@webority/mobile-core 0.0.29 → 0.2.0

package/lib/module/api/userClient.js

@@ -1,243 +1 @@
-"use strict";
-
-import axios, { AxiosHeaders } from 'axios';
-import { ACCESS_TOKEN_KEY, getToken } from "../auth/authStore.js";
-import { getConfigValue } from "../config/index.js";
-import { Logger } from "../logger/index.js";
-import { getLastKnownNetworkStatus } from "../network/networkStatus.js";
-import "../types/axios.js";
-import { applyConfiguredBaseUrl } from "./baseUrl.js";
-import { logCurl } from "./curl.js";
-import { sendFormDataAsMultipart } from "./multipart.js";
-import { attachRetry } from "./retry.js";
-import { dispatchLogout, getErrorMessage, getRefreshPath, isRefreshInFlight, queueBehindRefresh, refreshAccessToken, resetRefreshState } from "./tokenRefresh.js";
-export { injectStore, injectUserAuth, resetRefreshState } from "./tokenRefresh.js";
-
-// Define timeout for requests
-const REQUEST_TIMEOUT = 30000; // 30 seconds
-
-/**
- * Thrown by the request interceptor when the device is offline, before the
- * request ever reaches the adapter (and therefore the network). Distinct from
- * an AxiosError so callers can show an offline message instead of a generic
- * request failure.
- */
-export class RequestOfflineError extends Error {
-  constructor(message = 'Request blocked: device is offline') {
-    super(message);
-    this.name = 'RequestOfflineError';
-    // Babel's class transform can drop the prototype link, which makes
-    // `instanceof RequestOfflineError` false in the transpiled build.
-    Object.setPrototypeOf(this, RequestOfflineError.prototype);
-  }
-}
-
-/**
- * Sub-codes a 401 response body carries when the session itself is dead
- * (terminated by an admin, or expired server-side) rather than merely
- * out-of-date. These never warrant a refresh attempt — only logout.
- */
-export const SESSION_TERMINATION_CODES = {
-  TERMINATED: 'SESSION_TERMINATED',
-  EXPIRED: 'SESSION_EXPIRED'
-};
-const TERMINATION_CODES = new Set(Object.values(SESSION_TERMINATION_CODES));
-
-/**
- * The header is the AUTHORITATIVE signal, verified against the backend:
- * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
- * `401` + `X-Security-Stamp-Invalid: true` and a body of
- * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
- * `error` is a string rather than an object. An earlier version of this checked
- * only body fields and would therefore never have fired against a real server.
- *
- * The body codes below are kept as a secondary path for any head that does send
- * an explicit sub-code; they match on exact strings, so looking is free.
- */
-export const SESSION_INVALID_HEADER = 'x-security-stamp-invalid';
-const hasSessionInvalidHeader = headers => {
-  if (!headers || typeof headers !== 'object') {
-    return false;
-  }
-  const get = headers.get;
-  const raw = typeof get === 'function' ? get.call(headers, SESSION_INVALID_HEADER) : headers[SESSION_INVALID_HEADER];
-  return String(raw).toLowerCase() === 'true';
-};
-const getSessionTerminationCode = data => {
-  if (!data || typeof data !== 'object') {
-    return undefined;
-  }
-  const body = data;
-  const nested = body.error;
-  const candidates = [body.code, body.errorCode, nested && typeof nested === 'object' ? nested.code : undefined];
-  for (const candidate of candidates) {
-    if (typeof candidate === 'string' && TERMINATION_CODES.has(candidate)) {
-      return candidate;
-    }
-  }
-  return undefined;
-};
-
-/**
- * Internal extension of axios request config to track retry attempts.
- */
-
-const userClient = axios.create({
-  headers: {
-    'Content-Type': 'application/json',
-    'Accept-Encoding': 'gzip, deflate, br'
-  },
-  timeout: REQUEST_TIMEOUT // Set timeout for all requests
-});
-
-// Registered before the auth interceptors below, so a retryable 5xx is retried
-// before anything else sees it while a 401 still falls through to the refresh
-// flow. Policy and reasoning live in ./retry.
-attachRetry(userClient);
-const setAuthHeader = (config, token) => {
-  if (config.headers instanceof AxiosHeaders) {
-    config.headers.set('Authorization', `Bearer ${token}`);
-  } else {
-    // Fallback in case headers were provided as a plain object.
-    config.headers = AxiosHeaders.from({
-      ...config.headers,
-      Authorization: `Bearer ${token}`
-    });
-  }
-};
-const isRefreshTokenRequest = url => {
-  const path = getRefreshPath();
-  return !!path && !!url?.includes(path);
-};
-
-/**
- * Attach Authorization Token Before Requests
- */
-// Registered after the curl logger and before the auth interceptor, so that it
-// RUNS between them: axios unshifts its request chain, making the first
-// registered run last. The curl line therefore describes a request that already
-// has both its baseURL and its Authorization header.
-applyConfiguredBaseUrl(userClient);
-sendFormDataAsMultipart(userClient);
-
-// Registered BEFORE the auth interceptor below deliberately. Axios builds its
-// request chain by unshifting, so the FIRST-registered request interceptor runs
-// LAST — closest to dispatch. This one therefore observes the final config,
-// with the Authorization header already attached, which is the whole point of
-// a curl line. Registering it after would log the request before it is signed.
-userClient.interceptors.request.use(config => {
-  if (getConfigValue('logCurl')) {
-    logCurl(config);
-  }
-  return config;
-});
-userClient.interceptors.request.use(async config => {
-  // Reject before any network call when the device is known to be offline.
-  // Unknown connectivity (netinfo not installed, or undetermined) is treated
-  // as online — never block a request on an unavailable probe.
-  const network = await getLastKnownNetworkStatus();
-  if (network.isConnected === false) {
-    Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
-    return Promise.reject(new RequestOfflineError());
-  }
-  try {
-    // Skip token check for refresh token endpoint to prevent infinite loop
-    if (isRefreshTokenRequest(config.url)) {
-      return config;
-    }
-    const token = await getToken(ACCESS_TOKEN_KEY);
-
-    // Check if token exists
-    if (!token?.token) {
-      throw new Error('No access token available');
-    }
-
-    // Check if token is expired
-    const currentTime = Date.now();
-    const tokenExpiry = Date.parse(token.expiry);
-    const bufferTime = 30 * 1000; // 30 seconds buffer
-
-    // If token is expired or about to expire, try to refresh it first
-    if (tokenExpiry <= currentTime + bufferTime) {
-      Logger.info('Access token expired or about to expire, refreshing before request');
-
-      // Joins a refresh already in flight rather than starting a second one.
-      const newToken = await refreshAccessToken();
-      setAuthHeader(config, newToken);
-      return config;
-    }
-
-    // Token is valid, proceed with request
-    setAuthHeader(config, token.token);
-    return config;
-  } catch (error) {
-    Logger.error('Failed to attach token:', getErrorMessage(error));
-    return Promise.reject(error);
-  }
-}, error => {
-  Logger.error('Request error:', getErrorMessage(error));
-  return Promise.reject(error);
-});
-
-/**
- * Handle Response & Token Refresh
- */
-userClient.interceptors.response.use(response => response, async error => {
-  if (!axios.isAxiosError(error)) {
-    Logger.error(`Non-axios error in response interceptor: ${getErrorMessage(error)}`);
-    return Promise.reject(error);
-  }
-  const axiosError = error;
-  const originalRequest = axiosError.config;
-  if (!axiosError.response) {
-    if (!originalRequest?.skipErrorLog) {
-      Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
-    }
-    return Promise.reject(error);
-  }
-  if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
-    // The refresh call goes through this client. A 401 on it must not queue behind
-    // refreshTokenPromise: that promise is the call itself, so queueing deadlocks it
-    // and every later 401 waits forever.
-    if (isRefreshTokenRequest(originalRequest.url)) {
-      return Promise.reject(error);
-    }
-    const terminationCode = getSessionTerminationCode(axiosError.response.data) ?? (hasSessionInvalidHeader(axiosError.response.headers) ? SESSION_TERMINATION_CODES.TERMINATED : undefined);
-    if (terminationCode) {
-      // The session is dead server-side — a refresh would only burn a
-      // pointless round-trip, so go straight to logout.
-      Logger.warn(`Session ${terminationCode}, logging out without refresh. URL: ${originalRequest.url}`);
-      resetRefreshState();
-      await dispatchLogout();
-      return Promise.reject(error);
-    }
-    Logger.warn(`Unauthorized URL: ${originalRequest.url}`);
-    originalRequest._retry = true;
-
-    // If we already have a refresh in progress, queue this request
-    if (isRefreshInFlight()) {
-      return queueBehindRefresh().then(token => {
-        Logger.info('Retrying request after token refresh:', originalRequest.url);
-        setAuthHeader(originalRequest, token);
-        return userClient(originalRequest);
-      }).catch(err => {
-        Logger.error('Failed to retry request after token refresh:', getErrorMessage(err));
-        return Promise.reject(err);
-      });
-    }
-    try {
-      // Start a new token refresh process and wait for it to complete
-      const newToken = await refreshAccessToken();
-      setAuthHeader(originalRequest, newToken);
-      return userClient(originalRequest);
-    } catch (err) {
-      return Promise.reject(err);
-    }
-  }
-  if (!originalRequest?.skipErrorLog) {
-    Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
-  }
-  return Promise.reject(error);
-});
-export default userClient;
-//# sourceMappingURL=userClient.js.map
+"use strict";import axios,{AxiosHeaders}from"axios";import{ACCESS_TOKEN_KEY,getToken}from"../auth/authStore.js";import{getConfigValue}from"../config/index.js";import{Logger}from"../logger/index.js";import{getLastKnownNetworkStatus}from"../network/networkStatus.js";import"../types/axios.js";import{applyConfiguredBaseUrl}from"./baseUrl.js";import{applyAccountIdHeader,applyClientHeaders}from"./clientHeaders.js";import{logCurl}from"./curl.js";import{readMinAppVersion}from"./minAppVersion.js";import{sendFormDataAsMultipart}from"./multipart.js";import{applyRequestDefaults}from"./requestDefaults.js";import{responseBodyText}from"./responseBodyText.js";import{attachRetry}from"./retry.js";import{endSessionAndLogout,getAccountIdProvider,getErrorMessage,getRefreshPath,isRefreshInFlight,queueBehindRefresh,readSignOutReason,refreshAccessToken,resetRefreshState}from"./tokenRefresh.js";export{injectStore,injectUserAuth,resetRefreshState,SIGN_OUT_REASON_HEADER}from"./tokenRefresh.js";export class RequestOfflineError extends Error{constructor(e="Request blocked: device is offline"){super(e),this.name="RequestOfflineError",Object.setPrototypeOf(this,RequestOfflineError.prototype)}}export const SESSION_TERMINATION_CODES={TERMINATED:"SESSION_TERMINATED",EXPIRED:"SESSION_EXPIRED"};const TERMINATION_CODES=new Set(Object.values(SESSION_TERMINATION_CODES));export const SESSION_INVALID_HEADER="x-security-stamp-invalid";const hasSessionInvalidHeader=e=>{if(!e||"object"!=typeof e)return!1;const r=e.get,t="function"==typeof r?r.call(e,SESSION_INVALID_HEADER):e[SESSION_INVALID_HEADER];return"true"===String(t).toLowerCase()},getSessionTerminationCode=e=>{if(!e||"object"!=typeof e)return;const r=e,t=r.error,s=[r.code,r.errorCode,t&&"object"==typeof t?t.code:void 0];for(const e of s)if("string"==typeof e&&TERMINATION_CODES.has(e))return e},userClient=axios.create({headers:{"Content-Type":"application/json"}});readMinAppVersion(userClient),attachRetry(userClient);const setAuthHeader=(e,r)=>{e.headers instanceof AxiosHeaders?e.headers.set("Authorization",`Bearer ${r}`):e.headers=AxiosHeaders.from({...e.headers,Authorization:`Bearer ${r}`})},isRefreshTokenRequest=e=>{const r=getRefreshPath();return!!r&&!!e?.includes(r)};applyConfiguredBaseUrl(userClient),applyRequestDefaults(userClient),sendFormDataAsMultipart(userClient),userClient.interceptors.request.use(e=>(getConfigValue("logCurl")&&logCurl(e),e)),applyClientHeaders(userClient),userClient.interceptors.request.use(async e=>{if(!1===(await getLastKnownNetworkStatus()).isConnected)return Logger.warn(`Request blocked: device is offline. URL: ${e.url}`),Promise.reject(new RequestOfflineError);try{if(isRefreshTokenRequest(e.url))return e;const r=await getToken(ACCESS_TOKEN_KEY);if(!r?.token)throw new Error("No access token available");const t=Date.now(),s=Date.parse(r.expiry);if(s<=t+3e4){Logger.info("Access token expired or about to expire, refreshing before request");const r=await refreshAccessToken();return setAuthHeader(e,r),await applyAccountIdHeader(e.headers,getAccountIdProvider()),e}return setAuthHeader(e,r.token),await applyAccountIdHeader(e.headers,getAccountIdProvider()),e}catch(e){return Logger.error("Failed to attach token:",getErrorMessage(e)),Promise.reject(e)}},e=>(Logger.error("Request error:",getErrorMessage(e)),Promise.reject(e))),userClient.interceptors.response.use(e=>e,async e=>{if(!axios.isAxiosError(e))return Logger.error(`Non-axios error in response interceptor: ${getErrorMessage(e)}`),Promise.reject(e);const r=e,t=r.config;if(!r.response)return t?.skipErrorLog||Logger.error(`Network error or no response from server: ${r.message}, URL: ${t?.url}`),Promise.reject(e);if(401===r.response.status&&t&&!t._retry){if(isRefreshTokenRequest(t.url))return Promise.reject(e);const s=readSignOutReason(r.response.headers),o=getSessionTerminationCode(r.response.data)??(hasSessionInvalidHeader(r.response.headers)||null!==s?SESSION_TERMINATION_CODES.TERMINATED:void 0);if(o)return Logger.warn(`Session ${o}, logging out without refresh. URL: ${t.url}`),resetRefreshState(),await endSessionAndLogout("terminated",s),Promise.reject(e);if(Logger.warn(`Unauthorized URL: ${t.url}`),t._retry=!0,isRefreshInFlight())return queueBehindRefresh().then(e=>(Logger.info("Retrying request after token refresh:",t.url),setAuthHeader(t,e),userClient(t))).catch(e=>(Logger.error("Failed to retry request after token refresh:",getErrorMessage(e)),Promise.reject(e)));try{const e=await refreshAccessToken();return setAuthHeader(t,e),userClient(t)}catch(e){return Promise.reject(e)}}return t?.skipErrorLog||Logger.error(`Response error: ${responseBodyText(r.response?.data,r.message)}, URL: ${t?.url}, Status: ${r.response.status}`),Promise.reject(e)});export default userClient;

package/lib/module/auth/authStore.js

@@ -1,257 +1 @@
-"use strict";
-
-import * as SecureStore from 'expo-secure-store';
-import { Logger } from "../logger/index.js";
-
-/**
- * Token data persisted in the keychain.
- */
-/**
- * The two keys the library itself reads. Everything in the library that needs
- * the bearer token, the HTTP client and the authenticated image cache,
- * resolves it through these rather than repeating the literal, so
- * one of them cannot silently drift and start reading a key nothing writes.
- * Apps are free to store their own tokens under any other key.
- */
-export const ACCESS_TOKEN_KEY = 'accessToken';
-export const REFRESH_TOKEN_KEY = 'refreshToken';
-
-/**
- * The shape this module speaks to its store through. expo-secure-store is
- * adapted to it below; an app or a test can supply anything else of this shape
- * through `setKeychainImplementation`.
- */
-/**
- * The GENERIC password API, not the internet-credentials one.
- *
- * `kSecClassInternetPassword` exists for credentials bound to a server, protocol
- * and port, and it integrates with Safari and AutoFill. A bearer token keyed by
- * a name like "accessToken" is none of those things, and the library was only
- * satisfying that API's required `server` argument by passing the key twice,
- * once as the server and once as the service. That is misuse of the class.
- *
- * `kSecClassGenericPassword` is the class for app-local secrets, which is what a
- * token is. It is what expo-secure-store uses underneath, and what the consumer
- * app being migrated had already chosen for itself.
- */
-/**
- * The credential shape the seam reads back, declared here rather than imported
- * from whichever package a consumer's backend comes from. A type-only import of
- * a package this library does not declare survives into the published `.d.ts`,
- * where a consumer that has not installed it either fails to typecheck or,
- * under the RN template's `skipLibCheck: true`, loses all checking on these
- * members with no signal. Any credential object with these three members
- * satisfies it structurally.
- */
-
-// Only what a test or the showcase injected; null means use expo-secure-store.
-let backend = null;
-
-/**
- * expo-secure-store, adapted to the generic-password shape this module speaks.
- *
- * It is a flat key/value store, so the credential shape is reconstructed around
- * it. The key is sanitised because expo rejects anything outside
- * [A-Za-z0-9._-] at runtime, which would otherwise surface as a throw from deep
- * inside the store rather than as a bad key.
- */
-const keyFor = service => (service ?? 'default').replace(/[^A-Za-z0-9._-]/g, '_');
-const expoSecureStoreBackend = {
-  setGenericPassword: async (username, password, options) => {
-    await SecureStore.setItemAsync(keyFor(options?.service), JSON.stringify({
-      username,
-      password
-    }));
-    return true;
-  },
-  getGenericPassword: async options => {
-    const service = options?.service;
-    const raw = await SecureStore.getItemAsync(keyFor(service));
-    if (raw === null) {
-      return false;
-    }
-    const parsed = JSON.parse(raw);
-    return {
-      username: parsed.username,
-      password: parsed.password,
-      service: service ?? 'default'
-    };
-  },
-  resetGenericPassword: async options => {
-    await SecureStore.deleteItemAsync(keyFor(options?.service));
-    return true;
-  }
-};
-const resolveBackend = () => backend ?? expoSecureStoreBackend;
-
-/**
- * Every request reads the access token, and a secure-store read is a native
- * keychain/keystore decrypt. Reads are therefore served from memory, written
- * through by `storeToken` and dropped by `removeToken`. `generation` moves on
- * every write, removal and backend swap, so a read that started before one of
- * those cannot cache the value it saw.
- */
-const memo = new Map();
-let generation = 0;
-const forget = key => {
-  generation += 1;
-  if (key === undefined) {
-    memo.clear();
-  } else {
-    memo.delete(key);
-  }
-};
-const requireBackend = op => {
-  const b = resolveBackend();
-  if (!b) {
-    const err = new Error(`[authStore] no secure-store backend available; cannot ${op}.`);
-    Logger.error(err.message);
-    throw err;
-  }
-  return b;
-};
-
-/**
- * Replace the secure-store backend. Intended for TESTS and for the showcase,
- * which injects a failing store to demo the write-failure path; it is not how
- * an app configures the library. Pass `null` to restore expo-secure-store.
- */
-export const setKeychainImplementation = impl => {
-  backend = impl;
-  forget();
-};
-
-/**
- * Store token with expiry.
- */
-export const storeToken = async (key, token, expiry) => {
-  // Never log the token or expiry values: Logger forwards to whatever remote
-  // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
-  Logger.info(`Storing token for key: ${key}`);
-  forget(key);
-  try {
-    const data = JSON.stringify({
-      token,
-      expiry
-    });
-    await requireBackend('store a token').setGenericPassword('token', data, {
-      service: key
-    });
-    forget(key);
-    memo.set(key, {
-      token,
-      expiry
-    });
-    Logger.info(`Token stored successfully for key: ${key}`);
-  } catch (error) {
-    forget(key);
-    // Log AND rethrow. Swallowing this told the caller the token was persisted
-    // when it was not, so an app would show a signed-in user holding a token
-    // that never reached the keychain — the session then dies at the next
-    // cold start with no failure anyone could have seen.
-    Logger.error(`Error storing token for key: ${key}`, error);
-    throw error;
-  }
-};
-
-/**
- * Parse token data from credentials.
- */
-const parseTokenData = credentials => {
-  if (!credentials) {
-    return null;
-  }
-  const {
-    password
-  } = credentials;
-  try {
-    const parsed = JSON.parse(password);
-    if (parsed && typeof parsed === 'object' && 'token' in parsed && 'expiry' in parsed && typeof parsed.token === 'string' && typeof parsed.expiry === 'string') {
-      return parsed;
-    }
-    return null;
-  } catch {
-    // The single report for "stored, but not a token" belongs to getToken, which
-    // knows whether anything was stored at all. Logging here too made one event
-    // arrive twice, at two different levels.
-    return null;
-  }
-};
-
-/**
- * Retrieve token and check if expired.
- */
-export const getToken = async key => {
-  if (memo.has(key)) {
-    return memo.get(key) ?? null;
-  }
-  const seen = generation;
-  try {
-    const credentials = await requireBackend('read a token').getGenericPassword({
-      service: key
-    });
-    // Nothing stored is an ORDINARY state, not a fault: a signed-out user has no
-    // token, and every authenticated request, image and download asks for one.
-    // Warning here put three info lines and a warning into the log, and into the
-    // remote crash sink, on every one of those calls.
-    let value = null;
-    if (credentials) {
-      const parsedData = parseTokenData(credentials);
-      if (parsedData) {
-        value = {
-          token: parsedData.token,
-          expiry: parsedData.expiry
-        };
-      } else {
-        // Something IS stored and it is not a token. That is corruption worth
-        // hearing about, and it is a different event from having no token.
-        Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
-      }
-    }
-    if (seen === generation) {
-      memo.set(key, value);
-    }
-    return value;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    // Both spellings matter. Android throws "Key permanently invalidated" when
-    // the biometric enrolment changes; iOS throws "Secret invalidated" for the
-    // equivalent. Either way the stored value can never be decrypted again, so
-    // clearing it is the only way out: leaving it makes every later read fail
-    // identically, and the user is stuck with no route back to a login. A
-    // consumer app handled the iOS spelling and the library did not.
-    if (message.includes('Key permanently invalidated') || message.includes('Secret invalidated')) {
-      Logger.error(`Stored token for key "${key}" can no longer be decrypted; clearing it.`);
-      await removeToken(key);
-      return null;
-    }
-    Logger.error(`Error retrieving token for key: ${key}`, error);
-    return null;
-  }
-};
-
-/**
- * Remove token by key.
- */
-export const removeToken = async key => {
-  forget(key);
-  try {
-    await requireBackend('remove a token').resetGenericPassword({
-      service: key
-    });
-    Logger.info(`Token removed successfully for key: ${key}`);
-  } catch (error) {
-    // Clearing a key that was never written is the ordinary logout path, not a
-    // failure: only one of the two tokens may ever have been stored. Logging it
-    // as an error puts routine traffic in the channel people watch for real
-    // problems, which is how an error channel stops being watched.
-    if (error instanceof Error && error.message.includes('Item not found')) {
-      Logger.info(`No token found to remove for key: ${key}`);
-      return;
-    }
-    Logger.error(`Failed to remove token for key: ${key}`, error);
-  } finally {
-    forget(key);
-  }
-};
-//# sourceMappingURL=authStore.js.map
+"use strict";import*as SecureStore from"expo-secure-store";import{Logger}from"../logger/index.js";import{Storage}from"../storage/index.js";import{getJWTExpiry}from"./jwt.js";export const ACCESS_TOKEN_KEY="accessToken";export const REFRESH_TOKEN_KEY="refreshToken";export const SESSION_USER_KEY="sessionUser";export const LEGACY_REFRESH_TOKEN_LIFETIME_MS=2592e6;let backend=null;const keyFor=e=>(e??"default").replace(/[^A-Za-z0-9._-]/g,"_"),expoSecureStoreBackend={setGenericPassword:async(e,r,o)=>(await SecureStore.setItemAsync(keyFor(o?.service),JSON.stringify({username:e,password:r})),!0),getGenericPassword:async e=>{const r=e?.service,o=await SecureStore.getItemAsync(keyFor(r));if(null===o)return!1;const t=JSON.parse(o);return{username:t.username,password:t.password,service:r??"default"}},resetGenericPassword:async e=>(await SecureStore.deleteItemAsync(keyFor(e?.service)),!0)},resolveBackend=()=>backend??expoSecureStoreBackend,memo=new Map;let generation=0;const forget=e=>{generation+=1,void 0===e?memo.clear():memo.delete(e)},requireBackend=e=>{const r=resolveBackend();if(!r){const r=new Error(`[authStore] no secure-store backend available; cannot ${e}.`);throw Logger.error(r.message),r}return r};export const setKeychainImplementation=e=>{backend=e,forget()};export const storeToken=async(e,r,o)=>{Logger.info(`Storing token for key: ${e}`),forget(e);try{const t=JSON.stringify({token:r,expiry:o});await requireBackend("store a token").setGenericPassword("token",t,{service:e}),forget(e),memo.set(e,{token:r,expiry:o}),Logger.info(`Token stored successfully for key: ${e}`)}catch(r){throw forget(e),Logger.error(`Error storing token for key: ${e}`,r),r}};const parseTokenData=e=>{if(!e)return null;const{password:r}=e;try{const e=JSON.parse(r);return e&&"object"==typeof e&&"token"in e&&"expiry"in e&&"string"==typeof e.token&&"string"==typeof e.expiry?e:null}catch{return null}};export const getToken=async e=>{if(isSessionKey(e)&&legacyKeys&&await migrateLegacySession(),memo.has(e))return memo.get(e)??null;const r=generation;try{const o=await requireBackend("read a token").getGenericPassword({service:e});let t=null;if(o){const r=parseTokenData(o);if(r)t={token:r.token,expiry:r.expiry};else if(Logger.warn(`Stored credentials for key "${e}" are not a valid token; ignoring them.`),isSessionKey(e))return await endSession("corrupt",!0),null}return r===generation&&memo.set(e,t),t}catch(r){const o=r instanceof Error?r.message:String(r);return o.includes("Key permanently invalidated")||o.includes("Secret invalidated")?(Logger.error(`Stored token for key "${e}" can no longer be decrypted; clearing it.`),isSessionKey(e)?await endSession("corrupt",!0):await removeToken(e),null):(Logger.error(`Error retrieving token for key: ${e}`,r),null)}};export const removeToken=async e=>{forget(e);try{await requireBackend("remove a token").resetGenericPassword({service:e}),Logger.info(`Token removed successfully for key: ${e}`)}catch(r){if(r instanceof Error&&r.message.includes("Item not found"))return void Logger.info(`No token found to remove for key: ${e}`);Logger.error(`Failed to remove token for key: ${e}`,r)}finally{forget(e)}};const isSessionKey=e=>"accessToken"===e||"refreshToken"===e;export const storeSessionUser=async e=>{if(!await Storage.setItem("sessionUser",JSON.stringify(e)))throw new Error("[authStore] could not store the session user.")};export const getSessionUser=async()=>{const e=await Storage.getItem("sessionUser");if(null===e)return null;try{return JSON.parse(e)}catch{return Logger.warn("The stored session user is not valid JSON; clearing it."),await removeSessionUser(),null}};export const removeSessionUser=async()=>{await Storage.removeItem("sessionUser")};let legacyKeys=null,legacyCheck=null;export const setLegacyTokenKeys=e=>{legacyKeys=e,legacyCheck=null};const readLegacyToken=e=>{try{const r=JSON.parse(e);if("string"==typeof r)return""===r.trim()?null:{token:r,expiry:null};if(r&&"object"==typeof r&&"string"==typeof r.token&&"string"==typeof r.expiry)return r}catch{}return""===e.trim()?null:{token:e,expiry:null}},expiryOf=e=>3===e.split(".").length?getJWTExpiry(e)?.toISOString()??null:null,readLegacyRaw=async e=>{const r=await resolveBackend().getGenericPassword({service:e});return r?r.password:null},migrateLegacySession=()=>{if(!legacyKeys)return Promise.resolve();if(legacyCheck)return legacyCheck;const e=legacyKeys;return legacyCheck=(async()=>{try{const r=resolveBackend(),o=!await r.getGenericPassword({service:"accessToken"})&&!await r.getGenericPassword({service:"refreshToken"}),t=await readLegacyRaw(e.accessToken),n=await readLegacyRaw(e.refreshToken);if(o&&(null!==t||null!==n)){const o=null===t?null:readLegacyToken(t),s=null===n?null:readLegacyToken(n);if(o){const e=o.expiry??expiryOf(o.token)??(new Date).toISOString();await r.setGenericPassword("token",JSON.stringify({token:o.token,expiry:e}),{service:"accessToken"})}if(s){const e=s.expiry??expiryOf(s.token)??new Date(Date.now()+2592e6).toISOString();await r.setGenericPassword("token",JSON.stringify({token:s.token,expiry:e}),{service:"refreshToken"})}if(e.sessionUser){const r=await Storage.getItem(e.sessionUser);null!==r&&await Storage.setItem("sessionUser",r)}null===o&&null===s||(forget(),Logger.breadcrumb("[authStore] moved a session from the legacy token keys"))}for(const o of[e.accessToken,e.refreshToken])await r.resetGenericPassword({service:o}).catch(()=>{});e.sessionUser&&await Storage.removeItem(e.sessionUser)}catch(e){Logger.error("[authStore] could not move the session from the legacy token keys",e)}})(),legacyCheck},listeners=new Set,emitSessionEnded=(e,r)=>{for(const o of[...listeners])try{o(e,r)}catch(e){Logger.error("[authStore] a session-ended listener threw",e)}};export const addSessionEndedListener=e=>(listeners.add(e),()=>{listeners.delete(e)});const endSession=async(e,r,o=null)=>{const t=r||null!==await getToken("accessToken")||null!==await getToken("refreshToken");await removeToken("accessToken"),await removeToken("refreshToken"),await removeSessionUser(),t&&emitSessionEnded(e,{signOutReason:o})};export const clearSession=async(e="signedOut",r={})=>endSession(e,!1,r.signOutReason??null);

package/lib/module/auth/index.js

@@ -1,5 +1 @@
-"use strict";
-
-export { getToken, removeToken, storeToken } from "./authStore.js";
-export { decodeJWT, getJWTExpiry, isJWTExpired } from "./jwt.js";
-//# sourceMappingURL=index.js.map
+"use strict";export{ACCESS_TOKEN_KEY,addSessionEndedListener,clearSession,getSessionUser,getToken,LEGACY_REFRESH_TOKEN_LIFETIME_MS,REFRESH_TOKEN_KEY,removeSessionUser,removeToken,SESSION_USER_KEY,setLegacyTokenKeys,storeSessionUser,storeToken}from"./authStore.js";export{decodeJWT,getJWTExpiry,isJWTExpired}from"./jwt.js";

package/lib/module/auth/jwt.js

@@ -1,106 +1 @@
-"use strict";
-
-import { Logger } from "../logger/index.js";
-
-/**
- * Standard claims plus arbitrary keys.
- * `sub`, `exp`, `iat`, `nbf` follow RFC 7519 conventions.
- */
-
-const base64UrlToBase64 = input => {
-  const padded = input + '='.repeat((4 - input.length % 4) % 4);
-  return padded.replace(/-/g, '+').replace(/_/g, '/');
-};
-const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-
-/**
- * Pure-JS base64, used only when the runtime has no `atob`.
- *
- * This used to be `require('buffer')`. That was a latent bundling failure for
- * every consumer: `buffer` is a Node builtin that React Native does not
- * provide, it was never declared as a dependency, and Metro resolves requires
- * STATICALLY — so sitting inside an unreached fallback branch did not save it.
- * The app still failed to bundle, with an error naming this file. It only went
- * unnoticed because the repo's own checks never bundle for a device.
- *
- * Decoding four base64 characters yields three bytes; the padding tells us how
- * many of those three are real.
- */
-const decodeBase64Fallback = input => {
-  let out = '';
-  for (let i = 0; i < input.length; i += 4) {
-    const chunk = [0, 1, 2, 3].map(offset => BASE64_ALPHABET.indexOf(input[i + offset] ?? '='));
-    const bits = Math.max(chunk[0], 0) << 18 | Math.max(chunk[1], 0) << 12 | Math.max(chunk[2], 0) << 6 | Math.max(chunk[3], 0);
-    out += String.fromCharCode(bits >> 16 & 0xff);
-    if (chunk[2] !== -1) {
-      out += String.fromCharCode(bits >> 8 & 0xff);
-    }
-    if (chunk[3] !== -1) {
-      out += String.fromCharCode(bits & 0xff);
-    }
-  }
-  return out;
-};
-const decodeBase64 = input =>
-// Every RN runtime the library supports has `atob` (Hermes 0.71+), so the
-// fallback is a safety net rather than a path anyone is expected to take.
-typeof atob === 'function' ? atob(input) : decodeBase64Fallback(input);
-const utf8FromBinary = binary => {
-  // Convert percent-encoded UTF-8 sequence so multi-byte chars survive.
-  try {
-    return decodeURIComponent(binary.split('').map(c => '%' + c.charCodeAt(0).toString(16).padStart(2, '0')).join(''));
-  } catch {
-    return binary;
-  }
-};
-
-/**
- * Decode a JWT's payload claims. Does **not** verify the signature.
- *
- * @returns claims object on success, `null` if the token is malformed.
- */
-export const decodeJWT = token => {
-  if (!token || typeof token !== 'string') {
-    return null;
-  }
-  const parts = token.split('.');
-  if (parts.length !== 3) {
-    Logger.warn('[jwt] decodeJWT: token is not a valid JWT (expected 3 segments)');
-    return null;
-  }
-  try {
-    const payload = parts[1];
-    const json = utf8FromBinary(decodeBase64(base64UrlToBase64(payload)));
-    return JSON.parse(json);
-  } catch (error) {
-    Logger.warn('[jwt] decodeJWT failed to parse payload', error);
-    return null;
-  }
-};
-
-/**
- * Returns true when the token is expired (or unparseable / missing `exp`).
- *
- * @param token JWT string
- * @param leewaySeconds amount of clock-skew tolerance to apply (default 30s)
- */
-export const isJWTExpired = (token, leewaySeconds = 30) => {
-  const claims = decodeJWT(token);
-  if (!claims || typeof claims.exp !== 'number') {
-    return true;
-  }
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  return claims.exp <= nowSeconds + leewaySeconds;
-};
-
-/**
- * Returns the token's expiry as a Date, or `null` when no `exp` claim exists.
- */
-export const getJWTExpiry = token => {
-  const claims = decodeJWT(token);
-  if (!claims || typeof claims.exp !== 'number') {
-    return null;
-  }
-  return new Date(claims.exp * 1000);
-};
-//# sourceMappingURL=jwt.js.map
+"use strict";import{Logger}from"../logger/index.js";const base64UrlToBase64=e=>(e+"=".repeat((4-e.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/"),BASE64_ALPHABET="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",decodeBase64Fallback=e=>{let t="";for(let r=0;r<e.length;r+=4){const o=[0,1,2,3].map(t=>BASE64_ALPHABET.indexOf(e[r+t]??"=")),n=Math.max(o[0],0)<<18|Math.max(o[1],0)<<12|Math.max(o[2],0)<<6|Math.max(o[3],0);t+=String.fromCharCode(n>>16&255),-1!==o[2]&&(t+=String.fromCharCode(n>>8&255)),-1!==o[3]&&(t+=String.fromCharCode(255&n))}return t},decodeBase64=e=>"function"==typeof atob?atob(e):decodeBase64Fallback(e),utf8FromBinary=e=>{try{return decodeURIComponent(e.split("").map(e=>"%"+e.charCodeAt(0).toString(16).padStart(2,"0")).join(""))}catch{return e}};export const decodeJWT=e=>{if(!e||"string"!=typeof e)return null;const t=e.split(".");if(3!==t.length)return Logger.warn("[jwt] decodeJWT: token is not a valid JWT (expected 3 segments)"),null;try{const e=t[1],r=utf8FromBinary(decodeBase64(base64UrlToBase64(e)));return JSON.parse(r)}catch(e){return Logger.warn("[jwt] decodeJWT failed to parse payload",e),null}};export const isJWTExpired=(e,t=30)=>{const r=decodeJWT(e);if(!r||"number"!=typeof r.exp)return!0;const o=Math.floor(Date.now()/1e3);return r.exp<=o+t};export const getJWTExpiry=e=>{const t=decodeJWT(e);return t&&"number"==typeof t.exp?new Date(1e3*t.exp):null};