@tumbaland/frontend-core 1.1.0 → 1.1.1

package/dist/authService.d.ts

@@ -14,12 +14,14 @@ export interface AuthServiceConfig {
  *     getAuthServiceUrl: () => getGlobalConfig().AUTH_SERVICE_URL!,
  *     getAuthFrontUrl: () => getGlobalConfig().AUTH_FRONT_URL!
  *   });
+ *
+ * The JWT lives only in an httpOnly `access_token` cookie — it is never
+ * readable from JS (no localStorage mirror, no client-side decode). Every
+ * call here that needs the session sends `credentials: 'include'` so the
+ * browser attaches the cookie automatically; auth state is always read via
+ * the network (checkAuth/getCurrentUser), never decoded locally.
  */
 export declare function createAuthService(config: AuthServiceConfig): {
-    /** Sync the JWT from cookie to localStorage. Call once on app start. */
-    init(): void;
-    getToken(): string | null;
-    syncToken(): void;
     clearAuthCache(): void;
     /** Verifies the session against auth-service. Cached for 5 minutes. */
     checkAuth(): Promise<AuthResponse>;
@@ -28,8 +30,6 @@ export declare function createAuthService(config: AuthServiceConfig): {
     getCurrentUser(): Promise<User | null>;
     /** Full profile (e.g. firstName/lastName) — only auth-service's /auth/profile has this. */
     getProfile(): Promise<User | null>;
-    /** Decodes the local JWT directly — no network call, but can be stale. */
-    getCurrentUserFromToken(): User | null;
     isAuthenticated(): Promise<boolean>;
 };
 export type AuthService = ReturnType<typeof createAuthService>;

package/dist/authService.js

@@ -7,10 +7,6 @@ function authHeaders() {
         'x-session-id': getSessionId()
     };
 }
-function getJwtTokenFromCookie(cookieName = 'access_token') {
-    const match = document.cookie.match(new RegExp('(^| )' + cookieName + '=([^;]+)'));
-    return match ? match[2] : null;
-}
 /**
  * Builds a per-front auth service instance. Each of the 7 frontends that
  * previously hand-rolled their own (six divergent copies, per
@@ -21,27 +17,17 @@ function getJwtTokenFromCookie(cookieName = 'access_token') {
  *     getAuthServiceUrl: () => getGlobalConfig().AUTH_SERVICE_URL!,
  *     getAuthFrontUrl: () => getGlobalConfig().AUTH_FRONT_URL!
  *   });
+ *
+ * The JWT lives only in an httpOnly `access_token` cookie — it is never
+ * readable from JS (no localStorage mirror, no client-side decode). Every
+ * call here that needs the session sends `credentials: 'include'` so the
+ * browser attaches the cookie automatically; auth state is always read via
+ * the network (checkAuth/getCurrentUser), never decoded locally.
  */
 export function createAuthService(config) {
     let authCache = null;
     let authCacheTime = 0;
-    function syncJwtToken() {
-        const token = getJwtTokenFromCookie();
-        if (token && localStorage.getItem('authToken') !== token) {
-            localStorage.setItem('authToken', token);
-        }
-    }
     return {
-        /** Sync the JWT from cookie to localStorage. Call once on app start. */
-        init() {
-            syncJwtToken();
-        },
-        getToken() {
-            return localStorage.getItem('authToken');
-        },
-        syncToken() {
-            syncJwtToken();
-        },
         clearAuthCache() {
             authCache = null;
             authCacheTime = 0;
@@ -93,7 +79,6 @@ export function createAuthService(config) {
                 }
                 const data = await response.json();
                 if (data.success) {
-                    localStorage.removeItem('authToken');
                     authCache = null;
                     authCacheTime = 0;
                     window.location.reload();
@@ -129,31 +114,6 @@ export function createAuthService(config) {
                 return null;
             }
         },
-        /** Decodes the local JWT directly — no network call, but can be stale. */
-        getCurrentUserFromToken() {
-            try {
-                const token = this.getToken();
-                if (!token)
-                    return null;
-                const payload = token.split('.')[1];
-                if (!payload)
-                    return null;
-                const decoded = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-                if (decoded.exp && Date.now() >= decoded.exp * 1000) {
-                    return null;
-                }
-                return {
-                    id: decoded.sub || decoded.id,
-                    email: decoded.email,
-                    name: decoded.name || decoded.preferred_username,
-                    picture: decoded.picture
-                };
-            }
-            catch (error) {
-                console.error('Failed to decode JWT token:', error);
-                return null;
-            }
-        },
         async isAuthenticated() {
             const result = await this.checkAuth();
             return result.authenticated;

package/dist/groupService.js

@@ -1,11 +1,7 @@
 import { getCorrelationId, getSessionId } from '@tumbaland/components';
-function getAuthToken() {
-    return localStorage.getItem('authToken') || '';
-}
 function groupHeaders() {
     return {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${getAuthToken()}`,
         'x-correlation-id': getCorrelationId(),
         'x-session-id': getSessionId()
     };
@@ -24,6 +20,7 @@ export function createGroupService(config) {
         async getUserGroups() {
             try {
                 const response = await fetch(`${config.getGroupApiUrl()}/api/groups/mine`, {
+                    credentials: 'include',
                     headers: groupHeaders()
                 });
                 if (!response.ok) {
@@ -43,6 +40,7 @@ export function createGroupService(config) {
         async getUserGroupIds() {
             try {
                 const response = await fetch(`${config.getGroupApiUrl()}/api/groups/mine/ids`, {
+                    credentials: 'include',
                     headers: groupHeaders()
                 });
                 if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/frontend-core",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Shared frontend auth/group/API-client logic for Tumbaland frontends",
   "author": "Tumbaland",
   "license": "MIT",