@oxyhq/core 1.4.0 → 1.6.0

package/dist/cjs/AuthManager.js

@@ -247,7 +247,7 @@ class AuthManager {
                 // Use session-based token endpoint which handles auto-refresh server-side
                 const response = await httpService.request({
                     method: 'GET',
-                    url: `/api/session/token/${sessionId}`,
+                    url: `/session/token/${sessionId}`,
                     cache: false,
                     retry: false,
                 });

package/dist/cjs/HttpService.js

@@ -28,7 +28,9 @@ const platform_1 = require("./utils/platform");
  */
 const isNativeApp = (0, platform_1.isNative)();
 /**
- * Token store for authentication (singleton)
+ * Token store for authentication (instance-based)
+ * Each HttpService gets its own TokenStore to prevent conflicts
+ * when multiple OxyServices instances coexist server-side.
  */
 class TokenStore {
     constructor() {
@@ -37,12 +39,6 @@ class TokenStore {
         this.csrfToken = null;
         this.csrfTokenFetchPromise = null;
     }
-    static getInstance() {
-        if (!TokenStore.instance) {
-            TokenStore.instance = new TokenStore();
-        }
-        return TokenStore.instance;
-    }
     setTokens(accessToken, refreshToken = '') {
         this.accessToken = accessToken;
         this.refreshToken = refreshToken;
@@ -86,6 +82,7 @@ class TokenStore {
 class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this.tokenRefreshCooldownUntil = 0;
         this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
@@ -98,7 +95,7 @@ class HttpService {
         };
         this.config = config;
         this.baseURL = config.baseURL;
-        this.tokenStore = TokenStore.getInstance();
+        this.tokenStore = new TokenStore();
         this.logger = new requestUtils_1.SimpleLogger(config.enableLogging || false, config.logLevel || 'error', 'HttpService');
         // Initialize performance infrastructure
         this.cache = new cache_1.TTLCache(config.cacheTTL || 5 * 60 * 1000);
@@ -250,6 +247,20 @@ class HttpService {
                         // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
+                    // On 403 with CSRF error, clear cached token and retry once
+                    if (response.status === 403 && !config._isCsrfRetry) {
+                        try {
+                            const clonedResponse = response.clone();
+                            const errBody = await clonedResponse.json();
+                            if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
+                                this.tokenStore.clearCsrfToken();
+                                return this.request({ ...config, _isCsrfRetry: true, retry: false });
+                            }
+                        }
+                        catch {
+                            // Failed to parse error body — not a CSRF error
+                        }
+                    }
                     // Try to parse error response (handle empty/malformed JSON)
                     let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
                     const contentType = response.headers.get('content-type');
@@ -406,52 +417,57 @@ class HttpService {
             return existingPromise;
         }
         const fetchPromise = (async () => {
-            try {
-                if ((0, debugUtils_1.isDev)())
-                    console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/api/csrf-token`);
-                // Use AbortController for timeout (more compatible than AbortSignal.timeout)
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), 5000);
-                const response = await fetch(`${this.baseURL}/api/csrf-token`, {
-                    method: 'GET',
-                    headers: { 'Accept': 'application/json' },
-                    credentials: 'include', // Required to receive and send cookies
-                    signal: controller.signal,
-                });
-                clearTimeout(timeoutId);
-                if ((0, debugUtils_1.isDev)())
-                    console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
-                if (response.ok) {
-                    const data = await response.json();
+            const maxAttempts = 2;
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+                try {
+                    if ((0, debugUtils_1.isDev)())
+                        console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/csrf-token`, `(attempt ${attempt})`);
+                    // Use AbortController for timeout (more compatible than AbortSignal.timeout)
+                    const controller = new AbortController();
+                    const timeoutId = setTimeout(() => controller.abort(), 5000);
+                    const response = await fetch(`${this.baseURL}/csrf-token`, {
+                        method: 'GET',
+                        headers: { 'Accept': 'application/json' },
+                        credentials: 'include', // Required to receive and send cookies
+                        signal: controller.signal,
+                    });
+                    clearTimeout(timeoutId);
+                    if ((0, debugUtils_1.isDev)())
+                        console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
+                    if (response.ok) {
+                        const data = await response.json();
+                        if ((0, debugUtils_1.isDev)())
+                            console.log('[HttpService] CSRF response data:', data);
+                        const token = data.csrfToken || null;
+                        this.tokenStore.setCsrfToken(token);
+                        this.logger.debug('CSRF token fetched');
+                        return token;
+                    }
+                    // Also check response header for CSRF token
+                    const headerToken = response.headers.get('X-CSRF-Token');
+                    if (headerToken) {
+                        this.tokenStore.setCsrfToken(headerToken);
+                        this.logger.debug('CSRF token from header');
+                        return headerToken;
+                    }
                     if ((0, debugUtils_1.isDev)())
-                        console.log('[HttpService] CSRF response data:', data);
-                    const token = data.csrfToken || null;
-                    this.tokenStore.setCsrfToken(token);
-                    this.logger.debug('CSRF token fetched');
-                    return token;
+                        console.log('[HttpService] CSRF fetch failed with status:', response.status);
+                    this.logger.warn('Failed to fetch CSRF token:', response.status);
                 }
-                // Also check response header for CSRF token
-                const headerToken = response.headers.get('X-CSRF-Token');
-                if (headerToken) {
-                    this.tokenStore.setCsrfToken(headerToken);
-                    this.logger.debug('CSRF token from header');
-                    return headerToken;
+                catch (error) {
+                    if ((0, debugUtils_1.isDev)())
+                        console.log('[HttpService] CSRF fetch error:', error);
+                    this.logger.warn('CSRF token fetch error:', error);
+                }
+                // Wait before retry (500ms)
+                if (attempt < maxAttempts) {
+                    await new Promise(resolve => setTimeout(resolve, 500));
                 }
-                if ((0, debugUtils_1.isDev)())
-                    console.log('[HttpService] CSRF fetch failed with status:', response.status);
-                this.logger.warn('Failed to fetch CSRF token:', response.status);
-                return null;
-            }
-            catch (error) {
-                if ((0, debugUtils_1.isDev)())
-                    console.log('[HttpService] CSRF fetch error:', error);
-                this.logger.warn('CSRF token fetch error:', error);
-                return null;
-            }
-            finally {
-                this.tokenStore.setCsrfTokenFetchPromise(null);
             }
-        })();
+            return null;
+        })().finally(() => {
+            this.tokenStore.setCsrfTokenFetchPromise(null);
+        });
         this.tokenStore.setCsrfTokenFetchPromise(fetchPromise);
         return fetchPromise;
     }
@@ -468,18 +484,25 @@ class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
-                // Deduplicate concurrent refresh attempts
-                if (!this.tokenRefreshPromise) {
-                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                // Skip if we recently failed a refresh (5s cooldown to prevent storms)
+                if (Date.now() < this.tokenRefreshCooldownUntil) {
+                    return `Bearer ${accessToken}`;
                 }
-                try {
-                    const result = await this.tokenRefreshPromise;
-                    if (result)
+                // Deduplicate concurrent refresh attempts. The promise is shared
+                // across all concurrent callers and cleared only after it settles,
+                // so every awaiter receives the same result.
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId)
+                        .then((result) => {
+                        if (!result)
+                            this.tokenRefreshCooldownUntil = Date.now() + 5000;
                         return result;
+                    })
+                        .finally(() => { this.tokenRefreshPromise = null; });
                 }
-                finally {
-                    this.tokenRefreshPromise = null;
-                }
+                const result = await this.tokenRefreshPromise;
+                if (result)
+                    return result;
             }
             return `Bearer ${accessToken}`;
         }
@@ -490,7 +513,7 @@ class HttpService {
     }
     async _refreshTokenFromSession(sessionId) {
         try {
-            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const refreshUrl = `${this.baseURL}/session/token/${sessionId}`;
             const response = await fetch(refreshUrl, {
                 method: 'GET',
                 headers: { 'Accept': 'application/json' },
@@ -643,15 +666,10 @@ class HttpService {
     getMetrics() {
         return { ...this.requestMetrics };
     }
-    // Test-only utility
-    static __resetTokensForTests() {
-        try {
-            TokenStore.getInstance().clearTokens();
-        }
-        catch (error) {
-            // Silently fail in test cleanup - this is expected behavior
-            // TokenStore might not be initialized in some test scenarios
-        }
+    // Test-only utility — clears tokens on this instance
+    __resetTokensForTests() {
+        this.tokenStore.clearTokens();
+        this.tokenStore.clearCsrfToken();
     }
 }
 exports.HttpService = HttpService;

package/dist/cjs/OxyServices.base.js

@@ -26,9 +26,10 @@ class OxyServicesBase {
         // Initialize unified HTTP service (handles auth, caching, deduplication, queuing, retry)
         this.httpService = new HttpService_1.HttpService(config);
     }
-    // Test-only utility to reset global tokens between jest tests
-    static __resetTokensForTests() {
-        HttpService_1.HttpService.__resetTokensForTests();
+    // Test-only utility to reset tokens on this instance between jest tests
+    // Note: tokens are now per-instance, so create new instances in tests for isolation
+    __resetTokensForTests() {
+        this.httpService.__resetTokensForTests();
     }
     /**
      * Make a request with all performance optimizations
@@ -234,7 +235,7 @@ class OxyServicesBase {
             return false;
         }
         try {
-            const res = await this.makeRequest('GET', '/api/auth/validate', undefined, {
+            const res = await this.makeRequest('GET', '/auth/validate', undefined, {
                 cache: false,
                 retry: false,
             });

package/dist/cjs/crypto/keyManager.js

@@ -92,18 +92,6 @@ async function initSecureStore() {
     }
     return SecureStore;
 }
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Check if we're on web platform
  * Identity storage is only available on native platforms (iOS/Android)
@@ -133,7 +121,7 @@ function uint8ArrayToHex(bytes) {
  */
 async function getSecureRandomBytes(length) {
     // In React Native, always use expo-crypto
-    if (isReactNative() || !isNodeJS()) {
+    if ((0, platform_1.isReactNative)() || !(0, platform_1.isNodeJS)()) {
         const Crypto = await initExpoCrypto();
         return Crypto.getRandomBytes(length);
     }

package/dist/cjs/crypto/signatureService.js

@@ -42,21 +42,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignatureService = void 0;
 const elliptic_1 = require("elliptic");
 const keyManager_1 = require("./keyManager");
+const platform_1 = require("../utils/platform");
 // Lazy import for expo-crypto
 let ExpoCrypto = null;
 const ec = new elliptic_1.ec('secp256k1');
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Initialize expo-crypto module
  */
@@ -73,16 +62,14 @@ async function initExpoCrypto() {
  */
 async function sha256(message) {
     // In React Native, use expo-crypto
-    if (isReactNative()) {
+    if ((0, platform_1.isReactNative)()) {
         const Crypto = await initExpoCrypto();
         return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, message);
     }
     // In Node.js, use Node's crypto module
-    if (isNodeJS()) {
+    if ((0, platform_1.isNodeJS)()) {
         try {
-            // eslint-disable-next-line @typescript-eslint/no-implied-eval
-            const getCrypto = new Function('return require("crypto")');
-            const nodeCrypto = getCrypto();
+            const nodeCrypto = await Promise.resolve().then(() => __importStar(require('crypto')));
             return nodeCrypto.createHash('sha256').update(message).digest('hex');
         }
         catch {
@@ -103,7 +90,7 @@ class SignatureService {
      */
     static async generateChallenge() {
         // In React Native, use expo-crypto
-        if (isReactNative()) {
+        if ((0, platform_1.isReactNative)()) {
             const Crypto = await initExpoCrypto();
             const randomBytes = await Crypto.getRandomBytesAsync(32);
             return Array.from(randomBytes)
@@ -111,7 +98,7 @@ class SignatureService {
                 .join('');
         }
         // In Node.js, use Node's crypto module
-        if (isNodeJS()) {
+        if ((0, platform_1.isNodeJS)()) {
             try {
                 // eslint-disable-next-line @typescript-eslint/no-implied-eval
                 const getCrypto = new Function('return require("crypto")');
@@ -178,7 +165,7 @@ class SignatureService {
      */
     static verifySync(message, signature, publicKey) {
         try {
-            if (!isNodeJS()) {
+            if (!(0, platform_1.isNodeJS)()) {
                 // In React Native, use async verify instead
                 throw new Error('verifySync should only be used in Node.js. Use verify() in React Native.');
             }

package/dist/cjs/mixins/OxyServices.analytics.js

@@ -14,7 +14,7 @@ function OxyServicesAnalyticsMixin(Base) {
          */
         async trackEvent(eventName, properties) {
             try {
-                await this.makeRequest('POST', '/api/analytics/events', {
+                await this.makeRequest('POST', '/analytics/events', {
                     event: eventName,
                     properties
                 }, { cache: false, retry: false }); // Don't retry analytics events
@@ -36,7 +36,7 @@ function OxyServicesAnalyticsMixin(Base) {
                     params.startDate = startDate;
                 if (endDate)
                     params.endDate = endDate;
-                return await this.makeRequest('GET', '/api/analytics', params, {
+                return await this.makeRequest('GET', '/analytics', params, {
                     cache: true,
                     cacheTTL: mixinHelpers_1.CACHE_TIMES.LONG,
                 });

package/dist/cjs/mixins/OxyServices.assets.js

@@ -11,7 +11,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async deleteFile(fileId) {
             try {
-                return await this.makeRequest('DELETE', `/api/assets/${encodeURIComponent(fileId)}`, undefined, { cache: false });
+                return await this.makeRequest('DELETE', `/assets/${encodeURIComponent(fileId)}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -32,7 +32,7 @@ function OxyServicesAssetsMixin(Base) {
             if (token)
                 params.set('token', token);
             const qs = params.toString();
-            return `${base}/api/assets/${encodeURIComponent(fileId)}/stream${qs ? `?${qs}` : ''}`;
+            return `${base}/assets/${encodeURIComponent(fileId)}/stream${qs ? `?${qs}` : ''}`;
         }
         /**
          * Get file download URL asynchronously (returns signed URL directly from CDN)
@@ -56,7 +56,7 @@ function OxyServicesAssetsMixin(Base) {
                     paramsObj.limit = limit;
                 if (offset)
                     paramsObj.offset = offset;
-                return await this.makeRequest('GET', '/api/assets', paramsObj, {
+                return await this.makeRequest('GET', '/assets', paramsObj, {
                     cache: false,
                 });
             }
@@ -69,7 +69,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async getAccountStorageUsage() {
             try {
-                return await this.makeRequest('GET', '/api/storage/usage', undefined, {
+                return await this.makeRequest('GET', '/storage/usage', undefined, {
                     cache: false,
                 });
             }
@@ -112,7 +112,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async getBatchFileAccess(fileIds, context) {
             try {
-                return await this.makeRequest('POST', '/api/assets/batch-access', {
+                return await this.makeRequest('POST', '/assets/batch-access', {
                     fileIds,
                     context
                 });
@@ -173,7 +173,7 @@ function OxyServicesAssetsMixin(Base) {
                 }
                 const response = await this.getClient().request({
                     method: 'POST',
-                    url: '/api/assets/upload',
+                    url: '/assets/upload',
                     data: formData,
                     cache: false,
                 });
@@ -231,7 +231,7 @@ function OxyServicesAssetsMixin(Base) {
                     body.visibility = visibility;
                 if (webhookUrl)
                     body.webhookUrl = webhookUrl;
-                return await this.makeRequest('POST', `/api/assets/${fileId}/links`, body, { cache: false });
+                return await this.makeRequest('POST', `/assets/${fileId}/links`, body, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -242,7 +242,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async assetUnlink(fileId, app, entityType, entityId) {
             try {
-                return await this.makeRequest('DELETE', `/api/assets/${fileId}/links`, {
+                return await this.makeRequest('DELETE', `/assets/${fileId}/links`, {
                     app,
                     entityType,
                     entityId
@@ -257,7 +257,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async assetGet(fileId) {
             try {
-                return await this.makeRequest('GET', `/api/assets/${fileId}`, undefined, {
+                return await this.makeRequest('GET', `/assets/${fileId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000,
                 });
@@ -276,7 +276,7 @@ function OxyServicesAssetsMixin(Base) {
                     params.variant = variant;
                 if (expiresIn)
                     params.expiresIn = expiresIn;
-                return await this.makeRequest('GET', `/api/assets/${fileId}/url`, params, {
+                return await this.makeRequest('GET', `/assets/${fileId}/url`, params, {
                     cache: true,
                     cacheTTL: 10 * 60 * 1000,
                 });
@@ -290,7 +290,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async assetRestore(fileId) {
             try {
-                return await this.makeRequest('POST', `/api/assets/${fileId}/restore`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/assets/${fileId}/restore`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -302,7 +302,7 @@ function OxyServicesAssetsMixin(Base) {
         async assetDelete(fileId, force = false) {
             try {
                 const params = force ? { force: 'true' } : undefined;
-                return await this.makeRequest('DELETE', `/api/assets/${fileId}`, params, { cache: false });
+                return await this.makeRequest('DELETE', `/assets/${fileId}`, params, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -325,7 +325,7 @@ function OxyServicesAssetsMixin(Base) {
          */
         async assetUpdateVisibility(fileId, visibility) {
             try {
-                return await this.makeRequest('PATCH', `/api/assets/${fileId}/visibility`, {
+                return await this.makeRequest('PATCH', `/assets/${fileId}/visibility`, {
                     visibility
                 }, { cache: false });
             }
@@ -363,7 +363,7 @@ function OxyServicesAssetsMixin(Base) {
                 params.variant = variant;
             if (expiresIn)
                 params.expiresIn = expiresIn;
-            const urlRes = await this.makeRequest('GET', `/api/assets/${encodeURIComponent(fileId)}/url`, Object.keys(params).length ? params : undefined, {
+            const urlRes = await this.makeRequest('GET', `/assets/${encodeURIComponent(fileId)}/url`, Object.keys(params).length ? params : undefined, {
                 cache: true,
                 cacheTTL: cacheTTL ?? 10 * 60 * 1000,
             });

package/dist/cjs/mixins/OxyServices.auth.js

@@ -43,7 +43,7 @@ function OxyServicesAuthMixin(Base) {
             if (this._serviceToken && this._serviceTokenExp > Date.now() + 60000) {
                 return this._serviceToken;
             }
-            const response = await this.makeRequest('POST', '/api/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
             this._serviceToken = response.token;
             this._serviceTokenExp = Date.now() + response.expiresIn * 1000;
             return this._serviceToken;
@@ -77,7 +77,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async register(publicKey, signature, timestamp) {
             try {
-                const res = await this.makeRequest('POST', '/api/auth/register', {
+                const res = await this.makeRequest('POST', '/auth/register', {
                     publicKey,
                     signature,
                     timestamp,
@@ -99,7 +99,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async requestChallenge(publicKey) {
             try {
-                return await this.makeRequest('POST', '/api/auth/challenge', {
+                return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
                 }, { cache: false });
             }
@@ -119,7 +119,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async verifyChallenge(publicKey, challenge, signature, timestamp, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/verify', {
+                return await this.makeRequest('POST', '/auth/verify', {
                     publicKey,
                     challenge,
                     signature,
@@ -137,7 +137,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -148,7 +148,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                return await this.makeRequest('GET', `/api/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                return await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -159,7 +159,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async getUserBySession(sessionId) {
             try {
-                return await this.makeRequest('GET', `/api/session/user/${sessionId}`, undefined, {
+                return await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                 });
@@ -177,7 +177,7 @@ function OxyServicesAuthMixin(Base) {
                     return [];
                 }
                 const uniqueSessionIds = Array.from(new Set(sessionIds)).sort();
-                return await this.makeRequest('POST', '/api/session/users/batch', { sessionIds: uniqueSessionIds }, {
+                return await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                     deduplicate: true,
@@ -192,7 +192,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async getTokenBySession(sessionId) {
             try {
-                const res = await this.makeRequest('GET', `/api/session/token/${sessionId}`, undefined, { cache: false, retry: false });
+                const res = await this.makeRequest('GET', `/session/token/${sessionId}`, undefined, { cache: false, retry: false });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -205,7 +205,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async getSessionsBySessionId(sessionId) {
             try {
-                return await this.makeRequest('GET', `/api/session/sessions/${sessionId}`, undefined, {
+                return await this.makeRequest('GET', `/session/sessions/${sessionId}`, undefined, {
                     cache: false,
                 });
             }
@@ -219,8 +219,8 @@ function OxyServicesAuthMixin(Base) {
         async logoutSession(sessionId, targetSessionId) {
             try {
                 const url = targetSessionId
-                    ? `/api/session/logout/${sessionId}/${targetSessionId}`
-                    : `/api/session/logout/${sessionId}`;
+                    ? `/session/logout/${sessionId}/${targetSessionId}`
+                    : `/session/logout/${sessionId}`;
                 await this.makeRequest('POST', url, undefined, { cache: false });
             }
             catch (error) {
@@ -232,7 +232,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async logoutAllSessions(sessionId) {
             try {
-                await this.makeRequest('POST', `/api/session/logout-all/${sessionId}`, undefined, { cache: false });
+                await this.makeRequest('POST', `/session/logout-all/${sessionId}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -248,9 +248,11 @@ function OxyServicesAuthMixin(Base) {
                     urlParams.deviceFingerprint = options.deviceFingerprint;
                 if (options.useHeaderValidation)
                     urlParams.useHeaderValidation = 'true';
-                return await this.makeRequest('GET', `/api/session/validate/${sessionId}`, urlParams, { cache: false });
+                return await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
             }
             catch (error) {
+                // Session is invalid — clear any cached user data for this session (#196)
+                this.clearCacheEntry(`GET:/session/user/${sessionId}`);
                 throw this.handleError(error);
             }
         }
@@ -259,7 +261,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-username/${username}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -270,7 +272,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-email/${email}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -281,7 +283,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async signUp(username, email, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/signup', {
+                return await this.makeRequest('POST', '/auth/signup', {
                     username,
                     email,
                     password,
@@ -298,7 +300,7 @@ function OxyServicesAuthMixin(Base) {
          */
         async signIn(identifier, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/login', {
+                return await this.makeRequest('POST', '/auth/login', {
                     identifier,
                     password,
                     deviceName,