@rebasepro/client 0.10.1-canary.d8d45b2 → 0.10.1-canary.ff9ccd6

package/dist/auth.d.ts

@@ -129,6 +129,7 @@ export declare function createAuth(transport: Transport, options?: CreateAuthOpt
     }>;
     signOut: () => Promise<void>;
     refreshSession: () => Promise<RebaseSession>;
+    handleUnauthorized: () => Promise<boolean>;
     getUser: () => Promise<User>;
     findUserByEmail: (email: string) => Promise<PublicUserProfile | null>;
     updateUser: (updates: {

package/dist/index.es.js

@@ -321,6 +321,34 @@ function createAuth(transport, options) {
 		transport.setToken(null);
 		emit("SIGNED_OUT", null);
 	}
+	/**
+	* Recover from a 401 on an ordinary API request.
+	*
+	* Returns `true` when the caller should retry — we minted a fresh access
+	* token. When the refresh is rejected *fatally* (the refresh token itself
+	* is invalid, expired or revoked) this client can no longer act as the
+	* user at all, so we drop the session and emit `SIGNED_OUT`. UIs gate on
+	* that event, so they show their login screen instead of leaving the user
+	* staring at "Invalid or expired token" on every view.
+	*
+	* Transient failures (offline, 5xx, backend restarting) keep the session:
+	* the scheduled refresh backs off and retries, and the token is very
+	* likely still good once the backend answers again.
+	*/
+	async function handleUnauthorized() {
+		if (!currentSession) return false;
+		if (authFlowMode !== "cookie" && !currentSession.refreshToken) {
+			abandonSessionLocally();
+			return false;
+		}
+		try {
+			await refreshSession();
+			return true;
+		} catch (err) {
+			if (isFatalRefreshError(err)) abandonSessionLocally();
+			return false;
+		}
+	}
 	async function attemptScheduledRefresh(attempt) {
 		try {
 			await refreshSession();
@@ -822,6 +850,7 @@ function createAuth(transport, options) {
 		signInWithSpotify,
 		signOut,
 		refreshSession,
+		handleUnauthorized,
 		getUser,
 		findUserByEmail,
 		updateUser,
@@ -5040,14 +5069,7 @@ function createRebaseClient(options) {
 				} catch (e) {}
 				return session?.accessToken || options.token || "";
 			},
-			onUnauthorized: options.onUnauthorized || (async () => {
-				try {
-					await auth.refreshSession();
-					return true;
-				} catch (e) {
-					return false;
-				}
-			})
+			onUnauthorized: options.onUnauthorized || (() => auth.handleUnauthorized())
 		});
 		auth.onAuthStateChange((event, session) => {
 			if (!ws) return;
@@ -5057,14 +5079,7 @@ function createRebaseClient(options) {
 			}
 		});
 	}
-	if (!options.onUnauthorized) transport.setOnUnauthorized(async () => {
-		try {
-			await auth.refreshSession();
-			return true;
-		} catch (e) {
-			return false;
-		}
-	});
+	if (!options.onUnauthorized) transport.setOnUnauthorized(() => auth.handleUnauthorized());
 	/**
 	* Suggest the closest known collection key for a mistyped accessor.
 	* Uses edit-distance-1 and prefix matching — no external dependency.