@webority/mobile-core 0.0.23

package/lib/module/api/curl.js

@@ -0,0 +1,104 @@
+"use strict";
+
+import { Logger } from "../logger/index.js";
+
+/**
+ * Header names whose VALUE is a credential. Matched case-insensitively against
+ * the whole name, since `Authorization` and `authorization` are the same header
+ * and axios does not normalise the case of headers a caller sets by hand.
+ */
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-access-token', 'x-refresh-token', 'api-key']);
+
+/**
+ * Body fields whose value is a credential. Matched on the key alone, so this
+ * catches `password`, `newPassword` and `password_confirmation` alike.
+ */
+const SECRET_BODY_PATTERN = /pass(word|code)|secret|token|otp|pin|cvv|authoriz/i;
+
+/** The axios per-method header buckets, which are config plumbing, not headers. */
+const AXIOS_METHOD_KEYS = new Set(['common', 'delete', 'get', 'head', 'post', 'put', 'patch']);
+const REDACTED = '<redacted>';
+const redactBody = (value, seen, depth = 0) => {
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+  // Both guards are needed and they catch different shapes. `seen` breaks a
+  // true cycle, which would otherwise recurse forever AND make the eventual
+  // JSON.stringify throw. The depth bound catches a body that is merely
+  // enormous. A curl line is a debugging aid, and it must never be able to
+  // hang or fail the request it is describing.
+  if (seen.has(value)) {
+    return '<circular>';
+  }
+  if (depth > 6) {
+    return '<truncated>';
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(entry => redactBody(entry, seen, depth + 1));
+  }
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    out[key] = SECRET_BODY_PATTERN.test(key) ? REDACTED : redactBody(entry, seen, depth + 1);
+  }
+  return out;
+};
+const buildUrl = config => {
+  const url = config.url ?? '';
+  const base = config.baseURL ? config.baseURL.replace(/\/$/, '') : '';
+  let complete = url.startsWith('http') ? url : `${base}/${url.replace(/^\//, '')}`;
+  if (config.params) {
+    const query = new URLSearchParams(config.params).toString();
+    if (query) {
+      complete += (complete.includes('?') ? '&' : '?') + query;
+    }
+  }
+  return complete;
+};
+
+/**
+ * Builds a copy-pasteable curl command for a request, with every credential
+ * replaced by a placeholder.
+ *
+ * The redaction is the point, not a nicety. An unredacted version of this in a
+ * consumer app put `Authorization: Bearer <token>` and the login request's
+ * plaintext password into the device console of a *release* staging build.
+ * A curl line is worth having; a curl line that has to be trusted not to be
+ * enabled in the wrong build is not.
+ */
+export const buildCurl = config => {
+  const method = (config.method ?? 'get').toUpperCase();
+  let command = `curl -X ${method} "${buildUrl(config)}"`;
+  const headers = config.headers;
+  if (headers) {
+    for (const [key, value] of Object.entries(headers)) {
+      if (AXIOS_METHOD_KEYS.has(key)) {
+        continue;
+      }
+      if (typeof value !== 'string' && typeof value !== 'number') {
+        continue;
+      }
+      const shown = SECRET_HEADERS.has(key.toLowerCase()) ? REDACTED : value;
+      command += ` -H "${key}: ${shown}"`;
+    }
+  }
+  if (config.data !== undefined && config.data !== null) {
+    const redacted = typeof config.data === 'object' ? redactBody(config.data, new WeakSet()) : config.data;
+    const body = typeof redacted === 'object' ? JSON.stringify(redacted) : String(redacted);
+    command += ` -d '${body.replace(/'/g, "'\\''")}'`;
+  }
+  return command;
+};
+
+/**
+ * Logs the curl equivalent of a request. Never throws: a failure to describe a
+ * request must not be able to fail the request itself.
+ */
+export const logCurl = config => {
+  try {
+    Logger.info('CURL Command:', buildCurl(config));
+  } catch (error) {
+    Logger.warn('[api] Failed to build a curl command for the request', error);
+  }
+};
+//# sourceMappingURL=curl.js.map

package/lib/module/api/publicClient.js

@@ -0,0 +1,69 @@
+"use strict";
+
+import axios from 'axios';
+import { getConfigValue } from "../config/index.js";
+import { Logger } from "../logger/index.js";
+import { applyConfiguredBaseUrl } from "./baseUrl.js";
+import { logCurl } from "./curl.js";
+import { attachRetry } from "./retry.js";
+
+// Define timeout for requests
+const REQUEST_TIMEOUT = 30000; // 30 seconds
+
+/**
+ * Public Axios Client
+ * - Base URL: Set your public API base URL.
+ * - No Authorization header is attached.
+ * - Includes timeout configuration and error handling.
+ * - Handles specific HTTP status codes.
+ */
+const publicClient = axios.create({
+  headers: {
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+    'Accept-Encoding': 'gzip, deflate, br'
+  },
+  timeout: REQUEST_TIMEOUT
+});
+applyConfiguredBaseUrl(publicClient);
+
+// Registered before the logging interceptors below so they only ever observe
+// the final outcome of a request, not its intermediate retries. The policy
+// itself, and why a bare network error is never retried, lives in ./retry.
+attachRetry(publicClient);
+
+// Add request interceptor for logging
+publicClient.interceptors.request.use(config => {
+  Logger.info(`Request: ${config.method?.toUpperCase()} ${config.url}`);
+  if (getConfigValue('logCurl')) {
+    logCurl(config);
+  }
+  return config;
+}, error => {
+  const message = error instanceof Error ? error.message : String(error);
+  Logger.error('Request error:', message);
+  return Promise.reject(error);
+});
+
+// Add response interceptor for error handling
+publicClient.interceptors.response.use(response => {
+  Logger.info(`Response: ${response.status} from ${response.config.url}`);
+  return response;
+}, error => {
+  if (axios.isAxiosError(error)) {
+    const originalRequest = error.config;
+    if (!error.response) {
+      Logger.error(`Network error or no response from server: ${error.message}, URL: ${originalRequest?.url}`);
+    } else {
+      const body = error.response.data;
+      const bodyText = body instanceof ArrayBuffer ? `binary response (${body.byteLength} bytes)` : typeof Blob !== 'undefined' && body instanceof Blob ? `binary response (${body.size} bytes)` : body ?? error.message;
+      Logger.error(`Response error: ${bodyText}, URL: ${originalRequest?.url}, Status: ${error.response.status}`);
+    }
+  } else {
+    const message = error instanceof Error ? error.message : String(error);
+    Logger.error(`Unknown response error: ${message}`);
+  }
+  return Promise.reject(error);
+});
+export default publicClient;
+//# sourceMappingURL=publicClient.js.map

package/lib/module/api/retry.js

@@ -0,0 +1,69 @@
+"use strict";
+
+/**
+ * Status-based ONLY, deliberately: a bare network error (no `error.response`)
+ * is never retryable. Both clients carry non-idempotent requests, login and OTP
+ * on the public one and every write on the user one, and a broken connection
+ * says nothing about whether the request reached the server. Retrying can
+ * therefore create a second session, or a duplicate record, that the user never
+ * sees. A generic network-error retry rule is not a substitute: it decides on
+ * the transport alone and never looks at the HTTP method, so it retries POSTs
+ * as readily as GETs.
+ */
+export const isRetryableStatus = status => typeof status === 'number' && (status === 429 || status >= 500 && status <= 599);
+const DEFAULT_POLICY = {
+  retries: 3,
+  retryDelayMs: attempt => attempt <= 1 ? 0 : 2 ** attempt * 1000,
+  shouldRetry: error => isRetryableStatus(error.response?.status),
+  onRetry: () => undefined
+};
+const waitOrAbort = (delay, signal) => new Promise(resolve => {
+  const onAbort = () => {
+    clearTimeout(timer);
+    resolve(false);
+  };
+  const timer = setTimeout(() => {
+    signal?.removeEventListener?.('abort', onAbort);
+    resolve(true);
+  }, delay);
+  signal?.addEventListener?.('abort', onAbort, {
+    once: true
+  });
+});
+export const attachRetry = (client, policy = {}) => {
+  client.interceptors.response.use(undefined, async error => {
+    const axiosError = error;
+    const config = axiosError?.config;
+    if (!config || config.retry === false) {
+      return Promise.reject(error);
+    }
+    const perRequest = typeof config.retry === 'object' ? config.retry : {};
+    const effective = {
+      ...DEFAULT_POLICY,
+      ...policy,
+      ...perRequest
+    };
+    const attempt = (config.__retryAttempt ?? 0) + 1;
+    if (attempt > effective.retries || !effective.shouldRetry(axiosError)) {
+      return Promise.reject(error);
+    }
+    if (config.signal?.aborted) {
+      return Promise.reject(error);
+    }
+
+    // The attempt count rides on the config, which axios copies onto the config
+    // of the retried request, so nested attempts continue the same count and
+    // separate requests never share one.
+    config.__retryAttempt = attempt;
+    // The body was serialised by the first pass; transforming it again would
+    // JSON-encode the already-encoded string.
+    config.transformRequest = [data => data];
+    effective.onRetry(attempt, axiosError);
+    const proceed = await waitOrAbort(effective.retryDelayMs(attempt), config.signal);
+    if (!proceed) {
+      return Promise.reject(error);
+    }
+    return client.request(config);
+  });
+};
+//# sourceMappingURL=retry.js.map

package/lib/module/api/tokenRefresh.js

@@ -0,0 +1,192 @@
+"use strict";
+
+import axios from 'axios';
+import { ACCESS_TOKEN_KEY, getToken, REFRESH_TOKEN_KEY, storeToken } from "../auth/authStore.js";
+import { Logger } from "../logger/index.js";
+import publicClient from "./publicClient.js";
+
+/**
+ * The one token-refresh flow in the library, run by userClient's interceptors.
+ * The library calls the refresh endpoint itself, so it can tell a rejected
+ * refresh token (400 or 401: the session is over) from a transient failure
+ * (network, timeout, 5xx: the session is kept and the caller sees the error).
+ * A refresh is single flight. A download goes through the app's client, so it
+ * reaches this only when that client is userClient.
+ */
+
+/**
+ * Minimal Redux-store shape required by the user client to dispatch logout.
+ */
+
+let store;
+let auth;
+export const injectStore = _store => {
+  store = _store;
+};
+export const injectUserAuth = options => {
+  auth = options;
+};
+
+// Single promise to track token refresh
+let refreshTokenPromise = null;
+
+// Queue for failed requests
+let failedQueue = [];
+
+/**
+ * Processes the queue of failed requests.
+ */
+const processQueue = (error, token = null) => {
+  failedQueue.forEach(({
+    resolve,
+    reject
+  }) => {
+    if (error) {
+      reject(error);
+    } else if (token !== null) {
+      resolve(token);
+    }
+  });
+  failedQueue = [];
+};
+
+/**
+ * Clear any in-flight token refresh and reject everything queued behind it.
+ * Call this on logout.
+ *
+ * Without it, a refresh that was already in flight when the user logged out
+ * resolves afterwards and replays every queued request with a token for a
+ * session that has ended. The queue is module state, so it survives the logout
+ * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
+ * same function locally, which is how it was found.
+ */
+export const resetRefreshState = () => {
+  refreshTokenPromise = null;
+  processQueue(new Error('[@webority/mobile-core] Session ended'));
+};
+export const getErrorMessage = error => {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  if (typeof error === 'string') {
+    return error;
+  }
+  return 'Unknown error';
+};
+const requireAuth = () => {
+  if (!store || !auth) {
+    throw new Error('User package store is not initialized. Call initUserAuth first.');
+  }
+  return {
+    store,
+    auth
+  };
+};
+
+/** The refresh endpoint's path, once initUserAuth has run. */
+export const getRefreshPath = () => auth?.refresh.path;
+export const dispatchLogout = async () => {
+  const wired = requireAuth();
+  await wired.store.dispatch(wired.auth.logout());
+};
+export const isRefreshInFlight = () => refreshTokenPromise !== null;
+
+/** Wait for the in-flight refresh without joining it: resolved or rejected by processQueue. */
+export const queueBehindRefresh = () => new Promise((resolve, reject) => {
+  failedQueue.push({
+    resolve,
+    reject
+  });
+});
+
+/** A failure that proves the session is over, as opposed to one worth retrying later. */
+class SessionEndedError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'SessionEndedError';
+    // Babel's class transform can drop the prototype link, which makes
+    // `instanceof SessionEndedError` false in the transpiled build.
+    Object.setPrototypeOf(this, SessionEndedError.prototype);
+  }
+}
+const endsSession = error => error instanceof SessionEndedError || axios.isAxiosError(error) && (error.response?.status === 400 || error.response?.status === 401);
+const asString = (value, field) => {
+  if (typeof value !== 'string' || value === '') {
+    throw new Error(`The refresh response has no "${field}".`);
+  }
+  return value;
+};
+
+/** The Webority API's refresh response. */
+const readWeborityTokens = data => {
+  const body = data ?? {};
+  return {
+    accessToken: asString(body.accessToken, 'accessToken'),
+    accessTokenExpiry: asString(body.accessTokenExpiration, 'accessTokenExpiration'),
+    refreshToken: asString(body.refreshToken, 'refreshToken'),
+    refreshTokenExpiry: asString(body.refreshTokenExpiration, 'refreshTokenExpiration')
+  };
+};
+const callRefreshEndpoint = async refresh => {
+  const refreshToken = await getToken(REFRESH_TOKEN_KEY);
+  if (!refreshToken?.token) {
+    throw new SessionEndedError('No refresh token available');
+  }
+  // An expired refresh token would only earn a 401 from the endpoint before the same logout.
+  if (Date.parse(refreshToken.expiry) <= Date.now()) {
+    throw new SessionEndedError('Refresh token expired');
+  }
+  const accessToken = await getToken(ACCESS_TOKEN_KEY);
+  const tokens = {
+    accessToken: accessToken?.token ?? null,
+    refreshToken: refreshToken.token
+  };
+  const body = refresh.body ? await refresh.body(tokens) : tokens;
+  Logger.info('Refreshing the access token');
+  const {
+    data
+  } = await publicClient.post(refresh.path, body);
+  const next = (refresh.readTokens ?? readWeborityTokens)(data);
+  await storeToken(ACCESS_TOKEN_KEY, next.accessToken, next.accessTokenExpiry);
+  await storeToken(REFRESH_TOKEN_KEY, next.refreshToken, next.refreshTokenExpiry);
+  Logger.info('Access token refreshed');
+  return next.accessToken;
+};
+
+/**
+ * Refresh the access token, joining a refresh already in flight rather than
+ * starting a second one. Every request queued behind it is replayed on success
+ * and rejected on failure. Logs out only when the failure proves the session
+ * is over; a network error, timeout or 5xx keeps it and rejects.
+ */
+export const refreshAccessToken = () => {
+  if (refreshTokenPromise) {
+    return refreshTokenPromise;
+  }
+  const run = async () => {
+    try {
+      const token = await callRefreshEndpoint(requireAuth().auth.refresh);
+      processQueue(null, token);
+      return token;
+    } catch (error) {
+      const responseData = axios.isAxiosError(error) ? error.response?.data : undefined;
+      Logger.error('Token refresh failed:', responseData ?? getErrorMessage(error));
+      processQueue(error, null);
+      if (endsSession(error)) {
+        await dispatchLogout();
+      }
+      throw error;
+    }
+  };
+  // Cleared in a chained finally, not inside run: a failure before run's first
+  // await would otherwise clear the slot before it was assigned, leaving a
+  // rejected promise that every later refresh joins.
+  const promise = run().finally(() => {
+    if (refreshTokenPromise === promise) {
+      refreshTokenPromise = null;
+    }
+  });
+  refreshTokenPromise = promise;
+  return promise;
+};
+//# sourceMappingURL=tokenRefresh.js.map

package/lib/module/api/userClient.js

@@ -0,0 +1,233 @@
+"use strict";
+
+import axios, { AxiosHeaders } from 'axios';
+import { ACCESS_TOKEN_KEY, getToken } from "../auth/authStore.js";
+import { getConfigValue } from "../config/index.js";
+import { Logger } from "../logger/index.js";
+import { getNetworkStatus } from "../network/networkStatus.js";
+import { applyConfiguredBaseUrl } from "./baseUrl.js";
+import { logCurl } from "./curl.js";
+import { attachRetry } from "./retry.js";
+import { dispatchLogout, getErrorMessage, getRefreshPath, isRefreshInFlight, queueBehindRefresh, refreshAccessToken, resetRefreshState } from "./tokenRefresh.js";
+export { injectStore, injectUserAuth, resetRefreshState } from "./tokenRefresh.js";
+
+// Define timeout for requests
+const REQUEST_TIMEOUT = 30000; // 30 seconds
+
+/**
+ * Thrown by the request interceptor when the device is offline, before the
+ * request ever reaches the adapter (and therefore the network). Distinct from
+ * an AxiosError so callers can show an offline message instead of a generic
+ * request failure.
+ */
+export class RequestOfflineError extends Error {
+  constructor(message = 'Request blocked: device is offline') {
+    super(message);
+    this.name = 'RequestOfflineError';
+  }
+}
+
+/**
+ * Sub-codes a 401 response body carries when the session itself is dead
+ * (terminated by an admin, or expired server-side) rather than merely
+ * out-of-date. These never warrant a refresh attempt — only logout.
+ */
+export const SESSION_TERMINATION_CODES = {
+  TERMINATED: 'SESSION_TERMINATED',
+  EXPIRED: 'SESSION_EXPIRED'
+};
+const TERMINATION_CODES = new Set(Object.values(SESSION_TERMINATION_CODES));
+
+/**
+ * The header is the AUTHORITATIVE signal, verified against the backend:
+ * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
+ * `401` + `X-Security-Stamp-Invalid: true` and a body of
+ * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
+ * `error` is a string rather than an object. An earlier version of this checked
+ * only body fields and would therefore never have fired against a real server.
+ *
+ * The body codes below are kept as a secondary path for any head that does send
+ * an explicit sub-code; they match on exact strings, so looking is free.
+ */
+export const SESSION_INVALID_HEADER = 'x-security-stamp-invalid';
+const hasSessionInvalidHeader = headers => {
+  if (!headers || typeof headers !== 'object') {
+    return false;
+  }
+  const get = headers.get;
+  const raw = typeof get === 'function' ? get.call(headers, SESSION_INVALID_HEADER) : headers[SESSION_INVALID_HEADER];
+  return String(raw).toLowerCase() === 'true';
+};
+const getSessionTerminationCode = data => {
+  if (!data || typeof data !== 'object') {
+    return undefined;
+  }
+  const body = data;
+  const nested = body.error;
+  const candidates = [body.code, body.errorCode, nested && typeof nested === 'object' ? nested.code : undefined];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && TERMINATION_CODES.has(candidate)) {
+      return candidate;
+    }
+  }
+  return undefined;
+};
+
+/**
+ * Internal extension of axios request config to track retry attempts.
+ */
+
+const userClient = axios.create({
+  headers: {
+    'Content-Type': 'application/json',
+    'Accept-Encoding': 'gzip, deflate, br'
+  },
+  timeout: REQUEST_TIMEOUT // Set timeout for all requests
+});
+
+// Registered before the auth interceptors below, so a retryable 5xx is retried
+// before anything else sees it while a 401 still falls through to the refresh
+// flow. Policy and reasoning live in ./retry.
+attachRetry(userClient);
+const setAuthHeader = (config, token) => {
+  if (config.headers instanceof AxiosHeaders) {
+    config.headers.set('Authorization', `Bearer ${token}`);
+  } else {
+    // Fallback in case headers were provided as a plain object.
+    config.headers = AxiosHeaders.from({
+      ...config.headers,
+      Authorization: `Bearer ${token}`
+    });
+  }
+};
+const isRefreshTokenRequest = url => {
+  const path = getRefreshPath();
+  return !!path && !!url?.includes(path);
+};
+
+/**
+ * Attach Authorization Token Before Requests
+ */
+// Registered after the curl logger and before the auth interceptor, so that it
+// RUNS between them: axios unshifts its request chain, making the first
+// registered run last. The curl line therefore describes a request that already
+// has both its baseURL and its Authorization header.
+applyConfiguredBaseUrl(userClient);
+
+// Registered BEFORE the auth interceptor below deliberately. Axios builds its
+// request chain by unshifting, so the FIRST-registered request interceptor runs
+// LAST — closest to dispatch. This one therefore observes the final config,
+// with the Authorization header already attached, which is the whole point of
+// a curl line. Registering it after would log the request before it is signed.
+userClient.interceptors.request.use(config => {
+  if (getConfigValue('logCurl')) {
+    logCurl(config);
+  }
+  return config;
+});
+userClient.interceptors.request.use(async config => {
+  // Reject before any network call when the device is known to be offline.
+  // Unknown connectivity (netinfo not installed, or undetermined) is treated
+  // as online — never block a request on an unavailable probe.
+  const network = await getNetworkStatus();
+  if (network.isConnected === false) {
+    Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
+    return Promise.reject(new RequestOfflineError());
+  }
+  try {
+    // Skip token check for refresh token endpoint to prevent infinite loop
+    if (isRefreshTokenRequest(config.url)) {
+      return config;
+    }
+    const token = await getToken(ACCESS_TOKEN_KEY);
+
+    // Check if token exists
+    if (!token?.token) {
+      throw new Error('No access token available');
+    }
+
+    // Check if token is expired
+    const currentTime = Date.now();
+    const tokenExpiry = Date.parse(token.expiry);
+    const bufferTime = 30 * 1000; // 30 seconds buffer
+
+    // If token is expired or about to expire, try to refresh it first
+    if (tokenExpiry <= currentTime + bufferTime) {
+      Logger.info('Access token expired or about to expire, refreshing before request');
+
+      // Joins a refresh already in flight rather than starting a second one.
+      const newToken = await refreshAccessToken();
+      setAuthHeader(config, newToken);
+      return config;
+    }
+
+    // Token is valid, proceed with request
+    setAuthHeader(config, token.token);
+    return config;
+  } catch (error) {
+    Logger.error('Failed to attach token:', getErrorMessage(error));
+    return Promise.reject(error);
+  }
+}, error => {
+  Logger.error('Request error:', getErrorMessage(error));
+  return Promise.reject(error);
+});
+
+/**
+ * Handle Response & Token Refresh
+ */
+userClient.interceptors.response.use(response => response, async error => {
+  if (!axios.isAxiosError(error)) {
+    Logger.error(`Non-axios error in response interceptor: ${getErrorMessage(error)}`);
+    return Promise.reject(error);
+  }
+  const axiosError = error;
+  const originalRequest = axiosError.config;
+  if (!axiosError.response) {
+    Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    return Promise.reject(error);
+  }
+  if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
+    // The refresh call goes through this client. A 401 on it must not queue behind
+    // refreshTokenPromise: that promise is the call itself, so queueing deadlocks it
+    // and every later 401 waits forever.
+    if (isRefreshTokenRequest(originalRequest.url)) {
+      return Promise.reject(error);
+    }
+    const terminationCode = getSessionTerminationCode(axiosError.response.data) ?? (hasSessionInvalidHeader(axiosError.response.headers) ? SESSION_TERMINATION_CODES.TERMINATED : undefined);
+    if (terminationCode) {
+      // The session is dead server-side — a refresh would only burn a
+      // pointless round-trip, so go straight to logout.
+      Logger.warn(`Session ${terminationCode}, logging out without refresh. URL: ${originalRequest.url}`);
+      resetRefreshState();
+      await dispatchLogout();
+      return Promise.reject(error);
+    }
+    Logger.warn(`Unauthorized URL: ${originalRequest.url}`);
+    originalRequest._retry = true;
+
+    // If we already have a refresh in progress, queue this request
+    if (isRefreshInFlight()) {
+      return queueBehindRefresh().then(token => {
+        Logger.info('Retrying request after token refresh:', originalRequest.url);
+        setAuthHeader(originalRequest, token);
+        return userClient(originalRequest);
+      }).catch(err => {
+        Logger.error('Failed to retry request after token refresh:', getErrorMessage(err));
+        return Promise.reject(err);
+      });
+    }
+    try {
+      // Start a new token refresh process and wait for it to complete
+      const newToken = await refreshAccessToken();
+      setAuthHeader(originalRequest, newToken);
+      return userClient(originalRequest);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  return Promise.reject(error);
+});
+export default userClient;
+//# sourceMappingURL=userClient.js.map