@spidy092/auth-client 2.1.0 → 2.1.3

package/core.js

@@ -233,15 +233,31 @@ export async function refreshToken() {
   refreshInProgress = true;
   refreshPromise = (async () => {
     try {
+      // Get stored refresh token (for HTTP development)
+      const storedRefreshToken = getRefreshToken();
+      
       console.log('🔄 Refreshing token:', { 
         clientKey, 
-        mode: isRouterMode() ? 'ROUTER' : 'CLIENT' 
+        mode: isRouterMode() ? 'ROUTER' : 'CLIENT',
+        hasStoredRefreshToken: !!storedRefreshToken
       });
       
-      const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, {
+      // Build request options - send refresh token in body and header for HTTP dev
+      const requestOptions = {
         method: 'POST',
-        credentials: 'include', // ✅ Include httpOnly cookies
-      });
+        credentials: 'include', // ✅ Include httpOnly cookies (for HTTPS)
+        headers: {
+          'Content-Type': 'application/json'
+        }
+      };
+      
+      // For HTTP development, send refresh token in body and header
+      if (storedRefreshToken) {
+        requestOptions.headers['X-Refresh-Token'] = storedRefreshToken;
+        requestOptions.body = JSON.stringify({ refreshToken: storedRefreshToken });
+      }
+      
+      const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, requestOptions);
 
       if (!response.ok) {
         const errorText = await response.text();
@@ -249,7 +265,8 @@ export async function refreshToken() {
         throw new Error(`Refresh failed: ${response.status}`);
       }
 
-      const { access_token } = await response.json();
+      const data = await response.json();
+      const { access_token, refresh_token: new_refresh_token } = data;
       
       if (!access_token) {
         throw new Error('No access token in refresh response');
@@ -257,6 +274,13 @@ export async function refreshToken() {
       
       // ✅ This will trigger token listeners
       setToken(access_token);
+      
+      // ✅ Store new refresh token if provided (token rotation)
+      if (new_refresh_token) {
+        setRefreshToken(new_refresh_token);
+        console.log('🔄 New refresh token stored from rotation');
+      }
+      
       console.log('✅ Token refresh successful, listeners notified');
       return access_token;
     } catch (err) {

package/index.js

@@ -1,7 +1,7 @@
 // auth-client/index.js
 import { setConfig, getConfig, isRouterMode } from './config';
 import { login, logout, handleCallback, refreshToken, resetCallbackState, validateCurrentSession } from './core';
-import { getToken, setToken, clearToken, addTokenListener, removeTokenListener, getListenerCount } from './token';
+import { getToken, setToken, clearToken, setRefreshToken, getRefreshToken, clearRefreshToken, addTokenListener, removeTokenListener, getListenerCount } from './token';
 import api from './api';
 import { decodeToken, isTokenExpired, isAuthenticated } from './utils/jwt';
 
@@ -23,6 +23,9 @@ export const auth = {
   getToken,
   setToken,
   clearToken,
+  setRefreshToken,     // ✅ Refresh token for HTTP dev
+  getRefreshToken,
+  clearRefreshToken,
   addTokenListener,    // ✅ Export new functions
   removeTokenListener,
   getListenerCount,    // ✅ Debug function

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spidy092/auth-client",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "description": "Scalable frontend auth SDK for centralized login using Keycloak + Auth Service.",
   "main": "index.js",
   "module": "index.js",

package/token.js

@@ -146,14 +146,14 @@ export function clearToken() {
 }
 
 // ========== REFRESH TOKEN STORAGE FOR HTTP DEVELOPMENT ==========
-// In production, refresh tokens should ONLY be in httpOnly cookies set by server
+// In production (HTTPS), refresh tokens should ONLY be in httpOnly cookies set by server
 // For HTTP development (cross-origin cookies don't work), we store in localStorage
 const REFRESH_TOKEN_KEY = 'auth_refresh_token';
 
 function isHttpDevelopment() {
   try {
-    return typeof window !== 'undefined' &&
-      window.location?.protocol === 'http:';
+    return typeof window !== 'undefined' && 
+           window.location?.protocol === 'http:';
   } catch (err) {
     return false;
   }
@@ -190,7 +190,7 @@ export function getRefreshToken() {
       return null;
     }
   }
-
+  
   // In production, refresh token is in httpOnly cookie (not accessible via JS)
   // The refresh endpoint uses credentials: 'include' to send the cookie
   return null;
@@ -203,14 +203,14 @@ export function clearRefreshToken() {
   } catch (err) {
     // Ignore
   }
-
+  
   // Clear cookie (for production)
   try {
     document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Strict${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;
   } catch (err) {
     console.warn('Could not clear refresh token cookie:', err);
   }
-
+  
   // Clear sessionStorage
   try {
     sessionStorage.removeItem(REFRESH_COOKIE);