@visin/frontend-core 0.1.4 → 0.1.5

package/dist/apiClient.d.ts

@@ -1,8 +1,6 @@
 export interface ApiClientOptions {
     /** Read fresh at call time (app config may not be resolved yet at module load). */
     baseUrl: () => string;
-    /** Reads the current auth token, e.g. `() => localStorage.getItem('authToken')`. */
-    getToken?: () => string | null;
     /** Called on a 401 response, e.g. to redirect to the login page. */
     onUnauthorized?: () => void;
 }
@@ -16,14 +14,13 @@ export declare class ApiError extends Error {
     constructor(status: number, message: string, body?: unknown);
 }
 /**
- * Generic authenticated JSON fetch wrapper — base URL handling, Bearer-token
- * auth, structured errors, and an opt-in 401 → redirect-to-auth hook.
+ * Generic authenticated JSON fetch wrapper — base URL handling, structured
+ * errors, and an opt-in 401 → redirect-to-auth hook.
  *
- * Matches the auth transport all four Visin services actually use today
- * (a Bearer token read from `localStorage`, not a cookie), unlike a
- * cookie-based client would. Each front currently hand-rolls this
- * (`account-front/services/authService.ts`, `vision-front/config/visionApi.ts`)
- * with near-identical logic; new call sites can adopt this instead.
+ * Auth rides the shared `access_token` httpOnly cookie (COOKIE_DOMAIN is a
+ * shared parent domain across every Visin subdomain), so every request
+ * defaults to `credentials: 'include'` — callers can still override via
+ * `init.credentials` for the rare request that shouldn't send it.
  */
 export declare function createApiClient(options: ApiClientOptions): {
     request: <T = unknown>(path: string, init?: ApiRequestOptions) => Promise<T>;

package/dist/apiClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/B,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,oJAAoJ;IACpJ,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;gBAEF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;CAM5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB;cAChC,CAAC,kBAAkB,MAAM,SAAQ,iBAAiB,KAAQ,OAAO,CAAC,CAAC,CAAC;UAoCnF,CAAC,kBAAkB,MAAM,SAAS,iBAAiB;WAClD,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;UAEpE,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;YAEjE,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;aAElE,CAAC,kBAAkB,MAAM,SAAS,iBAAiB;EAE/D;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,oJAAoJ;IACpJ,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;gBAEF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;CAM5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB;cAChC,CAAC,kBAAkB,MAAM,SAAQ,iBAAiB,KAAQ,OAAO,CAAC,CAAC,CAAC;UAmCnF,CAAC,kBAAkB,MAAM,SAAS,iBAAiB;WAClD,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;UAEpE,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;YAEjE,CAAC,kBAAkB,MAAM,SAAS,OAAO,SAAS,iBAAiB;aAElE,CAAC,kBAAkB,MAAM,SAAS,iBAAiB;EAE/D;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/apiClient.js

@@ -7,24 +7,22 @@ export class ApiError extends Error {
     }
 }
 /**
- * Generic authenticated JSON fetch wrapper — base URL handling, Bearer-token
- * auth, structured errors, and an opt-in 401 → redirect-to-auth hook.
+ * Generic authenticated JSON fetch wrapper — base URL handling, structured
+ * errors, and an opt-in 401 → redirect-to-auth hook.
  *
- * Matches the auth transport all four Visin services actually use today
- * (a Bearer token read from `localStorage`, not a cookie), unlike a
- * cookie-based client would. Each front currently hand-rolls this
- * (`account-front/services/authService.ts`, `vision-front/config/visionApi.ts`)
- * with near-identical logic; new call sites can adopt this instead.
+ * Auth rides the shared `access_token` httpOnly cookie (COOKIE_DOMAIN is a
+ * shared parent domain across every Visin subdomain), so every request
+ * defaults to `credentials: 'include'` — callers can still override via
+ * `init.credentials` for the rare request that shouldn't send it.
  */
 export function createApiClient(options) {
     async function request(path, init = {}) {
         const { skipAuthRedirect, headers, ...rest } = init;
-        const token = options.getToken?.();
         const response = await fetch(`${options.baseUrl()}${path}`, {
+            credentials: 'include',
             ...rest,
             headers: {
                 'Content-Type': 'application/json',
-                ...(token && { Authorization: `Bearer ${token}` }),
                 ...headers
             }
         });

package/dist/apiClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiClient.js","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,QAAS,SAAQ,KAAK;IAIjC,YAAY,MAAc,EAAE,OAAe,EAAE,IAAc;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,KAAK,UAAU,OAAO,CAAc,IAAY,EAAE,OAA0B,EAAE;QAC5E,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC1D,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,KAAK,IAAI,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;gBAClD,GAAG,OAAO;aACX;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjD,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YACD,MAAM,OAAO,GAAI,IAAyC,EAAE,OAAO,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChH,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,EAAE,CAAc,IAAY,EAAE,IAAwB,EAAE,EAAE,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,IAAI,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC5E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5G,GAAG,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC3E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC3G,KAAK,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC7E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7G,MAAM,EAAE,CAAc,IAAY,EAAE,IAAwB,EAAE,EAAE,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KACjH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"apiClient.js","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,QAAS,SAAQ,KAAK;IAIjC,YAAY,MAAc,EAAE,OAAe,EAAE,IAAc;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,KAAK,UAAU,OAAO,CAAc,IAAY,EAAE,OAA0B,EAAE;QAC5E,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC1D,WAAW,EAAE,SAAS;YACtB,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO;aACX;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjD,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YACD,MAAM,OAAO,GAAI,IAAyC,EAAE,OAAO,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChH,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,OAAO;QACP,GAAG,EAAE,CAAc,IAAY,EAAE,IAAwB,EAAE,EAAE,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,IAAI,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC5E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5G,GAAG,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC3E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC3G,KAAK,EAAE,CAAc,IAAY,EAAE,IAAc,EAAE,IAAwB,EAAE,EAAE,CAC7E,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7G,MAAM,EAAE,CAAc,IAAY,EAAE,IAAwB,EAAE,EAAE,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KACjH,CAAC;AACJ,CAAC"}

package/dist/auth/authService.d.ts

@@ -26,16 +26,17 @@ export interface AuthServiceOptions {
     authFrontUrl: () => string;
 }
 /**
- * Session-management logic shared by every Visin frontend: token storage,
- * `/auth/verify` + `/auth/profile` checks, logout, and the redirect to
- * auth-front's login page. Each app previously hand-rolled this
+ * Session-management logic shared by every Visin frontend: `/auth/verify` +
+ * `/auth/profile` checks, logout, and the redirect to auth-front's login
+ * page. Auth rides the shared `access_token` httpOnly cookie (see
+ * `createApiClient`) rather than a token this service has to store itself.
+ * Each app previously hand-rolled this
  * (`account-front/services/authService.ts`, `vision-front/contexts/AuthContext.tsx`)
  * with near-identical but subtly diverging logic; wrap the result in
  * `createAuthContext` for a React Context/hook, or use it directly for a
  * plain-object service.
  */
 export declare function createAuthService({ authServiceUrl, authFrontUrl }: AuthServiceOptions): {
-    getToken: () => string | null;
     checkAuth: () => Promise<AuthCheckResult>;
     getCurrentUser: () => Promise<AuthUser | null>;
     getProfile: () => Promise<AuthUser | null>;

package/dist/auth/authService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,YAAY,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,kBAAkB;oBAM/D,MAAM,GAAG,IAAI;qBAIN,OAAO,CAAC,eAAe,CAAC;0BAsBnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;sBAK5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;2BAUnB,OAAO,CAAC,OAAO,CAAC;kBAKzB,OAAO,CAAC,OAAO,CAAC;kCAaJ,MAAM,KAAG,IAAI;EAMnD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,YAAY,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,kBAAkB;qBAS9D,OAAO,CAAC,eAAe,CAAC;0BA+Bb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;sBAK5B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;2BAUnB,OAAO,CAAC,OAAO,CAAC;kBAKzB,OAAO,CAAC,OAAO,CAAC;kCAUJ,MAAM,KAAG,IAAI;EAMnD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/auth/authService.js

@@ -1,38 +1,47 @@
-import { createApiClient } from '../apiClient';
+import { createApiClient, ApiError } from '../apiClient';
 /**
- * Session-management logic shared by every Visin frontend: token storage,
- * `/auth/verify` + `/auth/profile` checks, logout, and the redirect to
- * auth-front's login page. Each app previously hand-rolled this
+ * Session-management logic shared by every Visin frontend: `/auth/verify` +
+ * `/auth/profile` checks, logout, and the redirect to auth-front's login
+ * page. Auth rides the shared `access_token` httpOnly cookie (see
+ * `createApiClient`) rather than a token this service has to store itself.
+ * Each app previously hand-rolled this
  * (`account-front/services/authService.ts`, `vision-front/contexts/AuthContext.tsx`)
  * with near-identical but subtly diverging logic; wrap the result in
  * `createAuthContext` for a React Context/hook, or use it directly for a
  * plain-object service.
  */
 export function createAuthService({ authServiceUrl, authFrontUrl }) {
-    const client = createApiClient({
-        baseUrl: authServiceUrl,
-        getToken: () => localStorage.getItem('authToken')
-    });
-    function getToken() {
-        return localStorage.getItem('authToken');
-    }
-    async function checkAuth() {
-        try {
-            const data = await client.get('/auth/verify', { credentials: 'include', skipAuthRedirect: true });
-            if (data.success) {
-                if (data.token) {
-                    localStorage.setItem('authToken', data.token);
+    const client = createApiClient({ baseUrl: authServiceUrl });
+    // Shared by concurrent callers (e.g. React StrictMode's double effect-invoke
+    // in development, or multiple components independently checking auth on
+    // first mount) so they trigger one /auth/verify request, not one each.
+    // Cleared once it settles, so the next distinct check gets a fresh request.
+    let inFlightCheck = null;
+    function checkAuth() {
+        if (inFlightCheck) {
+            return inFlightCheck;
+        }
+        inFlightCheck = (async () => {
+            try {
+                const data = await client.get('/auth/verify', { skipAuthRedirect: true });
+                if (data.success) {
+                    return { authenticated: data.authenticated, user: data.user ?? null };
                 }
-                return { authenticated: data.authenticated, user: data.user ?? null };
+                return { authenticated: false, user: null };
             }
-            localStorage.removeItem('authToken');
-            return { authenticated: false, user: null };
-        }
-        catch (error) {
-            console.error('Auth check failed:', error);
-            localStorage.removeItem('authToken');
-            return { authenticated: false, user: null };
-        }
+            catch (error) {
+                // A 401 here just means "not logged in" — the normal state for an
+                // anonymous visitor, not a bug worth an error-level log.
+                if (!(error instanceof ApiError && error.status === 401)) {
+                    console.error('Auth check failed:', error);
+                }
+                return { authenticated: false, user: null };
+            }
+            finally {
+                inFlightCheck = null;
+            }
+        })();
+        return inFlightCheck;
     }
     async function getCurrentUser() {
         const result = await checkAuth();
@@ -40,7 +49,7 @@ export function createAuthService({ authServiceUrl, authFrontUrl }) {
     }
     async function getProfile() {
         try {
-            const data = await client.get('/auth/profile', { credentials: 'include' });
+            const data = await client.get('/auth/profile');
             return data.success ? (data.user ?? null) : null;
         }
         catch (error) {
@@ -54,10 +63,7 @@ export function createAuthService({ authServiceUrl, authFrontUrl }) {
     }
     async function logout() {
         try {
-            const data = await client.post('/auth/logout', undefined, { credentials: 'include' });
-            if (data.success) {
-                localStorage.removeItem('authToken');
-            }
+            const data = await client.post('/auth/logout');
             return data.success;
         }
         catch (error) {
@@ -69,6 +75,6 @@ export function createAuthService({ authServiceUrl, authFrontUrl }) {
         const currentUrl = returnUrl || window.location.href;
         window.location.href = `${authFrontUrl()}?redirect_uri=${encodeURIComponent(currentUrl)}`;
     }
-    return { getToken, checkAuth, getCurrentUser, getProfile, isAuthenticated, logout, redirectToLogin };
+    return { checkAuth, getCurrentUser, getProfile, isAuthenticated, logout, redirectToLogin };
 }
 //# sourceMappingURL=authService.js.map

package/dist/auth/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgC/C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,cAAc,EAAE,YAAY,EAAsB;IACpF,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;KAClD,CAAC,CAAC;IAEH,SAAS,QAAQ;QACf,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,cAAc,EACd,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,CACnD,CAAC;YAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChD,CAAC;gBACD,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACxE,CAAC;YACD,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACrC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAC3C,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACrC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,UAAU;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,eAAe,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAClH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAuB,cAAc,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5G,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,SAAkB;QACzC,MAAM,UAAU,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,YAAY,EAAE,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAgCzD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,cAAc,EAAE,YAAY,EAAsB;IACpF,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAE5D,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,aAAa,GAAoC,IAAI,CAAC;IAE1D,SAAS,SAAS;QAChB,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,cAAc,EACd,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;gBAEF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxE,CAAC;gBACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kEAAkE;gBAClE,yDAAyD;gBACzD,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;oBACzD,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,UAAU;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,eAAe,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAuB,cAAc,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,SAAkB;QACzC,MAAM,UAAU,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,YAAY,EAAE,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC7F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visin/frontend-core",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Shared frontend auth/API-client logic for Visin frontends",
   "author": "Toomas Tahves",
   "license": "MIT",