@startsimpli/auth 0.4.25 → 0.4.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/__tests__/auth-client.test.ts

@@ -123,3 +123,55 @@ describe('AuthClient.login', () => {
     expect(session.accessToken).toBe(VALID_TOKEN);
   });
 });
+
+// Regression coverage for startsim-768w.2.3: a dead / wrong-audience refresh
+// cookie must end the session ONCE (clear + signal expiry, so the app bounces
+// to login) rather than spin in a refresh loop — while a transient backend
+// flake (5xx / network) must NOT log the user out. This session-dead-vs-transient
+// split in performTokenRefresh is the loop-prevention; pin it so a refactor
+// can't reintroduce either the auth loop or premature logout.
+describe('AuthClient.refreshToken — session-dead vs transient (768w.2.3)', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  function clientWithSession(onSessionExpired: () => void) {
+    const client = new AuthClient({ apiBaseUrl: 'http://localhost:8001', onSessionExpired });
+    (client as any).session = {
+      user: { id: 'u', email: 'e@x.com', firstName: '', lastName: '', isEmailVerified: false, createdAt: '', updatedAt: '' },
+      accessToken: VALID_TOKEN,
+      expiresAt: Date.now() + 3600000,
+    };
+    return client;
+  }
+
+  it('clears the session + signals expiry on a 401 refresh (dead/wrong-aud cookie → no loop)', async () => {
+    const onSessionExpired = vi.fn();
+    const client = clientWithSession(onSessionExpired);
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValueOnce({ status: 401, ok: false }));
+
+    await expect(client.refreshToken()).rejects.toThrow(/session expired/i);
+    expect(onSessionExpired).toHaveBeenCalledTimes(1);
+    expect((client as any).session).toBeFalsy();
+  });
+
+  it('does NOT clear the session on a 5xx refresh (transient backend flake → retry, no logout)', async () => {
+    const onSessionExpired = vi.fn();
+    const client = clientWithSession(onSessionExpired);
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValueOnce({ status: 503, ok: false }));
+
+    await expect(client.refreshToken()).rejects.toThrow(/transient/i);
+    expect(onSessionExpired).not.toHaveBeenCalled();
+    expect((client as any).session).toBeTruthy();
+  });
+
+  it('does NOT clear the session on a network error (unreachable backend)', async () => {
+    const onSessionExpired = vi.fn();
+    const client = clientWithSession(onSessionExpired);
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValueOnce(new Error('ECONNREFUSED')));
+
+    await expect(client.refreshToken()).rejects.toThrow(/transient/i);
+    expect(onSessionExpired).not.toHaveBeenCalled();
+    expect((client as any).session).toBeTruthy();
+  });
+});

package/src/client/auth-client.ts

@@ -45,7 +45,7 @@ function hasLoggedOutFlag(): boolean {
 export class AuthClient implements AuthBackend {
   private config: Required<AuthConfig>;
   private session: Session | null = null;
-  private refreshTimer: NodeJS.Timeout | null = null;
+  private refreshTimer: ReturnType<typeof setTimeout> | null = null;
   private isRefreshing = false;
   private refreshPromise: Promise<string> | null = null;
 

package/src/utils/central-auth.ts

@@ -66,6 +66,7 @@ const APP_HOME_URLS: Record<string, string> = {
   raise: 'https://app.raisesimpli.com',
   recipe: 'https://recipesimpli.com',
   crochet: 'https://crochets.site',
+  genai: 'https://app.genaiconsulting.services',
 };
 
 /**