@spidy092/auth-client 3.1.3 → 3.1.5

package/dist/react/AuthProvider.cjs

@@ -38,8 +38,10 @@ var import_react = __toESM(require("react"), 1);
 // token.js
 var import_jwt_decode = require("jwt-decode");
 var accessToken = null;
+var idToken = null;
 var listeners = /* @__PURE__ */ new Set();
 var REFRESH_COOKIE = "account_refresh_token";
+var ID_TOKEN_KEY = "auth_id_token";
 var COOKIE_MAX_AGE = 7 * 24 * 60 * 60;
 function secureAttribute() {
   var _a;
@@ -108,12 +110,14 @@ function getToken() {
 function clearToken() {
   if (!accessToken) {
     writeAccessToken(null);
+    clearIdToken();
     clearRefreshToken();
     return;
   }
   const previousToken = accessToken;
   accessToken = null;
   writeAccessToken(null);
+  clearIdToken();
   clearRefreshToken();
   listeners.forEach((listener) => {
     try {
@@ -123,6 +127,22 @@ function clearToken() {
     }
   });
 }
+function getIdToken() {
+  if (idToken) return idToken;
+  try {
+    idToken = sessionStorage.getItem(ID_TOKEN_KEY) || null;
+  } catch {
+    idToken = null;
+  }
+  return idToken;
+}
+function clearIdToken() {
+  idToken = null;
+  try {
+    sessionStorage.removeItem(ID_TOKEN_KEY);
+  } catch {
+  }
+}
 var REFRESH_TOKEN_KEY = "auth_refresh_token";
 var _persistRefreshToken = false;
 function shouldUseLocalStorage() {
@@ -177,6 +197,15 @@ function clearRefreshToken() {
   } catch (err) {
   }
 }
+function addTokenListener(listener) {
+  if (typeof listener !== "function") {
+    throw new Error("Token listener must be a function");
+  }
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
 if (typeof window !== "undefined" && window.addEventListener) {
   window.addEventListener("storage", (event) => {
     if (event.key !== "authToken") return;
@@ -290,6 +319,28 @@ function acquireLoginLock(clientKey, redirectUri, ttlMs = 5e3) {
   }
   return true;
 }
+async function reportClientDiagnostic(safe) {
+  if (typeof fetch !== "function" || typeof getToken !== "function") return;
+  if (safe.outcome === "SUCCESS" && !safe.event.startsWith("PROFILE_") && !safe.event.startsWith("SESSION_")) return;
+  const { authBaseUrl } = getConfig();
+  const token = getToken();
+  if (!authBaseUrl || !token) return;
+  try {
+    await fetch(`${authBaseUrl.replace(/\/+$/, "")}/client-telemetry`, {
+      method: "POST",
+      credentials: "include",
+      keepalive: true,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-Correlation-ID": safe.correlationId,
+        "X-Request-ID": safe.correlationId
+      },
+      body: JSON.stringify(safe)
+    });
+  } catch {
+  }
+}
 async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   const context = getDiagnosticContext();
   const safe = {
@@ -306,6 +357,7 @@ async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
   };
   const method = outcome === "FAILURE" ? "error" : outcome === "WARNING" ? "warn" : "info";
   console[method]("[auth-client]", safe);
+  void reportClientDiagnostic(safe);
   return safe;
 }
 
@@ -368,6 +420,7 @@ async function logout(options = {}) {
   const { clientKey, authBaseUrl, accountUiUrl } = getConfig();
   const scope = options.scope === "client" ? "client" : "sso";
   const token = getToken();
+  const idToken2 = getIdToken();
   const refreshToken2 = getRefreshToken();
   console.log("\u{1F6AA} Smart Logout initiated", {
     mode: isRouterMode() ? "ROUTER" : "CLIENT",
@@ -376,6 +429,7 @@ async function logout(options = {}) {
   });
   emitAuthDiagnostic("LOGOUT_INITIATED", "PENDING", "NONE", { clientKey });
   clearToken();
+  clearIdToken();
   clearRefreshToken();
   sessionStorage.removeItem("originalApp");
   sessionStorage.removeItem("returnUrl");
@@ -388,7 +442,7 @@ async function logout(options = {}) {
         "Authorization": token ? `Bearer ${token}` : "",
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken: refreshToken2, scope })
+      body: JSON.stringify({ refreshToken: refreshToken2, idToken: idToken2, scope })
     });
     if (!response.ok) {
       throw new Error(`Logout failed: ${response.status}`);
@@ -773,23 +827,72 @@ function stopSessionSecurity() {
 
 // react/AuthProvider.jsx
 var AuthContext = (0, import_react.createContext)();
-function AuthProvider({ children, onSessionExpired }) {
+function AuthProvider({ children, onSessionExpired, manageSessionSecurity = true }) {
   const [token, setTokenState] = (0, import_react.useState)(getToken());
   const [user, setUser] = (0, import_react.useState)(null);
   const [loading, setLoading] = (0, import_react.useState)(!!token);
   const [sessionValid, setSessionValid] = (0, import_react.useState)(true);
   const sessionSecurityRef = (0, import_react.useRef)(null);
+  const onSessionExpiredRef = (0, import_react.useRef)(onSessionExpired);
+  const recoveryInFlightRef = (0, import_react.useRef)(null);
+  const profileRecoveryTokensRef = (0, import_react.useRef)(/* @__PURE__ */ new Set());
+  (0, import_react.useEffect)(() => {
+    onSessionExpiredRef.current = onSessionExpired;
+  }, [onSessionExpired]);
+  (0, import_react.useEffect)(() => {
+    const unsubscribe = addTokenListener((nextToken, previousToken) => {
+      if (nextToken === previousToken) return;
+      setTokenState(nextToken);
+      if (nextToken) {
+        setSessionValid(true);
+        setLoading(true);
+      } else {
+        setSessionValid(false);
+        setUser(null);
+        setLoading(false);
+      }
+    });
+    return unsubscribe;
+  }, []);
+  const invalidateLocalSession = () => {
+    clearToken();
+    setTokenState(null);
+    setUser(null);
+    setSessionValid(false);
+    setLoading(false);
+  };
   const handleSessionInvalid = (reason) => {
     console.log("\u{1F6A8} AuthProvider: Session invalidated -", reason);
-    setSessionValid(false);
-    setUser(null);
-    setTokenState(null);
-    if (onSessionExpired && typeof onSessionExpired === "function") {
-      onSessionExpired(reason);
-    }
+    if (recoveryInFlightRef.current) return recoveryInFlightRef.current;
+    const recover = async () => {
+      const callback = onSessionExpiredRef.current;
+      if (typeof callback === "function") {
+        try {
+          await callback(reason);
+          const recoveredToken = getToken();
+          if (recoveredToken) {
+            setTokenState(recoveredToken);
+            setSessionValid(true);
+            setLoading(true);
+            return true;
+          }
+        } catch (error) {
+          await emitAuthDiagnostic("SESSION_RECOVERY_FAILED", "FAILURE", reason, {
+            status: (error == null ? void 0 : error.status) || null,
+            errorCode: (error == null ? void 0 : error.code) || null
+          });
+        }
+      }
+      invalidateLocalSession();
+      return false;
+    };
+    recoveryInFlightRef.current = recover().finally(() => {
+      recoveryInFlightRef.current = null;
+    });
+    return recoveryInFlightRef.current;
   };
   (0, import_react.useEffect)(() => {
-    if (token && !sessionSecurityRef.current) {
+    if (manageSessionSecurity && token && !sessionSecurityRef.current) {
       console.log("\u{1F510} AuthProvider: Starting session security");
       const unsubscribe = onSessionInvalid(handleSessionInvalid);
       sessionSecurityRef.current = startSessionSecurity(handleSessionInvalid);
@@ -801,11 +904,11 @@ function AuthProvider({ children, onSessionExpired }) {
         }
       };
     }
-    if (!token && sessionSecurityRef.current) {
+    if ((!manageSessionSecurity || !token) && sessionSecurityRef.current) {
       sessionSecurityRef.current.stopAll();
       sessionSecurityRef.current = null;
     }
-  }, [token]);
+  }, [manageSessionSecurity, token]);
   (0, import_react.useEffect)(() => {
     console.log("\u{1F50D} AuthProvider useEffect triggered:", {
       hasToken: !!token,
@@ -826,26 +929,79 @@ function AuthProvider({ children, onSessionExpired }) {
       authBaseUrl,
       tokenPreview: token.slice(0, 50) + "..."
     });
-    fetch(`${authBaseUrl}/account/profile`, {
-      headers: { Authorization: `Bearer ${token}` },
-      credentials: "include"
-    }).then((res) => {
-      console.log("\u{1F4E5} Profile response status:", res.status);
-      if (!res.ok) throw new Error("Failed to fetch user");
-      return res.json();
-    }).then((responseBody) => {
-      const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
-      console.log("\u2705 Profile fetched successfully:", userData.email);
-      setUser(userData);
-      setSessionValid(true);
-      setLoading(false);
-    }).catch((err) => {
-      console.error("\u274C Fetch user error:", err);
-      clearToken();
-      setTokenState(null);
-      setUser(null);
-      setLoading(false);
-    });
+    let cancelled = false;
+    const fetchProfile = async (accessToken2) => {
+      const response = await fetch(`${authBaseUrl}/account/profile`, {
+        headers: { Authorization: `Bearer ${accessToken2}` },
+        credentials: "include"
+      });
+      console.log("\u{1F4E5} Profile response status:", response.status);
+      if (!response.ok) {
+        const error = new Error(`Profile request failed: ${response.status}`);
+        error.status = response.status;
+        throw error;
+      }
+      return response.json();
+    };
+    const loadProfile = async () => {
+      try {
+        const responseBody = await fetchProfile(token);
+        if (cancelled) return;
+        const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+        console.log("\u2705 Profile fetched successfully:", userData.email);
+        setUser(userData);
+        setSessionValid(true);
+        setLoading(false);
+      } catch (error) {
+        if (cancelled) return;
+        const status = Number((error == null ? void 0 : error.status) || 0);
+        const isUnauthorized = status === 401;
+        const callback = onSessionExpiredRef.current;
+        await emitAuthDiagnostic(
+          "PROFILE_REQUEST_FAILED",
+          isUnauthorized ? "FAILURE" : "WARNING",
+          isUnauthorized ? "PROFILE_UNAUTHORIZED" : status ? `PROFILE_HTTP_${status}` : "PROFILE_NETWORK_ERROR",
+          { status, errorName: error == null ? void 0 : error.name, errorCode: error == null ? void 0 : error.code }
+        );
+        if (!isUnauthorized) {
+          console.warn("\u26A0\uFE0F Profile unavailable; retaining the current auth session", error);
+          setLoading(false);
+          return;
+        }
+        if (typeof callback === "function" && !profileRecoveryTokensRef.current.has(token)) {
+          profileRecoveryTokensRef.current.add(token);
+          try {
+            await callback("profile_unauthorized");
+            const recoveredToken = getToken();
+            if (recoveredToken && recoveredToken !== token) {
+              setTokenState(recoveredToken);
+              setSessionValid(true);
+              setLoading(true);
+              return;
+            }
+            if (recoveredToken) {
+              const responseBody = await fetchProfile(recoveredToken);
+              if (cancelled) return;
+              const userData = (responseBody == null ? void 0 : responseBody.data) ?? responseBody;
+              setUser(userData);
+              setSessionValid(true);
+              setLoading(false);
+              return;
+            }
+          } catch (recoveryError) {
+            await emitAuthDiagnostic("PROFILE_RECOVERY_FAILED", "FAILURE", "PROFILE_REFRESH_FAILED", {
+              status: (recoveryError == null ? void 0 : recoveryError.status) || null,
+              errorCode: (recoveryError == null ? void 0 : recoveryError.code) || null
+            });
+          }
+        }
+        invalidateLocalSession();
+      }
+    };
+    void loadProfile();
+    return () => {
+      cancelled = true;
+    };
   }, [token]);
   const login2 = (clientKey, redirectUri, state) => {
     login(clientKey, redirectUri, state);
@@ -874,6 +1030,7 @@ function AuthProvider({ children, onSessionExpired }) {
       setToken(newToken);
       setTokenState(newToken);
       setSessionValid(true);
+      if (newToken) setLoading(true);
     },
     clearToken: () => {
       stopSessionSecurity();