@vansite/ts-sharetribe-flex-sdk 3.0.6 → 3.0.7

package/dist/types/utils/stores/BrowserStore.d.ts

@@ -28,8 +28,9 @@ export type BrowserStoreOptions = {
 /**
  * `BrowserStore` is an implementation of the `TokenStore` interface for storing authentication tokens in browser cookies.
  *
- * **Security Note:** This store uses JavaScript-accessible cookies. For maximum security in production,
- * consider using `ExpressStore` with `httpOnly: true` which prevents JavaScript access to tokens.
+ * **Note:** This store shares the same cookie key as `ExpressStore` (using the `st` namespace).
+ * The `ExpressStore` must NOT use `httpOnly: true` when both stores are used together,
+ * as that would prevent this store from reading or writing the shared cookie.
  */
 declare class BrowserStore implements TokenStore {
     expiration: number;

package/dist/types/utils/stores/BrowserStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserStore.d.ts","sourceRoot":"","sources":["../../../../src/utils/stores/BrowserStore.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,SAAS,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,cAAM,YAAa,YAAW,UAAU;IACtC,UAAU,EAAE,MAAM,CAAM;IACxB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAK5B;IAEF;;;OAGG;gBACS,EACV,QAAQ,EACR,MAAc,EACd,QAAgB,EAChB,IAAU,EACV,MAAM,GACP,EAAE,mBAAmB;IAkBtB;;;OAGG;IACH,QAAQ,IAAI,SAAS,GAAG,IAAI;IAc5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAOhC;;OAEG;IACH,WAAW,IAAI,IAAI;CAGpB;AAED,eAAe,YAAY,CAAC"}
+{"version":3,"file":"BrowserStore.d.ts","sourceRoot":"","sources":["../../../../src/utils/stores/BrowserStore.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,SAAS,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,cAAM,YAAa,YAAW,UAAU;IACtC,UAAU,EAAE,MAAM,CAAM;IACxB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAK5B;IAEF;;;OAGG;gBACS,EACV,QAAQ,EACR,MAAc,EACd,QAAgB,EAChB,IAAU,EACV,MAAM,GACP,EAAE,mBAAmB;IAkBtB;;;OAGG;IACH,QAAQ,IAAI,SAAS,GAAG,IAAI;IAc5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAOhC;;OAEG;IACH,WAAW,IAAI,IAAI;CAGpB;AAED,eAAe,YAAY,CAAC"}

package/dist/types/utils/stores/ExpressStore.d.ts

@@ -14,7 +14,10 @@ export type ExpressStoreOptions = {
     secure?: boolean;
     /**
      * Whether to set httpOnly flag (prevents JavaScript access).
-     * Defaults to true for security. This is the recommended setting for server-side token storage.
+     * Defaults to false to match the original Sharetribe SDK behavior and allow
+     * the BrowserStore to share the same cookie. Setting to true will prevent
+     * client-side JavaScript from reading or writing the token cookie, which
+     * breaks the shared session model between server and client SDK instances.
      */
     httpOnly?: boolean;
     /**
@@ -26,8 +29,9 @@ export type ExpressStoreOptions = {
 /**
  * `ExpressStore` is an implementation of the `TokenStore` interface for managing authentication tokens via cookies in an Express application.
  *
- * **Security Note:** This store supports `httpOnly` cookies (default: true), which prevents JavaScript access to tokens
- * and is the recommended approach for production server-side token storage.
+ * **Note:** This store defaults to `httpOnly: false` to match the original Sharetribe SDK behavior.
+ * Server and client SDK instances share the same cookie, so httpOnly must be false
+ * for the BrowserStore to read/write the token set by the server.
  */
 declare class ExpressStore implements TokenStore {
     expiration: number;

package/dist/types/utils/stores/ExpressStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExpressStore.d.ts","sourceRoot":"","sources":["../../../../src/utils/stores/ExpressStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAC,SAAS,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,QAAQ,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,cAAM,YAAa,YAAW,UAAU;IACtC,UAAU,EAAE,MAAM,CAAO;IACzB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,aAAa,CAInB;IACF,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,GAAG,CAAW;IACtB,OAAO,CAAC,YAAY,CAA0B;IAE9C;;;OAGG;gBACS,EAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAc,EAAE,QAAe,EAAE,QAAgB,EAAC,EAAE,mBAAmB;IAqBxG;;;OAGG;IACH,QAAQ,IAAI,SAAS,GAAG,IAAI;IAK5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAQhC;;OAEG;IACH,WAAW,IAAI,IAAI;IAKnB;;;OAGG;IACH,OAAO,CAAC,UAAU;CAanB;AAED,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ExpressStore.d.ts","sourceRoot":"","sources":["../../../../src/utils/stores/ExpressStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAC,SAAS,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,QAAQ,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,cAAM,YAAa,YAAW,UAAU;IACtC,UAAU,EAAE,MAAM,CAAO;IACzB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,aAAa,CAInB;IACF,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,GAAG,CAAW;IACtB,OAAO,CAAC,YAAY,CAA0B;IAE9C;;;OAGG;gBACS,EAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAc,EAAE,QAAgB,EAAE,QAAgB,EAAC,EAAE,mBAAmB;IAqBzG;;;OAGG;IACH,QAAQ,IAAI,SAAS,GAAG,IAAI;IAK5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAQhC;;OAEG;IACH,WAAW,IAAI,IAAI;IAKnB;;;OAGG;IACH,OAAO,CAAC,UAAU;CAanB;AAED,eAAe,YAAY,CAAC"}

package/dist/utils/stores/BrowserStore.d.ts

@@ -28,8 +28,9 @@ export type BrowserStoreOptions = {
 /**
  * `BrowserStore` is an implementation of the `TokenStore` interface for storing authentication tokens in browser cookies.
  *
- * **Security Note:** This store uses JavaScript-accessible cookies. For maximum security in production,
- * consider using `ExpressStore` with `httpOnly: true` which prevents JavaScript access to tokens.
+ * **Note:** This store shares the same cookie key as `ExpressStore` (using the `st` namespace).
+ * The `ExpressStore` must NOT use `httpOnly: true` when both stores are used together,
+ * as that would prevent this store from reading or writing the shared cookie.
  */
 declare class BrowserStore implements TokenStore {
     expiration: number;

package/dist/utils/stores/ExpressStore.d.ts

@@ -14,7 +14,10 @@ export type ExpressStoreOptions = {
     secure?: boolean;
     /**
      * Whether to set httpOnly flag (prevents JavaScript access).
-     * Defaults to true for security. This is the recommended setting for server-side token storage.
+     * Defaults to false to match the original Sharetribe SDK behavior and allow
+     * the BrowserStore to share the same cookie. Setting to true will prevent
+     * client-side JavaScript from reading or writing the token cookie, which
+     * breaks the shared session model between server and client SDK instances.
      */
     httpOnly?: boolean;
     /**
@@ -26,8 +29,9 @@ export type ExpressStoreOptions = {
 /**
  * `ExpressStore` is an implementation of the `TokenStore` interface for managing authentication tokens via cookies in an Express application.
  *
- * **Security Note:** This store supports `httpOnly` cookies (default: true), which prevents JavaScript access to tokens
- * and is the recommended approach for production server-side token storage.
+ * **Note:** This store defaults to `httpOnly: false` to match the original Sharetribe SDK behavior.
+ * Server and client SDK instances share the same cookie, so httpOnly must be false
+ * for the BrowserStore to read/write the token set by the server.
  */
 declare class ExpressStore implements TokenStore {
     expiration: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vansite/ts-sharetribe-flex-sdk",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "This is a TypeScript SDK for Sharetribe Flex API. It reduces the complexity of the API and provides a more user-friendly interface.",
   "keywords": [
     "sharetribe",