@sendoracloud/sdk-react-native 1.35.0 → 1.36.0

package/dist/index.cjs

@@ -65,6 +65,12 @@ async function getAsyncStorage() {
   })();
   return asyncStoragePromise;
 }
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
 var Storage = class {
   constructor(opts = {}) {
     this.cache = /* @__PURE__ */ new Map();
@@ -73,6 +79,12 @@ var Storage = class {
     this.secureKeys = new Set(opts.secureKeys ?? []);
     this.prefix = opts.prefix ?? DEFAULT_PREFIX;
     this.securePrefix = opts.prefix ?? "";
+    if (this.secure === null && this.secureKeys.size > 0) {
+      warnOnce(
+        "no-secure-adapter",
+        "[sendora] No `secureStorage` adapter supplied \u2014 auth tokens (refresh token, access token, cached user) will be stored in PLAIN AsyncStorage, which is included in iOS/Android device backups. Pass `secureStorage` in init() with a Keychain/Keystore-backed adapter (e.g. expo-secure-store). The session still persists either way; this is about where the token rests."
+      );
+    }
   }
   /** The adapter-facing name for a key. Bare by default; see `prefix`. */
   secureName(key) {
@@ -126,6 +138,10 @@ var Storage = class {
         }
       }
     } catch {
+      warnOnce(
+        "secure-read-degraded",
+        "[sendora] The `secureStorage` adapter failed on read; falling back to plain AsyncStorage for this session. Tokens are preserved but no longer encrypted at rest. Check your adapter."
+      );
       if (store) {
         try {
           const legacy = await store.getItem(this.prefix + k);
@@ -142,6 +158,10 @@ var Storage = class {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
       void this.secure.setItem(this.secureName(key), value).catch(() => {
+        warnOnce(
+          "secure-write-degraded",
+          "[sendora] The `secureStorage` adapter failed on write; this value fell back to plain AsyncStorage. The session is preserved but this token is no longer encrypted at rest. Check your adapter."
+        );
         void getAsyncStorage().then((store) => {
           if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
@@ -208,7 +228,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.35.0",
+  version: "1.36.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -496,6 +516,12 @@ function classifyAuthErrorKind(code, status) {
       return "credential_in_use";
     case "LAST_CREDENTIAL":
       return "last_credential";
+    // ⚠ MUST be a code case, not a status one. The tail of this function is
+    // `if (status >= 400) return "invalid_credential"`, which would otherwise
+    // claim the 403 and report a step-up refusal as a bad credential —
+    // documented as "needs NEW input", which is the opposite of the truth.
+    case "RECENT_AUTH_REQUIRED":
+      return "recent_auth_required";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -1582,13 +1608,24 @@ var Auth = class {
     const data = await this.unwrap(res, "MFA_CONFIRM_FAILED");
     return Boolean(data.confirmed);
   }
+  /**
+   * Disable MFA.
+   *
+   * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+   * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+   *
+   * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+   * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+   * surface — the app reported MFA as off while TOTP stayed enrolled.
+   */
   async disableMfa() {
-    await post(
+    const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/mfa/disable",
       {},
       this.bearerHeaders()
     );
+    await this.unwrap(res, "MFA_DISABLE_FAILED");
   }
   // ============================================================
   // DEVICE SESSIONS (Bearer-authenticated)
@@ -1603,19 +1640,28 @@ var Auth = class {
     const parsed = await res.json();
     return Array.isArray(parsed.data) ? parsed.data : [];
   }
+  /**
+   * Revoke one of the caller's own sessions ("sign out that device").
+   * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+   * that reports success on a failure is the one place a user acts on the claim
+   * and then stops worrying.
+   */
   async revokeSession(sessionId) {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       `/api/v1/auth-service/sessions/me/${encodeURIComponent(sessionId)}`,
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_FAILED");
   }
+  /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
   async revokeAllSessions() {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sessions/me",
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_ALL_FAILED");
   }
   /**
    * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -1781,7 +1827,10 @@ var Auth = class {
     if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
     const parsed = await res.json().catch(() => ({}));
     if (!res.ok || !parsed.success) {
-      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`);
+      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`, {
+        status: res.status,
+        retryAfterSeconds: readRetryAfterSeconds(parsed)
+      });
     }
     return parsed.data;
   }

package/dist/index.d.cts

@@ -464,7 +464,7 @@ type UnlinkResult = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "recent_auth_required" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -1109,6 +1109,16 @@ declare class Auth {
         recoveryCodes: string[];
     }>;
     confirmMfa(code: string): Promise<boolean>;
+    /**
+     * Disable MFA.
+     *
+     * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+     * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+     *
+     * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+     * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+     * surface — the app reported MFA as off while TOTP stayed enrolled.
+     */
     disableMfa(): Promise<void>;
     listMySessions(): Promise<Array<{
         id: string;
@@ -1117,7 +1127,14 @@ declare class Auth {
         lastUsedAt: string | null;
         createdAt: string;
     }>>;
+    /**
+     * Revoke one of the caller's own sessions ("sign out that device").
+     * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+     * that reports success on a failure is the one place a user acts on the claim
+     * and then stops worrying.
+     */
     revokeSession(sessionId: string): Promise<void>;
+    /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
     revokeAllSessions(): Promise<void>;
     /**
      * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).

package/dist/index.d.ts

@@ -464,7 +464,7 @@ type UnlinkResult = {
  * OTP, a dismissed Game Center sheet and a 429 all leave `getUserSync()` and
  * the stored refresh token exactly as they were.
  */
-type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "already_identified" | "cancelled" | "config" | "unknown";
+type AuthErrorKind = "network" | "server" | "rate_limited" | "invalid_credential" | "account_locked" | "credential_in_use" | "last_credential" | "recent_auth_required" | "already_identified" | "cancelled" | "config" | "unknown";
 declare class AuthError extends Error {
     code: string;
     /**
@@ -1109,6 +1109,16 @@ declare class Auth {
         recoveryCodes: string[];
     }>;
     confirmMfa(code: string): Promise<boolean>;
+    /**
+     * Disable MFA.
+     *
+     * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+     * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+     *
+     * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+     * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+     * surface — the app reported MFA as off while TOTP stayed enrolled.
+     */
     disableMfa(): Promise<void>;
     listMySessions(): Promise<Array<{
         id: string;
@@ -1117,7 +1127,14 @@ declare class Auth {
         lastUsedAt: string | null;
         createdAt: string;
     }>>;
+    /**
+     * Revoke one of the caller's own sessions ("sign out that device").
+     * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+     * that reports success on a failure is the one place a user acts on the claim
+     * and then stops worrying.
+     */
     revokeSession(sessionId: string): Promise<void>;
+    /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
     revokeAllSessions(): Promise<void>;
     /**
      * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).

package/dist/index.js

@@ -20,6 +20,12 @@ async function getAsyncStorage() {
   })();
   return asyncStoragePromise;
 }
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
 var Storage = class {
   constructor(opts = {}) {
     this.cache = /* @__PURE__ */ new Map();
@@ -28,6 +34,12 @@ var Storage = class {
     this.secureKeys = new Set(opts.secureKeys ?? []);
     this.prefix = opts.prefix ?? DEFAULT_PREFIX;
     this.securePrefix = opts.prefix ?? "";
+    if (this.secure === null && this.secureKeys.size > 0) {
+      warnOnce(
+        "no-secure-adapter",
+        "[sendora] No `secureStorage` adapter supplied \u2014 auth tokens (refresh token, access token, cached user) will be stored in PLAIN AsyncStorage, which is included in iOS/Android device backups. Pass `secureStorage` in init() with a Keychain/Keystore-backed adapter (e.g. expo-secure-store). The session still persists either way; this is about where the token rests."
+      );
+    }
   }
   /** The adapter-facing name for a key. Bare by default; see `prefix`. */
   secureName(key) {
@@ -81,6 +93,10 @@ var Storage = class {
         }
       }
     } catch {
+      warnOnce(
+        "secure-read-degraded",
+        "[sendora] The `secureStorage` adapter failed on read; falling back to plain AsyncStorage for this session. Tokens are preserved but no longer encrypted at rest. Check your adapter."
+      );
       if (store) {
         try {
           const legacy = await store.getItem(this.prefix + k);
@@ -97,6 +113,10 @@ var Storage = class {
     this.cache.set(key, value);
     if (this.isSecure(key)) {
       void this.secure.setItem(this.secureName(key), value).catch(() => {
+        warnOnce(
+          "secure-write-degraded",
+          "[sendora] The `secureStorage` adapter failed on write; this value fell back to plain AsyncStorage. The session is preserved but this token is no longer encrypted at rest. Check your adapter."
+        );
         void getAsyncStorage().then((store) => {
           if (store) store.setItem(this.prefix + key, value).catch(() => {
           });
@@ -163,7 +183,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.35.0",
+  version: "1.36.0",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -451,6 +471,12 @@ function classifyAuthErrorKind(code, status) {
       return "credential_in_use";
     case "LAST_CREDENTIAL":
       return "last_credential";
+    // ⚠ MUST be a code case, not a status one. The tail of this function is
+    // `if (status >= 400) return "invalid_credential"`, which would otherwise
+    // claim the 403 and report a step-up refusal as a bad credential —
+    // documented as "needs NEW input", which is the opposite of the truth.
+    case "RECENT_AUTH_REQUIRED":
+      return "recent_auth_required";
     case "NOT_ANONYMOUS":
     case "FORBIDDEN_NON_ANONYMOUS":
       return "already_identified";
@@ -1537,13 +1563,24 @@ var Auth = class {
     const data = await this.unwrap(res, "MFA_CONFIRM_FAILED");
     return Boolean(data.confirmed);
   }
+  /**
+   * Disable MFA.
+   *
+   * ⚠ STEP-UP gated (s58.319): a stale `auth_time` is refused with 403
+   * `RECENT_AUTH_REQUIRED` / kind `recent_auth_required`.
+   *
+   * ⚠ Discarded its response until s58.335, and `request()` never throws on a
+   * non-2xx (it warns and returns the Response), so the refusal had nowhere to
+   * surface — the app reported MFA as off while TOTP stayed enrolled.
+   */
   async disableMfa() {
-    await post(
+    const res = await post(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/mfa/disable",
       {},
       this.bearerHeaders()
     );
+    await this.unwrap(res, "MFA_DISABLE_FAILED");
   }
   // ============================================================
   // DEVICE SESSIONS (Bearer-authenticated)
@@ -1558,19 +1595,28 @@ var Auth = class {
     const parsed = await res.json();
     return Array.isArray(parsed.data) ? parsed.data : [];
   }
+  /**
+   * Revoke one of the caller's own sessions ("sign out that device").
+   * ⚠ Discarded its response until s58.335 — a "sign out this device" button
+   * that reports success on a failure is the one place a user acts on the claim
+   * and then stops worrying.
+   */
   async revokeSession(sessionId) {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       `/api/v1/auth-service/sessions/me/${encodeURIComponent(sessionId)}`,
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_FAILED");
   }
+  /** Revoke every session for the caller. Same reporting defect as `revokeSession`. */
   async revokeAllSessions() {
-    await del(
+    const res = await del(
       { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
       "/api/v1/auth-service/sessions/me",
       this.bearerHeaders()
     );
+    await this.unwrap(res, "SESSION_REVOKE_ALL_FAILED");
   }
   /**
    * Delete the signed-in user's account (Apple App Store Guideline 5.1.1(v)).
@@ -1736,7 +1782,10 @@ var Auth = class {
     if (!res) throw new AuthError("NETWORK_ERROR", "Network request failed");
     const parsed = await res.json().catch(() => ({}));
     if (!res.ok || !parsed.success) {
-      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`);
+      throw new AuthError(parsed.error?.code ?? errCode, parsed.error?.message ?? `HTTP ${res.status}`, {
+        status: res.status,
+        retryAfterSeconds: readRetryAfterSeconds(parsed)
+      });
     }
     return parsed.data;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",