@spidy092/auth-client 3.1.2 → 3.1.3

package/dist/index.js

@@ -217,6 +217,44 @@ var config = {
   // ⚠️ In true production, set to false and rely on httpOnly cookies
   persistRefreshToken: false
 };
+var RUNTIME_POLICY_DEFAULTS = {
+  tokenRefreshBuffer: 60,
+  sessionValidationInterval: 15 * 60 * 1e3,
+  enableSessionValidation: true,
+  enableProactiveRefresh: true,
+  validateOnVisibility: true
+};
+function validateRuntimePolicy(policy = {}) {
+  const numberInRange = (value, min, max) => Number.isInteger(value) && value >= min && value <= max;
+  const result = { ...RUNTIME_POLICY_DEFAULTS };
+  if (numberInRange(policy.tokenRefreshBuffer, 10, 300)) result.tokenRefreshBuffer = policy.tokenRefreshBuffer;
+  if (numberInRange(policy.sessionValidationInterval, 6e4, 864e5)) result.sessionValidationInterval = policy.sessionValidationInterval;
+  for (const key of ["enableSessionValidation", "enableProactiveRefresh", "validateOnVisibility"]) {
+    if (typeof policy[key] === "boolean") result[key] = policy[key];
+  }
+  return result;
+}
+function applyRuntimePolicy(policy = {}) {
+  config = { ...config, ...validateRuntimePolicy(policy) };
+  return getConfig();
+}
+async function loadRuntimePolicy() {
+  const { authBaseUrl, clientKey } = config;
+  if (!authBaseUrl || !clientKey || typeof fetch !== "function") return getConfig();
+  try {
+    const response = await fetch(`${authBaseUrl.replace(/\/+$/, "")}/clients/${encodeURIComponent(clientKey)}/config`, {
+      method: "GET",
+      credentials: "include",
+      headers: { Accept: "application/json" }
+    });
+    if (!response.ok) throw new Error(`runtime policy HTTP ${response.status}`);
+    const payload = await response.json();
+    return applyRuntimePolicy(payload.authentication_policy || {});
+  } catch (error) {
+    console.warn("[auth-client] Runtime policy unavailable; using safe defaults", error.message);
+    return applyRuntimePolicy({});
+  }
+}
 function setConfig(customConfig = {}) {
   if (!customConfig.clientKey || !customConfig.authBaseUrl) {
     throw new Error("Missing required config: clientKey and authBaseUrl are required");
@@ -323,7 +361,7 @@ async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
 
 // core.js
 var callbackProcessed = false;
-function login(clientKeyArg, redirectUriArg) {
+function login(clientKeyArg, redirectUriArg, options = {}) {
   resetCallbackState();
   const {
     clientKey: defaultClientKey,
@@ -346,23 +384,24 @@ function login(clientKeyArg, redirectUriArg) {
   sessionStorage.setItem("originalApp", clientKey);
   sessionStorage.setItem("returnUrl", redirectUri);
   if (isRouterMode()) {
-    return routerLogin(clientKey, redirectUri);
+    return routerLogin(clientKey, redirectUri, options);
   } else {
-    return clientLogin(clientKey, redirectUri);
+    return clientLogin(clientKey, redirectUri, options);
   }
 }
-function routerLogin(clientKey, redirectUri) {
+function routerLogin(clientKey, redirectUri, options = {}) {
   const { authBaseUrl } = getConfig();
   const params = new URLSearchParams();
   if (redirectUri) {
     params.append("redirect_uri", redirectUri);
   }
+  if (options.switchAccount || options.switch_account) params.append("switch_account", "true");
   params.append("correlation_id", getDiagnosticContext().correlationId);
   const query = params.toString();
   const backendLoginUrl = `${authBaseUrl}/login/${clientKey}${query ? `?${query}` : ""}`;
   window.location.href = backendLoginUrl;
 }
-function clientLogin(clientKey, redirectUri) {
+function clientLogin(clientKey, redirectUri, options = {}) {
   const { accountUiUrl } = getConfig();
   const params = new URLSearchParams({
     client: clientKey
@@ -370,6 +409,7 @@ function clientLogin(clientKey, redirectUri) {
   if (redirectUri) {
     params.append("redirect_uri", redirectUri);
   }
+  if (options.switchAccount || options.switch_account) params.append("switch_account", "true");
   const centralizedLoginUrl = `${accountUiUrl}/login?${params.toString()}`;
   window.location.href = centralizedLoginUrl;
 }
@@ -495,6 +535,28 @@ function resetCallbackState() {
 }
 var refreshInProgress = false;
 var refreshPromise = null;
+async function withCrossTabRefreshLock(clientKey, tokenBeforeRefresh, refreshRequest) {
+  var _a;
+  const lockName = `auth-refresh-${clientKey}`;
+  const run = async () => {
+    try {
+      const persistedToken = localStorage.getItem("authToken");
+      if (tokenBeforeRefresh && persistedToken && persistedToken !== tokenBeforeRefresh) {
+        setToken(persistedToken);
+        emitAuthDiagnostic("TOKEN_REFRESH_REUSED_CROSS_TAB", "SUCCESS", "CROSS_TAB_ROTATION", {
+          clientKey
+        });
+        return persistedToken;
+      }
+    } catch {
+    }
+    return refreshRequest();
+  };
+  if (typeof navigator !== "undefined" && ((_a = navigator.locks) == null ? void 0 : _a.request)) {
+    return navigator.locks.request(lockName, run);
+  }
+  return run();
+}
 async function refreshToken() {
   const { clientKey, authBaseUrl } = getConfig();
   if (refreshInProgress && refreshPromise) {
@@ -503,70 +565,74 @@ async function refreshToken() {
   }
   refreshInProgress = true;
   refreshPromise = (async () => {
-    var _a, _b, _c, _d, _e, _f;
-    try {
-      const storedRefreshToken = getRefreshToken();
-      console.log("\u{1F504} Refreshing token:", {
-        clientKey,
-        mode: isRouterMode() ? "ROUTER" : "CLIENT",
-        hasStoredRefreshToken: !!storedRefreshToken
-      });
-      const requestOptions = {
-        method: "POST",
-        credentials: "include",
-        // ✅ Include httpOnly cookies (for HTTPS)
-        headers: {
-          ...diagnosticHeaders(),
-          "Content-Type": "application/json"
-        }
-      };
-      if (storedRefreshToken) {
-        requestOptions.body = JSON.stringify({ refreshToken: storedRefreshToken });
-        console.log("\u{1F4E6} Sending refresh token in body only (Header skipped) v3.0.2");
-      }
-      const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, requestOptions);
-      if (!response.ok) {
-        const errorText = await response.text();
-        let serverCode = null;
-        try {
-          serverCode = ((_a = JSON.parse(errorText)) == null ? void 0 : _a.error) || ((_b = JSON.parse(errorText)) == null ? void 0 : _b.code);
-        } catch {
-        }
-        emitAuthDiagnostic("TOKEN_REFRESH_REJECTED", "FAILURE", serverCode || `HTTP_${response.status}`, {
+    const tokenBeforeRefresh = getToken();
+    const refreshRequest = async () => {
+      var _a, _b, _c, _d, _e, _f;
+      try {
+        const storedRefreshToken = getRefreshToken();
+        console.log("\u{1F504} Refreshing token:", {
           clientKey,
-          status: response.status
+          mode: isRouterMode() ? "ROUTER" : "CLIENT",
+          hasStoredRefreshToken: !!storedRefreshToken
         });
-        const refreshError = new Error(`Refresh failed: ${response.status}`);
-        refreshError.code = serverCode || `HTTP_${response.status}`;
-        refreshError.status = response.status;
-        throw refreshError;
-      }
-      const data = await response.json();
-      const { access_token, refresh_token: new_refresh_token } = data;
-      if (!access_token) {
-        throw new Error("No access token in refresh response");
-      }
-      setToken(access_token);
-      if (new_refresh_token) {
-        setRefreshToken(new_refresh_token);
-        console.log("\u{1F504} New refresh token stored from rotation");
-      }
-      console.log("\u2705 Token refresh successful, listeners notified");
-      emitAuthDiagnostic("TOKEN_REFRESH_COMPLETED", "SUCCESS", "NONE", { clientKey });
-      return access_token;
-    } catch (err) {
-      console.error("\u274C Token refresh error:", err);
-      const isAuthRejection = ((_c = err.message) == null ? void 0 : _c.includes("401")) || ((_d = err.message) == null ? void 0 : _d.includes("403")) || ((_e = err.message) == null ? void 0 : _e.includes("invalid_grant")) || ((_f = err.message) == null ? void 0 : _f.includes("Refresh failed: 4"));
-      if (isAuthRejection) {
-        clearToken();
-        clearRefreshToken();
+        const requestOptions = {
+          method: "POST",
+          credentials: "include",
+          // ✅ Include httpOnly cookies (for HTTPS)
+          headers: {
+            ...diagnosticHeaders(),
+            "Content-Type": "application/json"
+          }
+        };
+        if (storedRefreshToken) {
+          requestOptions.body = JSON.stringify({ refreshToken: storedRefreshToken });
+          console.log("\u{1F4E6} Sending refresh token in body only (Header skipped) v3.0.2");
+        }
+        const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, requestOptions);
+        if (!response.ok) {
+          const errorText = await response.text();
+          let serverCode = null;
+          try {
+            serverCode = ((_a = JSON.parse(errorText)) == null ? void 0 : _a.error) || ((_b = JSON.parse(errorText)) == null ? void 0 : _b.code);
+          } catch {
+          }
+          emitAuthDiagnostic("TOKEN_REFRESH_REJECTED", "FAILURE", serverCode || `HTTP_${response.status}`, {
+            clientKey,
+            status: response.status
+          });
+          const refreshError = new Error(`Refresh failed: ${response.status}`);
+          refreshError.code = serverCode || `HTTP_${response.status}`;
+          refreshError.status = response.status;
+          throw refreshError;
+        }
+        const data = await response.json();
+        const { access_token, refresh_token: new_refresh_token } = data;
+        if (!access_token) {
+          throw new Error("No access token in refresh response");
+        }
+        setToken(access_token);
+        if (new_refresh_token) {
+          setRefreshToken(new_refresh_token);
+          console.log("\u{1F504} New refresh token stored from rotation");
+        }
+        console.log("\u2705 Token refresh successful, listeners notified");
+        emitAuthDiagnostic("TOKEN_REFRESH_COMPLETED", "SUCCESS", "NONE", { clientKey });
+        return access_token;
+      } catch (err) {
+        console.error("\u274C Token refresh error:", err);
+        const isAuthRejection = ((_c = err.message) == null ? void 0 : _c.includes("401")) || ((_d = err.message) == null ? void 0 : _d.includes("403")) || ((_e = err.message) == null ? void 0 : _e.includes("invalid_grant")) || ((_f = err.message) == null ? void 0 : _f.includes("Refresh failed: 4"));
+        if (isAuthRejection) {
+          clearToken();
+          clearRefreshToken();
+        }
+        throw err;
       }
-      throw err;
-    } finally {
-      refreshInProgress = false;
-      refreshPromise = null;
-    }
-  })();
+    };
+    return withCrossTabRefreshLock(clientKey, tokenBeforeRefresh, refreshRequest);
+  })().finally(() => {
+    refreshInProgress = false;
+    refreshPromise = null;
+  });
   return refreshPromise;
 }
 async function validateCurrentSession() {
@@ -1387,6 +1453,8 @@ function usePreferences() {
 var auth = {
   // 🔧 Config
   setConfig,
+  applyRuntimePolicy,
+  loadRuntimePolicy,
   getConfig,
   isRouterMode,
   // 🔐 Core flows