@sendoracloud/sdk-react-native 1.41.1 → 1.41.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.41.2 — claiming or restoring a held guest works on a real phone
+
+**Fix (reported by TapMap: `merge()` / `claimHeldGuest()` returned 401 on an iPhone after every sign-in).** Before the server fix (e09c86dc, already live), `/token/refresh` preferred the `sd_rt` refresh cookie over the token in the request body. A phone keeps a native cookie jar, and after a sign-in that jar holds the ACCOUNT's cookie — so refreshing a HELD guest's token was answered for the account, and the SDK wrote the account's token into the guest's slot. The device lost its only copy of the guest's credential; `claimHeldGuest()` / `merge()` then failed with 401 and `restoreHeldGuest()` released the guest. The guest's account was never touched on the server.
+
+- **No cookies.** Every SDK request now sends `credentials: "omit"`, so React Native's native cookie jar is neither read nor written (iOS `HTTPShouldHandleCookies = NO`, Android `CookieJar.NO_COOKIES`). The SDK never used cookies — it authenticates with the API key header and tokens in the body.
+- **Identity check on a held refresh.** A held guest's refresh must come back for that guest. A response for anyone else now throws `HELD_GUEST_IDENTITY_MISMATCH` and changes nothing: the slot keeps the guest's own token, no `/merge`, nothing installed, nothing released.
+- No action needed for apps on 1.41.0 / 1.41.1: the server fix already covers them. Upgrade for the belt-and-braces. Same fix in web 3.24.2 / iOS 5.4.2 / Android 4.26.2.
+
 ## 1.41.1 — a dead session is `session_expired` again; the server's detail moves to `endReason`
 
 **Fix to a 1.41.0 behaviour change (ADR-023: a new value is additive only for a NEW situation).**

package/dist/index.cjs

@@ -263,7 +263,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.1",
+  version: "1.41.2",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -320,7 +320,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -391,7 +391,18 @@ async function request(opts, method, path, body, extraHeaders, reqOpts) {
         ...extraHeaders ?? {}
       },
       body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: controller.signal
+      signal: controller.signal,
+      // ⚠ NO COOKIES (s58.360). The SDK authenticates with the x-api-key header
+      // and tokens in the body — never a cookie. But RN's fetch keeps a NATIVE
+      // cookie jar unless told otherwise (`XMLHttpRequest.withCredentials`
+      // defaults to true → iOS `HTTPShouldHandleCookies`; Android's OkHttp jar),
+      // so every `sd_rt` the server set was replayed on the next
+      // /token/refresh. After a sign-in that cookie is the ACCOUNT's, and the
+      // server preferred it over the HELD GUEST's token in the body: a claim
+      // refreshed the account and wrote its token into the guest's slot. The
+      // server now answers for the body (e09c86dc); this keeps the SDK out of
+      // that class regardless of what any endpoint prefers.
+      credentials: "omit"
     });
   } catch (err) {
     clearTimeout(timer);
@@ -2810,6 +2821,14 @@ var Auth = class {
     const rotated = readRotatedTokens(parsed.data);
     if (!rotated) throw new AuthError("PARSE_ERROR", "refresh response carried no token pair", { status: res.status });
     const d = parsed.data;
+    const answeredFor = isAuthUserShape(d?.user) ? d.user.id : this.userFromClaims(rotated.accessToken).id;
+    if (answeredFor && answeredFor !== slot.userId) {
+      throw new AuthError(
+        "HELD_GUEST_IDENTITY_MISMATCH",
+        "The held guest's refresh was answered for a different account; nothing was changed",
+        { kind: "unknown", status: res.status }
+      );
+    }
     const user = isAuthUserShape(d?.user) ? d.user : { ...this.userFromClaims(rotated.accessToken), id: slot.userId, isAnonymous: true };
     const persisted = this.commit({ kind: "slot_tokens", slot: i, sent, refreshToken: rotated.refreshToken });
     if (persisted.status !== "applied") return { outcome: "kept" };

package/dist/index.js

@@ -212,7 +212,7 @@ var Storage = class {
 // package.json
 var package_default = {
   name: "@sendoracloud/sdk-react-native",
-  version: "1.41.1",
+  version: "1.41.2",
   description: "Sendora Cloud React Native + Expo SDK \u2014 analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   type: "module",
   main: "./dist/index.cjs",
@@ -269,7 +269,7 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     typecheck: "tsc --noEmit",
-    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    test: "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   devDependencies: {
     "@types/react": "^19.2.16",
@@ -340,7 +340,18 @@ async function request(opts, method, path, body, extraHeaders, reqOpts) {
         ...extraHeaders ?? {}
       },
       body: body !== void 0 ? JSON.stringify(body) : void 0,
-      signal: controller.signal
+      signal: controller.signal,
+      // ⚠ NO COOKIES (s58.360). The SDK authenticates with the x-api-key header
+      // and tokens in the body — never a cookie. But RN's fetch keeps a NATIVE
+      // cookie jar unless told otherwise (`XMLHttpRequest.withCredentials`
+      // defaults to true → iOS `HTTPShouldHandleCookies`; Android's OkHttp jar),
+      // so every `sd_rt` the server set was replayed on the next
+      // /token/refresh. After a sign-in that cookie is the ACCOUNT's, and the
+      // server preferred it over the HELD GUEST's token in the body: a claim
+      // refreshed the account and wrote its token into the guest's slot. The
+      // server now answers for the body (e09c86dc); this keeps the SDK out of
+      // that class regardless of what any endpoint prefers.
+      credentials: "omit"
     });
   } catch (err) {
     clearTimeout(timer);
@@ -2759,6 +2770,14 @@ var Auth = class {
     const rotated = readRotatedTokens(parsed.data);
     if (!rotated) throw new AuthError("PARSE_ERROR", "refresh response carried no token pair", { status: res.status });
     const d = parsed.data;
+    const answeredFor = isAuthUserShape(d?.user) ? d.user.id : this.userFromClaims(rotated.accessToken).id;
+    if (answeredFor && answeredFor !== slot.userId) {
+      throw new AuthError(
+        "HELD_GUEST_IDENTITY_MISMATCH",
+        "The held guest's refresh was answered for a different account; nothing was changed",
+        { kind: "unknown", status: res.status }
+      );
+    }
     const user = isAuthUserShape(d?.user) ? d.user : { ...this.userFromClaims(rotated.accessToken), id: slot.userId, isAnonymous: true };
     const persisted = this.commit({ kind: "slot_tokens", slot: i, sent, refreshToken: rotated.refreshToken });
     if (persisted.status !== "applied") return { outcome: "kept" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "1.41.1",
+  "version": "1.41.2",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth (incl. Game Center / Play Games), deep links (Branch / Firebase Dynamic Links parity). Auth + analytics + deep links work in Expo Go; push-token registration and the no-arg Game Center / Play Games sign-in require a Dev Client (EAS Build or `npx expo prebuild`).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -57,7 +57,7 @@
   "scripts": {
     "build": "tsup src/index.ts src/contact-widget.tsx --format esm,cjs --dts --clean --external react --external react-native --external react-native-webview",
     "typecheck": "tsc --noEmit",
-    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts"
+    "test": "tsx test/secure-storage.test.ts && tsx test/integration-storage.test.ts && tsx test/plugin.test.ts && tsx test/game-auth.test.ts && tsx test/link.test.ts && tsx test/session-preservation.test.ts && tsx test/credential-collision.test.ts && tsx test/token-expiry.test.ts && tsx test/unlink.test.ts && tsx test/deferred-match.test.ts && tsx test/anon-id-stability.test.ts && tsx test/event-queue.test.ts && tsx test/anonymous-over-account.test.ts && tsx test/auth-machine-conformance.test.ts && tsx test/held-guests.test.ts && tsx test/held-identity.test.ts"
   },
   "devDependencies": {
     "@types/react": "^19.2.16",