@webority/mobile-core 0.0.23

package/lib/commonjs/api/tokenRefresh.js

@@ -0,0 +1,205 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.resetRefreshState = exports.refreshAccessToken = exports.queueBehindRefresh = exports.isRefreshInFlight = exports.injectUserAuth = exports.injectStore = exports.getRefreshPath = exports.getErrorMessage = exports.dispatchLogout = void 0;
+var _axios = _interopRequireDefault(require("axios"));
+var _authStore = require("../auth/authStore.js");
+var _index = require("../logger/index.js");
+var _publicClient = _interopRequireDefault(require("./publicClient.js"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+/**
+ * The one token-refresh flow in the library, run by userClient's interceptors.
+ * The library calls the refresh endpoint itself, so it can tell a rejected
+ * refresh token (400 or 401: the session is over) from a transient failure
+ * (network, timeout, 5xx: the session is kept and the caller sees the error).
+ * A refresh is single flight. A download goes through the app's client, so it
+ * reaches this only when that client is userClient.
+ */
+
+/**
+ * Minimal Redux-store shape required by the user client to dispatch logout.
+ */
+
+let store;
+let auth;
+const injectStore = _store => {
+  store = _store;
+};
+exports.injectStore = injectStore;
+const injectUserAuth = options => {
+  auth = options;
+};
+
+// Single promise to track token refresh
+exports.injectUserAuth = injectUserAuth;
+let refreshTokenPromise = null;
+
+// Queue for failed requests
+let failedQueue = [];
+
+/**
+ * Processes the queue of failed requests.
+ */
+const processQueue = (error, token = null) => {
+  failedQueue.forEach(({
+    resolve,
+    reject
+  }) => {
+    if (error) {
+      reject(error);
+    } else if (token !== null) {
+      resolve(token);
+    }
+  });
+  failedQueue = [];
+};
+
+/**
+ * Clear any in-flight token refresh and reject everything queued behind it.
+ * Call this on logout.
+ *
+ * Without it, a refresh that was already in flight when the user logged out
+ * resolves afterwards and replays every queued request with a token for a
+ * session that has ended. The queue is module state, so it survives the logout
+ * entirely: nothing else clears it. A consumer app hit this and hand-wrote the
+ * same function locally, which is how it was found.
+ */
+const resetRefreshState = () => {
+  refreshTokenPromise = null;
+  processQueue(new Error('[@webority/mobile-core] Session ended'));
+};
+exports.resetRefreshState = resetRefreshState;
+const getErrorMessage = error => {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  if (typeof error === 'string') {
+    return error;
+  }
+  return 'Unknown error';
+};
+exports.getErrorMessage = getErrorMessage;
+const requireAuth = () => {
+  if (!store || !auth) {
+    throw new Error('User package store is not initialized. Call initUserAuth first.');
+  }
+  return {
+    store,
+    auth
+  };
+};
+
+/** The refresh endpoint's path, once initUserAuth has run. */
+const getRefreshPath = () => auth?.refresh.path;
+exports.getRefreshPath = getRefreshPath;
+const dispatchLogout = async () => {
+  const wired = requireAuth();
+  await wired.store.dispatch(wired.auth.logout());
+};
+exports.dispatchLogout = dispatchLogout;
+const isRefreshInFlight = () => refreshTokenPromise !== null;
+
+/** Wait for the in-flight refresh without joining it: resolved or rejected by processQueue. */
+exports.isRefreshInFlight = isRefreshInFlight;
+const queueBehindRefresh = () => new Promise((resolve, reject) => {
+  failedQueue.push({
+    resolve,
+    reject
+  });
+});
+
+/** A failure that proves the session is over, as opposed to one worth retrying later. */
+exports.queueBehindRefresh = queueBehindRefresh;
+class SessionEndedError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'SessionEndedError';
+    // Babel's class transform can drop the prototype link, which makes
+    // `instanceof SessionEndedError` false in the transpiled build.
+    Object.setPrototypeOf(this, SessionEndedError.prototype);
+  }
+}
+const endsSession = error => error instanceof SessionEndedError || _axios.default.isAxiosError(error) && (error.response?.status === 400 || error.response?.status === 401);
+const asString = (value, field) => {
+  if (typeof value !== 'string' || value === '') {
+    throw new Error(`The refresh response has no "${field}".`);
+  }
+  return value;
+};
+
+/** The Webority API's refresh response. */
+const readWeborityTokens = data => {
+  const body = data ?? {};
+  return {
+    accessToken: asString(body.accessToken, 'accessToken'),
+    accessTokenExpiry: asString(body.accessTokenExpiration, 'accessTokenExpiration'),
+    refreshToken: asString(body.refreshToken, 'refreshToken'),
+    refreshTokenExpiry: asString(body.refreshTokenExpiration, 'refreshTokenExpiration')
+  };
+};
+const callRefreshEndpoint = async refresh => {
+  const refreshToken = await (0, _authStore.getToken)(_authStore.REFRESH_TOKEN_KEY);
+  if (!refreshToken?.token) {
+    throw new SessionEndedError('No refresh token available');
+  }
+  // An expired refresh token would only earn a 401 from the endpoint before the same logout.
+  if (Date.parse(refreshToken.expiry) <= Date.now()) {
+    throw new SessionEndedError('Refresh token expired');
+  }
+  const accessToken = await (0, _authStore.getToken)(_authStore.ACCESS_TOKEN_KEY);
+  const tokens = {
+    accessToken: accessToken?.token ?? null,
+    refreshToken: refreshToken.token
+  };
+  const body = refresh.body ? await refresh.body(tokens) : tokens;
+  _index.Logger.info('Refreshing the access token');
+  const {
+    data
+  } = await _publicClient.default.post(refresh.path, body);
+  const next = (refresh.readTokens ?? readWeborityTokens)(data);
+  await (0, _authStore.storeToken)(_authStore.ACCESS_TOKEN_KEY, next.accessToken, next.accessTokenExpiry);
+  await (0, _authStore.storeToken)(_authStore.REFRESH_TOKEN_KEY, next.refreshToken, next.refreshTokenExpiry);
+  _index.Logger.info('Access token refreshed');
+  return next.accessToken;
+};
+
+/**
+ * Refresh the access token, joining a refresh already in flight rather than
+ * starting a second one. Every request queued behind it is replayed on success
+ * and rejected on failure. Logs out only when the failure proves the session
+ * is over; a network error, timeout or 5xx keeps it and rejects.
+ */
+const refreshAccessToken = () => {
+  if (refreshTokenPromise) {
+    return refreshTokenPromise;
+  }
+  const run = async () => {
+    try {
+      const token = await callRefreshEndpoint(requireAuth().auth.refresh);
+      processQueue(null, token);
+      return token;
+    } catch (error) {
+      const responseData = _axios.default.isAxiosError(error) ? error.response?.data : undefined;
+      _index.Logger.error('Token refresh failed:', responseData ?? getErrorMessage(error));
+      processQueue(error, null);
+      if (endsSession(error)) {
+        await dispatchLogout();
+      }
+      throw error;
+    }
+  };
+  // Cleared in a chained finally, not inside run: a failure before run's first
+  // await would otherwise clear the slot before it was assigned, leaving a
+  // rejected promise that every later refresh joins.
+  const promise = run().finally(() => {
+    if (refreshTokenPromise === promise) {
+      refreshTokenPromise = null;
+    }
+  });
+  refreshTokenPromise = promise;
+  return promise;
+};
+exports.refreshAccessToken = refreshAccessToken;
+//# sourceMappingURL=tokenRefresh.js.map

package/lib/commonjs/api/userClient.js

@@ -0,0 +1,255 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = exports.SESSION_TERMINATION_CODES = exports.SESSION_INVALID_HEADER = exports.RequestOfflineError = void 0;
+Object.defineProperty(exports, "injectStore", {
+  enumerable: true,
+  get: function () {
+    return _tokenRefresh.injectStore;
+  }
+});
+Object.defineProperty(exports, "injectUserAuth", {
+  enumerable: true,
+  get: function () {
+    return _tokenRefresh.injectUserAuth;
+  }
+});
+Object.defineProperty(exports, "resetRefreshState", {
+  enumerable: true,
+  get: function () {
+    return _tokenRefresh.resetRefreshState;
+  }
+});
+var _axios = _interopRequireWildcard(require("axios"));
+var _authStore = require("../auth/authStore.js");
+var _index = require("../config/index.js");
+var _index2 = require("../logger/index.js");
+var _networkStatus = require("../network/networkStatus.js");
+var _baseUrl = require("./baseUrl.js");
+var _curl = require("./curl.js");
+var _retry = require("./retry.js");
+var _tokenRefresh = require("./tokenRefresh.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+// Define timeout for requests
+const REQUEST_TIMEOUT = 30000; // 30 seconds
+
+/**
+ * Thrown by the request interceptor when the device is offline, before the
+ * request ever reaches the adapter (and therefore the network). Distinct from
+ * an AxiosError so callers can show an offline message instead of a generic
+ * request failure.
+ */
+class RequestOfflineError extends Error {
+  constructor(message = 'Request blocked: device is offline') {
+    super(message);
+    this.name = 'RequestOfflineError';
+  }
+}
+
+/**
+ * Sub-codes a 401 response body carries when the session itself is dead
+ * (terminated by an admin, or expired server-side) rather than merely
+ * out-of-date. These never warrant a refresh attempt — only logout.
+ */
+exports.RequestOfflineError = RequestOfflineError;
+const SESSION_TERMINATION_CODES = exports.SESSION_TERMINATION_CODES = {
+  TERMINATED: 'SESSION_TERMINATED',
+  EXPIRED: 'SESSION_EXPIRED'
+};
+const TERMINATION_CODES = new Set(Object.values(SESSION_TERMINATION_CODES));
+
+/**
+ * The header is the AUTHORITATIVE signal, verified against the backend:
+ * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
+ * `401` + `X-Security-Stamp-Invalid: true` and a body of
+ * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
+ * `error` is a string rather than an object. An earlier version of this checked
+ * only body fields and would therefore never have fired against a real server.
+ *
+ * The body codes below are kept as a secondary path for any head that does send
+ * an explicit sub-code; they match on exact strings, so looking is free.
+ */
+const SESSION_INVALID_HEADER = exports.SESSION_INVALID_HEADER = 'x-security-stamp-invalid';
+const hasSessionInvalidHeader = headers => {
+  if (!headers || typeof headers !== 'object') {
+    return false;
+  }
+  const get = headers.get;
+  const raw = typeof get === 'function' ? get.call(headers, SESSION_INVALID_HEADER) : headers[SESSION_INVALID_HEADER];
+  return String(raw).toLowerCase() === 'true';
+};
+const getSessionTerminationCode = data => {
+  if (!data || typeof data !== 'object') {
+    return undefined;
+  }
+  const body = data;
+  const nested = body.error;
+  const candidates = [body.code, body.errorCode, nested && typeof nested === 'object' ? nested.code : undefined];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && TERMINATION_CODES.has(candidate)) {
+      return candidate;
+    }
+  }
+  return undefined;
+};
+
+/**
+ * Internal extension of axios request config to track retry attempts.
+ */
+
+const userClient = _axios.default.create({
+  headers: {
+    'Content-Type': 'application/json',
+    'Accept-Encoding': 'gzip, deflate, br'
+  },
+  timeout: REQUEST_TIMEOUT // Set timeout for all requests
+});
+
+// Registered before the auth interceptors below, so a retryable 5xx is retried
+// before anything else sees it while a 401 still falls through to the refresh
+// flow. Policy and reasoning live in ./retry.
+(0, _retry.attachRetry)(userClient);
+const setAuthHeader = (config, token) => {
+  if (config.headers instanceof _axios.AxiosHeaders) {
+    config.headers.set('Authorization', `Bearer ${token}`);
+  } else {
+    // Fallback in case headers were provided as a plain object.
+    config.headers = _axios.AxiosHeaders.from({
+      ...config.headers,
+      Authorization: `Bearer ${token}`
+    });
+  }
+};
+const isRefreshTokenRequest = url => {
+  const path = (0, _tokenRefresh.getRefreshPath)();
+  return !!path && !!url?.includes(path);
+};
+
+/**
+ * Attach Authorization Token Before Requests
+ */
+// Registered after the curl logger and before the auth interceptor, so that it
+// RUNS between them: axios unshifts its request chain, making the first
+// registered run last. The curl line therefore describes a request that already
+// has both its baseURL and its Authorization header.
+(0, _baseUrl.applyConfiguredBaseUrl)(userClient);
+
+// Registered BEFORE the auth interceptor below deliberately. Axios builds its
+// request chain by unshifting, so the FIRST-registered request interceptor runs
+// LAST — closest to dispatch. This one therefore observes the final config,
+// with the Authorization header already attached, which is the whole point of
+// a curl line. Registering it after would log the request before it is signed.
+userClient.interceptors.request.use(config => {
+  if ((0, _index.getConfigValue)('logCurl')) {
+    (0, _curl.logCurl)(config);
+  }
+  return config;
+});
+userClient.interceptors.request.use(async config => {
+  // Reject before any network call when the device is known to be offline.
+  // Unknown connectivity (netinfo not installed, or undetermined) is treated
+  // as online — never block a request on an unavailable probe.
+  const network = await (0, _networkStatus.getNetworkStatus)();
+  if (network.isConnected === false) {
+    _index2.Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
+    return Promise.reject(new RequestOfflineError());
+  }
+  try {
+    // Skip token check for refresh token endpoint to prevent infinite loop
+    if (isRefreshTokenRequest(config.url)) {
+      return config;
+    }
+    const token = await (0, _authStore.getToken)(_authStore.ACCESS_TOKEN_KEY);
+
+    // Check if token exists
+    if (!token?.token) {
+      throw new Error('No access token available');
+    }
+
+    // Check if token is expired
+    const currentTime = Date.now();
+    const tokenExpiry = Date.parse(token.expiry);
+    const bufferTime = 30 * 1000; // 30 seconds buffer
+
+    // If token is expired or about to expire, try to refresh it first
+    if (tokenExpiry <= currentTime + bufferTime) {
+      _index2.Logger.info('Access token expired or about to expire, refreshing before request');
+
+      // Joins a refresh already in flight rather than starting a second one.
+      const newToken = await (0, _tokenRefresh.refreshAccessToken)();
+      setAuthHeader(config, newToken);
+      return config;
+    }
+
+    // Token is valid, proceed with request
+    setAuthHeader(config, token.token);
+    return config;
+  } catch (error) {
+    _index2.Logger.error('Failed to attach token:', (0, _tokenRefresh.getErrorMessage)(error));
+    return Promise.reject(error);
+  }
+}, error => {
+  _index2.Logger.error('Request error:', (0, _tokenRefresh.getErrorMessage)(error));
+  return Promise.reject(error);
+});
+
+/**
+ * Handle Response & Token Refresh
+ */
+userClient.interceptors.response.use(response => response, async error => {
+  if (!_axios.default.isAxiosError(error)) {
+    _index2.Logger.error(`Non-axios error in response interceptor: ${(0, _tokenRefresh.getErrorMessage)(error)}`);
+    return Promise.reject(error);
+  }
+  const axiosError = error;
+  const originalRequest = axiosError.config;
+  if (!axiosError.response) {
+    _index2.Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
+    return Promise.reject(error);
+  }
+  if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
+    // The refresh call goes through this client. A 401 on it must not queue behind
+    // refreshTokenPromise: that promise is the call itself, so queueing deadlocks it
+    // and every later 401 waits forever.
+    if (isRefreshTokenRequest(originalRequest.url)) {
+      return Promise.reject(error);
+    }
+    const terminationCode = getSessionTerminationCode(axiosError.response.data) ?? (hasSessionInvalidHeader(axiosError.response.headers) ? SESSION_TERMINATION_CODES.TERMINATED : undefined);
+    if (terminationCode) {
+      // The session is dead server-side — a refresh would only burn a
+      // pointless round-trip, so go straight to logout.
+      _index2.Logger.warn(`Session ${terminationCode}, logging out without refresh. URL: ${originalRequest.url}`);
+      (0, _tokenRefresh.resetRefreshState)();
+      await (0, _tokenRefresh.dispatchLogout)();
+      return Promise.reject(error);
+    }
+    _index2.Logger.warn(`Unauthorized URL: ${originalRequest.url}`);
+    originalRequest._retry = true;
+
+    // If we already have a refresh in progress, queue this request
+    if ((0, _tokenRefresh.isRefreshInFlight)()) {
+      return (0, _tokenRefresh.queueBehindRefresh)().then(token => {
+        _index2.Logger.info('Retrying request after token refresh:', originalRequest.url);
+        setAuthHeader(originalRequest, token);
+        return userClient(originalRequest);
+      }).catch(err => {
+        _index2.Logger.error('Failed to retry request after token refresh:', (0, _tokenRefresh.getErrorMessage)(err));
+        return Promise.reject(err);
+      });
+    }
+    try {
+      // Start a new token refresh process and wait for it to complete
+      const newToken = await (0, _tokenRefresh.refreshAccessToken)();
+      setAuthHeader(originalRequest, newToken);
+      return userClient(originalRequest);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+  }
+  _index2.Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
+  return Promise.reject(error);
+});
+var _default = exports.default = userClient;
+//# sourceMappingURL=userClient.js.map

package/lib/commonjs/auth/authStore.js

@@ -0,0 +1,232 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.storeToken = exports.setKeychainImplementation = exports.removeToken = exports.getToken = exports.REFRESH_TOKEN_KEY = exports.ACCESS_TOKEN_KEY = void 0;
+var SecureStore = _interopRequireWildcard(require("expo-secure-store"));
+var _index = require("../logger/index.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * Token data persisted in the keychain.
+ */
+/**
+ * The two keys the library itself reads. Everything in the library that needs
+ * the bearer token, the HTTP client and the authenticated image cache,
+ * resolves it through these rather than repeating the literal, so
+ * one of them cannot silently drift and start reading a key nothing writes.
+ * Apps are free to store their own tokens under any other key.
+ */
+const ACCESS_TOKEN_KEY = exports.ACCESS_TOKEN_KEY = 'accessToken';
+const REFRESH_TOKEN_KEY = exports.REFRESH_TOKEN_KEY = 'refreshToken';
+
+/**
+ * The shape this module speaks to its store through. expo-secure-store is
+ * adapted to it below; an app or a test can supply anything else of this shape
+ * through `setKeychainImplementation`.
+ */
+/**
+ * The GENERIC password API, not the internet-credentials one.
+ *
+ * `kSecClassInternetPassword` exists for credentials bound to a server, protocol
+ * and port, and it integrates with Safari and AutoFill. A bearer token keyed by
+ * a name like "accessToken" is none of those things, and the library was only
+ * satisfying that API's required `server` argument by passing the key twice,
+ * once as the server and once as the service. That is misuse of the class.
+ *
+ * `kSecClassGenericPassword` is the class for app-local secrets, which is what a
+ * token is. It is what expo-secure-store uses underneath, and what the consumer
+ * app being migrated had already chosen for itself.
+ */
+/**
+ * The credential shape the seam reads back, declared here rather than imported
+ * from whichever package a consumer's backend comes from. A type-only import of
+ * a package this library does not declare survives into the published `.d.ts`,
+ * where a consumer that has not installed it either fails to typecheck or,
+ * under the RN template's `skipLibCheck: true`, loses all checking on these
+ * members with no signal. Any credential object with these three members
+ * satisfies it structurally.
+ */
+
+// Only what a test or the showcase injected; null means use expo-secure-store.
+let backend = null;
+
+/**
+ * expo-secure-store, adapted to the generic-password shape this module speaks.
+ *
+ * It is a flat key/value store, so the credential shape is reconstructed around
+ * it. The key is sanitised because expo rejects anything outside
+ * [A-Za-z0-9._-] at runtime, which would otherwise surface as a throw from deep
+ * inside the store rather than as a bad key.
+ */
+const keyFor = service => (service ?? 'default').replace(/[^A-Za-z0-9._-]/g, '_');
+const expoSecureStoreBackend = {
+  setGenericPassword: async (username, password, options) => {
+    await SecureStore.setItemAsync(keyFor(options?.service), JSON.stringify({
+      username,
+      password
+    }));
+    return true;
+  },
+  getGenericPassword: async options => {
+    const service = options?.service;
+    const raw = await SecureStore.getItemAsync(keyFor(service));
+    if (raw === null) {
+      return false;
+    }
+    const parsed = JSON.parse(raw);
+    return {
+      username: parsed.username,
+      password: parsed.password,
+      service: service ?? 'default'
+    };
+  },
+  resetGenericPassword: async options => {
+    await SecureStore.deleteItemAsync(keyFor(options?.service));
+    return true;
+  }
+};
+const resolveBackend = () => backend ?? expoSecureStoreBackend;
+const requireBackend = op => {
+  const b = resolveBackend();
+  if (!b) {
+    const err = new Error(`[authStore] no secure-store backend available; cannot ${op}.`);
+    _index.Logger.error(err.message);
+    throw err;
+  }
+  return b;
+};
+
+/**
+ * Replace the secure-store backend. Intended for TESTS and for the showcase,
+ * which injects a failing store to demo the write-failure path; it is not how
+ * an app configures the library. Pass `null` to restore expo-secure-store.
+ */
+const setKeychainImplementation = impl => {
+  backend = impl;
+};
+
+/**
+ * Store token with expiry.
+ */
+exports.setKeychainImplementation = setKeychainImplementation;
+const storeToken = async (key, token, expiry) => {
+  // Never log the token or expiry values: Logger forwards to whatever remote
+  // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
+  _index.Logger.info(`Storing token for key: ${key}`);
+  try {
+    const data = JSON.stringify({
+      token,
+      expiry
+    });
+    await requireBackend('store a token').setGenericPassword('token', data, {
+      service: key
+    });
+    _index.Logger.info(`Token stored successfully for key: ${key}`);
+  } catch (error) {
+    // Log AND rethrow. Swallowing this told the caller the token was persisted
+    // when it was not, so an app would show a signed-in user holding a token
+    // that never reached the keychain — the session then dies at the next
+    // cold start with no failure anyone could have seen.
+    _index.Logger.error(`Error storing token for key: ${key}`, error);
+    throw error;
+  }
+};
+
+/**
+ * Parse token data from credentials.
+ */
+exports.storeToken = storeToken;
+const parseTokenData = credentials => {
+  if (!credentials) {
+    return null;
+  }
+  const {
+    password
+  } = credentials;
+  try {
+    const parsed = JSON.parse(password);
+    if (parsed && typeof parsed === 'object' && 'token' in parsed && 'expiry' in parsed && typeof parsed.token === 'string' && typeof parsed.expiry === 'string') {
+      return parsed;
+    }
+    return null;
+  } catch {
+    // The single report for "stored, but not a token" belongs to getToken, which
+    // knows whether anything was stored at all. Logging here too made one event
+    // arrive twice, at two different levels.
+    return null;
+  }
+};
+
+/**
+ * Retrieve token and check if expired.
+ */
+const getToken = async key => {
+  try {
+    const credentials = await requireBackend('read a token').getGenericPassword({
+      service: key
+    });
+    // Nothing stored is an ORDINARY state, not a fault: a signed-out user has no
+    // token, and every authenticated request, image and download asks for one.
+    // Warning here put three info lines and a warning into the log, and into the
+    // remote crash sink, on every one of those calls.
+    if (!credentials) {
+      return null;
+    }
+    const parsedData = parseTokenData(credentials);
+    if (!parsedData) {
+      // Something IS stored and it is not a token. That is corruption worth
+      // hearing about, and it is a different event from having no token.
+      _index.Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
+      return null;
+    }
+    const {
+      token,
+      expiry
+    } = parsedData;
+    return {
+      token,
+      expiry
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    // Both spellings matter. Android throws "Key permanently invalidated" when
+    // the biometric enrolment changes; iOS throws "Secret invalidated" for the
+    // equivalent. Either way the stored value can never be decrypted again, so
+    // clearing it is the only way out: leaving it makes every later read fail
+    // identically, and the user is stuck with no route back to a login. A
+    // consumer app handled the iOS spelling and the library did not.
+    if (message.includes('Key permanently invalidated') || message.includes('Secret invalidated')) {
+      _index.Logger.error(`Stored token for key "${key}" can no longer be decrypted; clearing it.`);
+      await removeToken(key);
+      return null;
+    }
+    _index.Logger.error(`Error retrieving token for key: ${key}`, error);
+    return null;
+  }
+};
+
+/**
+ * Remove token by key.
+ */
+exports.getToken = getToken;
+const removeToken = async key => {
+  try {
+    await requireBackend('remove a token').resetGenericPassword({
+      service: key
+    });
+    _index.Logger.info(`Token removed successfully for key: ${key}`);
+  } catch (error) {
+    // Clearing a key that was never written is the ordinary logout path, not a
+    // failure: only one of the two tokens may ever have been stored. Logging it
+    // as an error puts routine traffic in the channel people watch for real
+    // problems, which is how an error channel stops being watched.
+    if (error instanceof Error && error.message.includes('Item not found')) {
+      _index.Logger.info(`No token found to remove for key: ${key}`);
+      return;
+    }
+    _index.Logger.error(`Failed to remove token for key: ${key}`, error);
+  }
+};
+exports.removeToken = removeToken;
+//# sourceMappingURL=authStore.js.map