@oxyhq/core 1.2.3 → 1.2.4

package/dist/cjs/AuthManager.js

@@ -111,6 +111,10 @@ class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.

package/dist/cjs/HttpService.js

@@ -86,6 +86,7 @@ class TokenStore {
 class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -228,7 +229,25 @@ class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = (0, jwt_decode_1.jwtDecode)(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -481,6 +500,7 @@ class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -587,6 +607,9 @@ class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();

package/dist/esm/AuthManager.js

@@ -107,6 +107,10 @@ export class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.

package/dist/esm/HttpService.js

@@ -83,6 +83,7 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -225,7 +226,25 @@ export class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = jwtDecode(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -478,6 +497,7 @@ export class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -584,6 +604,9 @@ export class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();

package/dist/types/HttpService.d.ts

@@ -28,6 +28,8 @@ interface RequestConfig extends RequestOptions {
     url: string;
     data?: unknown;
     params?: Record<string, unknown>;
+    /** @internal Used to prevent infinite auth retry loops */
+    _isAuthRetry?: boolean;
 }
 /**
  * Unified HTTP Service
@@ -44,6 +46,7 @@ export declare class HttpService {
     private logger;
     private config;
     private tokenRefreshPromise;
+    private _onTokenRefreshed;
     private requestMetrics;
     constructor(config: OxyConfig);
     /**
@@ -140,6 +143,7 @@ export declare class HttpService {
         data: T;
     }>;
     setTokens(accessToken: string, refreshToken?: string): void;
+    set onTokenRefreshed(callback: ((accessToken: string) => void) | null);
     clearTokens(): void;
     getAccessToken(): string | null;
     hasAccessToken(): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -153,6 +153,11 @@ export class AuthManager {
       refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
     };
     this.storage = this.config.storage;
+
+    // Persist tokens to storage when HttpService refreshes them automatically
+    this.oxyServices.httpService.onTokenRefreshed = (accessToken: string) => {
+      this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+    };
   }
 
   /**

package/src/HttpService.ts

@@ -52,6 +52,8 @@ interface RequestConfig extends RequestOptions {
   url: string;
   data?: unknown;
   params?: Record<string, unknown>;
+  /** @internal Used to prevent infinite auth retry loops */
+  _isAuthRetry?: boolean;
 }
 
 /**
@@ -132,6 +134,7 @@ export class HttpService {
   private logger: SimpleLogger;
   private config: OxyConfig;
   private tokenRefreshPromise: Promise<string | null> | null = null;
+  private _onTokenRefreshed: ((accessToken: string) => void) | null = null;
 
   // Performance monitoring
   private requestMetrics = {
@@ -322,10 +325,27 @@ export class HttpService {
 
         // Handle response
         if (!response.ok) {
-          if (response.status === 401) {
+          // On 401, attempt token refresh and retry once before giving up
+          if (response.status === 401 && !config._isAuthRetry) {
+            const currentToken = this.tokenStore.getAccessToken();
+            if (currentToken) {
+              try {
+                const decoded = jwtDecode<JwtPayload>(currentToken);
+                if (decoded.sessionId) {
+                  const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                  if (refreshResult) {
+                    // Retry the request with the new token
+                    return this.request<T>({ ...config, _isAuthRetry: true, retry: false });
+                  }
+                }
+              } catch {
+                // Token decode failed, fall through to clear
+              }
+            }
+            // Refresh failed or no token — clear tokens
             this.tokenStore.clearTokens();
           }
-          
+
           // Try to parse error response (handle empty/malformed JSON)
           let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
           const contentType = response.headers.get('content-type');
@@ -343,10 +363,10 @@ export class HttpService {
               this.logger.warn('Failed to parse error response JSON:', parseError);
             }
           }
-          
-          const error = new Error(errorMessage) as Error & { 
-            status?: number; 
-            response?: { status: number; statusText: string } 
+
+          const error = new Error(errorMessage) as Error & {
+            status?: number;
+            response?: { status: number; statusText: string }
           };
           error.status = response.status;
           error.response = { status: response.status, statusText: response.statusText };
@@ -596,6 +616,7 @@ export class HttpService {
       if (response.ok) {
         const { accessToken: newToken } = await response.json();
         this.tokenStore.setTokens(newToken);
+        this._onTokenRefreshed?.(newToken);
         this.logger.debug('Token refreshed');
         return `Bearer ${newToken}`;
       }
@@ -712,6 +733,10 @@ export class HttpService {
     this.tokenStore.setTokens(accessToken, refreshToken);
   }
 
+  set onTokenRefreshed(callback: ((accessToken: string) => void) | null) {
+    this._onTokenRefreshed = callback;
+  }
+
   clearTokens(): void {
     this.tokenStore.clearTokens();
     this.tokenStore.clearCsrfToken();