@pylonsync/react 0.5.0 → 0.5.2

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.5.0",
+  "version": "0.5.2",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./dist/index.d.ts",
@@ -14,8 +14,8 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@pylonsync/sdk": "0.5.0",
-    "@pylonsync/sync": "0.5.0"
+    "@pylonsync/sdk": "0.5.2",
+    "@pylonsync/sync": "0.5.2"
   },
   "peerDependencies": {
     "react": ">=19.0.0"

package/src/index.ts

@@ -236,7 +236,37 @@ export function configureClient(config: AgentDBClientConfig): void {
     maybeWarnDowngrade(config.baseUrl);
   }
   if (config.appName) {
+    const prev = _appName;
     _appName = config.appName;
+    // An app moving off the default (unprefixed `pylon_token`) keyspace onto
+    // its own `pylon:<app>:token` namespace keeps its session: copy the legacy
+    // keys up once. COPY, never delete — a framework rollback still finds the
+    // old keys, and a shared-origin multi-app collision self-heals on next
+    // login (each app rewrites its own namespace).
+    if (config.appName !== "default" && prev === "default") {
+      adoptLegacyKeys();
+    }
+  }
+}
+
+/** Session slots whose legacy (default-keyspace) value is adopted into the
+ *  app namespace on first `configureClient({ appName })`. */
+const MIGRATED_SLOTS = ["token", "userId"] as const;
+
+function adoptLegacyKeys(): void {
+  try {
+    for (const slot of MIGRATED_SLOTS) {
+      const nsKey = storageKey(slot); // pylon:<app>:<slot>
+      const legacyKey = `pylon_${slot}`;
+      if (nsKey === legacyKey) continue;
+      const existing = _storage.get(nsKey);
+      if (existing != null && existing !== "") continue; // already namespaced
+      const legacy = _storage.get(legacyKey);
+      if (legacy != null && legacy !== "") _storage.set(nsKey, legacy);
+    }
+  } catch {
+    // Storage can be absent (SSR/node) or throw (Safari private mode) —
+    // never let a migration attempt break client configuration.
   }
 }
 

package/src/storageMigration.test.ts

@@ -0,0 +1,42 @@
+// Regression: a fresh app defaulted `_appName` to "default", so `storageKey`
+// returned the unprefixed `pylon_token`. Two apps on one origin (every app on
+// localhost:4321 in dev) then shared one token keyspace and clobbered each
+// other's sessions. The fix auto-namespaces per app; this pins that adopting a
+// namespace copies an existing default-keyspace session up (non-destructively),
+// so no one gets logged out on the switch.
+//
+// `_appName` is module-global and only transitions off "default" once, so the
+// no-clobber branch lives in its own file (storageMigrationNoClobber.test.ts)
+// with a fresh transition.
+
+import { expect, test } from "bun:test";
+
+import { configureClient, setReactStorage, storageKey } from "./index";
+import type { Storage as PylonStorage } from "@pylonsync/sync";
+
+function memStorage(): PylonStorage & { map: Map<string, string> } {
+  const map = new Map<string, string>();
+  return {
+    map,
+    get: (k: string) => map.get(k) ?? null,
+    set: (k: string, v: string) => void map.set(k, v),
+    remove: (k: string) => void map.delete(k),
+  };
+}
+
+test("adopts a legacy pylon_token into the app namespace, non-destructively", () => {
+  const store = memStorage();
+  setReactStorage(store);
+  store.set("pylon_token", "tok_legacy");
+  store.set("pylon_userId", "user_1");
+
+  configureClient({ appName: "revtrail" });
+
+  // Session preserved under the new namespaced keys…
+  expect(store.get("pylon:revtrail:token")).toBe("tok_legacy");
+  expect(store.get("pylon:revtrail:userId")).toBe("user_1");
+  // …and COPIED, not moved — a framework rollback still finds the old key.
+  expect(store.get("pylon_token")).toBe("tok_legacy");
+  // storageKey now resolves to the namespace.
+  expect(storageKey("token")).toBe("pylon:revtrail:token");
+});

package/src/storageMigrationNoClobber.test.ts

@@ -0,0 +1,30 @@
+// The legacy-token adoption (see storageMigration.test.ts) must never overwrite
+// a token already living in the app namespace — that would replay a stale
+// default-keyspace session over the app's real one. Own file so `_appName`
+// starts at "default" and the single transition runs the guard.
+
+import { expect, test } from "bun:test";
+
+import { configureClient, setReactStorage } from "./index";
+import type { Storage as PylonStorage } from "@pylonsync/sync";
+
+function memStorage(): PylonStorage & { map: Map<string, string> } {
+  const map = new Map<string, string>();
+  return {
+    map,
+    get: (k: string) => map.get(k) ?? null,
+    set: (k: string, v: string) => void map.set(k, v),
+    remove: (k: string) => void map.delete(k),
+  };
+}
+
+test("does not clobber a token already in the app namespace", () => {
+  const store = memStorage();
+  setReactStorage(store);
+  store.set("pylon_token", "tok_legacy");
+  store.set("pylon:revtrail:token", "tok_current");
+
+  configureClient({ appName: "revtrail" });
+
+  expect(store.get("pylon:revtrail:token")).toBe("tok_current");
+});