@scaleway/auth-scw 1.0.4 → 1.1.0

package/README.md

@@ -12,6 +12,46 @@ pnpm add @scaleway/auth-scw
 
 ...
 
+### Choosing a storage backend
+
+By default, the JWT and audienceId are persisted in **cookies**. You can opt-in
+to **localStorage** with the `storageType` option:
+
+```tsx
+<AuthScwProvider
+  // ...other props
+  storageType="localStorage"
+>
+  {children}
+</AuthScwProvider>
+```
+
+| `storageType`    | Pros                                                        | Cons                                                              |
+| ---------------- | ----------------------------------------------------------- | ----------------------------------------------------------------- |
+| `'cookie'`       | Cross-tab synchronisation, sent to the server automatically | Size limits (~4KB), sent on every request                         |
+| `'localStorage'` | Larger storage limit (~5MB), not sent on every HTTP request | Origin-scoped, no cross-tab sync (use `storage` events if needed) |
+
+### Live migration from cookie to localStorage
+
+When switching from `'cookie'` to `'localStorage'` on an already-deployed app,
+set `migrateFromCookie` to migrate any existing cookie-based session to
+localStorage on provider initialization (then clean up the cookies):
+
+```tsx
+<AuthScwProvider
+  // ...other props
+  storageType="localStorage"
+  migrateFromCookie
+>
+  {children}
+</AuthScwProvider>
+```
+
+The migration runs **once**, before the provider reads the active storage. It is
+idempotent and safe to keep enabled even after all users have migrated — it is a
+no-op when nothing is found in cookies. You can also invoke it manually via the
+exported `migrateCookieToLocalStorage()` helper.
+
 ## How to dev
 
 ### Prerequisites

package/dist/constants.js

@@ -8,7 +8,8 @@ const EmptySession = {
 		issuerId: "",
 		jti: "",
 		updatedAt: void 0,
-		userAgent: ""
+		userAgent: "",
+		srn: ""
 	},
 	renewToken: "",
 	token: ""

package/dist/index.d.ts

@@ -1,6 +1,8 @@
-import { AudienceIdType, AuthScwContextType, EncodedJWT } from "./types/index.js";
+import { COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, getUniqueHostnameString } from "./useAuthScw/authStoreManager/constants.js";
+import { AuthStoreManager, createAuthStoreManager } from "./useAuthScw/authStoreManager/authStoreManager.js";
+import "./useAuthScw/authStoreManager/index.js";
+import { AudienceIdType, AuthScwContextType, EncodedJWT, StorageType } from "./types/index.js";
 import { EmptySession } from "./constants.js";
 import { AuthScwProvider, useAuthScw } from "./useAuthScw/AuthScwProvider.js";
 import "./useAuthScw/index.js";
-import { AuthStoreManager } from "./useAuthScw/authStoreManager.js";
-export { type AudienceIdType, type AuthScwContextType, AuthScwProvider, AuthStoreManager, EmptySession, type EncodedJWT, useAuthScw };
+export { type AudienceIdType, type AuthScwContextType, AuthScwProvider, AuthStoreManager, COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, EmptySession, type EncodedJWT, type StorageType, createAuthStoreManager, getUniqueHostnameString, useAuthScw };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { EmptySession } from "./constants.js";
-import { AuthStoreManager } from "./useAuthScw/authStoreManager.js";
+import { COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, getUniqueHostnameString } from "./useAuthScw/authStoreManager/constants.js";
+import { AuthStoreManager, createAuthStoreManager } from "./useAuthScw/authStoreManager/authStoreManager.js";
 import { AuthScwProvider, useAuthScw } from "./useAuthScw/AuthScwProvider.js";
-export { AuthScwProvider, AuthStoreManager, EmptySession, useAuthScw };
+export { AuthScwProvider, AuthStoreManager, COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, EmptySession, createAuthStoreManager, getUniqueHostnameString, useAuthScw };

package/dist/types/dist/index.d.ts

@@ -0,0 +1,13 @@
+//#region ../types/dist/index.d.ts
+/**
+ * A utility used for XOR: marks every key that is only in T (and not in U)
+ * as optional-never, effectively requiring those keys to be absent.
+ */
+export type Without<T, U> = Partial<Record<Exclude<keyof T, keyof U>, never>>;
+/**
+ * Exclusive-or of two object types: produces a type that is either
+ * (T without any U-specific keys) OR (U without any T-specific keys),
+ * so only one of them may be present. For non-object unions it falls back to T | U.
+ */
+export type SingleXOR<T, U> = T | U extends object ? (Without<T, U> & U) | (Without<U, T> & T) : T | U;
+//#endregion

package/dist/types/index.d.ts

@@ -1,3 +1,5 @@
+import { AuthStoreManagerInstance } from "../useAuthScw/authStoreManager/authStoreManager.js";
+import "../useAuthScw/authStoreManager/index.js";
 import { Iamv1alpha1 } from "./iam/index.js";
 import { audienceIdSchema, jwtSchema } from "../zodSchemas.js";
 import { z } from "zod";
@@ -11,7 +13,7 @@ export type OnError = (onError: {
   extra?: Record<string, unknown>;
 }) => void;
 type GetJWT = (audienceId?: string) => Promise<(EncodedJWT & {
-  source: 'refreshSession' | 'cookie';
+  source: 'refreshSession' | 'storage';
 }) | undefined>;
 type GetJwtTokenResponse = NonNullable<Awaited<ReturnType<GetJWT>>>['token'] | undefined;
 export type AuthScwContextType = {
@@ -25,6 +27,7 @@ export type AuthScwContextType = {
   getJwtToken: (audienceId?: string) => Promise<GetJwtTokenResponse>;
   logout: () => void;
   authenticated: boolean;
+  storeManager: AuthStoreManagerInstance;
 };
 export declare class IamV1alpha1API extends API {
   deleteJWT: Iamv1alpha1.API['deleteJWT'];
@@ -45,4 +48,19 @@ export type CookieConfigType = {
   sameSite: 'lax' | 'none' | 'strict' | boolean | undefined;
   secure: boolean;
 };
+export type CookieOptions = {
+  /** Suffix appended to storage keys to namespace sessions. */
+  suffix: string;
+  /** Cookie attributes (httpOnly, path, sameSite, secure). Defaults to `COOKIE_CONFIG`. */
+  config?: CookieConfigType;
+  /** Cookie max-age in seconds. Defaults to `COOKIE_AGE` (31 days). */
+  age?: number;
+};
+/**
+ * Where the JWT and audienceId are persisted.
+ *
+ * - `'cookie'` (default): backward-compatible, allows synchronisation across tabs.
+ * - `'localStorage'`: scoped to a single origin, survives reloads, avoids cookie size limits.
+ */
+export type StorageType = 'cookie' | 'localStorage';
 //#endregion

package/dist/useAuthScw/AuthScwProvider.d.ts

@@ -1,13 +1,28 @@
-import { AuthScwContextType, ConfigAuthProvider, CookieConfigType, OnError } from "../types/index.js";
+import { AuthScwContextType, ConfigAuthProvider, CookieOptions, OnError } from "../types/index.js";
+import { SingleXOR } from "../types/dist/index.js";
 import { ReactNode } from "react";
 //#region src/useAuthScw/AuthScwProvider.d.ts
+type CookieStorageOptions = {
+  storageType?: 'cookie';
+  cookie: CookieOptions;
+};
+type LocalStorageOptions = {
+  storageType: 'localStorage';
+  cookie?: CookieOptions;
+};
 export type AuthProviderParamType = ConfigAuthProvider & {
   children: ReactNode;
-  cookieSuffix: string;
   urlParamTokenName: string;
   onError?: OnError;
-  cookieConfig?: CookieConfigType;
-};
+  /**
+   * When `true` and `storageType` is `'localStorage'`, any JWT/audienceId
+   * previously stored in cookies will be migrated to localStorage on
+   * initialization, then removed from cookies. Useful for live migrations.
+   *
+   * Defaults to `false`.
+   */
+  migrateFromCookie?: boolean;
+} & SingleXOR<CookieStorageOptions, LocalStorageOptions>;
 export declare const useAuthScw: () => AuthScwContextType;
-export declare const AuthScwProvider: ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alpha1, children, cookieSuffix, cookieConfig, urlParamTokenName, onError }: AuthProviderParamType) => import("react").JSX.Element;
+export declare const AuthScwProvider: ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alpha1, children, cookie, urlParamTokenName, onError, storageType, migrateFromCookie }: AuthProviderParamType) => import("react").JSX.Element;
 //#endregion

package/dist/useAuthScw/AuthScwProvider.js

@@ -1,56 +1,66 @@
 import { isExpired } from "../isExpired.js";
-import { AuthStoreManager, setCookieConfig } from "./authStoreManager.js";
+import { createAuthStoreManager } from "./authStoreManager/authStoreManager.js";
 import { clientSingleton } from "./createClient.js";
-import { decodeToken, encodeToken, getCookieJWT, refreshSession } from "./helpers.js";
+import { decodeToken, encodeToken, getStoredJWT, refreshSession } from "./helpers.js";
 import { proxyJwt } from "./proxyJwt.js";
 import { createContext, useCallback, useContext, useMemo, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/useAuthScw/AuthScwProvider.tsx
 const AuthScwContext = createContext({});
 const useAuthScw = () => useContext(AuthScwContext);
-const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alpha1, children, cookieSuffix, cookieConfig, urlParamTokenName, onError }) => {
-	if (cookieConfig) setCookieConfig(cookieConfig);
+const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alpha1, children, cookie, urlParamTokenName, onError, storageType = "cookie", migrateFromCookie = false }) => {
+	const storeManager = useMemo(() => createAuthStoreManager({
+		storageType,
+		cookieConfig: cookie?.config,
+		cookieAge: cookie?.age,
+		suffixKey: cookie?.suffix
+	}), [
+		storageType,
+		cookie?.config,
+		cookie?.age,
+		cookie?.suffix
+	]);
 	clientSingleton.setAPIsAndSettings({
 		clientSettings,
 		IamV1Alpha1,
 		IamUnauthenticatedV1Alpha1
 	});
-	const initAudienceId = useCallback(() => {
-		AuthStoreManager.setSuffixKey(cookieSuffix);
+	const initAudienceId = () => {
+		if (storageType === "localStorage" && migrateFromCookie) storeManager.migrateCookieToLocalStorage();
 		const currentUrl = new URL(globalThis.location.href);
 		const tokenRaw = currentUrl.searchParams.get(urlParamTokenName);
 		if (tokenRaw) {
 			currentUrl.searchParams.delete(urlParamTokenName);
-			const token = decodeToken(tokenRaw);
+			const token = decodeToken(tokenRaw, storeManager);
 			if (token) {
 				const jwtProxy = proxyJwt(token);
-				if (jwtProxy.jwt) AuthStoreManager.setJwt({ jwtInfo: jwtProxy });
+				if (jwtProxy.jwt) storeManager.setJwt({ jwtInfo: jwtProxy });
 				globalThis.history.replaceState({}, "", currentUrl);
 				return jwtProxy.jwt?.audienceId;
 			}
 		}
-		const audienceId = AuthStoreManager.getAudienceId();
+		const audienceId = storeManager.getAudienceId();
 		if (audienceId) {
-			if (AuthStoreManager.getJwt(audienceId)) return audienceId;
+			if (storeManager.getJwt(audienceId)) return audienceId;
 		}
-	}, [cookieSuffix, urlParamTokenName]);
+	};
 	const [currentAudienceId, setCurrentAudienceId] = useState(() => initAudienceId());
 	const setJWT = useCallback((jwtInfoParam) => {
 		const currentJWT = proxyJwt(jwtInfoParam);
 		if (currentJWT.jwt?.audienceId) {
-			AuthStoreManager.setJwt({ jwtInfo: currentJWT });
+			storeManager.setJwt({ jwtInfo: currentJWT });
 			setCurrentAudienceId(currentJWT.jwt.audienceId);
 		}
-	}, [setCurrentAudienceId]);
+	}, [setCurrentAudienceId, storeManager]);
 	const getJWT = useCallback(async (audienceId = currentAudienceId) => {
 		if (audienceId) {
-			const cookieJWT = getCookieJWT(audienceId);
-			if (cookieJWT?.jwt) {
-				const { renewToken, token, jwt: currentJWT } = cookieJWT;
+			const storedJWT = getStoredJWT(audienceId, storeManager);
+			if (storedJWT?.jwt) {
+				const { renewToken, token, jwt: currentJWT } = storedJWT;
 				if (currentJWT.expiresAt && !isExpired(new Date(currentJWT.expiresAt))) return {
 					jwt: currentJWT,
 					renewToken,
-					source: "cookie",
+					source: "storage",
 					token
 				};
 				const jwtInfoData = await refreshSession({
@@ -72,7 +82,8 @@ const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alph
 	}, [
 		currentAudienceId,
 		setJWT,
-		onError
+		onError,
+		storeManager
 	]);
 	const getJwtToken = useCallback(async (audienceId) => {
 		const currentJWT = await getJWT(audienceId);
@@ -80,37 +91,42 @@ const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alph
 	}, [getJWT]);
 	const logout = useCallback(() => {
 		if (currentAudienceId) {
-			const cookieJWT = getCookieJWT(currentAudienceId);
-			AuthStoreManager.deleteJwt(currentAudienceId);
-			if (cookieJWT?.jwt) {
+			const storedJWT = getStoredJWT(currentAudienceId, storeManager);
+			storeManager.deleteJwt(currentAudienceId);
+			if (storedJWT?.jwt) {
 				const { deleteJWT } = clientSingleton.createClient({ getAsyncToken: getJwtToken });
-				deleteJWT?.({ jti: cookieJWT.jwt.jti }).catch(() => null);
+				deleteJWT?.({ jti: storedJWT.jwt.jti }).catch(() => null);
 			}
 		}
-		AuthStoreManager.deleteAudienceId();
+		storeManager.deleteAudienceId();
 		setCurrentAudienceId(void 0);
-	}, [getJwtToken, currentAudienceId]);
+	}, [
+		getJwtToken,
+		currentAudienceId,
+		storeManager
+	]);
 	const jti = useMemo(() => {
 		if (currentAudienceId) {
-			const cookieJWT = getCookieJWT(currentAudienceId);
-			if (cookieJWT?.jwt) return cookieJWT.jwt.jti;
+			const storedJWT = getStoredJWT(currentAudienceId, storeManager);
+			if (storedJWT?.jwt) return storedJWT.jwt.jti;
 		}
-	}, [currentAudienceId]);
-	const isAuthenticated = useMemo(() => Boolean(currentAudienceId && getCookieJWT(currentAudienceId)), [currentAudienceId]);
+	}, [currentAudienceId, storeManager]);
+	const isAuthenticated = useMemo(() => Boolean(currentAudienceId && getStoredJWT(currentAudienceId, storeManager)), [currentAudienceId, storeManager]);
 	const setAudienceId = useCallback((audienceId) => {
 		setCurrentAudienceId(audienceId);
 	}, []);
 	const value = useMemo(() => ({
 		audienceId: currentAudienceId ?? void 0,
 		authenticated: isAuthenticated,
-		decodeToken,
+		decodeToken: (encodedToken) => decodeToken(encodedToken, storeManager),
 		encodeToken,
 		getJWT,
 		getJwtToken,
 		jti,
 		logout,
 		setAudienceId,
-		setJWT
+		setJWT,
+		storeManager
 	}), [
 		getJWT,
 		getJwtToken,
@@ -119,7 +135,8 @@ const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alph
 		setAudienceId,
 		currentAudienceId,
 		isAuthenticated,
-		jti
+		jti,
+		storeManager
 	]);
 	return /* @__PURE__ */ jsx(AuthScwContext, {
 		value,

package/dist/useAuthScw/authStoreManager/authStoreManager.d.ts

@@ -0,0 +1,59 @@
+import { CreateAuthStoreManagerOptions } from "./types.js";
+import { COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, getUniqueHostnameString } from "./constants.js";
+import { AudienceIdType, EncodedJWT, StorageType } from "../../types/index.js";
+//#region src/useAuthScw/authStoreManager/authStoreManager.d.ts
+export type AuthStoreManagerInstance = ReturnType<typeof createAuthStoreManager>;
+/**
+ * Factory that creates an isolated AuthStoreManager instance with its own
+ * immutable `storageType`, `suffixKey`, and cookie config (`cookieConfig`/`cookieAge`).
+ *
+ * Each instance owns its own backends, so multiple providers can coexist
+ * without clobbering each other's config. The `storageType` is set at creation
+ * time and cannot be changed afterwards — use {@link createAuthStoreManager}
+ * to create a new instance with a different storage type.
+ *
+ * Accepts either an options object `{ storageType, cookieConfig, cookieAge }`
+ * or, for backward compatibility, a bare `StorageType` string.
+ *
+ * For backward compatibility, a default singleton `AuthStoreManager` is also
+ * exported below.
+ */
+export declare const createAuthStoreManager: (param?: StorageType | CreateAuthStoreManagerOptions) => {
+  COOKIE_AGE: number;
+  DOMAIN: string;
+  deleteAllJwts(): void;
+  deleteAudienceId(): void;
+  deleteJwt(audienceId: string): void;
+  getAudienceId(): string | null;
+  getJwt(audienceId: string): EncodedJWT | null;
+  getKeyAudienceId(): string;
+  getKeySession(audienceId: string): string;
+  getStorageType(): StorageType;
+  getUniqueHostnameString: typeof getUniqueHostnameString;
+  /**
+   * Migrates any existing JWT and audienceId stored in cookies to localStorage,
+   * then removes the cookie entries. Safe to call repeatedly — it is a no-op when
+   * nothing is stored in cookies.
+   *
+   * Accesses the cookie and localStorage backends directly without changing
+   * the instance's active `storageType`.
+   */
+  migrateCookieToLocalStorage(): {
+    migrated: boolean;
+    audienceId?: string;
+  };
+  setAudienceId(audienceId: string): void;
+  setJwt({ jwtInfo, setAudienceId }: {
+    jwtInfo: EncodedJWT;
+    setAudienceId?: boolean;
+  }): void;
+  readonly SUFFIX_KEY: string;
+  typeGuardAudienceId(untypedObject: unknown): untypedObject is AudienceIdType;
+  typeGuardJWT(untypedObject: unknown): untypedObject is EncodedJWT;
+};
+/**
+ * @deprecated Use `useAuthScw().storeManager` or `createAuthStoreManager()` instead.
+ * The singleton bypasses the provider's configuration and shares global state across all providers.
+ */
+export declare const AuthStoreManager: AuthStoreManagerInstance;
+//#endregion

package/dist/useAuthScw/authStoreManager/authStoreManager.js

@@ -0,0 +1,143 @@
+import { COOKIE_AGE, DOMAIN, getUniqueHostnameString } from "./constants.js";
+import { audienceIdSchema, jwtSchema } from "../../zodSchemas.js";
+import { createCookieBackend } from "./cookieBackend.js";
+import { createLocalStorageBackend } from "./localStorageBackend.js";
+//#region src/useAuthScw/authStoreManager/authStoreManager.ts
+const KEY_SESSION = "_scw_session";
+const KEY_AUDIENCE_ID = "_scw_audience_id";
+const DEFAULT_SUFFIX_KEY = "";
+const buildBackends = (options) => ({
+	cookie: createCookieBackend({
+		cookieConfig: options.cookieConfig,
+		cookieAge: options.cookieAge
+	}),
+	localStorage: createLocalStorageBackend()
+});
+const normalizeOptions = (param) => typeof param === "string" ? { storageType: param } : param ?? {};
+/**
+* Factory that creates an isolated AuthStoreManager instance with its own
+* immutable `storageType`, `suffixKey`, and cookie config (`cookieConfig`/`cookieAge`).
+*
+* Each instance owns its own backends, so multiple providers can coexist
+* without clobbering each other's config. The `storageType` is set at creation
+* time and cannot be changed afterwards — use {@link createAuthStoreManager}
+* to create a new instance with a different storage type.
+*
+* Accepts either an options object `{ storageType, cookieConfig, cookieAge }`
+* or, for backward compatibility, a bare `StorageType` string.
+*
+* For backward compatibility, a default singleton `AuthStoreManager` is also
+* exported below.
+*/
+const createAuthStoreManager = (param) => {
+	const options = normalizeOptions(param);
+	const storageType = options.storageType ?? "cookie";
+	const suffixKey = options.suffixKey ? `_${options.suffixKey}` : DEFAULT_SUFFIX_KEY;
+	const backends = buildBackends(options);
+	const getBackend = () => backends[storageType];
+	const instance = {
+		COOKIE_AGE,
+		DOMAIN,
+		deleteAllJwts() {
+			const prefix = instance.getKeySession("");
+			getBackend().deleteAllWithPrefix(prefix);
+		},
+		deleteAudienceId() {
+			getBackend().delete(instance.getKeyAudienceId());
+		},
+		deleteJwt(audienceId) {
+			getBackend().delete(instance.getKeySession(audienceId));
+		},
+		getAudienceId() {
+			const parsed = getBackend().get(instance.getKeyAudienceId());
+			const resultParsed = audienceIdSchema.safeParse(parsed);
+			if (resultParsed.success) return resultParsed.data.audienceId;
+			return null;
+		},
+		getJwt(audienceId) {
+			const parsed = getBackend().get(instance.getKeySession(audienceId));
+			const resultParsed = jwtSchema.safeParse(parsed);
+			if (resultParsed.success) return resultParsed.data;
+			if (resultParsed.error) {}
+			return null;
+		},
+		getKeyAudienceId() {
+			return `${KEY_AUDIENCE_ID}${suffixKey}`;
+		},
+		getKeySession(audienceId) {
+			return `${KEY_SESSION}${suffixKey}_${audienceId}`;
+		},
+		getStorageType() {
+			return storageType;
+		},
+		getUniqueHostnameString,
+		/**
+		* Migrates any existing JWT and audienceId stored in cookies to localStorage,
+		* then removes the cookie entries. Safe to call repeatedly — it is a no-op when
+		* nothing is stored in cookies.
+		*
+		* Accesses the cookie and localStorage backends directly without changing
+		* the instance's active `storageType`.
+		*/
+		migrateCookieToLocalStorage() {
+			const cookieBackend = backends.cookie;
+			const localStorageBackend = backends.localStorage;
+			const audienceIdRaw = cookieBackend.get(instance.getKeyAudienceId());
+			const audienceIdParsed = audienceIdSchema.safeParse(audienceIdRaw);
+			if (!audienceIdParsed.success) return { migrated: false };
+			const { audienceId } = audienceIdParsed.data;
+			const jwtRaw = cookieBackend.get(instance.getKeySession(audienceId));
+			const jwtParsed = jwtSchema.safeParse(jwtRaw);
+			if (!jwtParsed.success) {
+				localStorageBackend.set(instance.getKeyAudienceId(), { audienceId });
+				cookieBackend.delete(instance.getKeyAudienceId());
+				return {
+					migrated: true,
+					audienceId
+				};
+			}
+			localStorageBackend.set(instance.getKeySession(audienceId), jwtParsed.data);
+			localStorageBackend.set(instance.getKeyAudienceId(), { audienceId });
+			cookieBackend.delete(instance.getKeySession(audienceId));
+			cookieBackend.delete(instance.getKeyAudienceId());
+			return {
+				migrated: true,
+				audienceId
+			};
+		},
+		setAudienceId(audienceId) {
+			getBackend().set(instance.getKeyAudienceId(), { audienceId });
+		},
+		setJwt({ jwtInfo, setAudienceId = true }) {
+			const audienceId = jwtInfo.jwt?.audienceId;
+			getBackend().set(instance.getKeySession(audienceId), jwtInfo);
+			if (setAudienceId) instance.setAudienceId(audienceId);
+		},
+		get SUFFIX_KEY() {
+			return suffixKey;
+		},
+		typeGuardAudienceId(untypedObject) {
+			return audienceIdSchema.safeParse(untypedObject).success;
+		},
+		typeGuardJWT(untypedObject) {
+			return jwtSchema.safeParse(untypedObject).success;
+		}
+	};
+	return instance;
+};
+let authStoreManagerSingletonWarned = false;
+const warnSingletonUsage = () => {
+	if (authStoreManagerSingletonWarned) return;
+	authStoreManagerSingletonWarned = true;
+	console.warn("`AuthStoreManager` singleton is deprecated. It uses shared global state that bypasses the provider. Use `useAuthScw().storeManager` to access the instance managed by `<AuthScwProvider>` instead. If you need a standalone instance, create one via `createAuthStoreManager()`.");
+};
+/**
+* @deprecated Use `useAuthScw().storeManager` or `createAuthStoreManager()` instead.
+* The singleton bypasses the provider's configuration and shares global state across all providers.
+*/
+const AuthStoreManager = new Proxy(createAuthStoreManager(), { get(target, prop, receiver) {
+	warnSingletonUsage();
+	return Reflect.get(target, prop, receiver);
+} });
+//#endregion
+export { AuthStoreManager, createAuthStoreManager };

package/dist/useAuthScw/authStoreManager/constants.d.ts

@@ -0,0 +1,6 @@
+//#region src/useAuthScw/authStoreManager/constants.d.ts
+export declare const COOKIE_AGE: number;
+export declare const DOMAIN: string;
+export declare const getUniqueHostnameString: (inputString: string) => string;
+export declare const DEFAULT_AUTH_SUFFIX_KEY: string;
+//#endregion

package/dist/useAuthScw/authStoreManager/constants.js

@@ -0,0 +1,7 @@
+//#region src/useAuthScw/authStoreManager/constants.ts
+const COOKIE_AGE = 2678400;
+const DOMAIN = typeof globalThis !== "undefined" && "location" in globalThis ? globalThis.location.hostname : "";
+const getUniqueHostnameString = (inputString) => inputString.replaceAll(".", "_").replaceAll("-", "_");
+const DEFAULT_AUTH_SUFFIX_KEY = getUniqueHostnameString(DOMAIN);
+//#endregion
+export { COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, getUniqueHostnameString };

package/dist/useAuthScw/authStoreManager/cookieBackend.js

@@ -0,0 +1,64 @@
+import { COOKIE_CONFIG } from "../../constants.js";
+import { DOMAIN } from "./constants.js";
+import { parseCookie, stringifySetCookie } from "cookie";
+//#region src/useAuthScw/authStoreManager/cookieBackend.ts
+const getCookie = (key) => {
+	const cookies = parseCookie(document.cookie);
+	if (key in cookies && cookies[key]) {
+		const cookieSessionString = cookies[key];
+		if (cookieSessionString) return JSON.parse(cookieSessionString);
+		return null;
+	}
+	return null;
+};
+const createCookieBackend = (options = {}) => {
+	const config = options.cookieConfig ?? COOKIE_CONFIG;
+	const maxAgeDefault = options.cookieAge ?? 2678400;
+	const setCookie = (value, key, maxAge = maxAgeDefault) => {
+		document.cookie = stringifySetCookie({
+			name: key,
+			value: JSON.stringify(value),
+			domain: DOMAIN,
+			httpOnly: config.httpOnly,
+			maxAge,
+			path: config.path,
+			sameSite: config.sameSite,
+			secure: config.secure
+		});
+	};
+	const deleteCookie = (key) => {
+		document.cookie = stringifySetCookie({
+			name: key,
+			value: "",
+			domain: DOMAIN,
+			httpOnly: config.httpOnly,
+			maxAge: -1,
+			path: config.path,
+			sameSite: config.sameSite,
+			secure: config.secure
+		});
+	};
+	return {
+		delete(key) {
+			deleteCookie(key);
+		},
+		deleteAllWithPrefix(prefix) {
+			document.cookie.split(";").forEach((cookieParam) => {
+				let [audienceId] = cookieParam.split("=");
+				if (audienceId) {
+					audienceId = audienceId.trim();
+					if (audienceId.startsWith(prefix)) deleteCookie(audienceId);
+				}
+			});
+		},
+		get(key) {
+			return getCookie(key);
+		},
+		set(key, value, maxAge = maxAgeDefault) {
+			setCookie(value, key, maxAge);
+		}
+	};
+};
+createCookieBackend();
+//#endregion
+export { createCookieBackend };

package/dist/useAuthScw/authStoreManager/index.d.ts

@@ -0,0 +1,4 @@
+import { CreateAuthStoreManagerOptions } from "./types.js";
+import { COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, getUniqueHostnameString } from "./constants.js";
+import { AuthStoreManager, AuthStoreManagerInstance, createAuthStoreManager } from "./authStoreManager.js";
+export { AuthStoreManager, type AuthStoreManagerInstance, COOKIE_AGE, DEFAULT_AUTH_SUFFIX_KEY, DOMAIN, createAuthStoreManager, getUniqueHostnameString };

package/dist/useAuthScw/authStoreManager/localStorageBackend.js

@@ -0,0 +1,41 @@
+//#region src/useAuthScw/authStoreManager/localStorageBackend.ts
+/**
+* localStorage-based storage backend.
+*
+* Reads/writes are wrapped in try/catch because `localStorage` can throw in
+* restricted environments (e.g. sandboxed iframes, private mode in some
+* browsers, or when the quota is exceeded).
+*/
+const createLocalStorageBackend = () => ({
+	delete(key) {
+		try {
+			globalThis.localStorage.removeItem(key);
+		} catch {}
+	},
+	deleteAllWithPrefix(prefix) {
+		try {
+			const keysToRemove = [];
+			for (let i = 0; i < globalThis.localStorage.length; i++) {
+				const key = globalThis.localStorage.key(i);
+				if (key?.startsWith(prefix)) keysToRemove.push(key);
+			}
+			keysToRemove.forEach((key) => globalThis.localStorage.removeItem(key));
+		} catch {}
+	},
+	get(key) {
+		try {
+			const raw = globalThis.localStorage.getItem(key);
+			if (!raw) return null;
+			return JSON.parse(raw);
+		} catch {
+			return null;
+		}
+	},
+	set(key, value) {
+		try {
+			globalThis.localStorage.setItem(key, JSON.stringify(value));
+		} catch {}
+	}
+});
+//#endregion
+export { createLocalStorageBackend };

package/dist/useAuthScw/authStoreManager/types.d.ts

@@ -0,0 +1,9 @@
+import { CookieConfigType, StorageType } from "../../types/index.js";
+//#region src/useAuthScw/authStoreManager/types.d.ts
+export type CreateAuthStoreManagerOptions = {
+  storageType?: StorageType;
+  cookieConfig?: CookieConfigType;
+  cookieAge?: number;
+  suffixKey?: string;
+};
+//#endregion

package/dist/useAuthScw/helpers.js

@@ -1,4 +1,3 @@
-import { AuthStoreManager } from "./authStoreManager.js";
 import { clientSingleton } from "./createClient.js";
 import { Errors } from "@scaleway/sdk-client";
 //#region src/useAuthScw/helpers.ts
@@ -25,16 +24,16 @@ const refreshSession = ({ paramsRenewRequest, setJWT, onError }) => {
 	});
 	return refreshSessionPromise;
 };
-const decodeToken = (encodedToken) => {
+const decodeToken = (encodedToken, storeManager) => {
 	try {
 		const decodedTokenRaw = JSON.parse(atob(encodedToken));
-		if (AuthStoreManager.typeGuardJWT(decodedTokenRaw)) return decodedTokenRaw;
+		if (storeManager.typeGuardJWT(decodedTokenRaw)) return decodedTokenRaw;
 		return null;
 	} catch {
 		return null;
 	}
 };
 const encodeToken = (jwt) => btoa(JSON.stringify(jwt));
-const getCookieJWT = (audienceId) => AuthStoreManager.getJwt(audienceId);
+const getStoredJWT = (audienceId, storeManager) => storeManager.getJwt(audienceId);
 //#endregion
-export { decodeToken, encodeToken, getCookieJWT, refreshSession };
+export { decodeToken, encodeToken, getStoredJWT, refreshSession };

package/dist/useAuthScw/index.d.ts

@@ -1,2 +1,4 @@
+import { DEFAULT_AUTH_SUFFIX_KEY, getUniqueHostnameString } from "./authStoreManager/constants.js";
+import "./authStoreManager/index.js";
 import { AuthScwProvider, useAuthScw } from "./AuthScwProvider.js";
 export { AuthScwProvider, useAuthScw };

package/dist/zodSchemas.d.ts

@@ -1,10 +1,11 @@
 import { Iamv1alpha1 } from "./types/iam/index.js";
 import { z } from "zod";
 //#region src/zodSchemas.d.ts
-type TransformJWT = Omit<Iamv1alpha1.JWT, 'createdAt' | 'updatedAt' | 'expiresAt'> & {
+type TransformJWT = Omit<Iamv1alpha1.JWT, 'createdAt' | 'updatedAt' | 'expiresAt' | 'srn'> & {
   createdAt?: string | Date;
   updatedAt?: string | Date;
   expiresAt?: string | Date;
+  srn?: string;
 };
 type ValidateJWTSchema = {
   jwt?: TransformJWT;

package/dist/zodSchemas.js

@@ -9,7 +9,8 @@ const rawJwtSchema = z.object({
 		issuerId: z.string().min(1),
 		jti: z.string().min(1),
 		updatedAt: z.union([z.string().min(1), z.date()]).optional(),
-		userAgent: z.string().min(1)
+		userAgent: z.string().min(1),
+		srn: z.string().optional()
 	}),
 	renewToken: z.string().min(1),
 	token: z.string().min(1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scaleway/auth-scw",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "Auth Scaleway",
   "homepage": "https://github.com/scaleway/scaleway-lib/tree/main/packages/auth-scw",
   "bugs": {
@@ -31,14 +31,15 @@
     "zod": "4.6.2"
   },
   "devDependencies": {
-    "@scaleway/sdk-client": "2.8.0",
-    "@scaleway/sdk-iam": "2.15.0",
+    "@scaleway/sdk-client": "2.9.0",
+    "@scaleway/sdk-iam": "2.16.0",
+    "@scaleway/types": "1.2.0",
     "@types/react": "19.3.0",
     "react": "19.3.0"
   },
   "peerDependencies": {
-    "@scaleway/sdk-client": "2.8.0",
-    "@scaleway/sdk-iam": "2.15.0",
+    "@scaleway/sdk-client": "2.9.0",
+    "@scaleway/sdk-iam": "2.16.0",
     "react": ">=18.0"
   },
   "scripts": {

package/dist/useAuthScw/authStoreManager.d.ts

@@ -1,25 +0,0 @@
-import { AudienceIdType, EncodedJWT } from "../types/index.js";
-//#region src/useAuthScw/authStoreManager.d.ts
-declare const getUniqueHostnameString: (inputString: string) => string;
-export declare const AuthStoreManager: {
-  COOKIE_AGE: number;
-  DOMAIN: string;
-  deleteAllJwts(): void;
-  deleteAudienceId(): void;
-  deleteJwt(audienceId: string): void;
-  getAudienceId(): string | null;
-  getJwt(audienceId: string): EncodedJWT | null;
-  getKeyAudienceId(): string;
-  getKeySession(audienceId: string): string;
-  getUniqueHostnameString: typeof getUniqueHostnameString;
-  SUFFIX_KEY: string;
-  setAudienceId(audienceId: string): void;
-  setJwt({ jwtInfo, setAudienceId }: {
-    jwtInfo: EncodedJWT;
-    setAudienceId?: boolean;
-  }): void;
-  setSuffixKey(key: string): void;
-  typeGuardAudienceId(untypedObject: unknown): untypedObject is AudienceIdType;
-  typeGuardJWT(untypedObject: unknown): untypedObject is EncodedJWT;
-};
-//#endregion

package/dist/useAuthScw/authStoreManager.js

@@ -1,105 +0,0 @@
-import { COOKIE_CONFIG } from "../constants.js";
-import { audienceIdSchema, jwtSchema } from "../zodSchemas.js";
-import { parseCookie, stringifySetCookie } from "cookie";
-//#region src/useAuthScw/authStoreManager.ts
-const KEY_SESSION = "_scw_session";
-const KEY_AUDIENCE_ID = "_scw_audience_id";
-const DEFAULT_SUFFIX_KEY = "";
-const COOKIE_AGE = 2678400;
-let cookieConfig = COOKIE_CONFIG;
-const DOMAIN = typeof window !== "undefined" ? globalThis.location.hostname : "";
-const getUniqueHostnameString = (inputString) => inputString.replaceAll(".", "_").replaceAll("-", "_");
-const setCookieConfig = (COOKIE_CONFIG_PARAM) => cookieConfig = COOKIE_CONFIG_PARAM;
-const setCookie = (value, key, maxAge = COOKIE_AGE) => {
-	document.cookie = stringifySetCookie({
-		name: key,
-		value: JSON.stringify(value),
-		domain: DOMAIN,
-		httpOnly: cookieConfig.httpOnly,
-		maxAge,
-		path: cookieConfig.path,
-		sameSite: cookieConfig.sameSite,
-		secure: cookieConfig.secure
-	});
-};
-const getCookie = (key) => {
-	const cookies = parseCookie(document.cookie);
-	if (key in cookies && cookies[key]) {
-		const cookieSessionString = cookies[key];
-		if (cookieSessionString) return JSON.parse(cookieSessionString);
-		return null;
-	}
-	return null;
-};
-const deleteCookie = (key) => {
-	document.cookie = stringifySetCookie({
-		name: key,
-		value: "",
-		domain: DOMAIN,
-		httpOnly: cookieConfig.httpOnly,
-		maxAge: -1,
-		path: cookieConfig.path,
-		sameSite: cookieConfig.sameSite,
-		secure: cookieConfig.secure
-	});
-};
-const AuthStoreManager = {
-	COOKIE_AGE,
-	DOMAIN,
-	deleteAllJwts() {
-		const prefix = AuthStoreManager.getKeySession("");
-		document.cookie.split(";").forEach((cookieParam) => {
-			let [audienceId] = cookieParam.split("=");
-			if (audienceId) {
-				audienceId = audienceId.trim();
-				if (audienceId.startsWith(prefix)) this.deleteJwt(audienceId);
-			}
-		});
-	},
-	deleteAudienceId() {
-		deleteCookie(AuthStoreManager.getKeyAudienceId());
-	},
-	deleteJwt(audienceId) {
-		deleteCookie(AuthStoreManager.getKeySession(audienceId));
-	},
-	getAudienceId() {
-		const cookieParsed = getCookie(AuthStoreManager.getKeyAudienceId());
-		const resultCookieParsed = audienceIdSchema.safeParse(cookieParsed);
-		if (resultCookieParsed.success) return resultCookieParsed.data.audienceId;
-		return null;
-	},
-	getJwt(audienceId) {
-		const cookieParsed = getCookie(AuthStoreManager.getKeySession(audienceId));
-		const resultCookieParsed = jwtSchema.safeParse(cookieParsed);
-		if (resultCookieParsed.success) return resultCookieParsed.data;
-		if (resultCookieParsed.error) {}
-		return null;
-	},
-	getKeyAudienceId() {
-		return `${KEY_AUDIENCE_ID}${AuthStoreManager.SUFFIX_KEY}`;
-	},
-	getKeySession(audienceId) {
-		return `${KEY_SESSION}${AuthStoreManager.SUFFIX_KEY}_${audienceId}`;
-	},
-	getUniqueHostnameString,
-	SUFFIX_KEY: DEFAULT_SUFFIX_KEY,
-	setAudienceId(audienceId) {
-		setCookie({ audienceId }, AuthStoreManager.getKeyAudienceId());
-	},
-	setJwt({ jwtInfo, setAudienceId = true }) {
-		const audienceId = jwtInfo.jwt?.audienceId;
-		setCookie(jwtInfo, AuthStoreManager.getKeySession(audienceId));
-		if (setAudienceId) this.setAudienceId(audienceId);
-	},
-	setSuffixKey(key) {
-		AuthStoreManager.SUFFIX_KEY = key ? `_${key}` : DEFAULT_SUFFIX_KEY;
-	},
-	typeGuardAudienceId(untypedObject) {
-		return audienceIdSchema.safeParse(untypedObject).success;
-	},
-	typeGuardJWT(untypedObject) {
-		return jwtSchema.safeParse(untypedObject).success;
-	}
-};
-//#endregion
-export { AuthStoreManager, setCookieConfig };