@oxyhq/core 1.2.2 → 1.2.4

package/dist/cjs/AuthManager.js

@@ -111,6 +111,10 @@ class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.
@@ -221,20 +225,53 @@ class AuthManager {
         }
     }
     async _doRefreshToken() {
-        const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
-        if (!refreshToken) {
+        // Get session info to find sessionId for token refresh
+        const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);
+        if (!sessionJson) {
+            return false;
+        }
+        let sessionId;
+        try {
+            const session = JSON.parse(sessionJson);
+            sessionId = session.sessionId;
+            if (!sessionId)
+                return false;
+        }
+        catch (err) {
+            console.error('AuthManager: Failed to parse session from storage.', err);
             return false;
         }
         try {
             await (0, asyncUtils_1.retryAsync)(async () => {
                 const httpService = this.oxyServices.httpService;
+                // Use session-based token endpoint which handles auto-refresh server-side
                 const response = await httpService.request({
-                    method: 'POST',
-                    url: '/api/auth/refresh',
-                    data: { refreshToken },
+                    method: 'GET',
+                    url: `/api/session/token/${sessionId}`,
                     cache: false,
+                    retry: false,
                 });
-                await this.handleAuthSuccess(response, 'credentials');
+                if (!response.accessToken) {
+                    throw new Error('No access token in refresh response');
+                }
+                // Update access token in storage and HTTP client
+                await this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, response.accessToken);
+                this.oxyServices.httpService.setTokens(response.accessToken);
+                // Update session expiry and schedule next refresh
+                if (response.expiresAt) {
+                    try {
+                        const session = JSON.parse(sessionJson);
+                        session.expiresAt = response.expiresAt;
+                        await this.storage.setItem(STORAGE_KEYS.SESSION, JSON.stringify(session));
+                    }
+                    catch (err) {
+                        // Ignore parse errors for session update, but log for debugging.
+                        console.error('AuthManager: Failed to re-save session after token refresh.', err);
+                    }
+                    if (this.config.autoRefresh) {
+                        this.setupTokenRefresh(response.expiresAt);
+                    }
+                }
             }, 2, // 2 retries = 3 total attempts
             1000, // 1s base delay with exponential backoff + jitter
             (error) => {

package/dist/cjs/HttpService.js

@@ -86,6 +86,7 @@ class TokenStore {
 class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -228,7 +229,25 @@ class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = (0, jwt_decode_1.jwtDecode)(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -481,6 +500,7 @@ class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -587,6 +607,9 @@ class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();

package/dist/cjs/mixins/OxyServices.utility.js

@@ -29,122 +29,215 @@ function OxyServicesUtilityMixin(Base) {
             }
         }
         /**
-         * Simple Express.js authentication middleware
+         * Express.js authentication middleware
          *
-         * Built-in authentication middleware that validates JWT tokens and adds user data to requests.
+         * Validates JWT tokens against the Oxy API and attaches user data to requests.
+         * Uses server-side session validation for security (not just JWT decode).
          *
          * @example
          * ```typescript
-         * // Basic usage - just add it to your routes
-         * app.use('/api/protected', oxyServices.auth());
+         * import { OxyServices } from '@oxyhq/core';
          *
-         * // With debug logging
-         * app.use('/api/protected', oxyServices.auth({ debug: true }));
+         * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
          *
-         * // With custom error handling
-         * app.use('/api/protected', oxyServices.auth({
-         *   onError: (error) => console.error('Auth failed:', error)
-         * }));
+         * // Protect all routes under /api/protected
+         * app.use('/api/protected', oxy.auth());
          *
-         * // Load full user data
-         * app.use('/api/protected', oxyServices.auth({ loadUser: true }));
+         * // Access user in route handler
+         * app.get('/api/protected/me', (req, res) => {
+         *   res.json({ userId: req.userId, user: req.user });
+         * });
+         *
+         * // Load full user profile from API
+         * app.use('/api/admin', oxy.auth({ loadUser: true }));
+         *
+         * // Optional auth - attach user if present, don't block if absent
+         * app.use('/api/public', oxy.auth({ optional: true }));
          * ```
          *
          * @param options Optional configuration
-         * @param options.debug Enable debug logging (default: false)
-         * @param options.onError Custom error handler
-         * @param options.loadUser Load full user data (default: false for performance)
-         * @param options.session Use session-based validation (default: false)
          * @returns Express middleware function
          */
         auth(options = {}) {
-            const { debug = false, onError, loadUser = false, session = false } = options;
-            // Return a synchronous middleware function
-            return (req, res, next) => {
+            const { debug = false, onError, loadUser = false, optional = false } = options;
+            // Cast to any for cross-mixin method access (Auth mixin methods available at runtime)
+            const oxyInstance = this;
+            // Return an async middleware function
+            return async (req, res, next) => {
                 try {
-                    // Extract token from Authorization header
+                    // Extract token from Authorization header or query params
                     const authHeader = req.headers['authorization'];
-                    const token = authHeader?.startsWith('Bearer ') ? authHeader.substring(7) : null;
+                    let token = authHeader?.startsWith('Bearer ') ? authHeader.substring(7) : null;
+                    // Fallback to query params (useful for WebSocket upgrades)
+                    if (!token) {
+                        const q = req.query || {};
+                        if (typeof q.token === 'string' && q.token)
+                            token = q.token;
+                        else if (typeof q.access_token === 'string' && q.access_token)
+                            token = q.access_token;
+                    }
                     if (debug) {
-                        console.log(`🔐 Auth: Processing ${req.method} ${req.path}`);
-                        console.log(`🔐 Auth: Token present: ${!!token}`);
+                        console.log(`[oxy.auth] ${req.method} ${req.path} | token: ${!!token}`);
                     }
                     if (!token) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
                         const error = {
                             message: 'Access token required',
                             code: 'MISSING_TOKEN',
                             status: 401
                         };
-                        if (debug)
-                            console.log(`❌ Auth: Missing token`);
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
                     }
-                    // Decode and validate token
+                    // Decode token to extract claims
                     let decoded;
                     try {
                         decoded = (0, jwt_decode_1.jwtDecode)(token);
-                        if (debug) {
-                            console.log(`🔐 Auth: Token decoded, User ID: ${decoded.userId || decoded.id}`);
-                        }
                     }
                     catch (decodeError) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
                         const error = {
                             message: 'Invalid token format',
                             code: 'INVALID_TOKEN_FORMAT',
-                            status: 403
+                            status: 401
                         };
-                        if (debug)
-                            console.log(`❌ Auth: Token decode failed`);
                         if (onError)
                             return onError(error);
-                        return res.status(403).json(error);
+                        return res.status(401).json(error);
                     }
                     const userId = decoded.userId || decoded.id;
                     if (!userId) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
                         const error = {
                             message: 'Token missing user ID',
                             code: 'INVALID_TOKEN_PAYLOAD',
-                            status: 403
+                            status: 401
                         };
-                        if (debug)
-                            console.log(`❌ Auth: Token missing user ID`);
                         if (onError)
                             return onError(error);
-                        return res.status(403).json(error);
+                        return res.status(401).json(error);
                     }
-                    // Check token expiration
+                    // Check token expiration locally first (fast path)
                     if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
                         const error = {
                             message: 'Token expired',
                             code: 'TOKEN_EXPIRED',
-                            status: 403
+                            status: 401
                         };
-                        if (debug)
-                            console.log(`❌ Auth: Token expired`);
                         if (onError)
                             return onError(error);
-                        return res.status(403).json(error);
+                        return res.status(401).json(error);
+                    }
+                    // Validate token against the Oxy API for session-based verification
+                    // This ensures the session hasn't been revoked server-side
+                    if (decoded.sessionId) {
+                        try {
+                            const validationResult = await oxyInstance.validateSession(decoded.sessionId, {
+                                useHeaderValidation: true,
+                            });
+                            if (!validationResult || !validationResult.valid) {
+                                if (optional) {
+                                    req.userId = null;
+                                    req.user = null;
+                                    return next();
+                                }
+                                const error = {
+                                    message: 'Session invalid or expired',
+                                    code: 'INVALID_SESSION',
+                                    status: 401
+                                };
+                                if (onError)
+                                    return onError(error);
+                                return res.status(401).json(error);
+                            }
+                            // Use validated user data from session validation (already has full user)
+                            req.userId = userId;
+                            req.accessToken = token;
+                            req.sessionId = decoded.sessionId;
+                            if (loadUser && validationResult.user) {
+                                // Session validation already returns full user data
+                                req.user = validationResult.user;
+                            }
+                            else {
+                                req.user = { id: userId };
+                            }
+                            if (debug) {
+                                console.log(`[oxy.auth] OK user=${userId} session=${decoded.sessionId}`);
+                            }
+                            return next();
+                        }
+                        catch (validationError) {
+                            if (debug) {
+                                console.log(`[oxy.auth] Session validation failed:`, validationError);
+                            }
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = {
+                                message: 'Session validation failed',
+                                code: 'SESSION_VALIDATION_ERROR',
+                                status: 401
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
                     }
-                    // For now, skip session validation to keep it simple
-                    // Session validation can be added later if needed
-                    // Set request properties immediately
+                    // Non-session token: use local validation only (userId from JWT)
                     req.userId = userId;
                     req.accessToken = token;
                     req.user = { id: userId };
-                    // Automatically authenticate the OxyServices instance so all subsequent API calls are authenticated
-                    this.setTokens(token);
+                    // If loadUser requested with non-session token, fetch from API
+                    if (loadUser) {
+                        try {
+                            // Temporarily set token to make the API call
+                            const prevToken = oxyInstance.getAccessToken();
+                            oxyInstance.setTokens(token);
+                            const fullUser = await oxyInstance.getCurrentUser();
+                            // Restore previous token
+                            if (prevToken) {
+                                oxyInstance.setTokens(prevToken);
+                            }
+                            else {
+                                oxyInstance.clearTokens();
+                            }
+                            if (fullUser) {
+                                req.user = fullUser;
+                            }
+                        }
+                        catch {
+                            // Failed to load user, continue with basic user object
+                        }
+                    }
                     if (debug) {
-                        console.log(`✅ Auth: Authentication successful for user ${userId}`);
+                        console.log(`[oxy.auth] OK user=${userId} (no session)`);
                     }
                     next();
                 }
                 catch (error) {
-                    const apiError = this.handleError(error);
+                    const apiError = oxyInstance.handleError(error);
                     if (debug) {
-                        // Debug logging - using console.log is acceptable here for development
-                        console.log(`❌ Auth: Unexpected error:`, apiError);
+                        console.log(`[oxy.auth] Error:`, apiError);
                     }
                     if (onError)
                         return onError(apiError);
@@ -152,5 +245,86 @@ function OxyServicesUtilityMixin(Base) {
                 }
             };
         }
+        /**
+         * Socket.IO authentication middleware factory
+         *
+         * Returns a middleware function for Socket.IO that validates JWT tokens
+         * from the handshake auth object and attaches user data to the socket.
+         *
+         * @example
+         * ```typescript
+         * import { OxyServices } from '@oxyhq/core';
+         * import { Server } from 'socket.io';
+         *
+         * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+         * const io = new Server(server);
+         *
+         * // Authenticate all socket connections
+         * io.use(oxy.authSocket());
+         *
+         * io.on('connection', (socket) => {
+         *   console.log('Authenticated user:', socket.data.userId);
+         * });
+         * ```
+         */
+        authSocket(options = {}) {
+            const { debug = false } = options;
+            // Cast to any for cross-mixin method access (Auth mixin methods available at runtime)
+            const oxyInstance = this;
+            return async (socket, next) => {
+                try {
+                    const token = socket.handshake?.auth?.token;
+                    if (!token) {
+                        return next(new Error('Authentication required'));
+                    }
+                    let decoded;
+                    try {
+                        decoded = (0, jwt_decode_1.jwtDecode)(token);
+                    }
+                    catch {
+                        return next(new Error('Invalid token'));
+                    }
+                    const userId = decoded.userId || decoded.id;
+                    if (!userId) {
+                        return next(new Error('Invalid token payload'));
+                    }
+                    // Check expiration
+                    if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
+                        return next(new Error('Token expired'));
+                    }
+                    // Validate session if available
+                    if (decoded.sessionId) {
+                        try {
+                            const result = await oxyInstance.validateSession(decoded.sessionId, {
+                                useHeaderValidation: true,
+                            });
+                            if (!result || !result.valid) {
+                                return next(new Error('Session invalid'));
+                            }
+                        }
+                        catch {
+                            return next(new Error('Session validation failed'));
+                        }
+                    }
+                    // Attach user data to socket
+                    socket.data = socket.data || {};
+                    socket.data.userId = userId;
+                    socket.data.sessionId = decoded.sessionId || null;
+                    socket.data.token = token;
+                    // Also set on socket.user for backward compatibility
+                    socket.user = { id: userId, userId, sessionId: decoded.sessionId };
+                    if (debug) {
+                        console.log(`[oxy.authSocket] OK user=${userId}`);
+                    }
+                    next();
+                }
+                catch (err) {
+                    if (debug) {
+                        console.log(`[oxy.authSocket] Error:`, err);
+                    }
+                    next(new Error('Authentication error'));
+                }
+            };
+        }
     };
 }

package/dist/esm/AuthManager.js

@@ -107,6 +107,10 @@ export class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.
@@ -217,20 +221,53 @@ export class AuthManager {
         }
     }
     async _doRefreshToken() {
-        const refreshToken = await this.storage.getItem(STORAGE_KEYS.REFRESH_TOKEN);
-        if (!refreshToken) {
+        // Get session info to find sessionId for token refresh
+        const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);
+        if (!sessionJson) {
+            return false;
+        }
+        let sessionId;
+        try {
+            const session = JSON.parse(sessionJson);
+            sessionId = session.sessionId;
+            if (!sessionId)
+                return false;
+        }
+        catch (err) {
+            console.error('AuthManager: Failed to parse session from storage.', err);
             return false;
         }
         try {
             await retryAsync(async () => {
                 const httpService = this.oxyServices.httpService;
+                // Use session-based token endpoint which handles auto-refresh server-side
                 const response = await httpService.request({
-                    method: 'POST',
-                    url: '/api/auth/refresh',
-                    data: { refreshToken },
+                    method: 'GET',
+                    url: `/api/session/token/${sessionId}`,
                     cache: false,
+                    retry: false,
                 });
-                await this.handleAuthSuccess(response, 'credentials');
+                if (!response.accessToken) {
+                    throw new Error('No access token in refresh response');
+                }
+                // Update access token in storage and HTTP client
+                await this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, response.accessToken);
+                this.oxyServices.httpService.setTokens(response.accessToken);
+                // Update session expiry and schedule next refresh
+                if (response.expiresAt) {
+                    try {
+                        const session = JSON.parse(sessionJson);
+                        session.expiresAt = response.expiresAt;
+                        await this.storage.setItem(STORAGE_KEYS.SESSION, JSON.stringify(session));
+                    }
+                    catch (err) {
+                        // Ignore parse errors for session update, but log for debugging.
+                        console.error('AuthManager: Failed to re-save session after token refresh.', err);
+                    }
+                    if (this.config.autoRefresh) {
+                        this.setupTokenRefresh(response.expiresAt);
+                    }
+                }
             }, 2, // 2 retries = 3 total attempts
             1000, // 1s base delay with exponential backoff + jitter
             (error) => {

package/dist/esm/HttpService.js

@@ -83,6 +83,7 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -225,7 +226,25 @@ export class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = jwtDecode(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -478,6 +497,7 @@ export class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -584,6 +604,9 @@ export class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();