@volr/react 0.1.14 → 0.1.15

package/dist/index.cjs

@@ -9033,6 +9033,7 @@ var safeStorage = {
 // ../shared/src/constants/storage.ts
 var STORAGE_KEYS = {
   accessToken: "volr:accessToken",
+  refreshToken: "volr:refreshToken",
   user: "volr:user",
   provider: "volr:provider",
   credentialId: "volr:credentialId",
@@ -9048,9 +9049,11 @@ var APIClient = class {
   constructor(config) {
     this.refreshPromise = null;
     this.accessToken = null;
+    this.refreshToken = null;
     this.apiKey = null;
     this.apiKey = config.apiKey || null;
     this.accessToken = safeStorage.getItem(STORAGE_KEYS.accessToken);
+    this.refreshToken = safeStorage.getItem(STORAGE_KEYS.refreshToken);
     this.api = axios__default.default.create({
       baseURL: config.baseUrl.replace(/\/+$/, ""),
       withCredentials: true,
@@ -9087,15 +9090,23 @@ var APIClient = class {
       (response) => response,
       async (error) => {
         const originalRequest = error.config;
+        console.log(`[APIClient] Response error:`, error.response?.status, originalRequest?.url);
+        if (originalRequest?.url?.includes("/auth/refresh")) {
+          console.log("[APIClient] Refresh endpoint failed, not retrying");
+          return Promise.reject(error);
+        }
         if (error.response?.status === 401 && !originalRequest._retry) {
+          console.log("[APIClient] 401 received, attempting token refresh...");
           originalRequest._retry = true;
           try {
             await this.refreshAccessToken();
             if (this.accessToken) {
               originalRequest.headers["Authorization"] = `Bearer ${this.accessToken}`;
             }
+            console.log("[APIClient] Token refreshed, retrying original request");
             return this.api(originalRequest);
           } catch (refreshError) {
+            console.error("[APIClient] Token refresh failed:", refreshError);
             return Promise.reject(refreshError);
           }
         }
@@ -9132,6 +9143,76 @@ var APIClient = class {
   getAccessToken() {
     return this.accessToken;
   }
+  /**
+   * Set refresh token
+   */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+    if (token) {
+      safeStorage.setItem(STORAGE_KEYS.refreshToken, token);
+    } else {
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
+    }
+  }
+  /**
+   * Get refresh token
+   */
+  getRefreshToken() {
+    return this.refreshToken;
+  }
+  /**
+   * Ensure access token is valid, refresh if missing or expired
+   * Use this before making authenticated requests that need a valid token upfront
+   * Note: Most requests don't need this as the 401 interceptor handles refresh automatically
+   */
+  async ensureAccessToken() {
+    if (this.accessToken) {
+      return;
+    }
+    if (!this.refreshToken) {
+      return;
+    }
+    try {
+      await this.refreshAccessToken();
+    } catch {
+    }
+  }
+  /**
+   * Refresh session and return user data
+   * Use this when you need fresh user data (e.g., before passkey restoration)
+   * @param timeoutMs - Timeout in milliseconds (default: 10000)
+   * @returns User data from refresh response, or null if refresh fails
+   */
+  async refreshSession(timeoutMs = 1e4) {
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
+    const timeoutPromise = new Promise(
+      (_, reject) => setTimeout(
+        () => reject(new Error("Session refresh timeout. Please check your network connection.")),
+        timeoutMs
+      )
+    );
+    const refreshPromise = this.api.post(
+      "/auth/refresh",
+      { refreshToken: this.refreshToken }
+    );
+    const response = await Promise.race([refreshPromise, timeoutPromise]);
+    const data = response.data;
+    if (isErrorResponse(data)) {
+      this.setAccessToken(null);
+      this.setRefreshToken(null);
+      throw new Error(data.error.message);
+    }
+    this.setAccessToken(data.data.accessToken);
+    if (data.data.refreshToken) {
+      this.setRefreshToken(data.data.refreshToken);
+    }
+    if (data.data.user) {
+      safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
+    }
+    return data.data.user ?? null;
+  }
   /**
    * Refresh access token (single-flight)
    */
@@ -9139,19 +9220,26 @@ var APIClient = class {
     if (this.refreshPromise) {
       return this.refreshPromise;
     }
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
     this.refreshPromise = (async () => {
       try {
         const response = await this.api.post(
           "/auth/refresh",
-          {}
+          { refreshToken: this.refreshToken }
         );
         const data = response.data;
         if (isErrorResponse(data)) {
           this.setAccessToken(null);
+          this.setRefreshToken(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
           throw new Error(data.error.message);
         }
         this.setAccessToken(data.data.accessToken);
+        if (data.data.refreshToken) {
+          this.setRefreshToken(data.data.refreshToken);
+        }
         if (data.data.user) {
           safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
         }
@@ -9187,6 +9275,7 @@ var APIClient = class {
    */
   async post(endpoint, body, idempotencyKey) {
     const normalizedEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+    console.log(`[APIClient] POST ${normalizedEndpoint}`);
     const config = {
       method: "POST",
       url: normalizedEndpoint,
@@ -9197,8 +9286,14 @@ var APIClient = class {
         "Idempotency-Key": idempotencyKey
       };
     }
-    const response = await this.api.request(config);
-    return unwrapResponse(response.data);
+    try {
+      const response = await this.api.request(config);
+      console.log(`[APIClient] POST ${normalizedEndpoint} response:`, response.data);
+      return unwrapResponse(response.data);
+    } catch (error) {
+      console.error(`[APIClient] POST ${normalizedEndpoint} error:`, error);
+      throw error;
+    }
   }
   /**
    * POST request that returns raw binary (ArrayBuffer)
@@ -9532,16 +9627,12 @@ async function restorePasskey(params) {
   );
   console.log("[restorePasskey] prfInput:", prfInput);
   console.log("[restorePasskey] Step 1: Ensuring access token is fresh...");
-  const currentToken = client.getAccessToken();
-  if (!currentToken) {
-    console.log("[restorePasskey] No access token found, calling /auth/refresh...");
-    try {
-      await client.post("/auth/refresh", {});
-      console.log("[restorePasskey] Access token refreshed successfully");
-    } catch (error) {
-      console.error("[restorePasskey] Failed to refresh access token:", error);
-      throw new Error("Failed to refresh access token. Please log in again.");
-    }
+  try {
+    await client.ensureAccessToken();
+    console.log("[restorePasskey] Access token ensured");
+  } catch (error) {
+    console.error("[restorePasskey] Failed to ensure access token:", error);
+    throw new Error("Failed to refresh access token. Please log in again.");
   }
   console.log("[restorePasskey] Step 2: Downloading blob via backend proxy for blobUrl:", blobUrl);
   const apiKey = client.getApiKey();
@@ -9653,6 +9744,9 @@ function VolrProvider({ config, children }) {
   const [accessToken, setAccessTokenState] = react.useState(() => {
     return client.getAccessToken();
   });
+  const [refreshToken, setRefreshTokenState] = react.useState(() => {
+    return client.getRefreshToken();
+  });
   const syncRef = react.useRef(null);
   react.useEffect(() => {
     syncRef.current = new SessionSync();
@@ -9668,7 +9762,9 @@ function VolrProvider({ config, children }) {
         client.setApiKey(config.projectApiKey);
       } else if (event.type === "LOGOUT") {
         client.setAccessToken(null);
+        client.setRefreshToken(null);
         setAccessTokenState(null);
+        setRefreshTokenState(null);
         setUser(null);
         setProviderState(null);
         safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9697,49 +9793,16 @@ function VolrProvider({ config, children }) {
         const keyStorageType = newProvider.keyStorageType;
         setProviderState(newProvider);
         try {
-          const refreshResponse = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          if (refreshResponse.user) {
-            console.log(
-              "[Provider] setProvider: User data refreshed from backend:",
-              refreshResponse.user
-            );
-            setUser(refreshResponse.user);
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify(refreshResponse.user)
-            );
+          const refreshedUser = await client.refreshSession();
+          if (refreshedUser) {
+            console.log("[Provider] setProvider: User data refreshed:", refreshedUser);
+            setUser(refreshedUser);
           } else {
-            setUser((prev) => ({
-              ...prev,
-              keyStorageType
-            }));
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify({
-                ...user,
-                keyStorageType
-              })
-            );
+            setUser((prev) => ({ ...prev, keyStorageType }));
           }
         } catch (error2) {
-          console.warn(
-            "[Provider] setProvider: Failed to refresh user data, using partial update:",
-            error2
-          );
-          setUser((prev) => ({
-            ...prev,
-            keyStorageType
-          }));
-          safeStorage.setItem(
-            STORAGE_KEYS.user,
-            JSON.stringify({
-              ...user,
-              keyStorageType
-            })
-          );
+          console.warn("[Provider] setProvider: Failed to refresh user data:", error2);
+          setUser((prev) => ({ ...prev, keyStorageType }));
         }
         safeStorage.setItem(STORAGE_KEYS.provider, keyStorageType);
         syncRef.current?.broadcast({
@@ -9764,70 +9827,38 @@ function VolrProvider({ config, children }) {
       const recover = async () => {
         try {
           setIsLoading(true);
-          const response = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          console.log("[Provider] /auth/refresh response:", response);
-          const refreshedToken = client.getAccessToken();
-          if (refreshedToken) {
-            if (response.user) {
-              console.log(
-                "[Provider] Setting user from response:",
-                response.user
-              );
-              console.log("[Provider] User fields:", {
-                id: response.user.id,
-                email: response.user.email,
-                accountId: response.user.accountId,
-                evmAddress: response.user.evmAddress,
-                signerType: response.user.signerType,
-                keyStorageType: response.user.keyStorageType,
-                walletConnector: response.user.walletConnector,
-                blobUrl: response.user.blobUrl,
-                prfInput: response.user.prfInput,
-                credentialId: response.user.credentialId
-              });
-              setUser(response.user);
-              safeStorage.setItem(
-                STORAGE_KEYS.user,
-                JSON.stringify(response.user)
-              );
-              if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else {
-                if (response.user.keyStorageType === "passkey") {
-                  console.log(
-                    "[Provider] TTL=0 mode: Provider restoration deferred until transaction (requires user gesture)"
-                  );
-                  if (!response.user.blobUrl || !response.user.prfInput) {
-                    console.warn(
-                      "[Provider] Passkey user detected but missing blobUrl or prfInput. User needs to re-enroll passkey."
-                    );
-                  }
-                }
+          if (!client.getRefreshToken()) {
+            console.log("[Provider] No refresh token found, skipping auto-recover");
+            setIsLoading(false);
+            return;
+          }
+          const refreshedUser = await client.refreshSession();
+          console.log("[Provider] Session refreshed, user:", refreshedUser);
+          setAccessTokenState(client.getAccessToken());
+          setRefreshTokenState(client.getRefreshToken());
+          if (refreshedUser) {
+            setUser(refreshedUser);
+            if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else if (refreshedUser.keyStorageType === "passkey") {
+              console.log("[Provider] TTL=0 mode: Provider restoration deferred");
+              if (!refreshedUser.blobUrl || !refreshedUser.prfInput) {
+                console.warn("[Provider] Passkey user missing blobUrl or prfInput");
               }
-            } else {
-              console.log(
-                "[Provider] No user in response, loading from storage"
-              );
-              const userStr = safeStorage.getItem(STORAGE_KEYS.user);
-              if (userStr) {
-                try {
-                  const storedUser = JSON.parse(userStr);
-                  console.log(
-                    "[Provider] Loaded user from storage:",
-                    storedUser
-                  );
-                  setUser(storedUser);
-                } catch {
-                  safeStorage.removeItem(STORAGE_KEYS.user);
-                }
+            }
+          } else {
+            const userStr = safeStorage.getItem(STORAGE_KEYS.user);
+            if (userStr) {
+              try {
+                setUser(JSON.parse(userStr));
+              } catch {
+                safeStorage.removeItem(STORAGE_KEYS.user);
               }
             }
-            setAccessTokenState(refreshedToken);
           }
         } catch {
           client.setAccessToken(null);
+          client.setRefreshToken(null);
           setAccessTokenState(null);
+          setRefreshTokenState(null);
           setUser(null);
           setProviderState(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9845,12 +9876,7 @@ function VolrProvider({ config, children }) {
     async (input) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const response = await client.post(
           "/wallet/precheck",
           input
@@ -9872,12 +9898,7 @@ function VolrProvider({ config, children }) {
     async (input, opts) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const idempotencyKey = opts?.idempotencyKey ?? (typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : `${Date.now()}-${Math.random()}`);
         const serializedInput = serializeBigIntDeep(input);
         const response = await client.post(
@@ -9902,10 +9923,14 @@ function VolrProvider({ config, children }) {
     try {
       setError(null);
       client.setAccessToken(null);
+      client.setRefreshToken(null);
+      setAccessTokenState(null);
+      setRefreshTokenState(null);
       setUser(null);
       setProviderState(null);
       safeStorage.removeItem(STORAGE_KEYS.user);
       safeStorage.removeItem(STORAGE_KEYS.accessToken);
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
       safeStorage.removeItem(STORAGE_KEYS.provider);
       syncRef.current?.broadcast({ type: "LOGOUT" });
     } catch (err) {
@@ -9990,22 +10015,25 @@ function VolrProvider({ config, children }) {
     () => ({
       session: {
         accessToken,
-        refreshToken: null
-        // Cookie-based, opaque
+        refreshToken
       },
       refreshAccessToken: async () => {
-        await client.post("/auth/refresh", {});
-        const token = client.getAccessToken();
-        setAccessTokenState(token);
+        await client.ensureAccessToken();
+        setAccessTokenState(client.getAccessToken());
+        setRefreshTokenState(client.getRefreshToken());
       },
       setAccessToken: (token) => {
         client.setAccessToken(token);
         setAccessTokenState(token);
       },
+      setRefreshToken: (token) => {
+        client.setRefreshToken(token);
+        setRefreshTokenState(token);
+      },
       client
       // Expose APIClient instance
     }),
-    [client, accessToken]
+    [client, accessToken, refreshToken]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(VolrContext.Provider, { value: publicValue, children: /* @__PURE__ */ jsxRuntime.jsx(InternalAuthContext.Provider, { value: internalValue, children }) });
 }
@@ -18252,22 +18280,24 @@ async function sendCalls(args) {
   console.log("[sendCalls] Calls normalized");
   let currentUser = deps.user;
   if (deps.user?.keyStorageType === "passkey" && !deps.provider) {
-    console.log("[sendCalls] Refreshing user data...");
+    console.log("[sendCalls] Refreshing user data (provider not available)...");
     try {
-      const refreshResponse = await deps.client.post(
-        "/auth/refresh",
-        {}
-      );
-      if (refreshResponse.user) {
-        currentUser = refreshResponse.user;
-        console.log("[sendCalls] User data refreshed");
+      const refreshedUser = await deps.client.refreshSession();
+      if (refreshedUser) {
+        currentUser = refreshedUser;
+        console.log("[sendCalls] User data refreshed successfully");
       }
     } catch (error) {
-      console.warn(
-        "[sendCalls] Failed to refresh user data before transaction:",
-        error
+      console.error("[sendCalls] Failed to refresh session:", error);
+      throw new Error(
+        `Failed to refresh session before transaction. ${error instanceof Error ? error.message : "Unknown error"}. Please try logging in again.`
       );
     }
+  } else {
+    console.log("[sendCalls] Skipping user refresh:", {
+      hasProvider: !!deps.provider,
+      keyStorageType: deps.user?.keyStorageType
+    });
   }
   if (opts.preflight !== false) {
     console.log("[sendCalls] Running preflight estimate...");
@@ -18513,7 +18543,7 @@ function createAxiosInstance(baseUrl, apiKey) {
 // src/hooks/useVolrLogin.ts
 function useVolrLogin() {
   const { config, setUser } = useVolr();
-  const { setAccessToken } = useInternalAuth();
+  const { setAccessToken, setRefreshToken } = useInternalAuth();
   const toVolrUser = react.useCallback((u) => {
     return {
       id: u.id,
@@ -18575,12 +18605,16 @@ function useVolrLogin() {
       const userFromServer = verifyData?.data?.user;
       const isNewUser = !!verifyData?.data?.isNewUser;
       const accessToken = verifyData?.data?.accessToken || "";
+      const refreshToken = verifyData?.data?.refreshToken || "";
       if (!accessToken) {
         throw new Error(
           "Access token is required but was not provided by the server"
         );
       }
       setAccessToken(accessToken);
+      if (refreshToken) {
+        setRefreshToken(refreshToken);
+      }
       if (userFromServer) {
         setUser(toVolrUser(userFromServer));
       } else {
@@ -18594,7 +18628,7 @@ function useVolrLogin() {
         accessToken
       };
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [api, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handleSocialLogin = react.useCallback(
     async (provider) => {
@@ -18636,12 +18670,16 @@ function useVolrLogin() {
         const userFromServer = verifyData?.data?.user;
         const isNewUser = !!verifyData?.data?.isNewUser;
         const accessToken = verifyData?.data?.accessToken || "";
+        const refreshToken = verifyData?.data?.refreshToken || "";
         if (!accessToken) {
           throw new Error(
             "Access token is required but was not provided by the server"
           );
         }
         setAccessToken(accessToken);
+        if (refreshToken) {
+          setRefreshToken(refreshToken);
+        }
         if (userFromServer) {
           setUser(toVolrUser(userFromServer));
         }
@@ -18661,7 +18699,7 @@ function useVolrLogin() {
         throw error;
       }
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [api, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handlePasskeyComplete = react.useCallback(async () => {
   }, []);
@@ -18676,7 +18714,7 @@ function useVolrLogin() {
 }
 function useVolrAuthCallback(options = {}) {
   const { config, setUser } = useVolr();
-  const { refreshAccessToken, setAccessToken } = useInternalAuth();
+  const { refreshAccessToken, setAccessToken, setRefreshToken, client } = useInternalAuth();
   const [isLoading, setIsLoading] = react.useState(true);
   const [error, setError] = react.useState(null);
   const [isNewUser, setIsNewUser] = react.useState(false);
@@ -18730,13 +18768,21 @@ function useVolrAuthCallback(options = {}) {
         if (!userRes.data?.ok) {
           throw new Error("Failed to fetch user details");
         }
-        const refreshRes = await api.post("/auth/refresh");
+        const currentRefreshToken = client.getRefreshToken();
+        if (!currentRefreshToken) {
+          throw new Error("No refresh token available. Please log in again.");
+        }
+        const refreshRes = await api.post("/auth/refresh", { refreshToken: currentRefreshToken });
         if (!refreshRes.data?.ok) {
           throw new Error("Failed to refresh session");
         }
         const userData = refreshRes.data.data.user;
         const accessToken = refreshRes.data.data.accessToken;
+        const newRefreshToken = refreshRes.data.data.refreshToken;
         setAccessToken(accessToken);
+        if (newRefreshToken) {
+          setRefreshToken(newRefreshToken);
+        }
         const volrUser = toVolrUser(userData);
         setUser(volrUser);
         setLocalUser(volrUser);
@@ -18751,7 +18797,7 @@ function useVolrAuthCallback(options = {}) {
       }
     };
     handleCallback();
-  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setUser, toVolrUser]);
+  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setRefreshToken, setUser, toVolrUser, client]);
   return {
     isLoading,
     error,