItem === 'function' &&
+        typeof candidate.setItem === 'function' &&
+        typeof candidate.removeItem === 'function' &&
+        typeof candidate.clear === 'function');
+};
 /**
  * Lazily import React Native AsyncStorage implementation.
  */
@@ -108,8 +125,17 @@ const createNativeStorage = async () => {
     try {
         // Variable indirection prevents bundlers (Vite, webpack) from statically resolving this
         const moduleName = '@react-native-async-storage/async-storage';
-        const asyncStorageModule = await Promise.resolve(`${moduleName}`).then(s => __importStar(require(s)));
-        asyncStorageInstance = asyncStorageModule.default;
+        const asyncStorageModule = (await Promise.resolve(`${moduleName}`).then(s => __importStar(require(s))));
+        const candidate = asyncStorageModule.default;
+        if (!isAsyncStorageLike(candidate)) {
+            throw new Error('AsyncStorage default export does not match expected API');
+        }
+        asyncStorageInstance = {
+            getItem: (key) => candidate.getItem(key),
+            setItem: (key, value) => candidate.setItem(key, value),
+            removeItem: (key) => candidate.removeItem(key),
+            clear: () => candidate.clear(),
+        };
         return asyncStorageInstance;
     }
     catch (error) {