@returningai/widget-sdk 1.8.2 → 1.8.4

package/dist/rai-widget.js

@@ -12418,8 +12418,12 @@ async function authenticateServerless(config, state, onRefreshScheduled) {
       setTokens(config, state, data, onRefreshScheduled);
       state.isAuthenticated = true;
       return true;
-    } catch {
+    } catch (err) {
       if (is4xx || attempt === maxRetries) {
+        state.lastAuthError ?? (state.lastAuthError = {
+          status: 0,
+          error: err instanceof Error ? err.message : "Authentication failed"
+        });
         state.isAuthenticated = false;
         return false;
       }
@@ -12438,6 +12442,7 @@ async function authenticateViaProxy(config, state, onRefreshScheduled) {
       );
     }
     let is4xx = false;
+    let status = 0;
     try {
       const response = await fetch(config.authUrl, {
         method: "POST",
@@ -12445,6 +12450,7 @@ async function authenticateViaProxy(config, state, onRefreshScheduled) {
         headers: { "Content-Type": "application/json" }
       });
       if (!response.ok) {
+        status = response.status;
         is4xx = response.status >= 400 && response.status < 500;
         throw new Error(`HTTP ${response.status}`);
       }
@@ -12459,12 +12465,17 @@ async function authenticateViaProxy(config, state, onRefreshScheduled) {
       state.accessTokenExpiry = Date.now() + ttl * 1e3;
       state.refreshTokenExpiry = null;
       state.isAuthenticated = true;
+      state.lastAuthError = null;
       if (config.autoRefresh && onRefreshScheduled) {
         onRefreshScheduled();
       }
       return true;
-    } catch {
+    } catch (err) {
       if (is4xx || attempt === maxRetries) {
+        state.lastAuthError = {
+          status,
+          error: err instanceof Error ? err.message : "Authentication failed"
+        };
         state.isAuthenticated = false;
         return false;
       }
@@ -12480,10 +12491,16 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
   if (!state.refreshToken) {
     return false;
   }
+  const presentedRefreshToken = state.refreshToken;
   state.isRefreshing = true;
   state.refreshPromise = (async () => {
     const reauthenticateAfterRefreshFailure = async () => {
-      clearState(state);
+      if (state.refreshToken && state.refreshToken !== presentedRefreshToken && state.accessToken && state.accessTokenExpiry && Date.now() < state.accessTokenExpiry) {
+        state.isAuthenticated = true;
+        if (sendToken) sendToken();
+        return true;
+      }
+      clearAuthenticationData(state);
       clearStorage(config);
       const authed = await authenticateServerless(config, state, onRefreshScheduled);
       if (authed && sendToken) sendToken();
@@ -12494,7 +12511,7 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${state.refreshToken}`
+          Authorization: `Bearer ${presentedRefreshToken}`
         },
         body: JSON.stringify({
           widgetType: config.widgetType,
@@ -12513,6 +12530,7 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
         throw new Error("Invalid refresh response");
       }
       setTokens(config, state, data, onRefreshScheduled);
+      state.isAuthenticated = true;
       if (sendToken) sendToken();
       return true;
     } catch {
@@ -12615,15 +12633,13 @@ async function fetchErrorSettings(config, state, opts = {}) {
   applyErrorSettingsToState(state, data);
   return state.errorSettings;
 }
-function clearState(state) {
+function clearAuthenticationData(state) {
   state.accessToken = null;
   state.refreshToken = null;
   state.tokenFamily = null;
   state.accessTokenExpiry = null;
   state.refreshTokenExpiry = null;
   state.isAuthenticated = false;
-  state.isRefreshing = false;
-  state.refreshPromise = null;
   state.lastAuthError = null;
   state.widgetData = null;
   if (state.refreshTimer) {
@@ -12635,6 +12651,11 @@ function clearState(state) {
     state.syncTimer = null;
   }
 }
+function clearState(state) {
+  clearAuthenticationData(state);
+  state.isRefreshing = false;
+  state.refreshPromise = null;
+}
 const AUTO_THEME_LEASE_STATE = "__RAI_AUTO_THEME_LEASE_STATE__";
 const DISABLE_AUTO_THEME = "__DISABLE_AUTO_THEME__";
 function acquireAutoThemeDisableLease(target = window) {
@@ -12662,6 +12683,145 @@ function acquireAutoThemeDisableLease(target = window) {
     delete target[AUTO_THEME_LEASE_STATE];
   };
 }
+const REGISTRY_SYMBOL = Symbol.for("returningai.widget-sdk.auth-sessions.v1");
+function registry() {
+  const root = globalThis;
+  root[REGISTRY_SYMBOL] ?? (root[REGISTRY_SYMBOL] = /* @__PURE__ */ new Map());
+  return root[REGISTRY_SYMBOL];
+}
+function stableIdentity(config) {
+  const identifiers = Object.keys(config.userIdentifiers || {}).sort().map((key) => [key, config.userIdentifiers[key]]);
+  return JSON.stringify({
+    embedToken: config.embedToken || "",
+    userIdentifiers: identifiers
+  });
+}
+function stableHash(value) {
+  let first = 2166136261;
+  let second = 2654435769;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    first = Math.imul(first ^ code, 16777619) >>> 0;
+    second = Math.imul(second ^ code, 2246822507) >>> 0;
+  }
+  return `${first.toString(36)}${second.toString(36)}`;
+}
+function normalizeUrl(value) {
+  if (!value) return "";
+  try {
+    const parsed = new URL(value);
+    return `${parsed.origin.toLowerCase()}${parsed.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return value.replace(/\/+$/, "");
+  }
+}
+function createAuthScopeKey(config) {
+  const scope = JSON.stringify({
+    apiUrl: normalizeUrl(config.apiUrl),
+    authUrl: normalizeUrl(config.authUrl),
+    widgetId: config.widgetId,
+    widgetType: config.widgetType,
+    identity: stableIdentity(config)
+  });
+  return `rai-auth-v1:${stableHash(scope)}`;
+}
+function captureSnapshot(state) {
+  return {
+    accessToken: state.accessToken,
+    refreshToken: state.refreshToken,
+    tokenFamily: state.tokenFamily,
+    accessTokenExpiry: state.accessTokenExpiry,
+    refreshTokenExpiry: state.refreshTokenExpiry,
+    isAuthenticated: state.isAuthenticated,
+    lastAuthError: state.lastAuthError ? { ...state.lastAuthError } : null,
+    widgetData: state.widgetData
+  };
+}
+function applySnapshot(subscriber, snapshot) {
+  var _a;
+  Object.assign(subscriber.state, snapshot);
+  if (snapshot.refreshToken) saveToStorage(subscriber.config, subscriber.state);
+  else clearStorage(subscriber.config);
+  try {
+    (_a = subscriber.onSnapshot) == null ? void 0 : _a.call(subscriber);
+  } catch (error) {
+    console.error("[rai-widget] Auth session subscriber failed:", error);
+  }
+}
+function publishSnapshot(session, state) {
+  session.generation += 1;
+  session.snapshot = captureSnapshot(state);
+  for (const subscriber of session.subscribers) {
+    applySnapshot(subscriber, session.snapshot);
+  }
+}
+function hasUsableAuthenticatedSnapshot(session) {
+  const snapshot = session.snapshot;
+  return Boolean(
+    (snapshot == null ? void 0 : snapshot.isAuthenticated) && snapshot.accessToken && snapshot.accessTokenExpiry && Date.now() < snapshot.accessTokenExpiry
+  );
+}
+function subscribeAuthSession(config, state, onSnapshot) {
+  const sessions = registry();
+  const scopeKey = createAuthScopeKey(config);
+  let session = sessions.get(scopeKey);
+  if (!session) {
+    session = {
+      generation: 0,
+      snapshot: null,
+      inFlight: null,
+      subscribers: /* @__PURE__ */ new Set()
+    };
+    sessions.set(scopeKey, session);
+  }
+  const subscriber = { config, state, onSnapshot };
+  session.subscribers.add(subscriber);
+  if (session.snapshot) applySnapshot(subscriber, session.snapshot);
+  let released = false;
+  return {
+    run(operation, execute) {
+      if (released) return Promise.resolve(false);
+      if (operation === "authenticate" && hasUsableAuthenticatedSnapshot(session)) {
+        applySnapshot(subscriber, session.snapshot);
+        return Promise.resolve(true);
+      }
+      if (session.inFlight) return session.inFlight;
+      if (session.snapshot) applySnapshot(subscriber, session.snapshot);
+      const startingGeneration = session.generation;
+      const inFlight = (async () => {
+        const succeeded = await execute();
+        if (succeeded || session.generation === startingGeneration) {
+          publishSnapshot(session, state);
+        }
+        return succeeded;
+      })().finally(() => {
+        if (session.inFlight === inFlight) session.inFlight = null;
+        if (session.subscribers.size === 0) sessions.delete(scopeKey);
+      });
+      session.inFlight = inFlight;
+      return inFlight;
+    },
+    publish() {
+      if (!released) publishSnapshot(session, state);
+    },
+    clear() {
+      if (released) return;
+      state.accessToken = null;
+      state.refreshToken = null;
+      state.tokenFamily = null;
+      state.accessTokenExpiry = null;
+      state.refreshTokenExpiry = null;
+      state.isAuthenticated = false;
+      publishSnapshot(session, state);
+    },
+    release() {
+      if (released) return;
+      released = true;
+      session.subscribers.delete(subscriber);
+      if (session.subscribers.size === 0 && !session.inFlight) sessions.delete(scopeKey);
+    }
+  };
+}
 const BUNDLE_READY_TIMEOUT_MS = 3e4;
 function isPromiseLike(value) {
   return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
@@ -13847,6 +14007,7 @@ class BaseWidget extends HTMLElement {
     __publicField(this, "bannerNode", null);
     __publicField(this, "releaseAutoThemeDisableLease");
     __publicField(this, "bundleUnmount");
+    __publicField(this, "authSession");
     this.shadow = this.attachShadow({ mode: "closed" });
   }
   static get observedAttributes() {
@@ -13901,7 +14062,7 @@ class BaseWidget extends HTMLElement {
     }
   }
   disconnectedCallback() {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     (_a = this.intersectionObserver) == null ? void 0 : _a.disconnect();
     (_b = this.themeObserver) == null ? void 0 : _b.disconnect();
     (_c = this.identityAttributeObserver) == null ? void 0 : _c.disconnect();
@@ -13909,6 +14070,8 @@ class BaseWidget extends HTMLElement {
     this.clearLottieInstances();
     this.restoreLoaderHeight();
     this.removeBanner();
+    (_d = this.authSession) == null ? void 0 : _d.release();
+    this.authSession = void 0;
     clearState(this.state);
   }
   attributeChangedCallback(name, oldValue, newValue) {
@@ -14509,12 +14672,22 @@ class BaseWidget extends HTMLElement {
   }
   // ── Initialization ─────────────────────────────────────────────────────
   async init() {
+    var _a;
     const initId = ++this.initGeneration;
     this.hasAttemptedInit = true;
     if (!this.config.communityId) {
       this.showError();
       return;
     }
+    if (!this.config.authUrl && !this.authSession) {
+      this.authSession = subscribeAuthSession(this.config, this.state, () => {
+        if (this.config.autoRefresh) this.scheduleRefresh();
+        if (this.state.iframe) {
+          sendTokenToWidget(this.config, this.state, this.state.iframe);
+        }
+        syncBundleAccessToken(this.config, this.state);
+      });
+    }
     if (this.config.bundleUrl) {
       this.prepareBundleRuntimeEnvironment();
       warmBundleRuntime(
@@ -14527,9 +14700,9 @@ class BaseWidget extends HTMLElement {
       (options) => fetchErrorSettings(this.config, this.state, options)
     );
     const launchWidget = () => {
-      var _a;
+      var _a2;
       if (!this.isCurrentInit(initId)) return;
-      (_a = this.errorEl) == null ? void 0 : _a.classList.remove("visible");
+      (_a2 = this.errorEl) == null ? void 0 : _a2.classList.remove("visible");
       this.shadow.querySelectorAll(".rai-custom-error").forEach((el2) => el2.remove());
       let bannerGated = false;
       let bannerGateTimer = 0;
@@ -14571,7 +14744,10 @@ class BaseWidget extends HTMLElement {
       clearState(this.state);
       clearStorage(this.config);
       const authed2 = await finishStartup(
-        authenticateServerless(
+        this.authSession ? this.authSession.run(
+          "authenticate",
+          () => authenticateServerless(this.config, this.state)
+        ) : authenticateServerless(
           this.config,
           this.state,
           () => this.scheduleRefresh()
@@ -14586,10 +14762,22 @@ class BaseWidget extends HTMLElement {
       }
       return;
     }
-    const hasStored = loadFromStorage(this.config, this.state);
+    const hasSharedSession = Boolean(
+      this.state.isAuthenticated && this.state.accessToken && this.state.accessTokenExpiry && Date.now() < this.state.accessTokenExpiry
+    );
+    const hasStored = hasSharedSession || loadFromStorage(this.config, this.state);
     if (hasStored) {
+      if (hasSharedSession) {
+        this.emit("rai-authenticated");
+        launchWidget();
+        return;
+      }
+      (_a = this.authSession) == null ? void 0 : _a.publish();
       const refreshed = await finishStartup(
-        refreshAccessToken(
+        this.authSession ? this.authSession.run(
+          "refresh",
+          () => refreshAccessToken(this.config, this.state)
+        ) : refreshAccessToken(
           this.config,
           this.state,
           () => this.scheduleRefresh()
@@ -14606,7 +14794,10 @@ class BaseWidget extends HTMLElement {
       return;
     }
     const authed = await finishStartup(
-      authenticateServerless(
+      this.authSession ? this.authSession.run(
+        "authenticate",
+        () => authenticateServerless(this.config, this.state)
+      ) : authenticateServerless(
         this.config,
         this.state,
         () => this.scheduleRefresh()
@@ -14847,13 +15038,18 @@ class BaseWidget extends HTMLElement {
           () => this.scheduleRefresh()
         );
         if (ok) pushToken();
+        else this.handleSessionExpired();
       } else {
-        await refreshAccessToken(
+        const ok = this.authSession ? await this.authSession.run(
+          "refresh",
+          () => refreshAccessToken(this.config, this.state)
+        ) : await refreshAccessToken(
           this.config,
           this.state,
           () => this.scheduleRefresh(),
           pushToken
         );
+        if (!ok) this.handleSessionExpired();
       }
     };
     if (delay > 0) {
@@ -14869,18 +15065,51 @@ class BaseWidget extends HTMLElement {
         sendTokenToWidget(this.config, this.state, iframe);
     }, 12e4);
   }
+  /**
+   * A background refresh exhausted every recovery path — /auth/refresh failed
+   * and the re-auth that follows it failed too, so `state.isAuthenticated` is
+   * now false and there is no live token.
+   *
+   * Every startup auth path already calls showError() on failure; this one is
+   * reached from a timer, so without it the widget stays mounted showing stale
+   * content while isAuthenticated() reports false to the host page — which is
+   * how a signed-in user ends up looking at content meant for signed-out users.
+   * The event gives hosts a signal to re-mint credentials instead of polling.
+   */
+  handleSessionExpired() {
+    var _a;
+    if (this.state.refreshTimer) {
+      clearTimeout(this.state.refreshTimer);
+      this.state.refreshTimer = null;
+    }
+    (_a = this.state).lastAuthError ?? (_a.lastAuthError = {
+      status: 401,
+      error: "Session expired",
+      hint: "The widget session could not be renewed. Reload to sign in again."
+    });
+    this.emit("rai-session-expired", {
+      communityId: this.config.communityId,
+      widgetType: this.config.widgetType,
+      lastAuthError: this.state.lastAuthError ?? void 0
+    });
+    this.showError();
+  }
   // ── Logout helper ─────────────────────────────────────────────────────
   async logoutAndClear() {
+    var _a;
     await logout(this.config, this.state);
+    (_a = this.authSession) == null ? void 0 : _a.clear();
     this.teardownMountedWidget();
     this.removeBanner();
     this.emit("rai-logout");
   }
   // ── Public API ────────────────────────────────────────────────────────
   async reload() {
-    var _a;
+    var _a, _b;
     const previousConfig = this.config;
-    this.config = readConfig(this, (_a = this.config) == null ? void 0 : _a.communityId);
+    (_a = this.authSession) == null ? void 0 : _a.release();
+    this.authSession = void 0;
+    this.config = readConfig(this, (_b = this.config) == null ? void 0 : _b.communityId);
     this.identitySignature = identitySignatureForConfig(this.config);
     this.style.width = this.config.width;
     this.style.height = this.config.height;
@@ -15024,7 +15253,7 @@ class CustomWidget extends BaseWidget {
     }
   }
 }
-console.log(`[rai-widget] v${"1.8.2"}`);
+console.log(`[rai-widget] v${"1.8.4"}`);
 class StoreWidgetCompat extends StoreWidget {
 }
 const WIDGET_REGISTRY = [
@@ -15088,7 +15317,7 @@ function exposePublicApi() {
   })();
   const widget = container == null ? void 0 : container.querySelector(ALL_WIDGET_SELECTOR);
   window.ReturningAIWidget = {
-    version: "1.8.2",
+    version: "1.8.4",
     reload: () => (widget == null ? void 0 : widget.reload()) ?? Promise.resolve(),
     logout: () => (widget == null ? void 0 : widget.logoutPublic()) ?? Promise.resolve(),
     isAuthenticated: () => (widget == null ? void 0 : widget.isAuthenticated()) ?? false,

package/dist/types/BaseWidget.d.ts

@@ -22,6 +22,7 @@ export declare abstract class BaseWidget extends HTMLElement {
     private bannerNode;
     private releaseAutoThemeDisableLease?;
     private bundleUnmount?;
+    private authSession?;
     constructor();
     registerCallback<K extends keyof ReturningAIWidgetCallbackMap>(callbackName: K, callback: ReturningAIWidgetCallbackMap[K]): void;
     registerCallback(callbackName: string, callback: ReturningAIWidgetCallback): void;
@@ -110,6 +111,18 @@ export declare abstract class BaseWidget extends HTMLElement {
     private mountWidget;
     private scheduleRefresh;
     private schedulePeriodicSync;
+    /**
+     * A background refresh exhausted every recovery path — /auth/refresh failed
+     * and the re-auth that follows it failed too, so `state.isAuthenticated` is
+     * now false and there is no live token.
+     *
+     * Every startup auth path already calls showError() on failure; this one is
+     * reached from a timer, so without it the widget stays mounted showing stale
+     * content while isAuthenticated() reports false to the host page — which is
+     * how a signed-in user ends up looking at content meant for signed-out users.
+     * The event gives hosts a signal to re-mint credentials instead of polling.
+     */
+    private handleSessionExpired;
     private logoutAndClear;
     reload(): Promise<void>;
     logoutPublic(): Promise<void>;

package/dist/types/core/auth-session-coordinator.d.ts

@@ -0,0 +1,11 @@
+import type { WidgetConfig, WidgetState } from '../types';
+export type AuthSessionOperation = 'authenticate' | 'refresh';
+export interface AuthSessionSubscription {
+    run(operation: AuthSessionOperation, execute: () => Promise<boolean>): Promise<boolean>;
+    publish(): void;
+    clear(): void;
+    release(): void;
+}
+export declare function createAuthScopeKey(config: WidgetConfig): string;
+export declare function subscribeAuthSession(config: WidgetConfig, state: WidgetState, onSnapshot?: () => void): AuthSessionSubscription;
+export declare function resetAuthSessionCoordinatorForTests(): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@returningai/widget-sdk",
-  "version": "1.8.2",
+  "version": "1.8.4",
   "description": "Shadow DOM isolated widget SDK for ReturningAI",
   "main": "dist/rai-widget.iife.js",
   "module": "dist/rai-widget.js",
@@ -25,12 +25,15 @@
     "build:all": "npm run build && npm run build:banner",
     "build:all:min": "npm run build:min && npm run build:banner:min",
     "types": "tsc --emitDeclarationOnly --outDir dist/types && cp src/jsx.d.ts dist/types/jsx.d.ts",
-    "test": "npm run test:host-callback && npm run test:bundle-readiness && npm run test:bundle-runtime-cache && npm run test:bundle-token-sync && npm run test:auth-bootstrap && npm run test:startup-performance && npm run test:jsx-types",
+    "test": "npm run test:host-callback && npm run test:bundle-readiness && npm run test:bundle-runtime-cache && npm run test:bundle-token-sync && npm run test:auth-bootstrap && npm run test:auth-error-reporting && npm run test:auth-refresh-state && npm run test:auth-session-coordinator && npm run test:startup-performance && npm run test:jsx-types",
     "test:host-callback": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/postmessage-host-callback.test.js",
     "test:bundle-readiness": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/bundle-readiness.test.js",
     "test:bundle-runtime-cache": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/bundle-runtime-cache.test.js",
     "test:bundle-token-sync": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/bundle-token-sync.test.js",
     "test:auth-bootstrap": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-bootstrap.test.js",
+    "test:auth-error-reporting": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-error-reporting.test.js",
+    "test:auth-refresh-state": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-refresh-state.test.js",
+    "test:auth-session-coordinator": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/auth-session-coordinator.test.js",
     "test:startup-performance": "rm -rf test/.tmp && tsc -p test/tsconfig.json && node test/.tmp/test/startup-performance.test.js",
     "test:jsx-types": "tsc --noEmit --strict --lib ES2020,DOM --skipLibCheck false src/jsx.d.ts",
     "coverage:repowise": "rm -rf coverage && npm run coverage:host-callback && npm run coverage:bundle-readiness && npm run test:jsx-types",
@@ -48,4 +51,4 @@
     "dompurify": "^3.4.12",
     "lottie-web": "^5.13.0"
   }
-}
+}