@spidy092/auth-client 3.1.2 → 3.1.4

package/dist/index.cjs

@@ -268,6 +268,44 @@ var config = {
   // ⚠️ In true production, set to false and rely on httpOnly cookies
   persistRefreshToken: false
 };
+var RUNTIME_POLICY_DEFAULTS = {
+  tokenRefreshBuffer: 60,
+  sessionValidationInterval: 15 * 60 * 1e3,
+  enableSessionValidation: true,
+  enableProactiveRefresh: true,
+  validateOnVisibility: true
+};
+function validateRuntimePolicy(policy = {}) {
+  const numberInRange = (value, min, max) => Number.isInteger(value) && value >= min && value <= max;
+  const result = { ...RUNTIME_POLICY_DEFAULTS };
+  if (numberInRange(policy.tokenRefreshBuffer, 10, 300)) result.tokenRefreshBuffer = policy.tokenRefreshBuffer;
+  if (numberInRange(policy.sessionValidationInterval, 6e4, 864e5)) result.sessionValidationInterval = policy.sessionValidationInterval;
+  for (const key of ["enableSessionValidation", "enableProactiveRefresh", "validateOnVisibility"]) {
+    if (typeof policy[key] === "boolean") result[key] = policy[key];
+  }
+  return result;
+}
+function applyRuntimePolicy(policy = {}) {
+  config = { ...config, ...validateRuntimePolicy(policy) };
+  return getConfig();
+}
+async function loadRuntimePolicy() {
+  const { authBaseUrl, clientKey } = config;
+  if (!authBaseUrl || !clientKey || typeof fetch !== "function") return getConfig();
+  try {
+    const response = await fetch(`${authBaseUrl.replace(/\/+$/, "")}/clients/${encodeURIComponent(clientKey)}/config`, {
+      method: "GET",
+      credentials: "include",
+      headers: { Accept: "application/json" }
+    });
+    if (!response.ok) throw new Error(`runtime policy HTTP ${response.status}`);
+    const payload = await response.json();
+    return applyRuntimePolicy(payload.authentication_policy || {});
+  } catch (error) {
+    console.warn("[auth-client] Runtime policy unavailable; using safe defaults", error.message);
+    return applyRuntimePolicy({});
+  }
+}
 function setConfig(customConfig = {}) {
   if (!customConfig.clientKey || !customConfig.authBaseUrl) {
     throw new Error("Missing required config: clientKey and authBaseUrl are required");
@@ -353,6 +391,28 @@ function clearLoginLock() {
   } catch {
   }
 }
+async function reportClientDiagnostic(safe) {
+  if (typeof fetch !== "function" || typeof getToken !== "function") return;
+  if (safe.outcome === "SUCCESS" && !safe.event.startsWith("PROFILE_") && !safe.event.startsWith("SESSION_")) return;
+  const { authBaseUrl } = getConfig();
+  const token = getToken();
+  if (!authBaseUrl || !token) return;
+  try {
+    await fetch(`${authBaseUrl.replace(/\/+$/, "")}/client-telemetry`, {
+      method: "POST",
+      credentials: "include",
+      keepalive: true,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-Correlation-ID": safe.correlationId,
+        "X-Request-ID": safe.correlationId
+      },
+      body: JSON.stringify(safe)
+    });
+  } catch {
+  }
+}
 async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   const context = getDiagnosticContext();
   const safe = {
@@ -369,12 +429,13 @@ async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   };
   const method = outcome === "FAILURE" ? "error" : outcome === "WARNING" ? "warn" : "info";
   console[method]("[auth-client]", safe);
+  void reportClientDiagnostic(safe);
   return safe;
 }
 
 // core.js
 var callbackProcessed = false;
-function login(clientKeyArg, redirectUriArg) {
+function login(clientKeyArg, redirectUriArg, options = {}) {
   resetCallbackState();
   const {
     clientKey: defaultClientKey,
@@ -397,23 +458,24 @@ function login(clientKeyArg, redirectUriArg) {
   sessionStorage.setItem("originalApp", clientKey);
   sessionStorage.setItem("returnUrl", redirectUri);
   if (isRouterMode()) {
-    return routerLogin(clientKey, redirectUri);
+    return routerLogin(clientKey, redirectUri, options);
   } else {
-    return clientLogin(clientKey, redirectUri);
+    return clientLogin(clientKey, redirectUri, options);
   }
 }
-function routerLogin(clientKey, redirectUri) {
+function routerLogin(clientKey, redirectUri, options = {}) {
   const { authBaseUrl } = getConfig();
   const params = new URLSearchParams();
   if (redirectUri) {
     params.append("redirect_uri", redirectUri);
   }
+  if (options.switchAccount || options.switch_account) params.append("switch_account", "true");
   params.append("correlation_id", getDiagnosticContext().correlationId);
   const query = params.toString();
   const backendLoginUrl = `${authBaseUrl}/login/${clientKey}${query ? `?${query}` : ""}`;
   window.location.href = backendLoginUrl;
 }
-function clientLogin(clientKey, redirectUri) {
+function clientLogin(clientKey, redirectUri, options = {}) {
   const { accountUiUrl } = getConfig();
   const params = new URLSearchParams({
     client: clientKey
@@ -421,6 +483,7 @@ function clientLogin(clientKey, redirectUri) {
   if (redirectUri) {
     params.append("redirect_uri", redirectUri);
   }
+  if (options.switchAccount || options.switch_account) params.append("switch_account", "true");
   const centralizedLoginUrl = `${accountUiUrl}/login?${params.toString()}`;
   window.location.href = centralizedLoginUrl;
 }
@@ -546,6 +609,28 @@ function resetCallbackState() {
 }
 var refreshInProgress = false;
 var refreshPromise = null;
+async function withCrossTabRefreshLock(clientKey, tokenBeforeRefresh, refreshRequest) {
+  var _a;
+  const lockName = `auth-refresh-${clientKey}`;
+  const run = async () => {
+    try {
+      const persistedToken = localStorage.getItem("authToken");
+      if (tokenBeforeRefresh && persistedToken && persistedToken !== tokenBeforeRefresh) {
+        setToken(persistedToken);
+        emitAuthDiagnostic("TOKEN_REFRESH_REUSED_CROSS_TAB", "SUCCESS", "CROSS_TAB_ROTATION", {
+          clientKey
+        });
+        return persistedToken;
+      }
+    } catch {
+    }
+    return refreshRequest();
+  };
+  if (typeof navigator !== "undefined" && ((_a = navigator.locks) == null ? void 0 : _a.request)) {
+    return navigator.locks.request(lockName, run);
+  }
+  return run();
+}
 async function refreshToken() {
   const { clientKey, authBaseUrl } = getConfig();
   if (refreshInProgress && refreshPromise) {
@@ -554,70 +639,74 @@ async function refreshToken() {
   }
   refreshInProgress = true;
   refreshPromise = (async () => {
-    var _a, _b, _c, _d, _e, _f;
-    try {
-      const storedRefreshToken = getRefreshToken();
-      console.log("\u{1F504} Refreshing token:", {
-        clientKey,
-        mode: isRouterMode() ? "ROUTER" : "CLIENT",
-        hasStoredRefreshToken: !!storedRefreshToken
-      });
-      const requestOptions = {
-        method: "POST",
-        credentials: "include",
-        // ✅ Include httpOnly cookies (for HTTPS)
-        headers: {
-          ...diagnosticHeaders(),
-          "Content-Type": "application/json"
-        }
-      };
-      if (storedRefreshToken) {
-        requestOptions.body = JSON.stringify({ refreshToken: storedRefreshToken });
-        console.log("\u{1F4E6} Sending refresh token in body only (Header skipped) v3.0.2");
-      }
-      const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, requestOptions);
-      if (!response.ok) {
-        const errorText = await response.text();
-        let serverCode = null;
-        try {
-          serverCode = ((_a = JSON.parse(errorText)) == null ? void 0 : _a.error) || ((_b = JSON.parse(errorText)) == null ? void 0 : _b.code);
-        } catch {
-        }
-        emitAuthDiagnostic("TOKEN_REFRESH_REJECTED", "FAILURE", serverCode || `HTTP_${response.status}`, {
+    const tokenBeforeRefresh = getToken();
+    const refreshRequest = async () => {
+      var _a, _b, _c, _d, _e, _f;
+      try {
+        const storedRefreshToken = getRefreshToken();
+        console.log("\u{1F504} Refreshing token:", {
           clientKey,
-          status: response.status
+          mode: isRouterMode() ? "ROUTER" : "CLIENT",
+          hasStoredRefreshToken: !!storedRefreshToken
         });
-        const refreshError = new Error(`Refresh failed: ${response.status}`);
-        refreshError.code = serverCode || `HTTP_${response.status}`;
-        refreshError.status = response.status;
-        throw refreshError;
-      }
-      const data = await response.json();
-      const { access_token, refresh_token: new_refresh_token } = data;
-      if (!access_token) {
-        throw new Error("No access token in refresh response");
-      }
-      setToken(access_token);
-      if (new_refresh_token) {
-        setRefreshToken(new_refresh_token);
-        console.log("\u{1F504} New refresh token stored from rotation");
-      }
-      console.log("\u2705 Token refresh successful, listeners notified");
-      emitAuthDiagnostic("TOKEN_REFRESH_COMPLETED", "SUCCESS", "NONE", { clientKey });
-      return access_token;
-    } catch (err) {
-      console.error("\u274C Token refresh error:", err);
-      const isAuthRejection = ((_c = err.message) == null ? void 0 : _c.includes("401")) || ((_d = err.message) == null ? void 0 : _d.includes("403")) || ((_e = err.message) == null ? void 0 : _e.includes("invalid_grant")) || ((_f = err.message) == null ? void 0 : _f.includes("Refresh failed: 4"));
-      if (isAuthRejection) {
-        clearToken();
-        clearRefreshToken();
+        const requestOptions = {
+          method: "POST",
+          credentials: "include",
+          // ✅ Include httpOnly cookies (for HTTPS)
+          headers: {
+            ...diagnosticHeaders(),
+            "Content-Type": "application/json"
+          }
+        };
+        if (storedRefreshToken) {
+          requestOptions.body = JSON.stringify({ refreshToken: storedRefreshToken });
+          console.log("\u{1F4E6} Sending refresh token in body only (Header skipped) v3.0.2");
+        }
+        const response = await fetch(`${authBaseUrl}/refresh/${clientKey}`, requestOptions);
+        if (!response.ok) {
+          const errorText = await response.text();
+          let serverCode = null;
+          try {
+            serverCode = ((_a = JSON.parse(errorText)) == null ? void 0 : _a.error) || ((_b = JSON.parse(errorText)) == null ? void 0 : _b.code);
+          } catch {
+          }
+          emitAuthDiagnostic("TOKEN_REFRESH_REJECTED", "FAILURE", serverCode || `HTTP_${response.status}`, {
+            clientKey,
+            status: response.status
+          });
+          const refreshError = new Error(`Refresh failed: ${response.status}`);
+          refreshError.code = serverCode || `HTTP_${response.status}`;
+          refreshError.status = response.status;
+          throw refreshError;
+        }
+        const data = await response.json();
+        const { access_token, refresh_token: new_refresh_token } = data;
+        if (!access_token) {
+          throw new Error("No access token in refresh response");
+        }
+        setToken(access_token);
+        if (new_refresh_token) {
+          setRefreshToken(new_refresh_token);
+          console.log("\u{1F504} New refresh token stored from rotation");
+        }
+        console.log("\u2705 Token refresh successful, listeners notified");
+        emitAuthDiagnostic("TOKEN_REFRESH_COMPLETED", "SUCCESS", "NONE", { clientKey });
+        return access_token;
+      } catch (err) {
+        console.error("\u274C Token refresh error:", err);
+        const isAuthRejection = ((_c = err.message) == null ? void 0 : _c.includes("401")) || ((_d = err.message) == null ? void 0 : _d.includes("403")) || ((_e = err.message) == null ? void 0 : _e.includes("invalid_grant")) || ((_f = err.message) == null ? void 0 : _f.includes("Refresh failed: 4"));
+        if (isAuthRejection) {
+          clearToken();
+          clearRefreshToken();
+        }
+        throw err;
       }
-      throw err;
-    } finally {
-      refreshInProgress = false;
-      refreshPromise = null;
-    }
-  })();
+    };
+    return withCrossTabRefreshLock(clientKey, tokenBeforeRefresh, refreshRequest);
+  })().finally(() => {
+    refreshInProgress = false;
+    refreshPromise = null;
+  });
   return refreshPromise;
 }
 async function validateCurrentSession() {
@@ -1170,23 +1259,72 @@ var preferences = {
 // react/AuthProvider.jsx
 var import_react = __toESM(require("react"), 1);
 var AuthContext = (0, import_react.createContext)();
-function AuthProvider({ children, onSessionExpired }) {
+function AuthProvider({ children, onSessionExpired, manageSessionSecurity = true }) {
   const [token, setTokenState] = (0, import_react.useState)(getToken());
   const [user, setUser] = (0, import_react.useState)(null);
   const [loading, setLoading] = (0, import_react.useState)(!!token);
   const [sessionValid, setSessionValid] = (0, import_react.useState)(true);
   const sessionSecurityRef = (0, import_react.useRef)(null);
+  const onSessionExpiredRef = (0, import_react.useRef)(onSessionExpired);
+  const recoveryInFlightRef = (0, import_react.useRef)(null);
+  const profileRecoveryTokensRef = (0, import_react.useRef)(/* @__PURE__ */ new Set());
+  (0, import_react.useEffect)(() => {
+    onSessionExpiredRef.current = onSessionExpired;
+  }, [onSessionExpired]);
+  (0, import_react.useEffect)(() => {
+    const unsubscribe = addTokenListener((nextToken, previousToken) => {
+      if (nextToken === previousToken) return;
+      setTokenState(nextToken);
+      if (nextToken) {
+        setSessionValid(true);
+        setLoading(true);
+      } else {
+        setSessionValid(false);
+        setUser(null);
+        setLoading(false);
+      }
+    });
+    return unsubscribe;
+  }, []);
+  const invalidateLocalSession = () => {
+    clearToken();
+    setTokenState(null);
+    setUser(null);
+    setSessionValid(false);
+    setLoading(false);
+  };
   const handleSessionInvalid = (reason) => {
     console.log("\u{1F6A8} AuthProvider: Session invalidated -", reason);
-    setSessionValid(false);
-    setUser(null);
-    setTokenState(null);
-    if (onSessionExpired && typeof onSessionExpired === "function") {
-      onSessionExpired(reason);
-    }
+    if (recoveryInFlightRef.current) return recoveryInFlightRef.current;
+    const recover = async () => {
+      const callback = onSessionExpiredRef.current;
+      if (typeof callback === "function") {
+        try {
+          await callback(reason);
+          const recoveredToken = getToken();
+          if (recoveredToken) {
+            setTokenState(recoveredToken);
+            setSessionValid(true);
+            setLoading(true);
+            return true;
+          }
+        } catch (error) {
+          await emitAuthDiagnostic("SESSION_RECOVERY_FAILED", "FAILURE", reason, {
+            status: (error == null ? void 0 : error.status) || null,
+            errorCode: (error == null ? void 0 : error.code) || null
+          });
+        }
+      }
+      invalidateLocalSession();
+      return false;
+    };
+    recoveryInFlightRef.current = recover().finally(() => {
+      recoveryInFlightRef.current = null;
+    });
+    return recoveryInFlightRef.current;
   };
   (0, import_react.useEffect)(() => {
-    if (token && !sessionSecurityRef.current) {
+    if (manageSessionSecurity && token && !sessionSecurityRef.current) {
       console.log("\u{1F510} AuthProvider: Starting session security");
       const unsubscribe = onSessionInvalid(handleSessionInvalid);
       sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);
@@ -1198,11 +1336,11 @@ function AuthProvider({ children, onSessionExpired }) {
         }
       };
     }
-    if (!token && sessionSecurityRef.current) {
+    if ((!manageSessionSecurity || !token) && sessionSecurityRef.current) {
       sessionSecurityRef.current.stopAll();
       sessionSecurityRef.current = null;
     }
-  }, [token]);
+  }, [manageSessionSecurity, token]);
   (0, import_react.useEffect)(() => {
     console.log("\u{1F50D} AuthProvider useEffect triggered:", {
       hasToken: !!token,
@@ -1223,26 +1361,79 @@ function AuthProvider({ children, onSessionExpired }) {
       authBaseUrl,
       tokenPreview: token.slice(0, 50) + "..."
     });
-    fetch(`${authBaseUrl}/account/profile`, {
-      headers: { Authorization: `Bearer ${token}` },
-      credentials: "include"
-    }).then((res) => {
-      console.log("\u{1F4E5} Profile response status:", res.status);
-      if (!res.ok) throw new Error("Failed to fetch user");
-      return res.json();
-    }).then((responseBody) => {
-      const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
-      console.log("\u2705 Profile fetched successfully:", userData.email);
-      setUser(userData);
-      setSessionValid(true);
-      setLoading(false);
-    }).catch((err) => {
-      console.error("\u274C Fetch user error:", err);
-      clearToken();
-      setTokenState(null);
-      setUser(null);
-      setLoading(false);
-    });
+    let cancelled = false;
+    const fetchProfile = async (accessToken2) => {
+      const response = await fetch(`${authBaseUrl}/account/profile`, {
+        headers: { Authorization: `Bearer ${accessToken2}` },
+        credentials: "include"
+      });
+      console.log("\u{1F4E5} Profile response status:", response.status);
+      if (!response.ok) {
+        const error = new Error(`Profile request failed: ${response.status}`);
+        error.status = response.status;
+        throw error;
+      }
+      return response.json();
+    };
+    const loadProfile = async () => {
+      try {
+        const responseBody = await fetchProfile(token);
+        if (cancelled) return;
+        const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+        console.log("\u2705 Profile fetched successfully:", userData.email);
+        setUser(userData);
+        setSessionValid(true);
+        setLoading(false);
+      } catch (error) {
+        if (cancelled) return;
+        const status = Number((error == null ? void 0 : error.status) || 0);
+        const isUnauthorized = status === 401;
+        const callback = onSessionExpiredRef.current;
+        await emitAuthDiagnostic(
+          "PROFILE_REQUEST_FAILED",
+          isUnauthorized ? "FAILURE" : "WARNING",
+          isUnauthorized ? "PROFILE_UNAUTHORIZED" : status ? `PROFILE_HTTP_${status}` : "PROFILE_NETWORK_ERROR",
+          { status, errorName: error == null ? void 0 : error.name, errorCode: error == null ? void 0 : error.code }
+        );
+        if (!isUnauthorized) {
+          console.warn("\u26A0\uFE0F Profile unavailable; retaining the current auth session", error);
+          setLoading(false);
+          return;
+        }
+        if (typeof callback === "function" && !profileRecoveryTokensRef.current.has(token)) {
+          profileRecoveryTokensRef.current.add(token);
+          try {
+            await callback("profile_unauthorized");
+            const recoveredToken = getToken();
+            if (recoveredToken && recoveredToken !== token) {
+              setTokenState(recoveredToken);
+              setSessionValid(true);
+              setLoading(true);
+              return;
+            }
+            if (recoveredToken) {
+              const responseBody = await fetchProfile(recoveredToken);
+              if (cancelled) return;
+              const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+              setUser(userData);
+              setSessionValid(true);
+              setLoading(false);
+              return;
+            }
+          } catch (recoveryError) {
+            await emitAuthDiagnostic("PROFILE_RECOVERY_FAILED", "FAILURE", "PROFILE_REFRESH_FAILED", {
+              status: (recoveryError == null ? void 0 : recoveryError.status) || null,
+              errorCode: (recoveryError == null ? void 0 : recoveryError.code) || null
+            });
+          }
+        }
+        invalidateLocalSession();
+      }
+    };
+    void loadProfile();
+    return () => {
+      cancelled = true;
+    };
   }, [token]);
   const login2 = (clientKey, redirectUri, state) => {
     login(clientKey, redirectUri, state);
@@ -1271,6 +1462,7 @@ function AuthProvider({ children, onSessionExpired }) {
       setToken(newToken);
       setTokenState(newToken);
       setSessionValid(true);
+      if (newToken) setLoading(true);
     },
     clearToken: () => {
       stopSessionSecurity();
@@ -1438,6 +1630,8 @@ function usePreferences() {
 var auth = {
   // 🔧 Config
   setConfig,
+  applyRuntimePolicy,
+  loadRuntimePolicy,
   getConfig,
   isRouterMode,
   // 🔐 Core flows