@spidy092/auth-client 3.1.3 → 3.1.5

package/dist/index.js

@@ -1,8 +1,10 @@
 // token.js
 import { jwtDecode } from "jwt-decode";
 var accessToken = null;
+var idToken = null;
 var listeners = /* @__PURE__ */ new Set();
 var REFRESH_COOKIE = "account_refresh_token";
+var ID_TOKEN_KEY = "auth_id_token";
 var COOKIE_MAX_AGE = 7 * 24 * 60 * 60;
 function secureAttribute() {
   var _a;
@@ -81,12 +83,14 @@ function getToken() {
 function clearToken() {
   if (!accessToken) {
     writeAccessToken(null);
+    clearIdToken();
     clearRefreshToken();
     return;
   }
   const previousToken = accessToken;
   accessToken = null;
   writeAccessToken(null);
+  clearIdToken();
   clearRefreshToken();
   listeners.forEach((listener) => {
     try {
@@ -96,6 +100,30 @@ function clearToken() {
     }
   });
 }
+function setIdToken(token) {
+  idToken = token || null;
+  try {
+    if (idToken) sessionStorage.setItem(ID_TOKEN_KEY, idToken);
+    else sessionStorage.removeItem(ID_TOKEN_KEY);
+  } catch {
+  }
+}
+function getIdToken() {
+  if (idToken) return idToken;
+  try {
+    idToken = sessionStorage.getItem(ID_TOKEN_KEY) || null;
+  } catch {
+    idToken = null;
+  }
+  return idToken;
+}
+function clearIdToken() {
+  idToken = null;
+  try {
+    sessionStorage.removeItem(ID_TOKEN_KEY);
+  } catch {
+  }
+}
 var REFRESH_TOKEN_KEY = "auth_refresh_token";
 var _persistRefreshToken = false;
 function enableRefreshTokenPersistence(enabled) {
@@ -340,6 +368,28 @@ function clearLoginLock() {
   } catch {
   }
 }
+async function reportClientDiagnostic(safe) {
+  if (typeof fetch !== "function" || typeof getToken !== "function") return;
+  if (safe.outcome === "SUCCESS" && !safe.event.startsWith("PROFILE_") && !safe.event.startsWith("SESSION_")) return;
+  const { authBaseUrl } = getConfig();
+  const token = getToken();
+  if (!authBaseUrl || !token) return;
+  try {
+    await fetch(`${authBaseUrl.replace(/\/+$/, "")}/client-telemetry`, {
+      method: "POST",
+      credentials: "include",
+      keepalive: true,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-Correlation-ID": safe.correlationId,
+        "X-Request-ID": safe.correlationId
+      },
+      body: JSON.stringify(safe)
+    });
+  } catch {
+  }
+}
 async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   const context = getDiagnosticContext();
   const safe = {
@@ -356,6 +406,7 @@ async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   };
   const method = outcome === "FAILURE" ? "error" : outcome === "WARNING" ? "warn" : "info";
   console[method]("[auth-client]", safe);
+  void reportClientDiagnostic(safe);
   return safe;
 }
 
@@ -418,6 +469,7 @@ async function logout(options = {}) {
   const { clientKey, authBaseUrl, accountUiUrl } = getConfig();
   const scope = options.scope === "client" ? "client" : "sso";
   const token = getToken();
+  const idToken2 = getIdToken();
   const refreshToken2 = getRefreshToken();
   console.log("\u{1F6AA} Smart Logout initiated", {
     mode: isRouterMode() ? "ROUTER" : "CLIENT",
@@ -426,6 +478,7 @@ async function logout(options = {}) {
   });
   emitAuthDiagnostic("LOGOUT_INITIATED", "PENDING", "NONE", { clientKey });
   clearToken();
+  clearIdToken();
   clearRefreshToken();
   sessionStorage.removeItem("originalApp");
   sessionStorage.removeItem("returnUrl");
@@ -438,7 +491,7 @@ async function logout(options = {}) {
         "Authorization": token ? `Bearer ${token}` : "",
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken: refreshToken2, scope })
+      body: JSON.stringify({ refreshToken: refreshToken2, idToken: idToken2, scope })
     });
     if (!response.ok) {
       throw new Error(`Logout failed: ${response.status}`);
@@ -472,9 +525,11 @@ async function logout(options = {}) {
 function handleCallback() {
   const params = new URLSearchParams(window.location.search);
   const accessToken2 = params.get("access_token");
+  const idToken2 = params.get("id_token");
   const error = params.get("error");
   console.log("\u{1F504} Callback handling:", {
     hasAccessToken: !!accessToken2,
+    hasIdToken: !!idToken2,
     error
   });
   if (callbackProcessed) {
@@ -502,6 +557,7 @@ function handleCallback() {
   }
   if (accessToken2) {
     setToken(accessToken2);
+    if (idToken2) setIdToken(idToken2);
     const refreshTokenInUrl = params.get("refresh_token");
     if (refreshTokenInUrl) {
       emitAuthDiagnostic("CALLBACK_REFRESH_TOKEN_IGNORED", "WARNING", "REFRESH_TOKEN_IN_URL", {
@@ -510,6 +566,7 @@ function handleCallback() {
     }
     const url = new URL(window.location);
     url.searchParams.delete("access_token");
+    url.searchParams.delete("id_token");
     url.searchParams.delete("refresh_token");
     url.searchParams.delete("state");
     url.searchParams.delete("error");
@@ -1185,23 +1242,72 @@ var preferences = {
 // react/AuthProvider.jsx
 import React, { createContext, useState, useEffect, useRef } from "react";
 var AuthContext = createContext();
-function AuthProvider({ children, onSessionExpired }) {
+function AuthProvider({ children, onSessionExpired, manageSessionSecurity = true }) {
   const [token, setTokenState] = useState(getToken());
   const [user, setUser] = useState(null);
   const [loading, setLoading] = useState(!!token);
   const [sessionValid, setSessionValid] = useState(true);
   const sessionSecurityRef = useRef(null);
+  const onSessionExpiredRef = useRef(onSessionExpired);
+  const recoveryInFlightRef = useRef(null);
+  const profileRecoveryTokensRef = useRef(/* @__PURE__ */ new Set());
+  useEffect(() => {
+    onSessionExpiredRef.current = onSessionExpired;
+  }, [onSessionExpired]);
+  useEffect(() => {
+    const unsubscribe = addTokenListener((nextToken, previousToken) => {
+      if (nextToken === previousToken) return;
+      setTokenState(nextToken);
+      if (nextToken) {
+        setSessionValid(true);
+        setLoading(true);
+      } else {
+        setSessionValid(false);
+        setUser(null);
+        setLoading(false);
+      }
+    });
+    return unsubscribe;
+  }, []);
+  const invalidateLocalSession = () => {
+    clearToken();
+    setTokenState(null);
+    setUser(null);
+    setSessionValid(false);
+    setLoading(false);
+  };
   const handleSessionInvalid = (reason) => {
     console.log("\u{1F6A8} AuthProvider: Session invalidated -", reason);
-    setSessionValid(false);
-    setUser(null);
-    setTokenState(null);
-    if (onSessionExpired && typeof onSessionExpired === "function") {
-      onSessionExpired(reason);
-    }
+    if (recoveryInFlightRef.current) return recoveryInFlightRef.current;
+    const recover = async () => {
+      const callback = onSessionExpiredRef.current;
+      if (typeof callback === "function") {
+        try {
+          await callback(reason);
+          const recoveredToken = getToken();
+          if (recoveredToken) {
+            setTokenState(recoveredToken);
+            setSessionValid(true);
+            setLoading(true);
+            return true;
+          }
+        } catch (error) {
+          await emitAuthDiagnostic("SESSION_RECOVERY_FAILED", "FAILURE", reason, {
+            status: (error == null ? void 0 : error.status) || null,
+            errorCode: (error == null ? void 0 : error.code) || null
+          });
+        }
+      }
+      invalidateLocalSession();
+      return false;
+    };
+    recoveryInFlightRef.current = recover().finally(() => {
+      recoveryInFlightRef.current = null;
+    });
+    return recoveryInFlightRef.current;
   };
   useEffect(() => {
-    if (token && !sessionSecurityRef.current) {
+    if (manageSessionSecurity && token && !sessionSecurityRef.current) {
       console.log("\u{1F510} AuthProvider: Starting session security");
       const unsubscribe = onSessionInvalid(handleSessionInvalid);
       sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);
@@ -1213,11 +1319,11 @@ function AuthProvider({ children, onSessionExpired }) {
         }
       };
     }
-    if (!token && sessionSecurityRef.current) {
+    if ((!manageSessionSecurity || !token) && sessionSecurityRef.current) {
       sessionSecurityRef.current.stopAll();
       sessionSecurityRef.current = null;
     }
-  }, [token]);
+  }, [manageSessionSecurity, token]);
   useEffect(() => {
     console.log("\u{1F50D} AuthProvider useEffect triggered:", {
       hasToken: !!token,
@@ -1238,26 +1344,79 @@ function AuthProvider({ children, onSessionExpired }) {
       authBaseUrl,
       tokenPreview: token.slice(0, 50) + "..."
     });
-    fetch(`${authBaseUrl}/account/profile`, {
-      headers: { Authorization: `Bearer ${token}` },
-      credentials: "include"
-    }).then((res) => {
-      console.log("\u{1F4E5} Profile response status:", res.status);
-      if (!res.ok) throw new Error("Failed to fetch user");
-      return res.json();
-    }).then((responseBody) => {
-      const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
-      console.log("\u2705 Profile fetched successfully:", userData.email);
-      setUser(userData);
-      setSessionValid(true);
-      setLoading(false);
-    }).catch((err) => {
-      console.error("\u274C Fetch user error:", err);
-      clearToken();
-      setTokenState(null);
-      setUser(null);
-      setLoading(false);
-    });
+    let cancelled = false;
+    const fetchProfile = async (accessToken2) => {
+      const response = await fetch(`${authBaseUrl}/account/profile`, {
+        headers: { Authorization: `Bearer ${accessToken2}` },
+        credentials: "include"
+      });
+      console.log("\u{1F4E5} Profile response status:", response.status);
+      if (!response.ok) {
+        const error = new Error(`Profile request failed: ${response.status}`);
+        error.status = response.status;
+        throw error;
+      }
+      return response.json();
+    };
+    const loadProfile = async () => {
+      try {
+        const responseBody = await fetchProfile(token);
+        if (cancelled) return;
+        const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+        console.log("\u2705 Profile fetched successfully:", userData.email);
+        setUser(userData);
+        setSessionValid(true);
+        setLoading(false);
+      } catch (error) {
+        if (cancelled) return;
+        const status = Number((error == null ? void 0 : error.status) || 0);
+        const isUnauthorized = status === 401;
+        const callback = onSessionExpiredRef.current;
+        await emitAuthDiagnostic(
+          "PROFILE_REQUEST_FAILED",
+          isUnauthorized ? "FAILURE" : "WARNING",
+          isUnauthorized ? "PROFILE_UNAUTHORIZED" : status ? `PROFILE_HTTP_${status}` : "PROFILE_NETWORK_ERROR",
+          { status, errorName: error == null ? void 0 : error.name, errorCode: error == null ? void 0 : error.code }
+        );
+        if (!isUnauthorized) {
+          console.warn("\u26A0\uFE0F Profile unavailable; retaining the current auth session", error);
+          setLoading(false);
+          return;
+        }
+        if (typeof callback === "function" && !profileRecoveryTokensRef.current.has(token)) {
+          profileRecoveryTokensRef.current.add(token);
+          try {
+            await callback("profile_unauthorized");
+            const recoveredToken = getToken();
+            if (recoveredToken && recoveredToken !== token) {
+              setTokenState(recoveredToken);
+              setSessionValid(true);
+              setLoading(true);
+              return;
+            }
+            if (recoveredToken) {
+              const responseBody = await fetchProfile(recoveredToken);
+              if (cancelled) return;
+              const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+              setUser(userData);
+              setSessionValid(true);
+              setLoading(false);
+              return;
+            }
+          } catch (recoveryError) {
+            await emitAuthDiagnostic("PROFILE_RECOVERY_FAILED", "FAILURE", "PROFILE_REFRESH_FAILED", {
+              status: (recoveryError == null ? void 0 : recoveryError.status) || null,
+              errorCode: (recoveryError == null ? void 0 : recoveryError.code) || null
+            });
+          }
+        }
+        invalidateLocalSession();
+      }
+    };
+    void loadProfile();
+    return () => {
+      cancelled = true;
+    };
   }, [token]);
   const login2 = (clientKey, redirectUri, state) => {
     login(clientKey, redirectUri, state);
@@ -1286,6 +1445,7 @@ function AuthProvider({ children, onSessionExpired }) {
       setToken(newToken);
       setTokenState(newToken);
       setSessionValid(true);
+      if (newToken) setLoading(true);
     },
     clearToken: () => {
       stopSessionSecurity();
@@ -1470,6 +1630,9 @@ var auth = {
   getToken,
   setToken,
   clearToken,
+  setIdToken,
+  getIdToken,
+  clearIdToken,
   setRefreshToken,
   // ✅ Refresh token for HTTP dev
   getRefreshToken,