@webority-technologies/mobile-core 0.0.1 → 0.0.3

package/lib/commonjs/storage/index.js

@@ -3,32 +3,41 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.setStorageImplementation = exports.Storage = void 0;
+exports.setStorageImplementation = exports.isStorageAvailable = exports.Storage = void 0;
+var _kvStore = _interopRequireDefault(require("expo-sqlite/kv-store"));
 var _index = require("../logger/index.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 /**
  * Minimal AsyncStorage shape we depend on.
  * Lets us avoid a hard import on `@react-native-async-storage/async-storage`.
  */
 
+/** Only what a test or the showcase injected; null means use expo-sqlite/kv-store. */
 let backend = null;
-let resolved = false;
-const resolveBackend = () => {
-  if (resolved) {
-    return backend;
-  }
-  resolved = true;
-  try {
-    const mod = require('@react-native-async-storage/async-storage');
-    backend = mod.default ?? mod;
-  } catch {
-    backend = null;
-  }
-  return backend;
-};
+
+/**
+ * expo-sqlite's key/value store, imported directly.
+ *
+ * It deliberately implements the AsyncStorage v1 surface — `getItem`,
+ * `setItem`, `removeItem`, `multiGet`, `multiSet`, `multiRemove`, `clear`,
+ * `getAllKeys`, with v1's shapes — which is exactly what this module already
+ * speaks, so there is nothing to convert. Verified against expo-sqlite 57.0.2.
+ */
+const resolveBackend = () => backend ?? _kvStore.default;
+
+/**
+ * Always true now that the backend ships with the library. Kept because callers
+ * whose use of storage is an OPTIMISATION branch on it, and removing it would
+ * be a breaking change for no gain.
+ */
+const isStorageAvailable = () => resolveBackend() !== null;
+exports.isStorageAvailable = isStorageAvailable;
 const requireBackend = op => {
   const b = resolveBackend();
   if (!b) {
-    const err = new Error(`[Storage] @react-native-async-storage/async-storage is not installed; cannot ${op}. ` + 'Install the peer dep or call setStorageImplementation() with a custom backend.');
+    // Only reachable if a caller injected something falsy; the default backend
+    // ships with the library, so there is no "not installed" case any more.
+    const err = new Error(`[Storage] no storage backend available; cannot ${op}.`);
     _index.Logger.error(err.message);
     throw err;
   }
@@ -36,12 +45,11 @@ const requireBackend = op => {
 };
 
 /**
- * Inject a custom storage backend (e.g. MMKV adapter) at runtime.
- * Pass `null` to reset to the default AsyncStorage backend.
+ * Replace the storage backend. Intended for TESTS and for the showcase; an app
+ * gets expo-sqlite/kv-store without wiring anything. Pass `null` to restore it.
  */
 const setStorageImplementation = impl => {
   backend = impl;
-  resolved = true;
 };
 exports.setStorageImplementation = setStorageImplementation;
 const safeJsonParse = raw => {
@@ -96,6 +104,10 @@ const setJson = async (key, value) => {
 const multiGet = async keys => {
   try {
     const b = requireBackend('multiGet');
+    // v3 first: its Record is already this function's return shape.
+    if (b.getMany) {
+      return await b.getMany([...keys]);
+    }
     if (!b.multiGet) {
       const out = {};
       await Promise.all(keys.map(async k => {
@@ -117,6 +129,11 @@ const multiGet = async keys => {
 const multiSet = async entries => {
   try {
     const b = requireBackend('multiSet');
+    // v3 first: it takes the Record this function already receives.
+    if (b.setMany) {
+      await b.setMany(entries);
+      return true;
+    }
     const pairs = Object.entries(entries);
     if (!b.multiSet) {
       await Promise.all(pairs.map(([k, v]) => b.setItem(k, v)));
@@ -132,6 +149,10 @@ const multiSet = async entries => {
 const multiRemove = async keys => {
   try {
     const b = requireBackend('multiRemove');
+    if (b.removeMany) {
+      await b.removeMany([...keys]);
+      return true;
+    }
     if (!b.multiRemove) {
       await Promise.all(keys.map(k => b.removeItem(k)));
       return true;
@@ -175,7 +196,7 @@ const getAllKeys = async () => {
  * All operations swallow errors (logging them) and return a falsy result
  * so that storage problems never crash the app.
  *
- * Backed by `@react-native-async-storage/async-storage` by default;
+ * Backed by `expo-sqlite/kv-store` by default;
  * override with `setStorageImplementation()` for MMKV or custom adapters.
  */
 const Storage = exports.Storage = {

package/lib/commonjs/types/globals.d.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=globals.d.js.map

package/lib/commonjs/utils/imageCompression.js

@@ -3,23 +3,60 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.qualityForFileSize = exports.compressImage = void 0;
+exports.setImageCompressorImplementation = exports.qualityForFileSize = exports.compressImage = void 0;
+var _expoImageManipulator = require("expo-image-manipulator");
 var _index = require("../logger/index.js");
-let compressor = null;
-let resolved = false;
-const resolveCompressor = () => {
-  if (resolved) {
-    return compressor;
-  }
-  resolved = true;
-  try {
-    compressor = require('react-native-compressor');
-  } catch {
-    _index.Logger.warn('[imageCompression] react-native-compressor is not installed; ' + 'compressImage() will return the original URI unchanged.');
-    compressor = null;
+/** expo's SaveFormat values, inlined to keep this file free of enum imports. */
+const EXPO_FORMAT = {
+  jpg: 'jpeg',
+  png: 'png',
+  webp: 'webp'
+};
+
+/**
+ * expo-image-manipulator, adapted to the compressor shape this module speaks.
+ *
+ * Written against the CONTEXTUAL api rather than `manipulateAsync`, which 57
+ * marks deprecated. Only ONE edge is constrained: expo treats a given width and
+ * height as targets and would distort the image, where maxWidth/maxHeight here
+ * mean a box to fit inside. The smaller bound is used so the result fits
+ * whichever way round the image is.
+ */
+const expoCompressorBackend = {
+  Image: {
+    compress: async (uri, options) => {
+      const context = _expoImageManipulator.ImageManipulator.manipulate(uri);
+      const {
+        maxWidth,
+        maxHeight
+      } = options;
+      if (typeof maxWidth === 'number' || typeof maxHeight === 'number') {
+        context.resize({
+          width: Math.min(maxWidth ?? Number.POSITIVE_INFINITY, maxHeight ?? Number.POSITIVE_INFINITY)
+        });
+      }
+      const image = await context.renderAsync();
+      const result = await image.saveAsync({
+        compress: options.quality,
+        format: EXPO_FORMAT[options.output ?? 'jpg'] ?? 'jpeg'
+      });
+      return result.uri;
+    }
   }
-  return compressor;
 };
+
+/** Only what a test or the showcase injected; null means use expo-image-manipulator. */
+let compressor = null;
+const resolveCompressor = () => compressor ?? expoCompressorBackend;
+
+/**
+ * Replace the compressor. Intended for TESTS and for the showcase; an app gets
+ * expo-image-manipulator without wiring anything. Pass `null` to restore it.
+ */
+const setImageCompressorImplementation = impl => {
+  compressor = impl;
+};
+exports.setImageCompressorImplementation = setImageCompressorImplementation;
 const EIGHT_MB = 8 * 1024 * 1024;
 const THREE_MB = 3 * 1024 * 1024;
 

package/lib/commonjs/utils/index.js

@@ -9,5 +9,11 @@ Object.defineProperty(exports, "compressImage", {
     return _imageCompression.compressImage;
   }
 });
+Object.defineProperty(exports, "setImageCompressorImplementation", {
+  enumerable: true,
+  get: function () {
+    return _imageCompression.setImageCompressorImplementation;
+  }
+});
 var _imageCompression = require("./imageCompression.js");
 //# sourceMappingURL=index.js.map

package/lib/commonjs/versionCheck/index.js

@@ -4,9 +4,11 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.useVersionCheck = exports.setDeviceInfoImplementation = exports.default = exports.VersionCheck = void 0;
+var Application = _interopRequireWildcard(require("expo-application"));
 var _react = require("react");
 var _index = require("../config/index.js");
 var _index2 = require("../logger/index.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 // Type-only — erased at compile time; react-native stays lazily required below.
 
 /**
@@ -20,6 +22,26 @@ var _index2 = require("../logger/index.js");
  * wire two config keys.
  */
 
+/**
+ * expo-application, read at call time.
+ *
+ * `applicationId` and `nativeApplicationVersion` are module CONSTANTS rather
+ * than functions, so they are read inside the accessors rather than captured
+ * here — capturing would snapshot them before the native module has
+ * initialised.
+ *
+ * `setConfig({ appId, appVersion })` still WINS over this: a Webority app
+ * already carries both in appsettings.Compiled.json, and config is checked
+ * first. This is the fallback for an app that would rather read its identity
+ * from the binary it is actually running, which is the one place the two can
+ * disagree.
+ */
+const expoApplicationBackend = {
+  getBundleId: () => Application.applicationId ?? '',
+  getVersion: () => Application.nativeApplicationVersion ?? ''
+};
+
+/** Only what a test or the showcase injected; null means use expo-application. */
 let deviceInfo = null;
 
 /**
@@ -50,8 +72,9 @@ const getBundleId = () => {
   if (fromConfig) {
     return fromConfig;
   }
-  if (deviceInfo) {
-    return deviceInfo.getBundleId();
+  const fromDevice = (deviceInfo ?? expoApplicationBackend).getBundleId();
+  if (fromDevice) {
+    return fromDevice;
   }
   throw missing('store identifier', 'appId');
 };
@@ -60,8 +83,9 @@ const getVersion = () => {
   if (fromConfig) {
     return fromConfig;
   }
-  if (deviceInfo) {
-    return deviceInfo.getVersion();
+  const fromDevice = (deviceInfo ?? expoApplicationBackend).getVersion();
+  if (fromDevice) {
+    return fromDevice;
   }
   throw missing('version', 'appVersion');
 };

package/lib/module/api/baseUrl.js

@@ -0,0 +1,30 @@
+"use strict";
+
+import { getConfigValue } from "../config/index.js";
+
+/**
+ * Resolves `baseURL` PER REQUEST rather than at module evaluation.
+ *
+ * `axios.create({ baseURL: getConfigValue('baseUrl') })` reads the value once,
+ * when the module is first imported — which happens the moment anything touches
+ * the package barrel, long before an app's startup code can call `setConfig`.
+ * The result was a client permanently pinned to `undefined` and a `setConfig`
+ * that appeared to do nothing, with no error anywhere: requests just went to a
+ * relative URL.
+ *
+ * A consumer cannot fix that by ordering its own imports, because the import
+ * that loses the race is usually one it never wrote. So the clients stop
+ * capturing the value and ask for it per request instead.
+ *
+ * An explicit per-request `baseURL` still wins, which is what keeps a one-off
+ * call to a different host possible.
+ */
+export const applyConfiguredBaseUrl = client => {
+  client.interceptors.request.use(config => {
+    if (!config.baseURL) {
+      config.baseURL = getConfigValue('baseUrl') ?? undefined;
+    }
+    return config;
+  });
+};
+//# sourceMappingURL=baseUrl.js.map

package/lib/module/api/curl.js

@@ -0,0 +1,104 @@
+"use strict";
+
+import { Logger } from "../logger/index.js";
+
+/**
+ * Header names whose VALUE is a credential. Matched case-insensitively against
+ * the whole name, since `Authorization` and `authorization` are the same header
+ * and axios does not normalise the case of headers a caller sets by hand.
+ */
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
+
+/**
+ * Body fields whose value is a credential. Matched on the key alone, so this
+ * catches `password`, `newPassword` and `password_confirmation` alike.
+ */
+const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
+
+/** The axios per-method header buckets, which are config plumbing, not headers. */
+const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
+const REDACTED = '<redacted>';
+const redactBody = (value, seen, depth = 0) => {
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  // Both guards are needed and they catch different shapes. `seen` breaks a
+  // true cycle, which would otherwise recurse forever AND make the eventual
+  // JSON.stringify throw. The depth bound catches a body that is merely
+  // enormous. A curl line is a debugging aid, and it must never be able to
+  // hang or fail the request it is describing.
+  if (seen.has(value)) {
+    return '<circular>';
+  }
+  if (depth > 6) {
+    return '<truncated>';
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(entry => redactBody(entry, seen, depth + 1));
+  }
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
+  }
+  return out;
+};
+const buildUrl = config => {
+  const url = config.url ?? '';
+  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
+  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
+  if (config.params) {
+    const query = new URLSearchParams(config.params).toString();
+    if (query) {
+      complete += (complete.includes('?') ? '&' : '?') + query;
+    }
+  }
+  return complete;
+};
+
+/**
+ * Builds a copy-pasteable curl command for a request, with every credential
+ * replaced by a placeholder.
+ *
+ * The redaction is the point, not a nicety. An unredacted version of this in a
+ * consumer app put `Authorization: Bearer <token>` and the login request's
+ * plaintext password into the device console of a *release* staging build.
+ * A curl line is worth having; a curl line that has to be trusted not to be
+ * enabled in the wrong build is not.
+ */
+export const buildCurl = config => {
+  const method = (config.method ?? 'get').toUpperCase();
+  let command = `curl -X ${method} "${buildUrl(config)}"`;
+  const headers = config.headers;
+  if (headers) {
+    for (const [key, value] of Object.entries(headers)) {
+      if (AXIOS_METHOD_KEYS.has(key)) {
+        continue;
+      }
+      if (typeof value !== 'string' && typeof value !== 'number') {
+        continue;
+      }
+      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
+      command += ` -H "${key}: ${shown}"`;
+    }
+  }
+  if (config.data !== undefined && config.data !== null) {
+    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
+    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
+    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
+  }
+  return command;
+};
+
+/**
+ * Logs the curl equivalent of a request. Never throws: a failure to describe a
+ * request must not be able to fail the request itself.
+ */
+export const logCurl = config => {
+  try {
+    Logger.info('CURL Command:', buildCurl(config));
+  } catch (error) {
+    Logger.warn('[api] Failed to build a curl command for the request', error);
+  }
+};
+//# sourceMappingURL=curl.js.map

package/lib/module/api/publicClient.js

@@ -1,9 +1,11 @@
 "use strict";
 
 import axios from 'axios';
-import axiosRetry from 'axios-retry';
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
+import { applyConfiguredBaseUrl } from "./baseUrl.js";
+import { logCurl } from "./curl.js";
+import { attachRetry } from "./retry.js";
 
 // Define timeout for requests
 const REQUEST_TIMEOUT = 30000; // 30 seconds
@@ -16,7 +18,6 @@ const REQUEST_TIMEOUT = 30000; // 30 seconds
  * - Handles specific HTTP status codes.
  */
 const publicClient = axios.create({
-  baseURL: getConfigValue('baseUrl') ?? undefined,
   headers: {
     'Content-Type': 'application/json',
     Accept: 'application/json',
@@ -24,29 +25,19 @@ const publicClient = axios.create({
   },
   timeout: REQUEST_TIMEOUT
 });
+applyConfiguredBaseUrl(publicClient);
 
-// Configure axios-retry with modified exponential backoff
-const retryConfig = {
-  retries: 3,
-  retryDelay: retryCount => retryCount === 0 ? 0 : Math.pow(2, retryCount) * 1000,
-  // Immediate retry for the first attempt
-  retryCondition: error => {
-    // Status-based ONLY, deliberately: a bare network error must never be
-    // retried here. This client carries login and OTP, which are not
-    // idempotent — the request may well have reached the server before the
-    // connection broke, so a retry can create a second session the user never
-    // sees. axios-retry's isNetworkOrIdempotentRequestError does NOT protect
-    // against this: its isNetworkError branch never looks at the HTTP method,
-    // so it retried POSTs too.
-    const status = error.response?.status;
-    return typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
-  }
-};
-axiosRetry(publicClient, retryConfig);
+// Registered before the logging interceptors below so they only ever observe
+// the final outcome of a request, not its intermediate retries. The policy
+// itself, and why a bare network error is never retried, lives in ./retry.
+attachRetry(publicClient);
 
 // Add request interceptor for logging
 publicClient.interceptors.request.use(config => {
   Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
+  if (getConfigValue('logCurl')) {
+    logCurl(config);
+  }
   return config;
 }, error => {
   const message = error instanceof Error ? error.message : String(error);

package/lib/module/api/retry.js

@@ -0,0 +1,69 @@
+"use strict";
+
+/**
+ * Status-based ONLY, deliberately: a bare network error (no `error.response`)
+ * is never retryable. Both clients carry non-idempotent requests, login and OTP
+ * on the public one and every write on the user one, and a broken connection
+ * says nothing about whether the request reached the server. Retrying can
+ * therefore create a second session, or a duplicate record, that the user never
+ * sees. A generic network-error retry rule is not a substitute: it decides on
+ * the transport alone and never looks at the HTTP method, so it retries POSTs
+ * as readily as GETs.
+ */
+export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
+const DEFAULT_POLICY = {
+  retries: 3,
+  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
+  shouldRetry: error => isRetryableStatus(error.response?.status),
+  onRetry: () => undefined
+};
+const waitOrAbort = (delay, signal) => new Promise(resolve => {
+  const onAbort = () => {
+    clearTimeout(timer);
+    resolve(false);
+  };
+  const timer = setTimeout(() => {
+    signal?.removeEventListener?.('abort', onAbort);
+    resolve(true);
+  }, delay);
+  signal?.addEventListener?.('abort', onAbort, {
+    once: true
+  });
+});
+export const attachRetry = (client, policy = {}) => {
+  client.interceptors.response.use(undefined, async error => {
+    const axiosError = error;
+    const config = axiosError?.config;
+    if (!config || config.retry === false) {
+      return Promise.reject(error);
+    }
+    const perRequest = typeof config.retry === 'object' ? config.retry : {};
+    const effective = {
+      ...DEFAULT_POLICY,
+      ...policy,
+      ...perRequest
+    };
+    const attempt = (config.__retryAttempt ?? 0) + 1;
+    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
+      return Promise.reject(error);
+    }
+    if (config.signal?.aborted) {
+      return Promise.reject(error);
+    }
+
+    // The attempt count rides on the config, which axios copies onto the config
+    // of the retried request, so nested attempts continue the same count and
+    // separate requests never share one.
+    config.__retryAttempt = attempt;
+    // The body was serialised by the first pass; transforming it again would
+    // JSON-encode the already-encoded string.
+    config.transformRequest = [data => data];
+    effective.onRetry(attempt, axiosError);
+    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
+    if (!proceed) {
+      return Promise.reject(error);
+    }
+    return client.request(config);
+  });
+};
+//# sourceMappingURL=retry.js.map

package/lib/module/api/userClient.js

@@ -1,11 +1,13 @@
 "use strict";
 
 import axios, { AxiosHeaders } from 'axios';
-import axiosRetry from 'axios-retry';
-import { getToken } from "../auth/authStore.js";
+import { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY } from "../auth/authStore.js";
 import { getConfigValue } from "../config/index.js";
 import { Logger } from "../logger/index.js";
 import { getNetworkStatus } from "../network/networkStatus.js";
+import { applyConfiguredBaseUrl } from "./baseUrl.js";
+import { logCurl } from "./curl.js";
+import { attachRetry } from "./retry.js";
 
 // Define timeout for requests
 const REQUEST_TIMEOUT = 30000; // 30 seconds
@@ -79,7 +81,6 @@ const getSessionTerminationCode = data => {
  */
 
 const userClient = axios.create({
-  baseURL: getConfigValue('baseUrl') ?? undefined,
   headers: {
     'Content-Type': 'application/json',
     'Accept-Encoding': 'gzip, deflate, br'
@@ -87,19 +88,10 @@ const userClient = axios.create({
   timeout: REQUEST_TIMEOUT // Set timeout for all requests
 });
 
-// Configure axios-retry with modified exponential backoff
-axiosRetry(userClient, {
-  retries: 3,
-  retryDelay: retryCount => retryCount === 0 ? 0 : Math.pow(2, retryCount) * 1000,
-  // Immediate retry for the first attempt
-  retryCondition: error => {
-    // Status-based ONLY — see publicClient for the reasoning. A bare network
-    // error carries no response, so it is not retried: the write may already
-    // have landed server-side, and this client issues non-idempotent requests.
-    const status = error.response?.status;
-    return typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
-  }
-});
+// Registered before the auth interceptors below, so a retryable 5xx is retried
+// before anything else sees it while a 401 still falls through to the refresh
+// flow. Policy and reasoning live in ./retry.
+attachRetry(userClient);
 let store;
 let authActions = {
   logout: () => undefined,
@@ -137,6 +129,21 @@ const processQueue = (error, token = null) => {
   });
   failedQueue = [];
 };
+
+/**
+ * Clear any in-flight token refresh and reject everything queued behind it.
+ * Call this on logout.
+ *
+ * Without it, a refresh that was already in flight when the user logged out
+ * resolves afterwards and replays every queued request with a token for a
+ * session that has ended. The queue is module state, so it survives the logout
+ * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
+ * same function locally, which is how it was found.
+ */
+export const resetRefreshState = () => {
+  refreshTokenPromise = null;
+  processQueue(new Error('[@webority-technologies/mobile-core] Session ended'));
+};
 const getErrorMessage = error => {
   if (error instanceof Error) {
     return error.message;
@@ -167,6 +174,23 @@ const requireStore = () => {
 /**
  * Attach Authorization Token Before Requests
  */
+// Registered after the curl logger and before the auth interceptor, so that it
+// RUNS between them: axios unshifts its request chain, making the first
+// registered run last. The curl line therefore describes a request that already
+// has both its baseURL and its Authorization header.
+applyConfiguredBaseUrl(userClient);
+
+// Registered BEFORE the auth interceptor below deliberately. Axios builds its
+// request chain by unshifting, so the FIRST-registered request interceptor runs
+// LAST — closest to dispatch. This one therefore observes the final config,
+// with the Authorization header already attached, which is the whole point of
+// a curl line. Registering it after would log the request before it is signed.
+userClient.interceptors.request.use(config => {
+  if (getConfigValue('logCurl')) {
+    logCurl(config);
+  }
+  return config;
+});
 userClient.interceptors.request.use(async config => {
   // Reject before any network call when the device is known to be offline.
   // Unknown connectivity (netinfo not installed, or undetermined) is treated
@@ -181,7 +205,7 @@ userClient.interceptors.request.use(async config => {
     if (config.url?.includes('/Account/RefreshToken')) {
       return config;
     }
-    const token = await getToken('accessToken');
+    const token = await getToken(ACCESS_TOKEN_KEY);
 
     // Check if token exists
     if (!token?.token) {
@@ -213,7 +237,7 @@ userClient.interceptors.request.use(async config => {
       // Start a new token refresh process
       refreshTokenPromise = (async () => {
         try {
-          const refreshToken = await getToken('refreshToken');
+          const refreshToken = await getToken(REFRESH_TOKEN_KEY);
           if (!refreshToken?.token) {
             Logger.error('No refresh token available');
             throw new Error('No refresh token available');
@@ -231,7 +255,7 @@ userClient.interceptors.request.use(async config => {
           if (refreshResult.error) {
             throw new Error(`Token refresh failed: ${refreshResult.error.message || 'Unknown error'}`);
           }
-          const newAccessToken = await getToken('accessToken');
+          const newAccessToken = await getToken(ACCESS_TOKEN_KEY);
           if (!newAccessToken?.token) {
             throw new Error('Failed to retrieve new access token after refresh');
           }
@@ -314,7 +338,7 @@ userClient.interceptors.response.use(response => response, async error => {
     refreshTokenPromise = (async () => {
       try {
         Logger.info('User Client: Refreshing token...');
-        const refreshToken = await getToken('refreshToken');
+        const refreshToken = await getToken(REFRESH_TOKEN_KEY);
         if (!refreshToken || !refreshToken.token) {
           Logger.error('No refresh token available or token is invalid');
           throw new Error('No refresh token available');
@@ -327,7 +351,7 @@ userClient.interceptors.response.use(response => response, async error => {
           throw new Error(`Token refresh failed: ${refreshResult.error.message || 'Unknown error'}`);
         }
         Logger.info('Getting new access token after refresh');
-        const newAccessToken = await getToken('accessToken');
+        const newAccessToken = await getToken(ACCESS_TOKEN_KEY);
         if (!newAccessToken?.token) {
           throw new Error('Failed to retrieve new access token');
         }