@startsimpli/auth 0.4.14 → 0.4.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.14",
+  "version": "0.4.15",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/client/auth-context.tsx

@@ -8,6 +8,7 @@ import {
   createContext,
   useContext,
   useEffect,
+  useRef,
   useState,
   useCallback,
   type ReactNode,
@@ -108,43 +109,49 @@ export function AuthProvider({
     };
   }, [authClient, initialSession]);
 
-  // Session expiration handler — covers both AuthClient timer and authFetch 401
-  useEffect(() => {
-    // Capture the consumer's onSessionExpired before we overwrite it below.
-    const consumerCallback = config.onSessionExpired;
-    const loginPath = config.loginPath;
-    const callbackParam = config.callbackParam ?? 'callbackUrl';
+  // Keep refs current on every render so the stable handleExpired closure
+  // below always reads the latest config values without being in deps.
+  const loginPathRef = useRef(config.loginPath);
+  const callbackParamRef = useRef(config.callbackParam ?? 'callbackUrl');
+  const onSessionExpiredRef = useRef(config.onSessionExpired);
+  loginPathRef.current = config.loginPath;
+  callbackParamRef.current = config.callbackParam ?? 'callbackUrl';
+  onSessionExpiredRef.current = config.onSessionExpired;
 
+  // Session expiration handler — covers both AuthClient timer and authFetch 401.
+  // Depends only on authClient (a useState singleton that never changes after
+  // mount). config intentionally omitted: it's a new object literal on every
+  // render from the caller, so including it caused destroy() to fire and wipe
+  // the session on every re-render.
+  useEffect(() => {
     const handleExpired = () => {
       setState({
         session: null,
         isLoading: false,
         isAuthenticated: false,
       });
-      consumerCallback?.();
+      onSessionExpiredRef.current?.();
 
-      // Redirect to login if configured. Done after state reset + consumer
-      // callback so any cleanup runs first. window.location avoids pulling
-      // a router dep into the shared package — works in any framework.
-      if (loginPath && typeof window !== 'undefined') {
+      if (loginPathRef.current && typeof window !== 'undefined') {
         const here = window.location.pathname + window.location.search;
-        const isOnLogin = window.location.pathname.startsWith(loginPath);
+        const isOnLogin = window.location.pathname.startsWith(loginPathRef.current);
         if (!isOnLogin) {
           const callback = encodeURIComponent(here);
-          window.location.href = `${loginPath}?${callbackParam}=${callback}`;
+          window.location.href = `${loginPathRef.current}?${callbackParamRef.current}=${callback}`;
         }
       }
     };
 
+    // Wire AuthClient's internal expiry calls and the functional API (FetchWrapper).
     config.onSessionExpired = handleExpired;
-    // Wire up the functional API's session expiration callback
     setOnSessionExpired(handleExpired);
 
     return () => {
       setOnSessionExpired(null);
       authClient.destroy();
     };
-  }, [authClient, config]);
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [authClient]);
 
   const login = useCallback(
     async (email: string, password: string) => {