@sendoracloud/sdk-react-native 1.0.2 → 1.0.4

package/dist/index.cjs

@@ -485,16 +485,30 @@ var Auth = class {
   signInWithDiscord(code, redirectUri) {
     return this.loginSocial({ provider: "discord", code, redirectUri });
   }
+  /**
+   * Read the stored anon refresh token if (and only if) the local
+   * subject is currently anonymous. Used by every identified-session
+   * mint path so the backend can run device-takeover (s58.111 +
+   * s58.112). Returns `undefined` when not anonymous — never forward
+   * an identified user's own refresh token.
+   */
+  readPrevAnonRefreshToken() {
+    if (!this.user?.isAnonymous) return void 0;
+    return this.hooks.storage.get(REFRESH_KEY) ?? void 0;
+  }
   /**
    * Exchange the MFA challenge token from `signIn` for a real session
    * by submitting a TOTP or recovery code from the user's authenticator.
    */
   challengeMfa(mfaChallengeToken, code) {
     return this.serialize(async () => {
-      const data = await this.callAuth("/api/v1/auth-service/mfa/challenge", {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+      const body = {
         challengeToken: mfaChallengeToken,
         code
-      });
+      };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/mfa/challenge", body);
       this.persist(data);
       return data.user;
     });
@@ -514,8 +528,11 @@ var Auth = class {
   }
   verifyMagicLink(token) {
     return this.serialize(async () => {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
       if (this.user !== null) await this.wipeLocalIdentity();
-      const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", { token });
+      const body = { token };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", body);
       this.persist(data);
       return data.user;
     });
@@ -535,8 +552,11 @@ var Auth = class {
   }
   verifyEmailOtp(email, code) {
     return this.serialize(async () => {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
       if (this.user !== null) await this.wipeLocalIdentity();
-      const data = await this.callAuth("/api/v1/auth-service/email-otp/verify", { email, code });
+      const body = { email, code };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/email-otp/verify", body);
       this.persist(data);
       return data.user;
     });
@@ -664,10 +684,13 @@ var Auth = class {
    * call `consumeSsoFragment(url)` on the captured URL.
    */
   async startSso(returnTo) {
+    const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+    const body = { returnTo };
+    if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
     const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sso/oidc/start",
-      { returnTo }
+      body
     );
     if (!res || !res.ok) throw new AuthError("SSO_START_FAILED", `HTTP ${res?.status ?? "network"}`);
     const parsed = await res.json();
@@ -687,10 +710,13 @@ var Auth = class {
    * and SAML fragments transparently.
    */
   async startSaml(returnTo) {
+    const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+    const body = { returnTo };
+    if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
     const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sso/saml/start",
-      { returnTo }
+      body
     );
     if (!res || !res.ok) throw new AuthError("SAML_START_FAILED", `HTTP ${res?.status ?? "network"}`);
     const parsed = await res.json();

package/dist/index.d.cts

@@ -220,6 +220,14 @@ declare class Auth {
     signInWithLinkedIn(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithFacebook(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithDiscord(code: string, redirectUri: string): Promise<AuthUser>;
+    /**
+     * Read the stored anon refresh token if (and only if) the local
+     * subject is currently anonymous. Used by every identified-session
+     * mint path so the backend can run device-takeover (s58.111 +
+     * s58.112). Returns `undefined` when not anonymous — never forward
+     * an identified user's own refresh token.
+     */
+    private readPrevAnonRefreshToken;
     /**
      * Exchange the MFA challenge token from `signIn` for a real session
      * by submitting a TOTP or recovery code from the user's authenticator.

package/dist/index.d.ts

@@ -220,6 +220,14 @@ declare class Auth {
     signInWithLinkedIn(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithFacebook(code: string, redirectUri: string): Promise<AuthUser>;
     signInWithDiscord(code: string, redirectUri: string): Promise<AuthUser>;
+    /**
+     * Read the stored anon refresh token if (and only if) the local
+     * subject is currently anonymous. Used by every identified-session
+     * mint path so the backend can run device-takeover (s58.111 +
+     * s58.112). Returns `undefined` when not anonymous — never forward
+     * an identified user's own refresh token.
+     */
+    private readPrevAnonRefreshToken;
     /**
      * Exchange the MFA challenge token from `signIn` for a real session
      * by submitting a TOTP or recovery code from the user's authenticator.

package/dist/index.js

@@ -442,16 +442,30 @@ var Auth = class {
   signInWithDiscord(code, redirectUri) {
     return this.loginSocial({ provider: "discord", code, redirectUri });
   }
+  /**
+   * Read the stored anon refresh token if (and only if) the local
+   * subject is currently anonymous. Used by every identified-session
+   * mint path so the backend can run device-takeover (s58.111 +
+   * s58.112). Returns `undefined` when not anonymous — never forward
+   * an identified user's own refresh token.
+   */
+  readPrevAnonRefreshToken() {
+    if (!this.user?.isAnonymous) return void 0;
+    return this.hooks.storage.get(REFRESH_KEY) ?? void 0;
+  }
   /**
    * Exchange the MFA challenge token from `signIn` for a real session
    * by submitting a TOTP or recovery code from the user's authenticator.
    */
   challengeMfa(mfaChallengeToken, code) {
     return this.serialize(async () => {
-      const data = await this.callAuth("/api/v1/auth-service/mfa/challenge", {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+      const body = {
         challengeToken: mfaChallengeToken,
         code
-      });
+      };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/mfa/challenge", body);
       this.persist(data);
       return data.user;
     });
@@ -471,8 +485,11 @@ var Auth = class {
   }
   verifyMagicLink(token) {
     return this.serialize(async () => {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
       if (this.user !== null) await this.wipeLocalIdentity();
-      const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", { token });
+      const body = { token };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/magic-link/verify", body);
       this.persist(data);
       return data.user;
     });
@@ -492,8 +509,11 @@ var Auth = class {
   }
   verifyEmailOtp(email, code) {
     return this.serialize(async () => {
+      const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
       if (this.user !== null) await this.wipeLocalIdentity();
-      const data = await this.callAuth("/api/v1/auth-service/email-otp/verify", { email, code });
+      const body = { email, code };
+      if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
+      const data = await this.callAuth("/api/v1/auth-service/email-otp/verify", body);
       this.persist(data);
       return data.user;
     });
@@ -621,10 +641,13 @@ var Auth = class {
    * call `consumeSsoFragment(url)` on the captured URL.
    */
   async startSso(returnTo) {
+    const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+    const body = { returnTo };
+    if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
     const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sso/oidc/start",
-      { returnTo }
+      body
     );
     if (!res || !res.ok) throw new AuthError("SSO_START_FAILED", `HTTP ${res?.status ?? "network"}`);
     const parsed = await res.json();
@@ -644,10 +667,13 @@ var Auth = class {
    * and SAML fragments transparently.
    */
   async startSaml(returnTo) {
+    const prevAnonRefreshToken = this.readPrevAnonRefreshToken();
+    const body = { returnTo };
+    if (prevAnonRefreshToken) body.prevAnonRefreshToken = prevAnonRefreshToken;
     const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sso/saml/start",
-      { returnTo }
+      body
     );
     if (!res || !res.ok) throw new AuthError("SAML_START_FAILED", `HTTP ${res?.status ?? "network"}`);
     const parsed = await res.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth, deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push token registration requires a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",