@proveanything/smartlinks-auth-ui 0.5.6 → 0.5.8

package/dist/index.js

@@ -11513,15 +11513,18 @@ class AuthAPI {
         return smartlinks__namespace.authKit.verifyMagicLink(this.clientId, token);
     }
     // ============= WhatsApp =============
-    async sendWhatsApp(redirectUrl, phoneNumber, reply, prefillMessage) {
+    async sendWhatsApp(redirectUrl, phoneNumber, reply, prefillMessage, contactData) {
         // phoneNumber is optional — backend extracts it from the inbound WhatsApp webhook.
         // `reply`, when provided, is sent back to the user via WhatsApp on successful verification.
         // `prefillMessage` customizes the message body pre-filled in the wa.me link.
+        // `contactData` is upserted onto the contact when the backend creates/links it,
+        // so the returned session.user is fully formed (name, email, custom fields, etc.).
         return smartlinks__namespace.authKit.sendWhatsApp(this.clientId, {
             phoneNumber: phoneNumber ?? '',
             redirectUrl,
             ...(reply ? { reply } : {}),
             ...(prefillMessage ? { prefillMessage } : {}),
+            ...(contactData ? { contactData } : {}),
         });
     }
     async exchangeWhatsAppSession(token, sessionKey) {
@@ -12713,6 +12716,44 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
             }
         }
     }, [token, user, isVerified, accountData, accountInfo, contact, contactId, notifyAuthStateChange, isNetworkError, logout]);
+    // Apply a session refresh from SDK calls that rotate the bearer token
+    // (e.g. authKit.updateProfile returns { token, ...profile }). Without this
+    // the persisted token still decodes to the OLD claims, so a page refresh
+    // would resurrect stale displayName / email / phone values.
+    const applySessionRefresh = React.useCallback(async (payload) => {
+        const nextToken = payload.token;
+        const nextUser = user
+            ? { ...user, ...(payload.user || {}) }
+            : (payload.user && payload.user.uid ? payload.user : null);
+        const nextAccountData = payload.accountData ?? accountData;
+        if (nextToken && !proxyMode) {
+            // Match the 7-day lifetime used by login()/refreshToken() — backend mints fresh JWTs with the same TTL.
+            await tokenStorage.saveToken(nextToken, Date.now() + 7 * 24 * 60 * 60 * 1000);
+            if (nextUser)
+                await tokenStorage.saveUser(nextUser);
+            if (payload.accountData)
+                await tokenStorage.saveAccountData(payload.accountData);
+        }
+        if (nextToken)
+            setToken(nextToken);
+        if (nextUser)
+            setUser(nextUser);
+        if (payload.accountData)
+            setAccountData(nextAccountData);
+        // Refresh contact too — the backend's account/contact unification means
+        // the contact record may now reflect the new displayName/email/phone.
+        if (collectionId && shouldSyncContacts) {
+            try {
+                const fresh = await smartlinks__namespace.contact.publicGetMine(collectionId);
+                if (fresh?.contact)
+                    setContact(fresh.contact);
+            }
+            catch {
+                // Non-fatal
+            }
+        }
+        notifyAuthStateChange('TOKEN_REFRESH', nextUser, nextToken ?? token, nextAccountData, accountInfo, isVerified, contact, contactId);
+    }, [proxyMode, user, accountData, accountInfo, isVerified, contact, contactId, collectionId, shouldSyncContacts, token, notifyAuthStateChange]);
     // Online/offline event listener for auto-retry verification
     React.useEffect(() => {
         if (proxyMode)
@@ -12790,6 +12831,7 @@ collectionId, enableContactSync, enableInteractionTracking, interactionAppId, in
         clearAccountCache,
         onAuthStateChange,
         retryVerification,
+        applySessionRefresh,
     };
     return jsxRuntime.jsx(AuthContext.Provider, { value: value, children: children });
 };
@@ -14291,8 +14333,17 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             });
             // Resolve outbound prefill message: per-call prop wins, then AuthKit default.
             const prefillMessage = whatsappPrefillMessage ?? config?.whatsappPrefillMessage;
-            const result = await api.sendWhatsApp(getRedirectUrl(), undefined, reply, prefillMessage);
-            whatsappSendRef.current = { token: result.token, sessionKey: result.sessionKey };
+            // Pass collected signup details as contactData so the backend creates the
+            // contact with name/customFields already attached and returns a fully
+            // formed session.user — no follow-up updateProfile call needed.
+            const trimmedName = displayName?.trim() || undefined;
+            const contactData = trimmedName ? { name: trimmedName } : undefined;
+            const result = await api.sendWhatsApp(getRedirectUrl(), undefined, reply, prefillMessage, contactData);
+            whatsappSendRef.current = {
+                token: result.token,
+                sessionKey: result.sessionKey,
+                displayName: trimmedName,
+            };
             return result;
         }
         catch (err) {
@@ -14311,9 +14362,9 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         const target = status.redirectUrl || getRedirectUrl();
         setAuthSuccess(true);
         setSuccessMessage('WhatsApp verified! Signing you in…');
-        // Exchange the verified WhatsApp proof for a real Auth Kit session token,
-        // so the user is fully logged in (not just verified) and any same-tab
-        // continuation flows (claim, bid, etc.) pick up an authenticated session.
+        // Exchange the verified WhatsApp proof for a real Auth Kit session token.
+        // The backend has already created/updated the contact using contactData
+        // sent at sendWhatsApp time, so session.user is fully formed.
         const send = whatsappSendRef.current;
         if (send?.sessionKey) {
             try {
@@ -14656,6 +14707,32 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     const [profile, setProfile] = React.useState(null);
     const [error, setError] = React.useState();
     const [success, setSuccess] = React.useState();
+    const [resolvedClientId, setResolvedClientId] = React.useState(clientId);
+    // Keep prop in sync
+    React.useEffect(() => {
+        if (clientId)
+            setResolvedClientId(clientId);
+    }, [clientId]);
+    // If no clientId was provided, try to resolve the collection's default Auth Kit.
+    // This supports "portal mode" where the host app only knows the collectionId.
+    React.useEffect(() => {
+        if (clientId || !collectionId)
+            return;
+        let cancelled = false;
+        (async () => {
+            try {
+                const collection = await smartlinks__namespace.collection.get(collectionId);
+                const defaultId = collection?.defaultAuthKitId;
+                if (!cancelled && defaultId)
+                    setResolvedClientId(defaultId);
+            }
+            catch {
+                // Non-fatal — handlers will surface a friendly error if still missing
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [clientId, collectionId]);
+    const NO_CLIENT_ID_MSG = 'This account section is not connected to an Auth Kit yet. Pass a clientId prop, or set a default Auth Kit on the collection in the admin console.';
     // Schema state — now uses SDK type directly
     const [schema, setSchema] = React.useState(null);
     const [schemaLoading, setSchemaLoading] = React.useState(false);
@@ -14727,26 +14804,29 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setLoading(true);
         setError(undefined);
         try {
+            // Pull contact first so we can fall back to fields the auth user object
+            // may not carry (e.g. WhatsApp phone numbers, displayName, email).
+            let contactData = auth.contact;
+            if (collectionId && !contactData) {
+                try {
+                    contactData = (await auth.getContact?.()) || null;
+                }
+                catch { /* non-fatal */ }
+            }
+            const contactAny = contactData;
             const profileData = {
                 uid: auth.user?.uid || '',
-                email: auth.user?.email,
-                displayName: auth.user?.displayName,
-                phoneNumber: auth.user?.phoneNumber,
+                email: auth.user?.email || contactAny?.email,
+                displayName: auth.user?.displayName || contactAny?.displayName || contactAny?.name,
+                phoneNumber: auth.user?.phoneNumber || contactAny?.phone || contactAny?.phoneNumber,
                 photoURL: auth.user?.photoURL,
                 emailVerified: true,
                 accountData: auth.accountData || {},
             };
             setProfile(profileData);
             setDisplayName(profileData.displayName || '');
-            // Load contact custom fields if collectionId provided
-            if (collectionId && auth.contact) {
-                setCustomFieldValues(auth.contact.customFields || {});
-            }
-            else if (collectionId) {
-                const contact = await auth.getContact?.();
-                if (contact?.customFields) {
-                    setCustomFieldValues(contact.customFields);
-                }
+            if (collectionId && contactData?.customFields) {
+                setCustomFieldValues(contactData.customFields);
             }
         }
         catch (err) {
@@ -14778,19 +14858,34 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     const editableCustomFields = getEditableFields(schema, customFieldValues).filter(f => !['email', 'displayName', 'phone', 'phoneNumber'].includes(f.key));
     const handleUpdateProfile = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks__namespace.authKit.updateProfile(clientId, { displayName });
+            // SDK 1.13.17+: updateProfile returns a fresh bearer token with refreshed
+            // claims (displayName/photoURL). We MUST persist the new token, otherwise
+            // a page refresh would decode the old token and resurrect stale values.
+            // Cast: older @proveanything/smartlinks type defs typed this as UserProfile
+            // (no `token`). The runtime always returns the rotated token in 1.13.17+.
+            const updated = await smartlinks__namespace.authKit.updateProfile(resolvedClientId, { displayName });
+            await auth.applySessionRefresh({
+                token: updated.token,
+                user: {
+                    displayName: updated.displayName ?? displayName,
+                    email: updated.email,
+                    phoneNumber: updated.phoneNumber ?? undefined,
+                    photoURL: updated.photoURL ?? undefined,
+                },
+                accountData: updated.accountData,
+            });
             setSuccess('Profile updated successfully!');
             setEditingSection(null);
             if (profile) {
-                setProfile({ ...profile, displayName });
+                setProfile({ ...profile, displayName: updated.displayName ?? displayName });
             }
         }
         catch (err) {
@@ -14825,8 +14920,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleChangeEmail = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
@@ -14834,7 +14929,11 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setSuccess(undefined);
         try {
             const redirectUrl = window.location.href;
-            await smartlinks__namespace.authKit.changeEmail(clientId, newEmail, emailPassword, redirectUrl);
+            const res = await smartlinks__namespace.authKit.changeEmail(resolvedClientId, newEmail, emailPassword, redirectUrl);
+            // SDK may rotate bearer token on email change — persist if present.
+            if (res?.token) {
+                await auth.applySessionRefresh({ token: res.token });
+            }
             setSuccess('Email change requested. Please check your new email for verification.');
             setEditingSection(null);
             setNewEmail('');
@@ -14850,8 +14949,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleChangePassword = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         if (newPassword !== confirmPassword) {
@@ -14866,7 +14965,7 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks__namespace.authKit.changePassword(clientId, currentPassword, newPassword);
+            await smartlinks__namespace.authKit.changePassword(resolvedClientId, currentPassword, newPassword);
             setSuccess('Password changed successfully!');
             setEditingSection(null);
             setCurrentPassword('');
@@ -14882,14 +14981,14 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         }
     };
     const handleSendPhoneCode = async () => {
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         try {
-            await smartlinks__namespace.authKit.sendPhoneCode(clientId, newPhone);
+            await smartlinks__namespace.authKit.sendPhoneCode(resolvedClientId, newPhone);
             setPhoneCodeSent(true);
             setSuccess('Verification code sent to your phone');
         }
@@ -14903,15 +15002,20 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
     };
     const handleUpdatePhone = async (e) => {
         e.preventDefault();
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         setLoading(true);
         setError(undefined);
         setSuccess(undefined);
         try {
-            await smartlinks__namespace.authKit.updatePhone(clientId, newPhone, phoneCode);
+            const res = await smartlinks__namespace.authKit.updatePhone(resolvedClientId, newPhone, phoneCode);
+            // Phone change rotates the bearer token (phoneNumber is a JWT claim).
+            await auth.applySessionRefresh({
+                token: res?.token,
+                user: { phoneNumber: newPhone },
+            });
             setSuccess('Phone number updated successfully!');
             setEditingSection(null);
             setNewPhone('');
@@ -14928,8 +15032,8 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         }
     };
     const handleDeleteAccount = async () => {
-        if (!clientId) {
-            setError('Client ID is required');
+        if (!resolvedClientId) {
+            setError(NO_CLIENT_ID_MSG);
             return;
         }
         if (deleteConfirmText !== 'DELETE') {
@@ -14943,7 +15047,7 @@ const AccountManagement = ({ apiEndpoint, clientId, collectionId, onError, class
         setLoading(true);
         setError(undefined);
         try {
-            await smartlinks__namespace.authKit.deleteAccount(clientId, deletePassword, deleteConfirmText);
+            await smartlinks__namespace.authKit.deleteAccount(resolvedClientId, deletePassword, deleteConfirmText);
             setSuccess('Account deleted successfully');
             await auth.logout();
         }