@qikdev/sdk 0.1.200 → 0.1.202

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qikdev/sdk",
-  "version": "0.1.200",
+  "version": "0.1.202",
   "type": "module",
   "description": "Promise based Javascript SDK",
   "main": "./dist/main.js",
@@ -10,6 +10,7 @@
     "dev": "vite build --watch",
     "test": "mocha  --colors ./test/*.spec.js",
     "test:watch": "mocha  --colors -w ./test/*.spec.js",
+    "test:auth": "yarn build && node test/server.js",
     "document": "jsdoc -r  . -d public/docs -c jsdoc.conf README.md"
   },
   "exports": {

package/src/api/qik.auth.js

@@ -1,5 +1,6 @@
 import axios from 'axios';
 import { EventDispatcher } from './qik.utils.js';
+import { createStorageAdapter } from './qik.storage.js';
 
 ///////////////////////////////////////////////////
 
@@ -23,19 +24,27 @@ var QikAuth = function(qik) {
 
     ///////////////////////////////////////////////////
 
-    var sessionStorage = {};
-    var store = sessionStorage;
+    // Create storage adapter based on configuration
+    const storageAdapter = createStorageAdapter({
+        useHttpOnlyCookies: qik.useHttpOnlyCookies,
+        cookieConfig: qik.cookieConfig
+    });
+
     const tokenBufferSeconds = 10;
 
     ///////////////////////////////////////////////////
 
     const service = {
         debug: false,
+        storageAdapter: storageAdapter,
     }
 
+    // Backwards compatibility - keep store reference
     Object.defineProperty(service, 'store', {
-        value: store,
-        writable: false,
+        get: function() {
+            return { user: storageAdapter.getUser() };
+        },
+        enumerable: true
     });
 
     //Create a new dispatcher
@@ -47,7 +56,7 @@ var QikAuth = function(qik) {
     function dispatch(parameters) {
 
         //Get the current user
-        var user = store.user;
+        var user = storageAdapter.getUser();
 
         //Dispatch the change to the listeners
         if (service.onChange) {
@@ -75,8 +84,9 @@ var QikAuth = function(qik) {
 
     service.set = function(user, parameters, stopDispatch) {
 
-        if (JSON.stringify(store.user) != JSON.stringify(user)) {
-            store.user = user;
+        const currentUser = storageAdapter.getUser();
+        if (JSON.stringify(currentUser) != JSON.stringify(user)) {
+            storageAdapter.setUser(user);
             if (!stopDispatch) {
                 return dispatch(parameters)
             }
@@ -95,7 +105,7 @@ var QikAuth = function(qik) {
      */
 
     service.logout = function() {
-        delete store.user;
+        storageAdapter.clearUser();
         qik.cache.reset();
         return dispatch()
     }
@@ -288,6 +298,15 @@ var QikAuth = function(qik) {
                 bypassInterceptor: true
             }
 
+            // Check if we're in cookie mode
+            const isCookieMode = storageAdapter.isCookieMode && storageAdapter.isCookieMode();
+            
+            if (isCookieMode) {
+                // Signal to backend that we want cookie-based auth
+                credentials.useCookies = true;
+                postOptions.withCredentials = true;
+            }
+
             /////////////////////////////////////////////
 
             var url = `${qik.apiURL}/user/login`;
@@ -305,7 +324,6 @@ var QikAuth = function(qik) {
 
                 if (autoAuthenticate) {
                     service.set(res.data);
-
                 }
 
                 resolve(res);
@@ -391,6 +409,15 @@ var QikAuth = function(qik) {
                 bypassInterceptor: true
             }
 
+            // Check if we're in cookie mode
+            const isCookieMode = storageAdapter.isCookieMode && storageAdapter.isCookieMode();
+            
+            if (isCookieMode) {
+                // Signal to backend that we want cookie-based auth
+                credentials.useCookies = true;
+                postOptions.withCredentials = true;
+            }
+
             /////////////////////////////////////////////
 
             var url = `${qik.apiURL}/user/signup`;
@@ -581,18 +608,29 @@ var QikAuth = function(qik) {
 
         var currentUser = service.getCurrentUser();
         if (!currentUser) {
-
             return Promise.reject('No user');
         }
 
+        // Check if we're in cookie mode
+        const isCookieMode = storageAdapter.isCookieMode && storageAdapter.isCookieMode();
+
+        if (isCookieMode) {
+            // In cookie mode, we can't check token expiry from JavaScript
+            // Just attempt a refresh if forced, otherwise let the server handle it
+            if (forceRefresh) {
+                return await service.refreshAccessToken();
+            } else {
+                // Return a placeholder - server will handle token validation
+                return 'cookie_mode_token';
+            }
+        }
+
+        // localStorage mode - existing token validation logic
         var { token } = currentUser;
         if (!token) {
-
             return Promise.reject('No token');
         }
 
-        /////////////////////////////////////////////////////
-
         //Check our date
         var now = new Date();
 
@@ -600,25 +638,18 @@ var QikAuth = function(qik) {
         //retiring the token
         now.setSeconds(now.getSeconds() + tokenBufferSeconds);
 
-        /////////////////////////////////////////////////////
-
         var expires = new Date(token.expires);
 
         if (forceRefresh) {
-            console.log('force refresh valid token', token.refreshToken)
             return await service.refreshAccessToken(token.refreshToken);
         }
 
         //If the token is still fresh
         if (now < expires) {
-
             return token;
         } else {
-
             return await service.refreshAccessToken(token.refreshToken);
         }
-
-
     }
 
     ///////////////////////////////////////////////////
@@ -627,78 +658,77 @@ var QikAuth = function(qik) {
 
     service.refreshAccessToken = async function(refreshToken) {
 
-        // /////////////////////////////////////////////
-
-        // if (appContext) {
-
-        // } else {
-
-        // }
-
-        // /////////////////////////////////////////////
-
         //If there is already a request in progress
         if (refreshContext.inflightRefreshRequest) {
-
             return refreshContext.inflightRefreshRequest;
         }
 
         /////////////////////////////////////////////////////
 
-        //Create an refresh request
+        // Check if we're in cookie mode
+        const isCookieMode = storageAdapter.isCookieMode && storageAdapter.isCookieMode();
 
+        //Create a refresh request
         refreshContext.inflightRefreshRequest = new Promise(function(resolve, reject) {
 
-            //Bypass the interceptor on all token refresh calls
-            //Because we don't need to add the access token etc onto it
+            let requestBody = {};
+            let requestOptions = {
+                bypassInterceptor: true,
+                withoutToken: true,
+            };
 
-            qik.api.post(`/user/refresh`, {
-                    refreshToken: refreshToken
-                }, {
-                    bypassInterceptor: true,
-                    withoutToken: true,
-                })
+            if (isCookieMode) {
+                // In cookie mode, refresh token is sent via httpOnly cookie
+                // No need to include it in the request body
+                requestOptions.withCredentials = true;
+            } else {
+                // In localStorage mode, send refresh token in request body
+                if (!refreshToken) {
+                    refreshContext.inflightRefreshRequest = null;
+                    return reject(new Error('No refresh token provided for localStorage mode'));
+                }
+                requestBody.refreshToken = refreshToken;
+            }
+
+            qik.api.post(`/user/refresh`, requestBody, requestOptions)
                 .then(function tokenRefreshComplete(res) {
 
                     //Update the user with any changes 
                     //returned back from the refresh request
-                    if (!res) {
-
+                    if (!res || !res.data) {
                         refreshContext.inflightRefreshRequest = null;
-                        return reject();
-
-                    } else {
-                        //Update with our new session
-                        service.set(res.data);
+                        return reject(new Error('Invalid refresh response'));
+                    }
 
+                    //Update with our new session
+                    service.set(res.data);
+                    dispatch();
 
-                        dispatch();
+                    // Return appropriate response based on mode
+                    if (isCookieMode) {
+                        // In cookie mode, just indicate success - tokens are in cookies
+                        resolve('cookie_token_refreshed');
+                    } else {
+                        // In localStorage mode, return the actual access token
+                        const newToken = res.data.token?.accessToken;
+                        if (newToken) {
+                            resolve(newToken);
+                        } else {
+                            reject(new Error('No access token in refresh response'));
+                        }
                     }
 
-                    //Resolve with the new token
-                    resolve(res.data.token);
-
                     //Remove the inflight request
                     setTimeout(function() {
                         refreshContext.inflightRefreshRequest = null;
-                    })
-
+                    });
 
                 })
                 .catch(function(err) {
-
-
-                    //TODO Check if invalid_refresh_token
-
-
-
                     setTimeout(function() {
                         refreshContext.inflightRefreshRequest = null;
                     });
                     reject(err);
-
-
-
                 });
         });
 
@@ -723,18 +753,26 @@ var QikAuth = function(qik) {
         return qik.api.get('/user')
             .then(function(res) {
 
-
                 if (res.data) {
-                    if (store.user) {
-                        Object.assign(store.user.session, res.data);
+                    const currentUser = storageAdapter.getUser();
+                    if (currentUser) {
+                        // Update the session data within the current user object
+                        const updatedUser = { ...currentUser };
+                        if (updatedUser.session) {
+                            Object.assign(updatedUser.session, res.data);
+                        } else {
+                            updatedUser.session = res.data;
+                        }
+                        service.set(updatedUser);
+                    } else {
+                        // No current user, set the response data as new user
+                        service.set(res.data);
                     }
                 } else {
                     service.set(null);
                 }
 
-
                 retryCount = 0;
-
                 dispatch();
             })
             .catch(function(err) {
@@ -749,7 +787,6 @@ var QikAuth = function(qik) {
                 // service.sync();
                 // }
 
-
             });
     }
 
@@ -763,7 +800,7 @@ var QikAuth = function(qik) {
      * const me = sdk.auth.getCurrentUser();
      */
     service.getCurrentUser = function() {
-        return store.user;
+        return storageAdapter.getUser();
     }
 
 
@@ -777,7 +814,13 @@ var QikAuth = function(qik) {
      */
     service.getCurrentToken = function() {
 
+        // First try to get token from storage adapter
+        var accessToken = storageAdapter.getAccessToken();
+        if (accessToken) {
+            return accessToken;
+        }
 
+        // For localStorage mode, check user object for token
         var user = service.getCurrentUser();
 
         //User is not logged in
@@ -819,7 +862,21 @@ var QikAuth = function(qik) {
 
             //////////////////////////////
 
-            var userDetails = await service.getCurrentUser();
+            // Check if we're in cookie mode
+            const isCookieMode = storageAdapter.isCookieMode && storageAdapter.isCookieMode();
+
+            if (isCookieMode) {
+                // In cookie mode, browser automatically includes httpOnly cookies
+                // We don't need to manually add Authorization headers or handle token refresh
+                // Just ensure withCredentials is set for cross-origin requests
+                if (!originalRequest.withCredentials) {
+                    originalRequest.withCredentials = true;
+                }
+                return originalRequest;
+            }
+
+            // localStorage mode - existing logic for manual token management
+            var userDetails = service.getCurrentUser();
             var accessToken;
             var refreshToken;
             var expiryDate;
@@ -839,11 +896,8 @@ var QikAuth = function(qik) {
             if (accessToken) {
                 //Set the token of the request as the user's access token
                 originalRequest.headers['Authorization'] = `Bearer ${accessToken}`;
-
-
             } else {
                 //Return the original request without a token
-
                 return originalRequest;
             }
 
@@ -851,8 +905,6 @@ var QikAuth = function(qik) {
 
             //If no refresh token
             if (!refreshToken) {
-
-
                 //Continue with the original request
                 return originalRequest;
             }
@@ -935,4 +987,4 @@ var QikAuth = function(qik) {
 }
 
 
-export default QikAuth;
+export default QikAuth;

package/src/api/qik.core.js

@@ -21,15 +21,26 @@ import { EventDispatcher } from './qik.utils.js';
  * @constructor
  * @param {Object} options 
  * @param {String} options.apiURL    The remote URL of the Qik API you want to connect to. Options are 'staging', 'production' or you may set a specific URL eg. 'https://api.qik.io' (do not include trailing slash). If no value is provided, will default to 'production'.
- * @param {String} options.applicationToken When running as a static application, (for example a website) you may set the application's access token before you initialize the Qik instance here.  
+ * @param {String} options.applicationToken When running as a static application, (for example a website) you may set the application's access token before you initialize the Qik instance here.
+ * @param {Boolean} options.useHttpOnlyCookies When set to true, authentication tokens will be stored in secure httpOnly cookies instead of localStorage. This provides enhanced security against XSS attacks. Requires backend support for cookie-based authentication.
+ * @param {Object} options.cookieConfig Configuration options for cookie storage when useHttpOnlyCookies is true.
+ * @param {String} options.cookieConfig.domain Cookie domain (auto-detected if not specified).
+ * @param {Boolean} options.cookieConfig.secure Whether cookies should only be sent over HTTPS (default: true).
+ * @param {String} options.cookieConfig.sameSite SameSite cookie attribute ('strict', 'lax', or 'none', default: 'lax').
  * @example
  *
  * //Import the Qik package
  * import Qik from '@qikdev/sdk';
  *
- * //Create a new Qik instance
+ * //Create a new Qik instance with localStorage (default)
  * var qik = new Qik();
  *
+ * //Create a new Qik instance with httpOnly cookies
+ * var qik = new Qik({
+ *   apiURL: 'production',
+ *   useHttpOnlyCookies: true
+ * });
+ *
  * //Request the current user session endpoint from the Qik API
  * qik.api.get('/session').then(function(res) {
  *   console.log('User session is ', res.data);
@@ -243,4 +254,4 @@ export default function(options) {
 
     return core;
 
-}
+}