@spidy092/auth-client 3.0.8 → 3.0.9

package/dist/react/useAuth.cjs

@@ -39,7 +39,24 @@ var import_react = __toESM(require("react"), 1);
 
 // token.js
 var import_jwt_decode = require("jwt-decode");
+var accessToken = null;
+var listeners = /* @__PURE__ */ new Set();
 var COOKIE_MAX_AGE = 7 * 24 * 60 * 60;
+if (typeof window !== "undefined" && window.addEventListener) {
+  window.addEventListener("storage", (event) => {
+    if (event.key !== "authToken") return;
+    const previousToken = accessToken;
+    accessToken = event.newValue || null;
+    if (previousToken === accessToken) return;
+    listeners.forEach((listener) => {
+      try {
+        listener(accessToken, previousToken);
+      } catch (err) {
+        console.warn("Token listener error:", err);
+      }
+    });
+  });
+}
 
 // config.js
 var config = {

package/dist/react/useAuth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../react/useAuth.js","../../react/AuthProvider.jsx","../../token.js","../../config.js"],"sourcesContent":["import { useContext } from 'react';\nimport { AuthContext } from './AuthProvider';\n\nexport function useAuth() {\n  const context = useContext(AuthContext);\n  if (!context) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return context;\n}","// auth-client/react/AuthProvider.jsx\nimport React, { createContext, useState, useEffect, useRef } from 'react';\nimport { getToken, setToken, clearToken } from '../token';\nimport { getConfig } from '../config';\nimport { \n  login as coreLogin, \n  logout as coreLogout,\n  startSessionSecurity,\n  stopSessionSecurity,\n  onSessionInvalid\n} from '../core';\n\nexport const AuthContext = createContext();\n\nexport function AuthProvider({ children, onSessionExpired }) {\n  const [token, setTokenState] = useState(getToken());\n  const [user, setUser] = useState(null);\n  const [loading, setLoading] = useState(!!token); // Loading if we have a token to validate\n  const [sessionValid, setSessionValid] = useState(true);\n  const sessionSecurityRef = useRef(null);\n\n  // Handle session invalidation (from Keycloak admin deletion or expiry)\n  const handleSessionInvalid = (reason) => {\n    console.log('🚨 AuthProvider: Session invalidated -', reason);\n    setSessionValid(false);\n    setUser(null);\n    setTokenState(null);\n    \n    // Call custom callback if provided\n    if (onSessionExpired && typeof onSessionExpired === 'function') {\n      onSessionExpired(reason);\n    }\n  };\n\n  // Start session security on mount (when we have a token)\n  useEffect(() => {\n    if (token && !sessionSecurityRef.current) {\n      console.log('🔐 AuthProvider: Starting session security');\n      \n      // Register session invalid handler\n      const unsubscribe = onSessionInvalid(handleSessionInvalid);\n      \n      // Start proactive refresh + session monitoring\n      sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);\n      \n      return () => {\n        unsubscribe();\n        if (sessionSecurityRef.current) {\n          sessionSecurityRef.current.stopAll();\n          sessionSecurityRef.current = null;\n        }\n      };\n    }\n    \n    // Cleanup when token is removed\n    if (!token && sessionSecurityRef.current) {\n      sessionSecurityRef.current.stopAll();\n      sessionSecurityRef.current = null;\n    }\n  }, [token]);\n\n  useEffect(() => {\n    console.log('🔍 AuthProvider useEffect triggered:', { \n      hasToken: !!token, \n      tokenLength: token?.length \n    });\n    \n    if (!token) {\n      console.log('⚠️ AuthProvider: No token, setting loading=false');\n      setLoading(false);\n      return;\n    }\n    \n    const { authBaseUrl } = getConfig();\n    if (!authBaseUrl) {\n      console.warn('AuthProvider: No authBaseUrl configured');\n      setLoading(false);\n      return;\n    }\n\n    console.log('🌐 AuthProvider: Fetching profile with token...', {\n      authBaseUrl,\n      tokenPreview: token.slice(0, 50) + '...'\n    });\n\n    fetch(`${authBaseUrl}/account/profile`, {\n      headers: { Authorization: `Bearer ${token}` },\n      credentials: 'include',\n    })\n      .then(res => {\n        console.log('📥 Profile response status:', res.status);\n        if (!res.ok) throw new Error('Failed to fetch user');\n        return res.json();\n      })\n      .then(userData => {\n        console.log('✅ Profile fetched successfully:', userData.email);\n        setUser(userData);\n        setSessionValid(true);\n        setLoading(false);\n      })\n      .catch(err => {\n        console.error('❌ Fetch user error:', err);\n        clearToken();\n        setTokenState(null);\n        setUser(null);\n        setLoading(false);\n      });\n  }, [token]);\n\n  const login = (clientKey, redirectUri, state) => {\n    coreLogin(clientKey, redirectUri, state);\n  };\n\n  const logout = () => {\n    // Stop session security before logout\n    stopSessionSecurity();\n    sessionSecurityRef.current = null;\n    \n    coreLogout();\n    setUser(null);\n    setTokenState(null);\n    setSessionValid(true);\n  };\n\n  const value = {\n    token,\n    user,\n    loading,\n    login,\n    logout,\n    isAuthenticated: !!token && !!user && sessionValid,\n    sessionValid,\n    setUser,\n    setToken: (newToken) => {\n      setToken(newToken);\n      setTokenState(newToken);\n      setSessionValid(true);\n    },\n    clearToken: () => {\n      stopSessionSecurity();\n      sessionSecurityRef.current = null;\n      clearToken();\n      setTokenState(null);\n      setUser(null);\n    },\n  };\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n\n","// auth-client/token.js - MINIMAL WORKING VERSION\n\nimport { jwtDecode } from 'jwt-decode';\n\nlet accessToken = null;\nconst listeners = new Set();\n\nconst REFRESH_COOKIE = 'account_refresh_token';\nconst COOKIE_MAX_AGE = 7 * 24 * 60 * 60;\n\nfunction secureAttribute() {\n  try {\n    return typeof window !== 'undefined' && window.location?.protocol === 'https:'\n      ? '; Secure'\n      : '';\n  } catch (err) {\n    return '';\n  }\n}\n\n// ========== ACCESS TOKEN ==========\nfunction writeAccessToken(token) {\n  if (!token) {\n    try {\n      localStorage.removeItem('authToken');\n    } catch (err) {\n      console.warn('Could not clear token from localStorage:', err);\n    }\n    return;\n  }\n\n  try {\n    localStorage.setItem('authToken', token);\n  } catch (err) {\n    console.warn('Could not persist token to localStorage:', err);\n  }\n}\n\nfunction readAccessToken() {\n  try {\n    return localStorage.getItem('authToken');\n  } catch (err) {\n    console.warn('Could not read token from localStorage:', err);\n    return null;\n  }\n}\n\n// ========== REFRESH TOKEN (KEEP SIMPLE) ==========\n// export function setRefreshToken(token) {\n//   if (!token) {\n//     clearRefreshToken();\n//     return;\n//   }\n\n//   const expires = new Date(Date.now() + COOKIE_MAX_AGE * 1000);\n\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax${secureAttribute()}; Expires=${expires.toUTCString()}`;\n//   } catch (err) {\n//     console.warn('Could not set refresh token:', err);\n//   }\n// }\n\n// export function getRefreshToken() {\n//   try {\n//     const match = document.cookie\n//       ?.split('; ')\n//       ?.find((row) => row.startsWith(`${REFRESH_COOKIE}=`));\n\n//     if (match) {\n//       return decodeURIComponent(match.split('=')[1]);\n//     }\n//   } catch (err) {\n//     console.warn('Could not read refresh token:', err);\n//   }\n\n//   return null;\n// }\n\n// export function clearRefreshToken() {\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Lax${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n//   } catch (err) {\n//     console.warn('Could not clear refresh token:', err);\n//   }\n// }\n\n// ========== ACCESS TOKEN FUNCTIONS ==========\nfunction decode(token) {\n  try {\n    return jwtDecode(token);\n  } catch (err) {\n    return null;\n  }\n}\n\nfunction isExpired(token, bufferSeconds = 60) {\n  if (!token) return true;\n  const decoded = decode(token);\n  if (!decoded?.exp) return true;\n  const now = Date.now() / 1000;\n  return decoded.exp < now + bufferSeconds;\n}\n\n// ========== TOKEN EXPIRY UTILITIES ==========\n// Get the exact expiry time of a token as a Date object\nexport function getTokenExpiryTime(token) {\n  if (!token) return null;\n  const decoded = decode(token);\n  if (!decoded?.exp) return null;\n  return new Date(decoded.exp * 1000);\n}\n\n// Get seconds until token expires (negative if already expired)\nexport function getTimeUntilExpiry(token) {\n  if (!token) return -1;\n  const decoded = decode(token);\n  if (!decoded?.exp) return -1;\n  const now = Date.now() / 1000;\n  return Math.floor(decoded.exp - now);\n}\n\n// Check if token will expire within the next N seconds\nexport function willExpireSoon(token, withinSeconds = 60) {\n  const timeLeft = getTimeUntilExpiry(token);\n  return timeLeft >= 0 && timeLeft <= withinSeconds;\n}\n\nexport function setToken(token) {\n  const previousToken = accessToken;\n  accessToken = token || null;\n  writeAccessToken(accessToken);\n\n  if (previousToken !== accessToken) {\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  }\n}\n\nexport function getToken() {\n  if (accessToken) return accessToken;\n  accessToken = readAccessToken();\n  return accessToken;\n}\n\nexport function clearToken() {\n  if (!accessToken) {\n    writeAccessToken(null);\n    clearRefreshToken();\n    return;\n  }\n\n  const previousToken = accessToken;\n  accessToken = null;\n  writeAccessToken(null);\n  clearRefreshToken();\n\n  listeners.forEach((listener) => {\n    try {\n      listener(null, previousToken);\n    } catch (err) {\n      console.warn('Token listener error:', err);\n    }\n  });\n}\n\n// ========== REFRESH TOKEN STORAGE ==========\n// By default:\n//   HTTP  → localStorage (cookies don't work cross-origin in dev)\n//   HTTPS → httpOnly cookies (secure, managed by server)\n// When persistRefreshToken is enabled:\n//   Always use localStorage (for local HTTPS with mkcert/self-signed certs)\nconst REFRESH_TOKEN_KEY = 'auth_refresh_token';\n\n// ✅ Persistence flag - controlled by config.persistRefreshToken\nlet _persistRefreshToken = false;\n\nexport function enableRefreshTokenPersistence(enabled) {\n  _persistRefreshToken = !!enabled;\n  console.log(`🔧 Refresh token persistence: ${_persistRefreshToken ? 'ENABLED' : 'DISABLED'}`);\n}\n\nfunction shouldUseLocalStorage() {\n  // If persistence is forced, always use localStorage\n  if (_persistRefreshToken) return true;\n  // Otherwise, only use localStorage on HTTP (dev mode)\n  try {\n    return typeof window !== 'undefined' &&\n      window.location?.protocol === 'http:';\n  } catch (err) {\n    return false;\n  }\n}\n\nexport function setRefreshToken(token) {\n  if (!token) {\n    clearRefreshToken();\n    return;\n  }\n\n  if (shouldUseLocalStorage()) {\n    try {\n      localStorage.setItem(REFRESH_TOKEN_KEY, token);\n      console.log(`📦 Refresh token stored in localStorage (${_persistRefreshToken ? 'persistence enabled' : 'HTTP dev mode'})`);\n    } catch (err) {\n      console.warn('Could not store refresh token:', err);\n    }\n  } else {\n    // HTTPS without persistence: refresh token is in httpOnly cookie only\n    console.log('🔒 Refresh token managed by server httpOnly cookie (production mode)');\n  }\n}\n\nexport function getRefreshToken() {\n  if (shouldUseLocalStorage()) {\n    try {\n      const token = localStorage.getItem(REFRESH_TOKEN_KEY);\n      return token;\n    } catch (err) {\n      console.warn('Could not read refresh token:', err);\n      return null;\n    }\n  }\n\n  // HTTPS without persistence: refresh token is in httpOnly cookie (not accessible via JS)\n  // The refresh endpoint uses credentials: 'include' to send the cookie\n  return null;\n}\n\nexport function clearRefreshToken() {\n  // Clear localStorage (for HTTP dev)\n  try {\n    localStorage.removeItem(REFRESH_TOKEN_KEY);\n  } catch (err) {\n    // Ignore\n  }\n\n  // Clear cookie (for production)\n  try {\n    document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Strict${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n  } catch (err) {\n    console.warn('Could not clear refresh token cookie:', err);\n  }\n\n  // Clear sessionStorage\n  try {\n    sessionStorage.removeItem(REFRESH_COOKIE);\n  } catch (err) {\n    // Ignore\n  }\n}\n\nexport function addTokenListener(listener) {\n  if (typeof listener !== 'function') {\n    throw new Error('Token listener must be a function');\n  }\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\nexport function removeTokenListener(listener) {\n  listeners.delete(listener);\n}\n\nexport function getListenerCount() {\n  return listeners.size;\n}\n\nexport function isAuthenticated() {\n  const token = getToken();\n  return !!token && !isExpired(token, 10);\n}\n\n\n\n","// auth-client/config.js\nimport { enableRefreshTokenPersistence } from './token';\n\n// ========== SESSION SECURITY CONFIGURATION ==========\n// These settings control how the auth-client handles token refresh and session validation\n// to ensure deleted sessions in Keycloak are detected quickly.\n\nlet config = {\n  clientKey: null,\n  authBaseUrl: null,\n  redirectUri: null,\n  accountUiUrl: null,\n  isRouter: false, // ✅ Add router flag\n\n  // ========== SESSION SECURITY SETTINGS ==========\n  // Buffer time (in seconds) before token expiry to trigger proactive refresh\n  // With 5-minute access tokens, refreshing 60s before expiry ensures seamless UX\n  tokenRefreshBuffer: 60,\n\n  // Interval (in milliseconds) for periodic session validation\n  // Validates that the session still exists in Keycloak (not deleted by admin)\n  // Default: 15 minutes (900000ms) - Increased from 2m to avoid frequent checks\n  sessionValidationInterval: 15 * 60 * 1000,\n\n  // Enable/disable periodic session validation\n  // When enabled, the client will ping the server to verify session is still active\n  enableSessionValidation: true,\n\n  // Enable/disable proactive token refresh\n  // When enabled, tokens are refreshed before they expire (using tokenRefreshBuffer)\n  enableProactiveRefresh: true,\n\n  // Validate session when browser tab becomes visible again\n  // Catches session deletions that happened while the tab was inactive\n  validateOnVisibility: true,\n\n  // ========== REFRESH TOKEN PERSISTENCE ==========\n  // When true, stores refresh token in localStorage even on HTTPS\n  // Required for local dev with mkcert/self-signed certs where httpOnly cookies\n  // may not work reliably across origins\n  // ⚠️ In true production, set to false and rely on httpOnly cookies\n  persistRefreshToken: false,\n};\n\nexport function setConfig(customConfig = {}) {\n  if (!customConfig.clientKey || !customConfig.authBaseUrl) {\n    throw new Error('Missing required config: clientKey and authBaseUrl are required');\n  }\n\n  config = {\n    ...config,\n    ...customConfig,\n    redirectUri: customConfig.redirectUri || window.location.origin + '/callback',\n    // ✅ Auto-detect router mode\n    isRouter: customConfig.isRouter || customConfig.clientKey === 'account-ui'\n  };\n\n  // ✅ Wire persistRefreshToken to token.js\n  if (config.persistRefreshToken) {\n    enableRefreshTokenPersistence(true);\n    console.log('📦 Refresh token persistence ENABLED (localStorage on HTTPS)');\n  }\n\n  console.log(`🔧 Auth Client Mode: ${config.isRouter ? 'ROUTER' : 'CLIENT'}`, {\n    clientKey: config.clientKey,\n    isRouter: config.isRouter,\n    persistRefreshToken: config.persistRefreshToken\n  });\n}\n\nexport function getConfig() {\n  return { ...config };\n}\n\n// ✅ Helper function\nexport function isRouterMode() {\n  return config.isRouter;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,gBAA2B;;;ACC3B,mBAAkE;;;ACClE,wBAA0B;AAM1B,IAAM,iBAAiB,IAAI,KAAK,KAAK;;;ACDrC,IAAI,SAAS;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAAA,EACd,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAKV,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAKpB,2BAA2B,KAAK,KAAK;AAAA;AAAA;AAAA,EAIrC,yBAAyB;AAAA;AAAA;AAAA,EAIzB,wBAAwB;AAAA;AAAA;AAAA,EAIxB,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtB,qBAAqB;AACvB;;;AF9BO,IAAM,kBAAc,4BAAc;;;ADTlC,SAAS,UAAU;AACxB,QAAM,cAAU,0BAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;","names":["import_react"]}
+{"version":3,"sources":["../../react/useAuth.js","../../react/AuthProvider.jsx","../../token.js","../../config.js"],"sourcesContent":["import { useContext } from 'react';\nimport { AuthContext } from './AuthProvider';\n\nexport function useAuth() {\n  const context = useContext(AuthContext);\n  if (!context) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return context;\n}","// auth-client/react/AuthProvider.jsx\nimport React, { createContext, useState, useEffect, useRef } from 'react';\nimport { getToken, setToken, clearToken } from '../token';\nimport { getConfig } from '../config';\nimport { \n  login as coreLogin, \n  logout as coreLogout,\n  startSessionSecurity,\n  stopSessionSecurity,\n  onSessionInvalid\n} from '../core';\n\nexport const AuthContext = createContext();\n\nexport function AuthProvider({ children, onSessionExpired }) {\n  const [token, setTokenState] = useState(getToken());\n  const [user, setUser] = useState(null);\n  const [loading, setLoading] = useState(!!token); // Loading if we have a token to validate\n  const [sessionValid, setSessionValid] = useState(true);\n  const sessionSecurityRef = useRef(null);\n\n  // Handle session invalidation (from Keycloak admin deletion or expiry)\n  const handleSessionInvalid = (reason) => {\n    console.log('🚨 AuthProvider: Session invalidated -', reason);\n    setSessionValid(false);\n    setUser(null);\n    setTokenState(null);\n    \n    // Call custom callback if provided\n    if (onSessionExpired && typeof onSessionExpired === 'function') {\n      onSessionExpired(reason);\n    }\n  };\n\n  // Start session security on mount (when we have a token)\n  useEffect(() => {\n    if (token && !sessionSecurityRef.current) {\n      console.log('🔐 AuthProvider: Starting session security');\n      \n      // Register session invalid handler\n      const unsubscribe = onSessionInvalid(handleSessionInvalid);\n      \n      // Start proactive refresh + session monitoring\n      sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);\n      \n      return () => {\n        unsubscribe();\n        if (sessionSecurityRef.current) {\n          sessionSecurityRef.current.stopAll();\n          sessionSecurityRef.current = null;\n        }\n      };\n    }\n    \n    // Cleanup when token is removed\n    if (!token && sessionSecurityRef.current) {\n      sessionSecurityRef.current.stopAll();\n      sessionSecurityRef.current = null;\n    }\n  }, [token]);\n\n  useEffect(() => {\n    console.log('🔍 AuthProvider useEffect triggered:', { \n      hasToken: !!token, \n      tokenLength: token?.length \n    });\n    \n    if (!token) {\n      console.log('⚠️ AuthProvider: No token, setting loading=false');\n      setLoading(false);\n      return;\n    }\n    \n    const { authBaseUrl } = getConfig();\n    if (!authBaseUrl) {\n      console.warn('AuthProvider: No authBaseUrl configured');\n      setLoading(false);\n      return;\n    }\n\n    console.log('🌐 AuthProvider: Fetching profile with token...', {\n      authBaseUrl,\n      tokenPreview: token.slice(0, 50) + '...'\n    });\n\n    fetch(`${authBaseUrl}/account/profile`, {\n      headers: { Authorization: `Bearer ${token}` },\n      credentials: 'include',\n    })\n      .then(res => {\n        console.log('📥 Profile response status:', res.status);\n        if (!res.ok) throw new Error('Failed to fetch user');\n        return res.json();\n      })\n      .then(userData => {\n        console.log('✅ Profile fetched successfully:', userData.email);\n        setUser(userData);\n        setSessionValid(true);\n        setLoading(false);\n      })\n      .catch(err => {\n        console.error('❌ Fetch user error:', err);\n        clearToken();\n        setTokenState(null);\n        setUser(null);\n        setLoading(false);\n      });\n  }, [token]);\n\n  const login = (clientKey, redirectUri, state) => {\n    coreLogin(clientKey, redirectUri, state);\n  };\n\n  const logout = async (options) => {\n    // Stop session security before logout\n    stopSessionSecurity();\n    sessionSecurityRef.current = null;\n    \n    try {\n      await coreLogout(options);\n    } finally {\n      setUser(null);\n      setTokenState(null);\n      setSessionValid(true);\n    }\n  };\n\n  const value = {\n    token,\n    user,\n    loading,\n    login,\n    logout,\n    isAuthenticated: !!token && !!user && sessionValid,\n    sessionValid,\n    setUser,\n    setToken: (newToken) => {\n      setToken(newToken);\n      setTokenState(newToken);\n      setSessionValid(true);\n    },\n    clearToken: () => {\n      stopSessionSecurity();\n      sessionSecurityRef.current = null;\n      clearToken();\n      setTokenState(null);\n      setUser(null);\n    },\n  };\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// auth-client/token.js - MINIMAL WORKING VERSION\n\nimport { jwtDecode } from 'jwt-decode';\n\nlet accessToken = null;\nconst listeners = new Set();\n\nconst REFRESH_COOKIE = 'account_refresh_token';\nconst COOKIE_MAX_AGE = 7 * 24 * 60 * 60;\n\nfunction secureAttribute() {\n  try {\n    return typeof window !== 'undefined' && window.location?.protocol === 'https:'\n      ? '; Secure'\n      : '';\n  } catch (err) {\n    return '';\n  }\n}\n\n// ========== ACCESS TOKEN ==========\nfunction writeAccessToken(token) {\n  if (!token) {\n    try {\n      localStorage.removeItem('authToken');\n    } catch (err) {\n      console.warn('Could not clear token from localStorage:', err);\n    }\n    return;\n  }\n\n  try {\n    localStorage.setItem('authToken', token);\n  } catch (err) {\n    console.warn('Could not persist token to localStorage:', err);\n  }\n}\n\nfunction readAccessToken() {\n  try {\n    return localStorage.getItem('authToken');\n  } catch (err) {\n    console.warn('Could not read token from localStorage:', err);\n    return null;\n  }\n}\n\n// ========== REFRESH TOKEN (KEEP SIMPLE) ==========\n// export function setRefreshToken(token) {\n//   if (!token) {\n//     clearRefreshToken();\n//     return;\n//   }\n\n//   const expires = new Date(Date.now() + COOKIE_MAX_AGE * 1000);\n\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax${secureAttribute()}; Expires=${expires.toUTCString()}`;\n//   } catch (err) {\n//     console.warn('Could not set refresh token:', err);\n//   }\n// }\n\n// export function getRefreshToken() {\n//   try {\n//     const match = document.cookie\n//       ?.split('; ')\n//       ?.find((row) => row.startsWith(`${REFRESH_COOKIE}=`));\n\n//     if (match) {\n//       return decodeURIComponent(match.split('=')[1]);\n//     }\n//   } catch (err) {\n//     console.warn('Could not read refresh token:', err);\n//   }\n\n//   return null;\n// }\n\n// export function clearRefreshToken() {\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Lax${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n//   } catch (err) {\n//     console.warn('Could not clear refresh token:', err);\n//   }\n// }\n\n// ========== ACCESS TOKEN FUNCTIONS ==========\nfunction decode(token) {\n  try {\n    return jwtDecode(token);\n  } catch (err) {\n    return null;\n  }\n}\n\nfunction isExpired(token, bufferSeconds = 60) {\n  if (!token) return true;\n  const decoded = decode(token);\n  if (!decoded?.exp) return true;\n  const now = Date.now() / 1000;\n  return decoded.exp < now + bufferSeconds;\n}\n\n// ========== TOKEN EXPIRY UTILITIES ==========\n// Get the exact expiry time of a token as a Date object\nexport function getTokenExpiryTime(token) {\n  if (!token) return null;\n  const decoded = decode(token);\n  if (!decoded?.exp) return null;\n  return new Date(decoded.exp * 1000);\n}\n\n// Get seconds until token expires (negative if already expired)\nexport function getTimeUntilExpiry(token) {\n  if (!token) return -1;\n  const decoded = decode(token);\n  if (!decoded?.exp) return -1;\n  const now = Date.now() / 1000;\n  return Math.floor(decoded.exp - now);\n}\n\n// Check if token will expire within the next N seconds\nexport function willExpireSoon(token, withinSeconds = 60) {\n  const timeLeft = getTimeUntilExpiry(token);\n  return timeLeft >= 0 && timeLeft <= withinSeconds;\n}\n\nexport function setToken(token) {\n  const previousToken = accessToken;\n  accessToken = token || null;\n  writeAccessToken(accessToken);\n\n  if (previousToken !== accessToken) {\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  }\n}\n\nexport function getToken() {\n  if (accessToken) return accessToken;\n  accessToken = readAccessToken();\n  return accessToken;\n}\n\nexport function clearToken() {\n  if (!accessToken) {\n    writeAccessToken(null);\n    clearRefreshToken();\n    return;\n  }\n\n  const previousToken = accessToken;\n  accessToken = null;\n  writeAccessToken(null);\n  clearRefreshToken();\n\n  listeners.forEach((listener) => {\n    try {\n      listener(null, previousToken);\n    } catch (err) {\n      console.warn('Token listener error:', err);\n    }\n  });\n}\n\n// ========== REFRESH TOKEN STORAGE ==========\n// By default:\n//   HTTP  → localStorage (cookies don't work cross-origin in dev)\n//   HTTPS → httpOnly cookies (secure, managed by server)\n// When persistRefreshToken is enabled:\n//   Always use localStorage (for local HTTPS with mkcert/self-signed certs)\nconst REFRESH_TOKEN_KEY = 'auth_refresh_token';\n\n// ✅ Persistence flag - controlled by config.persistRefreshToken\nlet _persistRefreshToken = false;\n\nexport function enableRefreshTokenPersistence(enabled) {\n  _persistRefreshToken = !!enabled;\n  console.log(`🔧 Refresh token persistence: ${_persistRefreshToken ? 'ENABLED' : 'DISABLED'}`);\n}\n\nfunction shouldUseLocalStorage() {\n  // If persistence is forced, always use localStorage\n  if (_persistRefreshToken) return true;\n  // Otherwise, only use localStorage on HTTP (dev mode)\n  try {\n    return typeof window !== 'undefined' &&\n      window.location?.protocol === 'http:';\n  } catch (err) {\n    return false;\n  }\n}\n\nexport function setRefreshToken(token) {\n  if (!token) {\n    clearRefreshToken();\n    return;\n  }\n\n  if (shouldUseLocalStorage()) {\n    try {\n      localStorage.setItem(REFRESH_TOKEN_KEY, token);\n      console.log(`📦 Refresh token stored in localStorage (${_persistRefreshToken ? 'persistence enabled' : 'HTTP dev mode'})`);\n    } catch (err) {\n      console.warn('Could not store refresh token:', err);\n    }\n  } else {\n    // HTTPS without persistence: refresh token is in httpOnly cookie only\n    console.log('🔒 Refresh token managed by server httpOnly cookie (production mode)');\n  }\n}\n\nexport function getRefreshToken() {\n  if (shouldUseLocalStorage()) {\n    try {\n      const token = localStorage.getItem(REFRESH_TOKEN_KEY);\n      return token;\n    } catch (err) {\n      console.warn('Could not read refresh token:', err);\n      return null;\n    }\n  }\n\n  // HTTPS without persistence: refresh token is in httpOnly cookie (not accessible via JS)\n  // The refresh endpoint uses credentials: 'include' to send the cookie\n  return null;\n}\n\nexport function clearRefreshToken() {\n  // Clear localStorage (for HTTP dev)\n  try {\n    localStorage.removeItem(REFRESH_TOKEN_KEY);\n  } catch (err) {\n    // Ignore\n  }\n\n  // Clear cookie (for production)\n  try {\n    document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Strict${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n  } catch (err) {\n    console.warn('Could not clear refresh token cookie:', err);\n  }\n\n  // Clear sessionStorage\n  try {\n    sessionStorage.removeItem(REFRESH_COOKIE);\n  } catch (err) {\n    // Ignore\n  }\n}\n\nexport function addTokenListener(listener) {\n  if (typeof listener !== 'function') {\n    throw new Error('Token listener must be a function');\n  }\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\nexport function removeTokenListener(listener) {\n  listeners.delete(listener);\n}\n\nexport function getListenerCount() {\n  return listeners.size;\n}\n\n// localStorage changes do not fire in the tab that made the change, but they\n// do fire in sibling tabs on the same origin. Keep the in-memory token cache\n// and React consumers synchronized when another tab logs in or out.\nif (typeof window !== 'undefined' && window.addEventListener) {\n  window.addEventListener('storage', (event) => {\n    if (event.key !== 'authToken') return;\n\n    const previousToken = accessToken;\n    accessToken = event.newValue || null;\n    if (previousToken === accessToken) return;\n\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  });\n}\n\nexport function isAuthenticated() {\n  const token = getToken();\n  return !!token && !isExpired(token, 10);\n}\n\n\n","// auth-client/config.js\nimport { enableRefreshTokenPersistence } from './token';\n\n// ========== SESSION SECURITY CONFIGURATION ==========\n// These settings control how the auth-client handles token refresh and session validation\n// to ensure deleted sessions in Keycloak are detected quickly.\n\nlet config = {\n  clientKey: null,\n  authBaseUrl: null,\n  redirectUri: null,\n  accountUiUrl: null,\n  isRouter: false, // ✅ Add router flag\n\n  // ========== SESSION SECURITY SETTINGS ==========\n  // Buffer time (in seconds) before token expiry to trigger proactive refresh\n  // With 5-minute access tokens, refreshing 60s before expiry ensures seamless UX\n  tokenRefreshBuffer: 60,\n\n  // Interval (in milliseconds) for periodic session validation\n  // Validates that the session still exists in Keycloak (not deleted by admin)\n  // Default: 15 minutes (900000ms) - Increased from 2m to avoid frequent checks\n  sessionValidationInterval: 15 * 60 * 1000,\n\n  // Enable/disable periodic session validation\n  // When enabled, the client will ping the server to verify session is still active\n  enableSessionValidation: true,\n\n  // Enable/disable proactive token refresh\n  // When enabled, tokens are refreshed before they expire (using tokenRefreshBuffer)\n  enableProactiveRefresh: true,\n\n  // Validate session when browser tab becomes visible again\n  // Catches session deletions that happened while the tab was inactive\n  validateOnVisibility: true,\n\n  // ========== REFRESH TOKEN PERSISTENCE ==========\n  // When true, stores refresh token in localStorage even on HTTPS\n  // Required for local dev with mkcert/self-signed certs where httpOnly cookies\n  // may not work reliably across origins\n  // ⚠️ In true production, set to false and rely on httpOnly cookies\n  persistRefreshToken: false,\n};\n\nexport function setConfig(customConfig = {}) {\n  if (!customConfig.clientKey || !customConfig.authBaseUrl) {\n    throw new Error('Missing required config: clientKey and authBaseUrl are required');\n  }\n\n  config = {\n    ...config,\n    ...customConfig,\n    redirectUri: customConfig.redirectUri || window.location.origin + '/callback',\n    // ✅ Auto-detect router mode\n    isRouter: customConfig.isRouter || customConfig.clientKey === 'account-ui'\n  };\n\n  // ✅ Wire persistRefreshToken to token.js\n  if (config.persistRefreshToken) {\n    enableRefreshTokenPersistence(true);\n    console.log('📦 Refresh token persistence ENABLED (localStorage on HTTPS)');\n  }\n\n  console.log(`🔧 Auth Client Mode: ${config.isRouter ? 'ROUTER' : 'CLIENT'}`, {\n    clientKey: config.clientKey,\n    isRouter: config.isRouter,\n    persistRefreshToken: config.persistRefreshToken\n  });\n}\n\nexport function getConfig() {\n  return { ...config };\n}\n\n// ✅ Helper function\nexport function isRouterMode() {\n  return config.isRouter;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,gBAA2B;;;ACC3B,mBAAkE;;;ACClE,wBAA0B;AAE1B,IAAI,cAAc;AAClB,IAAM,YAAY,oBAAI,IAAI;AAG1B,IAAM,iBAAiB,IAAI,KAAK,KAAK;AA8QrC,IAAI,OAAO,WAAW,eAAe,OAAO,kBAAkB;AAC5D,SAAO,iBAAiB,WAAW,CAAC,UAAU;AAC5C,QAAI,MAAM,QAAQ,YAAa;AAE/B,UAAM,gBAAgB;AACtB,kBAAc,MAAM,YAAY;AAChC,QAAI,kBAAkB,YAAa;AAEnC,cAAU,QAAQ,CAAC,aAAa;AAC9B,UAAI;AACF,iBAAS,aAAa,aAAa;AAAA,MACrC,SAAS,KAAK;AACZ,gBAAQ,KAAK,yBAAyB,GAAG;AAAA,MAC3C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;;;AC/RA,IAAI,SAAS;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAAA,EACd,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAKV,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAKpB,2BAA2B,KAAK,KAAK;AAAA;AAAA;AAAA,EAIrC,yBAAyB;AAAA;AAAA;AAAA,EAIzB,wBAAwB;AAAA;AAAA;AAAA,EAIxB,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtB,qBAAqB;AACvB;;;AF9BO,IAAM,kBAAc,4BAAc;;;ADTlC,SAAS,UAAU;AACxB,QAAM,cAAU,0BAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;","names":["import_react"]}

package/dist/react/useAuth.js

@@ -6,7 +6,24 @@ import React, { createContext, useState, useEffect, useRef } from "react";
 
 // token.js
 import { jwtDecode } from "jwt-decode";
+var accessToken = null;
+var listeners = /* @__PURE__ */ new Set();
 var COOKIE_MAX_AGE = 7 * 24 * 60 * 60;
+if (typeof window !== "undefined" && window.addEventListener) {
+  window.addEventListener("storage", (event) => {
+    if (event.key !== "authToken") return;
+    const previousToken = accessToken;
+    accessToken = event.newValue || null;
+    if (previousToken === accessToken) return;
+    listeners.forEach((listener) => {
+      try {
+        listener(accessToken, previousToken);
+      } catch (err) {
+        console.warn("Token listener error:", err);
+      }
+    });
+  });
+}
 
 // config.js
 var config = {

package/dist/react/useAuth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../react/useAuth.js","../../react/AuthProvider.jsx","../../token.js","../../config.js"],"sourcesContent":["import { useContext } from 'react';\nimport { AuthContext } from './AuthProvider';\n\nexport function useAuth() {\n  const context = useContext(AuthContext);\n  if (!context) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return context;\n}","// auth-client/react/AuthProvider.jsx\nimport React, { createContext, useState, useEffect, useRef } from 'react';\nimport { getToken, setToken, clearToken } from '../token';\nimport { getConfig } from '../config';\nimport { \n  login as coreLogin, \n  logout as coreLogout,\n  startSessionSecurity,\n  stopSessionSecurity,\n  onSessionInvalid\n} from '../core';\n\nexport const AuthContext = createContext();\n\nexport function AuthProvider({ children, onSessionExpired }) {\n  const [token, setTokenState] = useState(getToken());\n  const [user, setUser] = useState(null);\n  const [loading, setLoading] = useState(!!token); // Loading if we have a token to validate\n  const [sessionValid, setSessionValid] = useState(true);\n  const sessionSecurityRef = useRef(null);\n\n  // Handle session invalidation (from Keycloak admin deletion or expiry)\n  const handleSessionInvalid = (reason) => {\n    console.log('🚨 AuthProvider: Session invalidated -', reason);\n    setSessionValid(false);\n    setUser(null);\n    setTokenState(null);\n    \n    // Call custom callback if provided\n    if (onSessionExpired && typeof onSessionExpired === 'function') {\n      onSessionExpired(reason);\n    }\n  };\n\n  // Start session security on mount (when we have a token)\n  useEffect(() => {\n    if (token && !sessionSecurityRef.current) {\n      console.log('🔐 AuthProvider: Starting session security');\n      \n      // Register session invalid handler\n      const unsubscribe = onSessionInvalid(handleSessionInvalid);\n      \n      // Start proactive refresh + session monitoring\n      sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);\n      \n      return () => {\n        unsubscribe();\n        if (sessionSecurityRef.current) {\n          sessionSecurityRef.current.stopAll();\n          sessionSecurityRef.current = null;\n        }\n      };\n    }\n    \n    // Cleanup when token is removed\n    if (!token && sessionSecurityRef.current) {\n      sessionSecurityRef.current.stopAll();\n      sessionSecurityRef.current = null;\n    }\n  }, [token]);\n\n  useEffect(() => {\n    console.log('🔍 AuthProvider useEffect triggered:', { \n      hasToken: !!token, \n      tokenLength: token?.length \n    });\n    \n    if (!token) {\n      console.log('⚠️ AuthProvider: No token, setting loading=false');\n      setLoading(false);\n      return;\n    }\n    \n    const { authBaseUrl } = getConfig();\n    if (!authBaseUrl) {\n      console.warn('AuthProvider: No authBaseUrl configured');\n      setLoading(false);\n      return;\n    }\n\n    console.log('🌐 AuthProvider: Fetching profile with token...', {\n      authBaseUrl,\n      tokenPreview: token.slice(0, 50) + '...'\n    });\n\n    fetch(`${authBaseUrl}/account/profile`, {\n      headers: { Authorization: `Bearer ${token}` },\n      credentials: 'include',\n    })\n      .then(res => {\n        console.log('📥 Profile response status:', res.status);\n        if (!res.ok) throw new Error('Failed to fetch user');\n        return res.json();\n      })\n      .then(userData => {\n        console.log('✅ Profile fetched successfully:', userData.email);\n        setUser(userData);\n        setSessionValid(true);\n        setLoading(false);\n      })\n      .catch(err => {\n        console.error('❌ Fetch user error:', err);\n        clearToken();\n        setTokenState(null);\n        setUser(null);\n        setLoading(false);\n      });\n  }, [token]);\n\n  const login = (clientKey, redirectUri, state) => {\n    coreLogin(clientKey, redirectUri, state);\n  };\n\n  const logout = () => {\n    // Stop session security before logout\n    stopSessionSecurity();\n    sessionSecurityRef.current = null;\n    \n    coreLogout();\n    setUser(null);\n    setTokenState(null);\n    setSessionValid(true);\n  };\n\n  const value = {\n    token,\n    user,\n    loading,\n    login,\n    logout,\n    isAuthenticated: !!token && !!user && sessionValid,\n    sessionValid,\n    setUser,\n    setToken: (newToken) => {\n      setToken(newToken);\n      setTokenState(newToken);\n      setSessionValid(true);\n    },\n    clearToken: () => {\n      stopSessionSecurity();\n      sessionSecurityRef.current = null;\n      clearToken();\n      setTokenState(null);\n      setUser(null);\n    },\n  };\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n\n","// auth-client/token.js - MINIMAL WORKING VERSION\n\nimport { jwtDecode } from 'jwt-decode';\n\nlet accessToken = null;\nconst listeners = new Set();\n\nconst REFRESH_COOKIE = 'account_refresh_token';\nconst COOKIE_MAX_AGE = 7 * 24 * 60 * 60;\n\nfunction secureAttribute() {\n  try {\n    return typeof window !== 'undefined' && window.location?.protocol === 'https:'\n      ? '; Secure'\n      : '';\n  } catch (err) {\n    return '';\n  }\n}\n\n// ========== ACCESS TOKEN ==========\nfunction writeAccessToken(token) {\n  if (!token) {\n    try {\n      localStorage.removeItem('authToken');\n    } catch (err) {\n      console.warn('Could not clear token from localStorage:', err);\n    }\n    return;\n  }\n\n  try {\n    localStorage.setItem('authToken', token);\n  } catch (err) {\n    console.warn('Could not persist token to localStorage:', err);\n  }\n}\n\nfunction readAccessToken() {\n  try {\n    return localStorage.getItem('authToken');\n  } catch (err) {\n    console.warn('Could not read token from localStorage:', err);\n    return null;\n  }\n}\n\n// ========== REFRESH TOKEN (KEEP SIMPLE) ==========\n// export function setRefreshToken(token) {\n//   if (!token) {\n//     clearRefreshToken();\n//     return;\n//   }\n\n//   const expires = new Date(Date.now() + COOKIE_MAX_AGE * 1000);\n\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax${secureAttribute()}; Expires=${expires.toUTCString()}`;\n//   } catch (err) {\n//     console.warn('Could not set refresh token:', err);\n//   }\n// }\n\n// export function getRefreshToken() {\n//   try {\n//     const match = document.cookie\n//       ?.split('; ')\n//       ?.find((row) => row.startsWith(`${REFRESH_COOKIE}=`));\n\n//     if (match) {\n//       return decodeURIComponent(match.split('=')[1]);\n//     }\n//   } catch (err) {\n//     console.warn('Could not read refresh token:', err);\n//   }\n\n//   return null;\n// }\n\n// export function clearRefreshToken() {\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Lax${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n//   } catch (err) {\n//     console.warn('Could not clear refresh token:', err);\n//   }\n// }\n\n// ========== ACCESS TOKEN FUNCTIONS ==========\nfunction decode(token) {\n  try {\n    return jwtDecode(token);\n  } catch (err) {\n    return null;\n  }\n}\n\nfunction isExpired(token, bufferSeconds = 60) {\n  if (!token) return true;\n  const decoded = decode(token);\n  if (!decoded?.exp) return true;\n  const now = Date.now() / 1000;\n  return decoded.exp < now + bufferSeconds;\n}\n\n// ========== TOKEN EXPIRY UTILITIES ==========\n// Get the exact expiry time of a token as a Date object\nexport function getTokenExpiryTime(token) {\n  if (!token) return null;\n  const decoded = decode(token);\n  if (!decoded?.exp) return null;\n  return new Date(decoded.exp * 1000);\n}\n\n// Get seconds until token expires (negative if already expired)\nexport function getTimeUntilExpiry(token) {\n  if (!token) return -1;\n  const decoded = decode(token);\n  if (!decoded?.exp) return -1;\n  const now = Date.now() / 1000;\n  return Math.floor(decoded.exp - now);\n}\n\n// Check if token will expire within the next N seconds\nexport function willExpireSoon(token, withinSeconds = 60) {\n  const timeLeft = getTimeUntilExpiry(token);\n  return timeLeft >= 0 && timeLeft <= withinSeconds;\n}\n\nexport function setToken(token) {\n  const previousToken = accessToken;\n  accessToken = token || null;\n  writeAccessToken(accessToken);\n\n  if (previousToken !== accessToken) {\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  }\n}\n\nexport function getToken() {\n  if (accessToken) return accessToken;\n  accessToken = readAccessToken();\n  return accessToken;\n}\n\nexport function clearToken() {\n  if (!accessToken) {\n    writeAccessToken(null);\n    clearRefreshToken();\n    return;\n  }\n\n  const previousToken = accessToken;\n  accessToken = null;\n  writeAccessToken(null);\n  clearRefreshToken();\n\n  listeners.forEach((listener) => {\n    try {\n      listener(null, previousToken);\n    } catch (err) {\n      console.warn('Token listener error:', err);\n    }\n  });\n}\n\n// ========== REFRESH TOKEN STORAGE ==========\n// By default:\n//   HTTP  → localStorage (cookies don't work cross-origin in dev)\n//   HTTPS → httpOnly cookies (secure, managed by server)\n// When persistRefreshToken is enabled:\n//   Always use localStorage (for local HTTPS with mkcert/self-signed certs)\nconst REFRESH_TOKEN_KEY = 'auth_refresh_token';\n\n// ✅ Persistence flag - controlled by config.persistRefreshToken\nlet _persistRefreshToken = false;\n\nexport function enableRefreshTokenPersistence(enabled) {\n  _persistRefreshToken = !!enabled;\n  console.log(`🔧 Refresh token persistence: ${_persistRefreshToken ? 'ENABLED' : 'DISABLED'}`);\n}\n\nfunction shouldUseLocalStorage() {\n  // If persistence is forced, always use localStorage\n  if (_persistRefreshToken) return true;\n  // Otherwise, only use localStorage on HTTP (dev mode)\n  try {\n    return typeof window !== 'undefined' &&\n      window.location?.protocol === 'http:';\n  } catch (err) {\n    return false;\n  }\n}\n\nexport function setRefreshToken(token) {\n  if (!token) {\n    clearRefreshToken();\n    return;\n  }\n\n  if (shouldUseLocalStorage()) {\n    try {\n      localStorage.setItem(REFRESH_TOKEN_KEY, token);\n      console.log(`📦 Refresh token stored in localStorage (${_persistRefreshToken ? 'persistence enabled' : 'HTTP dev mode'})`);\n    } catch (err) {\n      console.warn('Could not store refresh token:', err);\n    }\n  } else {\n    // HTTPS without persistence: refresh token is in httpOnly cookie only\n    console.log('🔒 Refresh token managed by server httpOnly cookie (production mode)');\n  }\n}\n\nexport function getRefreshToken() {\n  if (shouldUseLocalStorage()) {\n    try {\n      const token = localStorage.getItem(REFRESH_TOKEN_KEY);\n      return token;\n    } catch (err) {\n      console.warn('Could not read refresh token:', err);\n      return null;\n    }\n  }\n\n  // HTTPS without persistence: refresh token is in httpOnly cookie (not accessible via JS)\n  // The refresh endpoint uses credentials: 'include' to send the cookie\n  return null;\n}\n\nexport function clearRefreshToken() {\n  // Clear localStorage (for HTTP dev)\n  try {\n    localStorage.removeItem(REFRESH_TOKEN_KEY);\n  } catch (err) {\n    // Ignore\n  }\n\n  // Clear cookie (for production)\n  try {\n    document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Strict${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n  } catch (err) {\n    console.warn('Could not clear refresh token cookie:', err);\n  }\n\n  // Clear sessionStorage\n  try {\n    sessionStorage.removeItem(REFRESH_COOKIE);\n  } catch (err) {\n    // Ignore\n  }\n}\n\nexport function addTokenListener(listener) {\n  if (typeof listener !== 'function') {\n    throw new Error('Token listener must be a function');\n  }\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\nexport function removeTokenListener(listener) {\n  listeners.delete(listener);\n}\n\nexport function getListenerCount() {\n  return listeners.size;\n}\n\nexport function isAuthenticated() {\n  const token = getToken();\n  return !!token && !isExpired(token, 10);\n}\n\n\n\n","// auth-client/config.js\nimport { enableRefreshTokenPersistence } from './token';\n\n// ========== SESSION SECURITY CONFIGURATION ==========\n// These settings control how the auth-client handles token refresh and session validation\n// to ensure deleted sessions in Keycloak are detected quickly.\n\nlet config = {\n  clientKey: null,\n  authBaseUrl: null,\n  redirectUri: null,\n  accountUiUrl: null,\n  isRouter: false, // ✅ Add router flag\n\n  // ========== SESSION SECURITY SETTINGS ==========\n  // Buffer time (in seconds) before token expiry to trigger proactive refresh\n  // With 5-minute access tokens, refreshing 60s before expiry ensures seamless UX\n  tokenRefreshBuffer: 60,\n\n  // Interval (in milliseconds) for periodic session validation\n  // Validates that the session still exists in Keycloak (not deleted by admin)\n  // Default: 15 minutes (900000ms) - Increased from 2m to avoid frequent checks\n  sessionValidationInterval: 15 * 60 * 1000,\n\n  // Enable/disable periodic session validation\n  // When enabled, the client will ping the server to verify session is still active\n  enableSessionValidation: true,\n\n  // Enable/disable proactive token refresh\n  // When enabled, tokens are refreshed before they expire (using tokenRefreshBuffer)\n  enableProactiveRefresh: true,\n\n  // Validate session when browser tab becomes visible again\n  // Catches session deletions that happened while the tab was inactive\n  validateOnVisibility: true,\n\n  // ========== REFRESH TOKEN PERSISTENCE ==========\n  // When true, stores refresh token in localStorage even on HTTPS\n  // Required for local dev with mkcert/self-signed certs where httpOnly cookies\n  // may not work reliably across origins\n  // ⚠️ In true production, set to false and rely on httpOnly cookies\n  persistRefreshToken: false,\n};\n\nexport function setConfig(customConfig = {}) {\n  if (!customConfig.clientKey || !customConfig.authBaseUrl) {\n    throw new Error('Missing required config: clientKey and authBaseUrl are required');\n  }\n\n  config = {\n    ...config,\n    ...customConfig,\n    redirectUri: customConfig.redirectUri || window.location.origin + '/callback',\n    // ✅ Auto-detect router mode\n    isRouter: customConfig.isRouter || customConfig.clientKey === 'account-ui'\n  };\n\n  // ✅ Wire persistRefreshToken to token.js\n  if (config.persistRefreshToken) {\n    enableRefreshTokenPersistence(true);\n    console.log('📦 Refresh token persistence ENABLED (localStorage on HTTPS)');\n  }\n\n  console.log(`🔧 Auth Client Mode: ${config.isRouter ? 'ROUTER' : 'CLIENT'}`, {\n    clientKey: config.clientKey,\n    isRouter: config.isRouter,\n    persistRefreshToken: config.persistRefreshToken\n  });\n}\n\nexport function getConfig() {\n  return { ...config };\n}\n\n// ✅ Helper function\nexport function isRouterMode() {\n  return config.isRouter;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;;;ACC3B,OAAO,SAAS,eAAe,UAAU,WAAW,cAAc;;;ACClE,SAAS,iBAAiB;AAM1B,IAAM,iBAAiB,IAAI,KAAK,KAAK;;;ACDrC,IAAI,SAAS;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAAA,EACd,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAKV,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAKpB,2BAA2B,KAAK,KAAK;AAAA;AAAA;AAAA,EAIrC,yBAAyB;AAAA;AAAA;AAAA,EAIzB,wBAAwB;AAAA;AAAA;AAAA,EAIxB,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtB,qBAAqB;AACvB;;;AF9BO,IAAM,cAAc,cAAc;;;ADTlC,SAAS,UAAU;AACxB,QAAM,UAAU,WAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../react/useAuth.js","../../react/AuthProvider.jsx","../../token.js","../../config.js"],"sourcesContent":["import { useContext } from 'react';\nimport { AuthContext } from './AuthProvider';\n\nexport function useAuth() {\n  const context = useContext(AuthContext);\n  if (!context) {\n    throw new Error('useAuth must be used within an AuthProvider');\n  }\n  return context;\n}","// auth-client/react/AuthProvider.jsx\nimport React, { createContext, useState, useEffect, useRef } from 'react';\nimport { getToken, setToken, clearToken } from '../token';\nimport { getConfig } from '../config';\nimport { \n  login as coreLogin, \n  logout as coreLogout,\n  startSessionSecurity,\n  stopSessionSecurity,\n  onSessionInvalid\n} from '../core';\n\nexport const AuthContext = createContext();\n\nexport function AuthProvider({ children, onSessionExpired }) {\n  const [token, setTokenState] = useState(getToken());\n  const [user, setUser] = useState(null);\n  const [loading, setLoading] = useState(!!token); // Loading if we have a token to validate\n  const [sessionValid, setSessionValid] = useState(true);\n  const sessionSecurityRef = useRef(null);\n\n  // Handle session invalidation (from Keycloak admin deletion or expiry)\n  const handleSessionInvalid = (reason) => {\n    console.log('🚨 AuthProvider: Session invalidated -', reason);\n    setSessionValid(false);\n    setUser(null);\n    setTokenState(null);\n    \n    // Call custom callback if provided\n    if (onSessionExpired && typeof onSessionExpired === 'function') {\n      onSessionExpired(reason);\n    }\n  };\n\n  // Start session security on mount (when we have a token)\n  useEffect(() => {\n    if (token && !sessionSecurityRef.current) {\n      console.log('🔐 AuthProvider: Starting session security');\n      \n      // Register session invalid handler\n      const unsubscribe = onSessionInvalid(handleSessionInvalid);\n      \n      // Start proactive refresh + session monitoring\n      sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);\n      \n      return () => {\n        unsubscribe();\n        if (sessionSecurityRef.current) {\n          sessionSecurityRef.current.stopAll();\n          sessionSecurityRef.current = null;\n        }\n      };\n    }\n    \n    // Cleanup when token is removed\n    if (!token && sessionSecurityRef.current) {\n      sessionSecurityRef.current.stopAll();\n      sessionSecurityRef.current = null;\n    }\n  }, [token]);\n\n  useEffect(() => {\n    console.log('🔍 AuthProvider useEffect triggered:', { \n      hasToken: !!token, \n      tokenLength: token?.length \n    });\n    \n    if (!token) {\n      console.log('⚠️ AuthProvider: No token, setting loading=false');\n      setLoading(false);\n      return;\n    }\n    \n    const { authBaseUrl } = getConfig();\n    if (!authBaseUrl) {\n      console.warn('AuthProvider: No authBaseUrl configured');\n      setLoading(false);\n      return;\n    }\n\n    console.log('🌐 AuthProvider: Fetching profile with token...', {\n      authBaseUrl,\n      tokenPreview: token.slice(0, 50) + '...'\n    });\n\n    fetch(`${authBaseUrl}/account/profile`, {\n      headers: { Authorization: `Bearer ${token}` },\n      credentials: 'include',\n    })\n      .then(res => {\n        console.log('📥 Profile response status:', res.status);\n        if (!res.ok) throw new Error('Failed to fetch user');\n        return res.json();\n      })\n      .then(userData => {\n        console.log('✅ Profile fetched successfully:', userData.email);\n        setUser(userData);\n        setSessionValid(true);\n        setLoading(false);\n      })\n      .catch(err => {\n        console.error('❌ Fetch user error:', err);\n        clearToken();\n        setTokenState(null);\n        setUser(null);\n        setLoading(false);\n      });\n  }, [token]);\n\n  const login = (clientKey, redirectUri, state) => {\n    coreLogin(clientKey, redirectUri, state);\n  };\n\n  const logout = async (options) => {\n    // Stop session security before logout\n    stopSessionSecurity();\n    sessionSecurityRef.current = null;\n    \n    try {\n      await coreLogout(options);\n    } finally {\n      setUser(null);\n      setTokenState(null);\n      setSessionValid(true);\n    }\n  };\n\n  const value = {\n    token,\n    user,\n    loading,\n    login,\n    logout,\n    isAuthenticated: !!token && !!user && sessionValid,\n    sessionValid,\n    setUser,\n    setToken: (newToken) => {\n      setToken(newToken);\n      setTokenState(newToken);\n      setSessionValid(true);\n    },\n    clearToken: () => {\n      stopSessionSecurity();\n      sessionSecurityRef.current = null;\n      clearToken();\n      setTokenState(null);\n      setUser(null);\n    },\n  };\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// auth-client/token.js - MINIMAL WORKING VERSION\n\nimport { jwtDecode } from 'jwt-decode';\n\nlet accessToken = null;\nconst listeners = new Set();\n\nconst REFRESH_COOKIE = 'account_refresh_token';\nconst COOKIE_MAX_AGE = 7 * 24 * 60 * 60;\n\nfunction secureAttribute() {\n  try {\n    return typeof window !== 'undefined' && window.location?.protocol === 'https:'\n      ? '; Secure'\n      : '';\n  } catch (err) {\n    return '';\n  }\n}\n\n// ========== ACCESS TOKEN ==========\nfunction writeAccessToken(token) {\n  if (!token) {\n    try {\n      localStorage.removeItem('authToken');\n    } catch (err) {\n      console.warn('Could not clear token from localStorage:', err);\n    }\n    return;\n  }\n\n  try {\n    localStorage.setItem('authToken', token);\n  } catch (err) {\n    console.warn('Could not persist token to localStorage:', err);\n  }\n}\n\nfunction readAccessToken() {\n  try {\n    return localStorage.getItem('authToken');\n  } catch (err) {\n    console.warn('Could not read token from localStorage:', err);\n    return null;\n  }\n}\n\n// ========== REFRESH TOKEN (KEEP SIMPLE) ==========\n// export function setRefreshToken(token) {\n//   if (!token) {\n//     clearRefreshToken();\n//     return;\n//   }\n\n//   const expires = new Date(Date.now() + COOKIE_MAX_AGE * 1000);\n\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax${secureAttribute()}; Expires=${expires.toUTCString()}`;\n//   } catch (err) {\n//     console.warn('Could not set refresh token:', err);\n//   }\n// }\n\n// export function getRefreshToken() {\n//   try {\n//     const match = document.cookie\n//       ?.split('; ')\n//       ?.find((row) => row.startsWith(`${REFRESH_COOKIE}=`));\n\n//     if (match) {\n//       return decodeURIComponent(match.split('=')[1]);\n//     }\n//   } catch (err) {\n//     console.warn('Could not read refresh token:', err);\n//   }\n\n//   return null;\n// }\n\n// export function clearRefreshToken() {\n//   try {\n//     document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Lax${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n//   } catch (err) {\n//     console.warn('Could not clear refresh token:', err);\n//   }\n// }\n\n// ========== ACCESS TOKEN FUNCTIONS ==========\nfunction decode(token) {\n  try {\n    return jwtDecode(token);\n  } catch (err) {\n    return null;\n  }\n}\n\nfunction isExpired(token, bufferSeconds = 60) {\n  if (!token) return true;\n  const decoded = decode(token);\n  if (!decoded?.exp) return true;\n  const now = Date.now() / 1000;\n  return decoded.exp < now + bufferSeconds;\n}\n\n// ========== TOKEN EXPIRY UTILITIES ==========\n// Get the exact expiry time of a token as a Date object\nexport function getTokenExpiryTime(token) {\n  if (!token) return null;\n  const decoded = decode(token);\n  if (!decoded?.exp) return null;\n  return new Date(decoded.exp * 1000);\n}\n\n// Get seconds until token expires (negative if already expired)\nexport function getTimeUntilExpiry(token) {\n  if (!token) return -1;\n  const decoded = decode(token);\n  if (!decoded?.exp) return -1;\n  const now = Date.now() / 1000;\n  return Math.floor(decoded.exp - now);\n}\n\n// Check if token will expire within the next N seconds\nexport function willExpireSoon(token, withinSeconds = 60) {\n  const timeLeft = getTimeUntilExpiry(token);\n  return timeLeft >= 0 && timeLeft <= withinSeconds;\n}\n\nexport function setToken(token) {\n  const previousToken = accessToken;\n  accessToken = token || null;\n  writeAccessToken(accessToken);\n\n  if (previousToken !== accessToken) {\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  }\n}\n\nexport function getToken() {\n  if (accessToken) return accessToken;\n  accessToken = readAccessToken();\n  return accessToken;\n}\n\nexport function clearToken() {\n  if (!accessToken) {\n    writeAccessToken(null);\n    clearRefreshToken();\n    return;\n  }\n\n  const previousToken = accessToken;\n  accessToken = null;\n  writeAccessToken(null);\n  clearRefreshToken();\n\n  listeners.forEach((listener) => {\n    try {\n      listener(null, previousToken);\n    } catch (err) {\n      console.warn('Token listener error:', err);\n    }\n  });\n}\n\n// ========== REFRESH TOKEN STORAGE ==========\n// By default:\n//   HTTP  → localStorage (cookies don't work cross-origin in dev)\n//   HTTPS → httpOnly cookies (secure, managed by server)\n// When persistRefreshToken is enabled:\n//   Always use localStorage (for local HTTPS with mkcert/self-signed certs)\nconst REFRESH_TOKEN_KEY = 'auth_refresh_token';\n\n// ✅ Persistence flag - controlled by config.persistRefreshToken\nlet _persistRefreshToken = false;\n\nexport function enableRefreshTokenPersistence(enabled) {\n  _persistRefreshToken = !!enabled;\n  console.log(`🔧 Refresh token persistence: ${_persistRefreshToken ? 'ENABLED' : 'DISABLED'}`);\n}\n\nfunction shouldUseLocalStorage() {\n  // If persistence is forced, always use localStorage\n  if (_persistRefreshToken) return true;\n  // Otherwise, only use localStorage on HTTP (dev mode)\n  try {\n    return typeof window !== 'undefined' &&\n      window.location?.protocol === 'http:';\n  } catch (err) {\n    return false;\n  }\n}\n\nexport function setRefreshToken(token) {\n  if (!token) {\n    clearRefreshToken();\n    return;\n  }\n\n  if (shouldUseLocalStorage()) {\n    try {\n      localStorage.setItem(REFRESH_TOKEN_KEY, token);\n      console.log(`📦 Refresh token stored in localStorage (${_persistRefreshToken ? 'persistence enabled' : 'HTTP dev mode'})`);\n    } catch (err) {\n      console.warn('Could not store refresh token:', err);\n    }\n  } else {\n    // HTTPS without persistence: refresh token is in httpOnly cookie only\n    console.log('🔒 Refresh token managed by server httpOnly cookie (production mode)');\n  }\n}\n\nexport function getRefreshToken() {\n  if (shouldUseLocalStorage()) {\n    try {\n      const token = localStorage.getItem(REFRESH_TOKEN_KEY);\n      return token;\n    } catch (err) {\n      console.warn('Could not read refresh token:', err);\n      return null;\n    }\n  }\n\n  // HTTPS without persistence: refresh token is in httpOnly cookie (not accessible via JS)\n  // The refresh endpoint uses credentials: 'include' to send the cookie\n  return null;\n}\n\nexport function clearRefreshToken() {\n  // Clear localStorage (for HTTP dev)\n  try {\n    localStorage.removeItem(REFRESH_TOKEN_KEY);\n  } catch (err) {\n    // Ignore\n  }\n\n  // Clear cookie (for production)\n  try {\n    document.cookie = `${REFRESH_COOKIE}=; Path=/; SameSite=Strict${secureAttribute()}; Expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n  } catch (err) {\n    console.warn('Could not clear refresh token cookie:', err);\n  }\n\n  // Clear sessionStorage\n  try {\n    sessionStorage.removeItem(REFRESH_COOKIE);\n  } catch (err) {\n    // Ignore\n  }\n}\n\nexport function addTokenListener(listener) {\n  if (typeof listener !== 'function') {\n    throw new Error('Token listener must be a function');\n  }\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\nexport function removeTokenListener(listener) {\n  listeners.delete(listener);\n}\n\nexport function getListenerCount() {\n  return listeners.size;\n}\n\n// localStorage changes do not fire in the tab that made the change, but they\n// do fire in sibling tabs on the same origin. Keep the in-memory token cache\n// and React consumers synchronized when another tab logs in or out.\nif (typeof window !== 'undefined' && window.addEventListener) {\n  window.addEventListener('storage', (event) => {\n    if (event.key !== 'authToken') return;\n\n    const previousToken = accessToken;\n    accessToken = event.newValue || null;\n    if (previousToken === accessToken) return;\n\n    listeners.forEach((listener) => {\n      try {\n        listener(accessToken, previousToken);\n      } catch (err) {\n        console.warn('Token listener error:', err);\n      }\n    });\n  });\n}\n\nexport function isAuthenticated() {\n  const token = getToken();\n  return !!token && !isExpired(token, 10);\n}\n\n\n","// auth-client/config.js\nimport { enableRefreshTokenPersistence } from './token';\n\n// ========== SESSION SECURITY CONFIGURATION ==========\n// These settings control how the auth-client handles token refresh and session validation\n// to ensure deleted sessions in Keycloak are detected quickly.\n\nlet config = {\n  clientKey: null,\n  authBaseUrl: null,\n  redirectUri: null,\n  accountUiUrl: null,\n  isRouter: false, // ✅ Add router flag\n\n  // ========== SESSION SECURITY SETTINGS ==========\n  // Buffer time (in seconds) before token expiry to trigger proactive refresh\n  // With 5-minute access tokens, refreshing 60s before expiry ensures seamless UX\n  tokenRefreshBuffer: 60,\n\n  // Interval (in milliseconds) for periodic session validation\n  // Validates that the session still exists in Keycloak (not deleted by admin)\n  // Default: 15 minutes (900000ms) - Increased from 2m to avoid frequent checks\n  sessionValidationInterval: 15 * 60 * 1000,\n\n  // Enable/disable periodic session validation\n  // When enabled, the client will ping the server to verify session is still active\n  enableSessionValidation: true,\n\n  // Enable/disable proactive token refresh\n  // When enabled, tokens are refreshed before they expire (using tokenRefreshBuffer)\n  enableProactiveRefresh: true,\n\n  // Validate session when browser tab becomes visible again\n  // Catches session deletions that happened while the tab was inactive\n  validateOnVisibility: true,\n\n  // ========== REFRESH TOKEN PERSISTENCE ==========\n  // When true, stores refresh token in localStorage even on HTTPS\n  // Required for local dev with mkcert/self-signed certs where httpOnly cookies\n  // may not work reliably across origins\n  // ⚠️ In true production, set to false and rely on httpOnly cookies\n  persistRefreshToken: false,\n};\n\nexport function setConfig(customConfig = {}) {\n  if (!customConfig.clientKey || !customConfig.authBaseUrl) {\n    throw new Error('Missing required config: clientKey and authBaseUrl are required');\n  }\n\n  config = {\n    ...config,\n    ...customConfig,\n    redirectUri: customConfig.redirectUri || window.location.origin + '/callback',\n    // ✅ Auto-detect router mode\n    isRouter: customConfig.isRouter || customConfig.clientKey === 'account-ui'\n  };\n\n  // ✅ Wire persistRefreshToken to token.js\n  if (config.persistRefreshToken) {\n    enableRefreshTokenPersistence(true);\n    console.log('📦 Refresh token persistence ENABLED (localStorage on HTTPS)');\n  }\n\n  console.log(`🔧 Auth Client Mode: ${config.isRouter ? 'ROUTER' : 'CLIENT'}`, {\n    clientKey: config.clientKey,\n    isRouter: config.isRouter,\n    persistRefreshToken: config.persistRefreshToken\n  });\n}\n\nexport function getConfig() {\n  return { ...config };\n}\n\n// ✅ Helper function\nexport function isRouterMode() {\n  return config.isRouter;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;;;ACC3B,OAAO,SAAS,eAAe,UAAU,WAAW,cAAc;;;ACClE,SAAS,iBAAiB;AAE1B,IAAI,cAAc;AAClB,IAAM,YAAY,oBAAI,IAAI;AAG1B,IAAM,iBAAiB,IAAI,KAAK,KAAK;AA8QrC,IAAI,OAAO,WAAW,eAAe,OAAO,kBAAkB;AAC5D,SAAO,iBAAiB,WAAW,CAAC,UAAU;AAC5C,QAAI,MAAM,QAAQ,YAAa;AAE/B,UAAM,gBAAgB;AACtB,kBAAc,MAAM,YAAY;AAChC,QAAI,kBAAkB,YAAa;AAEnC,cAAU,QAAQ,CAAC,aAAa;AAC9B,UAAI;AACF,iBAAS,aAAa,aAAa;AAAA,MACrC,SAAS,KAAK;AACZ,gBAAQ,KAAK,yBAAyB,GAAG;AAAA,MAC3C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;;;AC/RA,IAAI,SAAS;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAAA,EACd,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,EAKV,oBAAoB;AAAA;AAAA;AAAA;AAAA,EAKpB,2BAA2B,KAAK,KAAK;AAAA;AAAA;AAAA,EAIrC,yBAAyB;AAAA;AAAA;AAAA,EAIzB,wBAAwB;AAAA;AAAA;AAAA,EAIxB,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtB,qBAAqB;AACvB;;;AF9BO,IAAM,cAAc,cAAc;;;ADTlC,SAAS,UAAU;AACxB,QAAM,UAAU,WAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,SAAO;AACT;","names":[]}

package/dist/react/useSessionMonitor.cjs

@@ -206,6 +206,21 @@ function removeTokenListener(listener) {
 function getListenerCount() {
   return listeners.size;
 }
+if (typeof window !== "undefined" && window.addEventListener) {
+  window.addEventListener("storage", (event) => {
+    if (event.key !== "authToken") return;
+    const previousToken = accessToken;
+    accessToken = event.newValue || null;
+    if (previousToken === accessToken) return;
+    listeners.forEach((listener) => {
+      try {
+        listener(accessToken, previousToken);
+      } catch (err) {
+        console.warn("Token listener error:", err);
+      }
+    });
+  });
+}
 
 // config.js
 var config = {
@@ -326,12 +341,17 @@ function clientLogin(clientKey, redirectUri) {
   });
   window.location.href = centralizedLoginUrl;
 }
-async function logout() {
+async function logout(options = {}) {
   resetCallbackState();
   const { clientKey, authBaseUrl, accountUiUrl } = getConfig();
+  const scope = options.scope === "client" ? "client" : "sso";
   const token = getToken();
   const refreshToken2 = getRefreshToken();
-  console.log("\u{1F6AA} Smart Logout initiated", { mode: isRouterMode() ? "ROUTER" : "CLIENT", clientKey });
+  console.log("\u{1F6AA} Smart Logout initiated", {
+    mode: isRouterMode() ? "ROUTER" : "CLIENT",
+    clientKey,
+    scope
+  });
   clearToken();
   clearRefreshToken();
   sessionStorage.removeItem("originalApp");
@@ -344,18 +364,29 @@ async function logout() {
         "Authorization": token ? `Bearer ${token}` : "",
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken: refreshToken2 })
+      body: JSON.stringify({ refreshToken: refreshToken2, scope })
     });
+    if (!response.ok) {
+      throw new Error(`Logout failed: ${response.status}`);
+    }
     const data = await response.json();
     console.log("\u2705 Logout response:", data);
+    if (data == null ? void 0 : data.logoutRedirectUrl) {
+      window.location.replace(data.logoutRedirectUrl);
+      return;
+    }
     if (data == null ? void 0 : data.keycloakLogoutUrl) {
-      window.location.href = data.keycloakLogoutUrl;
+      window.location.replace(data.keycloakLogoutUrl);
       return;
     }
   } catch (error) {
     console.warn("\u26A0\uFE0F Logout backend call failed:", error);
   }
-  window.location.href = isRouterMode() ? "/login" : `${accountUiUrl}/login?client=${clientKey}&logout=true`;
+  const fallbackUrl = isRouterMode() ? new URL("/login", window.location.origin) : new URL("/login", accountUiUrl);
+  fallbackUrl.searchParams.set("logged_out", "true");
+  fallbackUrl.searchParams.set("client", clientKey);
+  fallbackUrl.searchParams.set("scope", scope);
+  window.location.replace(fallbackUrl.toString());
 }
 function handleCallback() {
   var _a;
@@ -827,6 +858,8 @@ var auth = {
   // 🔐 Core flows
   login,
   logout,
+  logoutClient: () => logout({ scope: "client" }),
+  logoutSso: () => logout({ scope: "sso" }),
   handleCallback,
   refreshToken,
   resetCallbackState,