@oxyhq/core 1.2.3 → 1.2.5

package/dist/cjs/AuthManager.js

@@ -111,6 +111,10 @@ class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.

package/dist/cjs/HttpService.js

@@ -86,6 +86,7 @@ class TokenStore {
 class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -228,7 +229,25 @@ class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = (0, jwt_decode_1.jwtDecode)(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -481,6 +500,7 @@ class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -587,6 +607,9 @@ class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();

package/dist/cjs/mixins/OxyServices.fedcm.js

@@ -105,12 +105,20 @@ function OxyServicesFedCMMixin(Base) {
                 }
                 catch (error) {
                     debug.log('Interactive sign-in failed:', error);
+                    const errorMessage = error instanceof Error ? error.message : String(error);
                     if (error.name === 'AbortError') {
                         throw new OxyServices_errors_1.OxyAuthenticationError('Sign-in was cancelled by user');
                     }
                     if (error.name === 'NetworkError') {
                         throw new OxyServices_errors_1.OxyAuthenticationError('Network error during sign-in. Please check your connection.');
                     }
+                    if (errorMessage.includes('multiple accounts')) {
+                        throw new OxyServices_errors_1.OxyAuthenticationError('Please sign out and sign in again to use FedCM with a single account');
+                    }
+                    if (errorMessage.includes('retrieving a token') || errorMessage.includes('Error retrieving')) {
+                        debug.error('FedCM token retrieval error - this may be a browser or IdP configuration issue');
+                        throw new OxyServices_errors_1.OxyAuthenticationError('Authentication failed. Please try again or use an alternative sign-in method.');
+                    }
                     throw error;
                 }
             }
@@ -170,7 +178,17 @@ function OxyServicesFedCMMixin(Base) {
                 catch (silentError) {
                     const errorName = silentError instanceof Error ? silentError.name : 'Unknown';
                     const errorMessage = silentError instanceof Error ? silentError.message : String(silentError);
-                    debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+                    // Handle specific FedCM errors with better logging
+                    if (errorMessage.includes('multiple accounts')) {
+                        debug.log('Silent SSO: User has used multiple accounts - silent mediation not available');
+                        debug.log('Silent SSO: User needs to explicitly sign in to choose account');
+                    }
+                    else if (errorMessage.includes('conditions')) {
+                        debug.log('Silent SSO: Conditions not met (user may not be logged in at IdP or not in approved_clients)');
+                    }
+                    else {
+                        debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+                    }
                     return null;
                 }
                 if (!credential || !credential.token) {

package/dist/esm/AuthManager.js

@@ -107,6 +107,10 @@ export class AuthManager {
             refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
         };
         this.storage = this.config.storage;
+        // Persist tokens to storage when HttpService refreshes them automatically
+        this.oxyServices.httpService.onTokenRefreshed = (accessToken) => {
+            this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+        };
     }
     /**
      * Get default storage based on environment.

package/dist/esm/HttpService.js

@@ -83,6 +83,7 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
             totalRequests: 0,
@@ -225,7 +226,25 @@ export class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    if (response.status === 401) {
+                    // On 401, attempt token refresh and retry once before giving up
+                    if (response.status === 401 && !config._isAuthRetry) {
+                        const currentToken = this.tokenStore.getAccessToken();
+                        if (currentToken) {
+                            try {
+                                const decoded = jwtDecode(currentToken);
+                                if (decoded.sessionId) {
+                                    const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                                    if (refreshResult) {
+                                        // Retry the request with the new token
+                                        return this.request({ ...config, _isAuthRetry: true, retry: false });
+                                    }
+                                }
+                            }
+                            catch {
+                                // Token decode failed, fall through to clear
+                            }
+                        }
+                        // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
                     // Try to parse error response (handle empty/malformed JSON)
@@ -478,6 +497,7 @@ export class HttpService {
             if (response.ok) {
                 const { accessToken: newToken } = await response.json();
                 this.tokenStore.setTokens(newToken);
+                this._onTokenRefreshed?.(newToken);
                 this.logger.debug('Token refreshed');
                 return `Bearer ${newToken}`;
             }
@@ -584,6 +604,9 @@ export class HttpService {
     setTokens(accessToken, refreshToken = '') {
         this.tokenStore.setTokens(accessToken, refreshToken);
     }
+    set onTokenRefreshed(callback) {
+        this._onTokenRefreshed = callback;
+    }
     clearTokens() {
         this.tokenStore.clearTokens();
         this.tokenStore.clearCsrfToken();

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -101,12 +101,20 @@ export function OxyServicesFedCMMixin(Base) {
                 }
                 catch (error) {
                     debug.log('Interactive sign-in failed:', error);
+                    const errorMessage = error instanceof Error ? error.message : String(error);
                     if (error.name === 'AbortError') {
                         throw new OxyAuthenticationError('Sign-in was cancelled by user');
                     }
                     if (error.name === 'NetworkError') {
                         throw new OxyAuthenticationError('Network error during sign-in. Please check your connection.');
                     }
+                    if (errorMessage.includes('multiple accounts')) {
+                        throw new OxyAuthenticationError('Please sign out and sign in again to use FedCM with a single account');
+                    }
+                    if (errorMessage.includes('retrieving a token') || errorMessage.includes('Error retrieving')) {
+                        debug.error('FedCM token retrieval error - this may be a browser or IdP configuration issue');
+                        throw new OxyAuthenticationError('Authentication failed. Please try again or use an alternative sign-in method.');
+                    }
                     throw error;
                 }
             }
@@ -166,7 +174,17 @@ export function OxyServicesFedCMMixin(Base) {
                 catch (silentError) {
                     const errorName = silentError instanceof Error ? silentError.name : 'Unknown';
                     const errorMessage = silentError instanceof Error ? silentError.message : String(silentError);
-                    debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+                    // Handle specific FedCM errors with better logging
+                    if (errorMessage.includes('multiple accounts')) {
+                        debug.log('Silent SSO: User has used multiple accounts - silent mediation not available');
+                        debug.log('Silent SSO: User needs to explicitly sign in to choose account');
+                    }
+                    else if (errorMessage.includes('conditions')) {
+                        debug.log('Silent SSO: Conditions not met (user may not be logged in at IdP or not in approved_clients)');
+                    }
+                    else {
+                        debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+                    }
                     return null;
                 }
                 if (!credential || !credential.token) {

package/dist/types/HttpService.d.ts

@@ -28,6 +28,8 @@ interface RequestConfig extends RequestOptions {
     url: string;
     data?: unknown;
     params?: Record<string, unknown>;
+    /** @internal Used to prevent infinite auth retry loops */
+    _isAuthRetry?: boolean;
 }
 /**
  * Unified HTTP Service
@@ -44,6 +46,7 @@ export declare class HttpService {
     private logger;
     private config;
     private tokenRefreshPromise;
+    private _onTokenRefreshed;
     private requestMetrics;
     constructor(config: OxyConfig);
     /**
@@ -140,6 +143,7 @@ export declare class HttpService {
         data: T;
     }>;
     setTokens(accessToken: string, refreshToken?: string): void;
+    set onTokenRefreshed(callback: ((accessToken: string) => void) | null);
     clearTokens(): void;
     getAccessToken(): string | null;
     hasAccessToken(): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/AuthManager.ts

@@ -153,6 +153,11 @@ export class AuthManager {
       refreshBuffer: config.refreshBuffer ?? 5 * 60 * 1000, // 5 minutes
     };
     this.storage = this.config.storage;
+
+    // Persist tokens to storage when HttpService refreshes them automatically
+    this.oxyServices.httpService.onTokenRefreshed = (accessToken: string) => {
+      this.storage.setItem(STORAGE_KEYS.ACCESS_TOKEN, accessToken);
+    };
   }
 
   /**

package/src/HttpService.ts

@@ -52,6 +52,8 @@ interface RequestConfig extends RequestOptions {
   url: string;
   data?: unknown;
   params?: Record<string, unknown>;
+  /** @internal Used to prevent infinite auth retry loops */
+  _isAuthRetry?: boolean;
 }
 
 /**
@@ -132,6 +134,7 @@ export class HttpService {
   private logger: SimpleLogger;
   private config: OxyConfig;
   private tokenRefreshPromise: Promise<string | null> | null = null;
+  private _onTokenRefreshed: ((accessToken: string) => void) | null = null;
 
   // Performance monitoring
   private requestMetrics = {
@@ -322,10 +325,27 @@ export class HttpService {
 
         // Handle response
         if (!response.ok) {
-          if (response.status === 401) {
+          // On 401, attempt token refresh and retry once before giving up
+          if (response.status === 401 && !config._isAuthRetry) {
+            const currentToken = this.tokenStore.getAccessToken();
+            if (currentToken) {
+              try {
+                const decoded = jwtDecode<JwtPayload>(currentToken);
+                if (decoded.sessionId) {
+                  const refreshResult = await this._refreshTokenFromSession(decoded.sessionId);
+                  if (refreshResult) {
+                    // Retry the request with the new token
+                    return this.request<T>({ ...config, _isAuthRetry: true, retry: false });
+                  }
+                }
+              } catch {
+                // Token decode failed, fall through to clear
+              }
+            }
+            // Refresh failed or no token — clear tokens
             this.tokenStore.clearTokens();
           }
-          
+
           // Try to parse error response (handle empty/malformed JSON)
           let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
           const contentType = response.headers.get('content-type');
@@ -343,10 +363,10 @@ export class HttpService {
               this.logger.warn('Failed to parse error response JSON:', parseError);
             }
           }
-          
-          const error = new Error(errorMessage) as Error & { 
-            status?: number; 
-            response?: { status: number; statusText: string } 
+
+          const error = new Error(errorMessage) as Error & {
+            status?: number;
+            response?: { status: number; statusText: string }
           };
           error.status = response.status;
           error.response = { status: response.status, statusText: response.statusText };
@@ -596,6 +616,7 @@ export class HttpService {
       if (response.ok) {
         const { accessToken: newToken } = await response.json();
         this.tokenStore.setTokens(newToken);
+        this._onTokenRefreshed?.(newToken);
         this.logger.debug('Token refreshed');
         return `Bearer ${newToken}`;
       }
@@ -712,6 +733,10 @@ export class HttpService {
     this.tokenStore.setTokens(accessToken, refreshToken);
   }
 
+  set onTokenRefreshed(callback: ((accessToken: string) => void) | null) {
+    this._onTokenRefreshed = callback;
+  }
+
   clearTokens(): void {
     this.tokenStore.clearTokens();
     this.tokenStore.clearCsrfToken();

package/src/mixins/OxyServices.fedcm.ts

@@ -131,12 +131,21 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
       return session;
     } catch (error) {
       debug.log('Interactive sign-in failed:', error);
+      const errorMessage = error instanceof Error ? error.message : String(error);
+
       if ((error as any).name === 'AbortError') {
         throw new OxyAuthenticationError('Sign-in was cancelled by user');
       }
       if ((error as any).name === 'NetworkError') {
         throw new OxyAuthenticationError('Network error during sign-in. Please check your connection.');
       }
+      if (errorMessage.includes('multiple accounts')) {
+        throw new OxyAuthenticationError('Please sign out and sign in again to use FedCM with a single account');
+      }
+      if (errorMessage.includes('retrieving a token') || errorMessage.includes('Error retrieving')) {
+        debug.error('FedCM token retrieval error - this may be a browser or IdP configuration issue');
+        throw new OxyAuthenticationError('Authentication failed. Please try again or use an alternative sign-in method.');
+      }
       throw error;
     }
   }
@@ -201,7 +210,17 @@ export function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(Base: T)
     } catch (silentError) {
       const errorName = silentError instanceof Error ? silentError.name : 'Unknown';
       const errorMessage = silentError instanceof Error ? silentError.message : String(silentError);
-      debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+
+      // Handle specific FedCM errors with better logging
+      if (errorMessage.includes('multiple accounts')) {
+        debug.log('Silent SSO: User has used multiple accounts - silent mediation not available');
+        debug.log('Silent SSO: User needs to explicitly sign in to choose account');
+      } else if (errorMessage.includes('conditions')) {
+        debug.log('Silent SSO: Conditions not met (user may not be logged in at IdP or not in approved_clients)');
+      } else {
+        debug.log('Silent SSO: Silent mediation failed:', { name: errorName, message: errorMessage });
+      }
+
       return null;
     }