@webority/mobile-core 0.0.29 → 0.2.0

package/lib/commonjs/api/userClient.js

@@ -1,265 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = exports.SESSION_TERMINATION_CODES = exports.SESSION_INVALID_HEADER = exports.RequestOfflineError = void 0;
-Object.defineProperty(exports, "injectStore", {
-  enumerable: true,
-  get: function () {
-    return _tokenRefresh.injectStore;
-  }
-});
-Object.defineProperty(exports, "injectUserAuth", {
-  enumerable: true,
-  get: function () {
-    return _tokenRefresh.injectUserAuth;
-  }
-});
-Object.defineProperty(exports, "resetRefreshState", {
-  enumerable: true,
-  get: function () {
-    return _tokenRefresh.resetRefreshState;
-  }
-});
-var _axios = _interopRequireWildcard(require("axios"));
-var _authStore = require("../auth/authStore.js");
-var _index = require("../config/index.js");
-var _index2 = require("../logger/index.js");
-var _networkStatus = require("../network/networkStatus.js");
-require("../types/axios.js");
-var _baseUrl = require("./baseUrl.js");
-var _curl = require("./curl.js");
-var _multipart = require("./multipart.js");
-var _retry = require("./retry.js");
-var _tokenRefresh = require("./tokenRefresh.js");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-// Define timeout for requests
-const REQUEST_TIMEOUT = 30000; // 30 seconds
-
-/**
- * Thrown by the request interceptor when the device is offline, before the
- * request ever reaches the adapter (and therefore the network). Distinct from
- * an AxiosError so callers can show an offline message instead of a generic
- * request failure.
- */
-class RequestOfflineError extends Error {
-  constructor(message = 'Request blocked: device is offline') {
-    super(message);
-    this.name = 'RequestOfflineError';
-    // Babel's class transform can drop the prototype link, which makes
-    // `instanceof RequestOfflineError` false in the transpiled build.
-    Object.setPrototypeOf(this, RequestOfflineError.prototype);
-  }
-}
-
-/**
- * Sub-codes a 401 response body carries when the session itself is dead
- * (terminated by an admin, or expired server-side) rather than merely
- * out-of-date. These never warrant a refresh attempt — only logout.
- */
-exports.RequestOfflineError = RequestOfflineError;
-const SESSION_TERMINATION_CODES = exports.SESSION_TERMINATION_CODES = {
-  TERMINATED: 'SESSION_TERMINATED',
-  EXPIRED: 'SESSION_EXPIRED'
-};
-const TERMINATION_CODES = new Set(Object.values(SESSION_TERMINATION_CODES));
-
-/**
- * The header is the AUTHORITATIVE signal, verified against the backend:
- * `WeborityJwtMiddleware.ReturnUnauthorized` answers an invalidated session with
- * `401` + `X-Security-Stamp-Invalid: true` and a body of
- * `{ error: 'Unauthorized', message: '...' }` — no code field at all, and
- * `error` is a string rather than an object. An earlier version of this checked
- * only body fields and would therefore never have fired against a real server.
- *
- * The body codes below are kept as a secondary path for any head that does send
- * an explicit sub-code; they match on exact strings, so looking is free.
- */
-const SESSION_INVALID_HEADER = exports.SESSION_INVALID_HEADER = 'x-security-stamp-invalid';
-const hasSessionInvalidHeader = headers => {
-  if (!headers || typeof headers !== 'object') {
-    return false;
-  }
-  const get = headers.get;
-  const raw = typeof get === 'function' ? get.call(headers, SESSION_INVALID_HEADER) : headers[SESSION_INVALID_HEADER];
-  return String(raw).toLowerCase() === 'true';
-};
-const getSessionTerminationCode = data => {
-  if (!data || typeof data !== 'object') {
-    return undefined;
-  }
-  const body = data;
-  const nested = body.error;
-  const candidates = [body.code, body.errorCode, nested && typeof nested === 'object' ? nested.code : undefined];
-  for (const candidate of candidates) {
-    if (typeof candidate === 'string' && TERMINATION_CODES.has(candidate)) {
-      return candidate;
-    }
-  }
-  return undefined;
-};
-
-/**
- * Internal extension of axios request config to track retry attempts.
- */
-
-const userClient = _axios.default.create({
-  headers: {
-    'Content-Type': 'application/json',
-    'Accept-Encoding': 'gzip, deflate, br'
-  },
-  timeout: REQUEST_TIMEOUT // Set timeout for all requests
-});
-
-// Registered before the auth interceptors below, so a retryable 5xx is retried
-// before anything else sees it while a 401 still falls through to the refresh
-// flow. Policy and reasoning live in ./retry.
-(0, _retry.attachRetry)(userClient);
-const setAuthHeader = (config, token) => {
-  if (config.headers instanceof _axios.AxiosHeaders) {
-    config.headers.set('Authorization', `Bearer ${token}`);
-  } else {
-    // Fallback in case headers were provided as a plain object.
-    config.headers = _axios.AxiosHeaders.from({
-      ...config.headers,
-      Authorization: `Bearer ${token}`
-    });
-  }
-};
-const isRefreshTokenRequest = url => {
-  const path = (0, _tokenRefresh.getRefreshPath)();
-  return !!path && !!url?.includes(path);
-};
-
-/**
- * Attach Authorization Token Before Requests
- */
-// Registered after the curl logger and before the auth interceptor, so that it
-// RUNS between them: axios unshifts its request chain, making the first
-// registered run last. The curl line therefore describes a request that already
-// has both its baseURL and its Authorization header.
-(0, _baseUrl.applyConfiguredBaseUrl)(userClient);
-(0, _multipart.sendFormDataAsMultipart)(userClient);
-
-// Registered BEFORE the auth interceptor below deliberately. Axios builds its
-// request chain by unshifting, so the FIRST-registered request interceptor runs
-// LAST — closest to dispatch. This one therefore observes the final config,
-// with the Authorization header already attached, which is the whole point of
-// a curl line. Registering it after would log the request before it is signed.
-userClient.interceptors.request.use(config => {
-  if ((0, _index.getConfigValue)('logCurl')) {
-    (0, _curl.logCurl)(config);
-  }
-  return config;
-});
-userClient.interceptors.request.use(async config => {
-  // Reject before any network call when the device is known to be offline.
-  // Unknown connectivity (netinfo not installed, or undetermined) is treated
-  // as online — never block a request on an unavailable probe.
-  const network = await (0, _networkStatus.getLastKnownNetworkStatus)();
-  if (network.isConnected === false) {
-    _index2.Logger.warn(`Request blocked: device is offline. URL: ${config.url}`);
-    return Promise.reject(new RequestOfflineError());
-  }
-  try {
-    // Skip token check for refresh token endpoint to prevent infinite loop
-    if (isRefreshTokenRequest(config.url)) {
-      return config;
-    }
-    const token = await (0, _authStore.getToken)(_authStore.ACCESS_TOKEN_KEY);
-
-    // Check if token exists
-    if (!token?.token) {
-      throw new Error('No access token available');
-    }
-
-    // Check if token is expired
-    const currentTime = Date.now();
-    const tokenExpiry = Date.parse(token.expiry);
-    const bufferTime = 30 * 1000; // 30 seconds buffer
-
-    // If token is expired or about to expire, try to refresh it first
-    if (tokenExpiry <= currentTime + bufferTime) {
-      _index2.Logger.info('Access token expired or about to expire, refreshing before request');
-
-      // Joins a refresh already in flight rather than starting a second one.
-      const newToken = await (0, _tokenRefresh.refreshAccessToken)();
-      setAuthHeader(config, newToken);
-      return config;
-    }
-
-    // Token is valid, proceed with request
-    setAuthHeader(config, token.token);
-    return config;
-  } catch (error) {
-    _index2.Logger.error('Failed to attach token:', (0, _tokenRefresh.getErrorMessage)(error));
-    return Promise.reject(error);
-  }
-}, error => {
-  _index2.Logger.error('Request error:', (0, _tokenRefresh.getErrorMessage)(error));
-  return Promise.reject(error);
-});
-
-/**
- * Handle Response & Token Refresh
- */
-userClient.interceptors.response.use(response => response, async error => {
-  if (!_axios.default.isAxiosError(error)) {
-    _index2.Logger.error(`Non-axios error in response interceptor: ${(0, _tokenRefresh.getErrorMessage)(error)}`);
-    return Promise.reject(error);
-  }
-  const axiosError = error;
-  const originalRequest = axiosError.config;
-  if (!axiosError.response) {
-    if (!originalRequest?.skipErrorLog) {
-      _index2.Logger.error(`Network error or no response from server: ${axiosError.message}, URL: ${originalRequest?.url}`);
-    }
-    return Promise.reject(error);
-  }
-  if (axiosError.response.status === 401 && originalRequest && !originalRequest._retry) {
-    // The refresh call goes through this client. A 401 on it must not queue behind
-    // refreshTokenPromise: that promise is the call itself, so queueing deadlocks it
-    // and every later 401 waits forever.
-    if (isRefreshTokenRequest(originalRequest.url)) {
-      return Promise.reject(error);
-    }
-    const terminationCode = getSessionTerminationCode(axiosError.response.data) ?? (hasSessionInvalidHeader(axiosError.response.headers) ? SESSION_TERMINATION_CODES.TERMINATED : undefined);
-    if (terminationCode) {
-      // The session is dead server-side — a refresh would only burn a
-      // pointless round-trip, so go straight to logout.
-      _index2.Logger.warn(`Session ${terminationCode}, logging out without refresh. URL: ${originalRequest.url}`);
-      (0, _tokenRefresh.resetRefreshState)();
-      await (0, _tokenRefresh.dispatchLogout)();
-      return Promise.reject(error);
-    }
-    _index2.Logger.warn(`Unauthorized URL: ${originalRequest.url}`);
-    originalRequest._retry = true;
-
-    // If we already have a refresh in progress, queue this request
-    if ((0, _tokenRefresh.isRefreshInFlight)()) {
-      return (0, _tokenRefresh.queueBehindRefresh)().then(token => {
-        _index2.Logger.info('Retrying request after token refresh:', originalRequest.url);
-        setAuthHeader(originalRequest, token);
-        return userClient(originalRequest);
-      }).catch(err => {
-        _index2.Logger.error('Failed to retry request after token refresh:', (0, _tokenRefresh.getErrorMessage)(err));
-        return Promise.reject(err);
-      });
-    }
-    try {
-      // Start a new token refresh process and wait for it to complete
-      const newToken = await (0, _tokenRefresh.refreshAccessToken)();
-      setAuthHeader(originalRequest, newToken);
-      return userClient(originalRequest);
-    } catch (err) {
-      return Promise.reject(err);
-    }
-  }
-  if (!originalRequest?.skipErrorLog) {
-    _index2.Logger.error(`Response error: ${axiosError.response?.data ?? axiosError.message}, URL: ${originalRequest?.url}, Status: ${axiosError.response.status}`);
-  }
-  return Promise.reject(error);
-});
-var _default = exports.default = userClient;
-//# sourceMappingURL=userClient.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.SESSION_TERMINATION_CODES=exports.SESSION_INVALID_HEADER=exports.RequestOfflineError=void 0,Object.defineProperty(exports,"SIGN_OUT_REASON_HEADER",{enumerable:!0,get:function(){return _tokenRefresh.SIGN_OUT_REASON_HEADER}}),exports.default=void 0,Object.defineProperty(exports,"injectStore",{enumerable:!0,get:function(){return _tokenRefresh.injectStore}}),Object.defineProperty(exports,"injectUserAuth",{enumerable:!0,get:function(){return _tokenRefresh.injectUserAuth}}),Object.defineProperty(exports,"resetRefreshState",{enumerable:!0,get:function(){return _tokenRefresh.resetRefreshState}});var _axios=_interopRequireWildcard(require("axios")),_authStore=require("../auth/authStore.js"),_index=require("../config/index.js"),_index2=require("../logger/index.js"),_networkStatus=require("../network/networkStatus.js");require("../types/axios.js");var _baseUrl=require("./baseUrl.js"),_clientHeaders=require("./clientHeaders.js"),_curl=require("./curl.js"),_minAppVersion=require("./minAppVersion.js"),_multipart=require("./multipart.js"),_requestDefaults=require("./requestDefaults.js"),_responseBodyText=require("./responseBodyText.js"),_retry=require("./retry.js"),_tokenRefresh=require("./tokenRefresh.js");function _interopRequireWildcard(e,r){if("function"==typeof WeakMap)var t=new WeakMap,s=new WeakMap;return(_interopRequireWildcard=function(e,r){if(!r&&e&&e.__esModule)return e;var o,n,i={__proto__:null,default:e};if(null===e||"object"!=typeof e&&"function"!=typeof e)return i;if(o=r?s:t){if(o.has(e))return o.get(e);o.set(e,i)}for(const r in e)"default"!==r&&{}.hasOwnProperty.call(e,r)&&((n=(o=Object.defineProperty)&&Object.getOwnPropertyDescriptor(e,r))&&(n.get||n.set)?o(i,r,n):i[r]=e[r]);return i})(e,r)}class RequestOfflineError extends Error{constructor(e="Request blocked: device is offline"){super(e),this.name="RequestOfflineError",Object.setPrototypeOf(this,RequestOfflineError.prototype)}}exports.RequestOfflineError=RequestOfflineError;const SESSION_TERMINATION_CODES=exports.SESSION_TERMINATION_CODES={TERMINATED:"SESSION_TERMINATED",EXPIRED:"SESSION_EXPIRED"},TERMINATION_CODES=new Set(Object.values(SESSION_TERMINATION_CODES)),SESSION_INVALID_HEADER=exports.SESSION_INVALID_HEADER="x-security-stamp-invalid",hasSessionInvalidHeader=e=>{if(!e||"object"!=typeof e)return!1;const r=e.get,t="function"==typeof r?r.call(e,SESSION_INVALID_HEADER):e[SESSION_INVALID_HEADER];return"true"===String(t).toLowerCase()},getSessionTerminationCode=e=>{if(!e||"object"!=typeof e)return;const r=e,t=r.error,s=[r.code,r.errorCode,t&&"object"==typeof t?t.code:void 0];for(const e of s)if("string"==typeof e&&TERMINATION_CODES.has(e))return e},userClient=_axios.default.create({headers:{"Content-Type":"application/json"}});(0,_minAppVersion.readMinAppVersion)(userClient),(0,_retry.attachRetry)(userClient);const setAuthHeader=(e,r)=>{e.headers instanceof _axios.AxiosHeaders?e.headers.set("Authorization",`Bearer ${r}`):e.headers=_axios.AxiosHeaders.from({...e.headers,Authorization:`Bearer ${r}`})},isRefreshTokenRequest=e=>{const r=(0,_tokenRefresh.getRefreshPath)();return!!r&&!!e?.includes(r)};(0,_baseUrl.applyConfiguredBaseUrl)(userClient),(0,_requestDefaults.applyRequestDefaults)(userClient),(0,_multipart.sendFormDataAsMultipart)(userClient),userClient.interceptors.request.use(e=>((0,_index.getConfigValue)("logCurl")&&(0,_curl.logCurl)(e),e)),(0,_clientHeaders.applyClientHeaders)(userClient),userClient.interceptors.request.use(async e=>{if(!1===(await(0,_networkStatus.getLastKnownNetworkStatus)()).isConnected)return _index2.Logger.warn(`Request blocked: device is offline. URL: ${e.url}`),Promise.reject(new RequestOfflineError);try{if(isRefreshTokenRequest(e.url))return e;const r=await(0,_authStore.getToken)(_authStore.ACCESS_TOKEN_KEY);if(!r?.token)throw new Error("No access token available");const t=Date.now(),s=Date.parse(r.expiry);if(s<=t+3e4){_index2.Logger.info("Access token expired or about to expire, refreshing before request");const r=await(0,_tokenRefresh.refreshAccessToken)();return setAuthHeader(e,r),await(0,_clientHeaders.applyAccountIdHeader)(e.headers,(0,_tokenRefresh.getAccountIdProvider)()),e}return setAuthHeader(e,r.token),await(0,_clientHeaders.applyAccountIdHeader)(e.headers,(0,_tokenRefresh.getAccountIdProvider)()),e}catch(e){return _index2.Logger.error("Failed to attach token:",(0,_tokenRefresh.getErrorMessage)(e)),Promise.reject(e)}},e=>(_index2.Logger.error("Request error:",(0,_tokenRefresh.getErrorMessage)(e)),Promise.reject(e))),userClient.interceptors.response.use(e=>e,async e=>{if(!_axios.default.isAxiosError(e))return _index2.Logger.error(`Non-axios error in response interceptor: ${(0,_tokenRefresh.getErrorMessage)(e)}`),Promise.reject(e);const r=e,t=r.config;if(!r.response)return t?.skipErrorLog||_index2.Logger.error(`Network error or no response from server: ${r.message}, URL: ${t?.url}`),Promise.reject(e);if(401===r.response.status&&t&&!t._retry){if(isRefreshTokenRequest(t.url))return Promise.reject(e);const s=(0,_tokenRefresh.readSignOutReason)(r.response.headers),o=getSessionTerminationCode(r.response.data)??(hasSessionInvalidHeader(r.response.headers)||null!==s?SESSION_TERMINATION_CODES.TERMINATED:void 0);if(o)return _index2.Logger.warn(`Session ${o}, logging out without refresh. URL: ${t.url}`),(0,_tokenRefresh.resetRefreshState)(),await(0,_tokenRefresh.endSessionAndLogout)("terminated",s),Promise.reject(e);if(_index2.Logger.warn(`Unauthorized URL: ${t.url}`),t._retry=!0,(0,_tokenRefresh.isRefreshInFlight)())return(0,_tokenRefresh.queueBehindRefresh)().then(e=>(_index2.Logger.info("Retrying request after token refresh:",t.url),setAuthHeader(t,e),userClient(t))).catch(e=>(_index2.Logger.error("Failed to retry request after token refresh:",(0,_tokenRefresh.getErrorMessage)(e)),Promise.reject(e)));try{const e=await(0,_tokenRefresh.refreshAccessToken)();return setAuthHeader(t,e),userClient(t)}catch(e){return Promise.reject(e)}}return t?.skipErrorLog||_index2.Logger.error(`Response error: ${(0,_responseBodyText.responseBodyText)(r.response?.data,r.message)}, URL: ${t?.url}, Status: ${r.response.status}`),Promise.reject(e)});var _default=exports.default=userClient;

package/lib/commonjs/auth/authStore.js

@@ -1,265 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.storeToken = exports.setKeychainImplementation = exports.removeToken = exports.getToken = exports.REFRESH_TOKEN_KEY = exports.ACCESS_TOKEN_KEY = void 0;
-var SecureStore = _interopRequireWildcard(require("expo-secure-store"));
-var _index = require("../logger/index.js");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-/**
- * Token data persisted in the keychain.
- */
-/**
- * The two keys the library itself reads. Everything in the library that needs
- * the bearer token, the HTTP client and the authenticated image cache,
- * resolves it through these rather than repeating the literal, so
- * one of them cannot silently drift and start reading a key nothing writes.
- * Apps are free to store their own tokens under any other key.
- */
-const ACCESS_TOKEN_KEY = exports.ACCESS_TOKEN_KEY = 'accessToken';
-const REFRESH_TOKEN_KEY = exports.REFRESH_TOKEN_KEY = 'refreshToken';
-
-/**
- * The shape this module speaks to its store through. expo-secure-store is
- * adapted to it below; an app or a test can supply anything else of this shape
- * through `setKeychainImplementation`.
- */
-/**
- * The GENERIC password API, not the internet-credentials one.
- *
- * `kSecClassInternetPassword` exists for credentials bound to a server, protocol
- * and port, and it integrates with Safari and AutoFill. A bearer token keyed by
- * a name like "accessToken" is none of those things, and the library was only
- * satisfying that API's required `server` argument by passing the key twice,
- * once as the server and once as the service. That is misuse of the class.
- *
- * `kSecClassGenericPassword` is the class for app-local secrets, which is what a
- * token is. It is what expo-secure-store uses underneath, and what the consumer
- * app being migrated had already chosen for itself.
- */
-/**
- * The credential shape the seam reads back, declared here rather than imported
- * from whichever package a consumer's backend comes from. A type-only import of
- * a package this library does not declare survives into the published `.d.ts`,
- * where a consumer that has not installed it either fails to typecheck or,
- * under the RN template's `skipLibCheck: true`, loses all checking on these
- * members with no signal. Any credential object with these three members
- * satisfies it structurally.
- */
-
-// Only what a test or the showcase injected; null means use expo-secure-store.
-let backend = null;
-
-/**
- * expo-secure-store, adapted to the generic-password shape this module speaks.
- *
- * It is a flat key/value store, so the credential shape is reconstructed around
- * it. The key is sanitised because expo rejects anything outside
- * [A-Za-z0-9._-] at runtime, which would otherwise surface as a throw from deep
- * inside the store rather than as a bad key.
- */
-const keyFor = service => (service ?? 'default').replace(/[^A-Za-z0-9._-]/g, '_');
-const expoSecureStoreBackend = {
-  setGenericPassword: async (username, password, options) => {
-    await SecureStore.setItemAsync(keyFor(options?.service), JSON.stringify({
-      username,
-      password
-    }));
-    return true;
-  },
-  getGenericPassword: async options => {
-    const service = options?.service;
-    const raw = await SecureStore.getItemAsync(keyFor(service));
-    if (raw === null) {
-      return false;
-    }
-    const parsed = JSON.parse(raw);
-    return {
-      username: parsed.username,
-      password: parsed.password,
-      service: service ?? 'default'
-    };
-  },
-  resetGenericPassword: async options => {
-    await SecureStore.deleteItemAsync(keyFor(options?.service));
-    return true;
-  }
-};
-const resolveBackend = () => backend ?? expoSecureStoreBackend;
-
-/**
- * Every request reads the access token, and a secure-store read is a native
- * keychain/keystore decrypt. Reads are therefore served from memory, written
- * through by `storeToken` and dropped by `removeToken`. `generation` moves on
- * every write, removal and backend swap, so a read that started before one of
- * those cannot cache the value it saw.
- */
-const memo = new Map();
-let generation = 0;
-const forget = key => {
-  generation += 1;
-  if (key === undefined) {
-    memo.clear();
-  } else {
-    memo.delete(key);
-  }
-};
-const requireBackend = op => {
-  const b = resolveBackend();
-  if (!b) {
-    const err = new Error(`[authStore] no secure-store backend available; cannot ${op}.`);
-    _index.Logger.error(err.message);
-    throw err;
-  }
-  return b;
-};
-
-/**
- * Replace the secure-store backend. Intended for TESTS and for the showcase,
- * which injects a failing store to demo the write-failure path; it is not how
- * an app configures the library. Pass `null` to restore expo-secure-store.
- */
-const setKeychainImplementation = impl => {
-  backend = impl;
-  forget();
-};
-
-/**
- * Store token with expiry.
- */
-exports.setKeychainImplementation = setKeychainImplementation;
-const storeToken = async (key, token, expiry) => {
-  // Never log the token or expiry values: Logger forwards to whatever remote
-  // sink the app wired (Crashlytics/Sentry), so a token here leaves the device.
-  _index.Logger.info(`Storing token for key: ${key}`);
-  forget(key);
-  try {
-    const data = JSON.stringify({
-      token,
-      expiry
-    });
-    await requireBackend('store a token').setGenericPassword('token', data, {
-      service: key
-    });
-    forget(key);
-    memo.set(key, {
-      token,
-      expiry
-    });
-    _index.Logger.info(`Token stored successfully for key: ${key}`);
-  } catch (error) {
-    forget(key);
-    // Log AND rethrow. Swallowing this told the caller the token was persisted
-    // when it was not, so an app would show a signed-in user holding a token
-    // that never reached the keychain — the session then dies at the next
-    // cold start with no failure anyone could have seen.
-    _index.Logger.error(`Error storing token for key: ${key}`, error);
-    throw error;
-  }
-};
-
-/**
- * Parse token data from credentials.
- */
-exports.storeToken = storeToken;
-const parseTokenData = credentials => {
-  if (!credentials) {
-    return null;
-  }
-  const {
-    password
-  } = credentials;
-  try {
-    const parsed = JSON.parse(password);
-    if (parsed && typeof parsed === 'object' && 'token' in parsed && 'expiry' in parsed && typeof parsed.token === 'string' && typeof parsed.expiry === 'string') {
-      return parsed;
-    }
-    return null;
-  } catch {
-    // The single report for "stored, but not a token" belongs to getToken, which
-    // knows whether anything was stored at all. Logging here too made one event
-    // arrive twice, at two different levels.
-    return null;
-  }
-};
-
-/**
- * Retrieve token and check if expired.
- */
-const getToken = async key => {
-  if (memo.has(key)) {
-    return memo.get(key) ?? null;
-  }
-  const seen = generation;
-  try {
-    const credentials = await requireBackend('read a token').getGenericPassword({
-      service: key
-    });
-    // Nothing stored is an ORDINARY state, not a fault: a signed-out user has no
-    // token, and every authenticated request, image and download asks for one.
-    // Warning here put three info lines and a warning into the log, and into the
-    // remote crash sink, on every one of those calls.
-    let value = null;
-    if (credentials) {
-      const parsedData = parseTokenData(credentials);
-      if (parsedData) {
-        value = {
-          token: parsedData.token,
-          expiry: parsedData.expiry
-        };
-      } else {
-        // Something IS stored and it is not a token. That is corruption worth
-        // hearing about, and it is a different event from having no token.
-        _index.Logger.warn(`Stored credentials for key "${key}" are not a valid token; ignoring them.`);
-      }
-    }
-    if (seen === generation) {
-      memo.set(key, value);
-    }
-    return value;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    // Both spellings matter. Android throws "Key permanently invalidated" when
-    // the biometric enrolment changes; iOS throws "Secret invalidated" for the
-    // equivalent. Either way the stored value can never be decrypted again, so
-    // clearing it is the only way out: leaving it makes every later read fail
-    // identically, and the user is stuck with no route back to a login. A
-    // consumer app handled the iOS spelling and the library did not.
-    if (message.includes('Key permanently invalidated') || message.includes('Secret invalidated')) {
-      _index.Logger.error(`Stored token for key "${key}" can no longer be decrypted; clearing it.`);
-      await removeToken(key);
-      return null;
-    }
-    _index.Logger.error(`Error retrieving token for key: ${key}`, error);
-    return null;
-  }
-};
-
-/**
- * Remove token by key.
- */
-exports.getToken = getToken;
-const removeToken = async key => {
-  forget(key);
-  try {
-    await requireBackend('remove a token').resetGenericPassword({
-      service: key
-    });
-    _index.Logger.info(`Token removed successfully for key: ${key}`);
-  } catch (error) {
-    // Clearing a key that was never written is the ordinary logout path, not a
-    // failure: only one of the two tokens may ever have been stored. Logging it
-    // as an error puts routine traffic in the channel people watch for real
-    // problems, which is how an error channel stops being watched.
-    if (error instanceof Error && error.message.includes('Item not found')) {
-      _index.Logger.info(`No token found to remove for key: ${key}`);
-      return;
-    }
-    _index.Logger.error(`Failed to remove token for key: ${key}`, error);
-  } finally {
-    forget(key);
-  }
-};
-exports.removeToken = removeToken;
-//# sourceMappingURL=authStore.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.storeToken=exports.storeSessionUser=exports.setLegacyTokenKeys=exports.setKeychainImplementation=exports.removeToken=exports.removeSessionUser=exports.getToken=exports.getSessionUser=exports.clearSession=exports.addSessionEndedListener=exports.SESSION_USER_KEY=exports.REFRESH_TOKEN_KEY=exports.LEGACY_REFRESH_TOKEN_LIFETIME_MS=exports.ACCESS_TOKEN_KEY=void 0;var SecureStore=_interopRequireWildcard(require("expo-secure-store")),_index=require("../logger/index.js"),_index2=require("../storage/index.js"),_jwt=require("./jwt.js");function _interopRequireWildcard(e,r){if("function"==typeof WeakMap)var n=new WeakMap,t=new WeakMap;return(_interopRequireWildcard=function(e,r){if(!r&&e&&e.__esModule)return e;var o,s,i={__proto__:null,default:e};if(null===e||"object"!=typeof e&&"function"!=typeof e)return i;if(o=r?t:n){if(o.has(e))return o.get(e);o.set(e,i)}for(const r in e)"default"!==r&&{}.hasOwnProperty.call(e,r)&&((s=(o=Object.defineProperty)&&Object.getOwnPropertyDescriptor(e,r))&&(s.get||s.set)?o(i,r,s):i[r]=e[r]);return i})(e,r)}const ACCESS_TOKEN_KEY=exports.ACCESS_TOKEN_KEY="accessToken",REFRESH_TOKEN_KEY=exports.REFRESH_TOKEN_KEY="refreshToken",SESSION_USER_KEY=exports.SESSION_USER_KEY="sessionUser",LEGACY_REFRESH_TOKEN_LIFETIME_MS=exports.LEGACY_REFRESH_TOKEN_LIFETIME_MS=2592e6;let backend=null;const keyFor=e=>(e??"default").replace(/[^A-Za-z0-9._-]/g,"_"),expoSecureStoreBackend={setGenericPassword:async(e,r,n)=>(await SecureStore.setItemAsync(keyFor(n?.service),JSON.stringify({username:e,password:r})),!0),getGenericPassword:async e=>{const r=e?.service,n=await SecureStore.getItemAsync(keyFor(r));if(null===n)return!1;const t=JSON.parse(n);return{username:t.username,password:t.password,service:r??"default"}},resetGenericPassword:async e=>(await SecureStore.deleteItemAsync(keyFor(e?.service)),!0)},resolveBackend=()=>backend??expoSecureStoreBackend,memo=new Map;let generation=0;const forget=e=>{generation+=1,void 0===e?memo.clear():memo.delete(e)},requireBackend=e=>{const r=resolveBackend();if(!r){const r=new Error(`[authStore] no secure-store backend available; cannot ${e}.`);throw _index.Logger.error(r.message),r}return r},setKeychainImplementation=e=>{backend=e,forget()};exports.setKeychainImplementation=setKeychainImplementation;const storeToken=async(e,r,n)=>{_index.Logger.info(`Storing token for key: ${e}`),forget(e);try{const t=JSON.stringify({token:r,expiry:n});await requireBackend("store a token").setGenericPassword("token",t,{service:e}),forget(e),memo.set(e,{token:r,expiry:n}),_index.Logger.info(`Token stored successfully for key: ${e}`)}catch(r){throw forget(e),_index.Logger.error(`Error storing token for key: ${e}`,r),r}};exports.storeToken=storeToken;const parseTokenData=e=>{if(!e)return null;const{password:r}=e;try{const e=JSON.parse(r);return e&&"object"==typeof e&&"token"in e&&"expiry"in e&&"string"==typeof e.token&&"string"==typeof e.expiry?e:null}catch{return null}},getToken=async e=>{if(isSessionKey(e)&&legacyKeys&&await migrateLegacySession(),memo.has(e))return memo.get(e)??null;const r=generation;try{const n=await requireBackend("read a token").getGenericPassword({service:e});let t=null;if(n){const r=parseTokenData(n);if(r)t={token:r.token,expiry:r.expiry};else if(_index.Logger.warn(`Stored credentials for key "${e}" are not a valid token; ignoring them.`),isSessionKey(e))return await endSession("corrupt",!0),null}return r===generation&&memo.set(e,t),t}catch(r){const n=r instanceof Error?r.message:String(r);return n.includes("Key permanently invalidated")||n.includes("Secret invalidated")?(_index.Logger.error(`Stored token for key "${e}" can no longer be decrypted; clearing it.`),isSessionKey(e)?await endSession("corrupt",!0):await removeToken(e),null):(_index.Logger.error(`Error retrieving token for key: ${e}`,r),null)}};exports.getToken=getToken;const removeToken=async e=>{forget(e);try{await requireBackend("remove a token").resetGenericPassword({service:e}),_index.Logger.info(`Token removed successfully for key: ${e}`)}catch(r){if(r instanceof Error&&r.message.includes("Item not found"))return void _index.Logger.info(`No token found to remove for key: ${e}`);_index.Logger.error(`Failed to remove token for key: ${e}`,r)}finally{forget(e)}};exports.removeToken=removeToken;const isSessionKey=e=>e===ACCESS_TOKEN_KEY||e===REFRESH_TOKEN_KEY,storeSessionUser=async e=>{if(!await _index2.Storage.setItem(SESSION_USER_KEY,JSON.stringify(e)))throw new Error("[authStore] could not store the session user.")};exports.storeSessionUser=storeSessionUser;const getSessionUser=async()=>{const e=await _index2.Storage.getItem(SESSION_USER_KEY);if(null===e)return null;try{return JSON.parse(e)}catch{return _index.Logger.warn("The stored session user is not valid JSON; clearing it."),await removeSessionUser(),null}};exports.getSessionUser=getSessionUser;const removeSessionUser=async()=>{await _index2.Storage.removeItem(SESSION_USER_KEY)};exports.removeSessionUser=removeSessionUser;let legacyKeys=null,legacyCheck=null;const setLegacyTokenKeys=e=>{legacyKeys=e,legacyCheck=null};exports.setLegacyTokenKeys=setLegacyTokenKeys;const readLegacyToken=e=>{try{const r=JSON.parse(e);if("string"==typeof r)return""===r.trim()?null:{token:r,expiry:null};if(r&&"object"==typeof r&&"string"==typeof r.token&&"string"==typeof r.expiry)return r}catch{}return""===e.trim()?null:{token:e,expiry:null}},expiryOf=e=>3===e.split(".").length?(0,_jwt.getJWTExpiry)(e)?.toISOString()??null:null,readLegacyRaw=async e=>{const r=await resolveBackend().getGenericPassword({service:e});return r?r.password:null},migrateLegacySession=()=>{if(!legacyKeys)return Promise.resolve();if(legacyCheck)return legacyCheck;const e=legacyKeys;return legacyCheck=(async()=>{try{const r=resolveBackend(),n=!await r.getGenericPassword({service:ACCESS_TOKEN_KEY})&&!await r.getGenericPassword({service:REFRESH_TOKEN_KEY}),t=await readLegacyRaw(e.accessToken),o=await readLegacyRaw(e.refreshToken);if(n&&(null!==t||null!==o)){const n=null===t?null:readLegacyToken(t),s=null===o?null:readLegacyToken(o);if(n){const e=n.expiry??expiryOf(n.token)??(new Date).toISOString();await r.setGenericPassword("token",JSON.stringify({token:n.token,expiry:e}),{service:ACCESS_TOKEN_KEY})}if(s){const e=s.expiry??expiryOf(s.token)??new Date(Date.now()+LEGACY_REFRESH_TOKEN_LIFETIME_MS).toISOString();await r.setGenericPassword("token",JSON.stringify({token:s.token,expiry:e}),{service:REFRESH_TOKEN_KEY})}if(e.sessionUser){const r=await _index2.Storage.getItem(e.sessionUser);null!==r&&await _index2.Storage.setItem(SESSION_USER_KEY,r)}null===n&&null===s||(forget(),_index.Logger.breadcrumb("[authStore] moved a session from the legacy token keys"))}for(const n of[e.accessToken,e.refreshToken])await r.resetGenericPassword({service:n}).catch(()=>{});e.sessionUser&&await _index2.Storage.removeItem(e.sessionUser)}catch(e){_index.Logger.error("[authStore] could not move the session from the legacy token keys",e)}})(),legacyCheck},listeners=new Set,emitSessionEnded=(e,r)=>{for(const n of[...listeners])try{n(e,r)}catch(e){_index.Logger.error("[authStore] a session-ended listener threw",e)}},addSessionEndedListener=e=>(listeners.add(e),()=>{listeners.delete(e)});exports.addSessionEndedListener=addSessionEndedListener;const endSession=async(e,r,n=null)=>{const t=r||null!==await getToken(ACCESS_TOKEN_KEY)||null!==await getToken(REFRESH_TOKEN_KEY);await removeToken(ACCESS_TOKEN_KEY),await removeToken(REFRESH_TOKEN_KEY),await removeSessionUser(),t&&emitSessionEnded(e,{signOutReason:n})},clearSession=async(e="signedOut",r={})=>endSession(e,!1,r.signOutReason??null);exports.clearSession=clearSession;

package/lib/commonjs/auth/index.js

@@ -1,44 +1 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-Object.defineProperty(exports, "decodeJWT", {
-  enumerable: true,
-  get: function () {
-    return _jwt.decodeJWT;
-  }
-});
-Object.defineProperty(exports, "getJWTExpiry", {
-  enumerable: true,
-  get: function () {
-    return _jwt.getJWTExpiry;
-  }
-});
-Object.defineProperty(exports, "getToken", {
-  enumerable: true,
-  get: function () {
-    return _authStore.getToken;
-  }
-});
-Object.defineProperty(exports, "isJWTExpired", {
-  enumerable: true,
-  get: function () {
-    return _jwt.isJWTExpired;
-  }
-});
-Object.defineProperty(exports, "removeToken", {
-  enumerable: true,
-  get: function () {
-    return _authStore.removeToken;
-  }
-});
-Object.defineProperty(exports, "storeToken", {
-  enumerable: true,
-  get: function () {
-    return _authStore.storeToken;
-  }
-});
-var _authStore = require("./authStore.js");
-var _jwt = require("./jwt.js");
-//# sourceMappingURL=index.js.map
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),Object.defineProperty(exports,"ACCESS_TOKEN_KEY",{enumerable:!0,get:function(){return _authStore.ACCESS_TOKEN_KEY}}),Object.defineProperty(exports,"LEGACY_REFRESH_TOKEN_LIFETIME_MS",{enumerable:!0,get:function(){return _authStore.LEGACY_REFRESH_TOKEN_LIFETIME_MS}}),Object.defineProperty(exports,"REFRESH_TOKEN_KEY",{enumerable:!0,get:function(){return _authStore.REFRESH_TOKEN_KEY}}),Object.defineProperty(exports,"SESSION_USER_KEY",{enumerable:!0,get:function(){return _authStore.SESSION_USER_KEY}}),Object.defineProperty(exports,"addSessionEndedListener",{enumerable:!0,get:function(){return _authStore.addSessionEndedListener}}),Object.defineProperty(exports,"clearSession",{enumerable:!0,get:function(){return _authStore.clearSession}}),Object.defineProperty(exports,"decodeJWT",{enumerable:!0,get:function(){return _jwt.decodeJWT}}),Object.defineProperty(exports,"getJWTExpiry",{enumerable:!0,get:function(){return _jwt.getJWTExpiry}}),Object.defineProperty(exports,"getSessionUser",{enumerable:!0,get:function(){return _authStore.getSessionUser}}),Object.defineProperty(exports,"getToken",{enumerable:!0,get:function(){return _authStore.getToken}}),Object.defineProperty(exports,"isJWTExpired",{enumerable:!0,get:function(){return _jwt.isJWTExpired}}),Object.defineProperty(exports,"removeSessionUser",{enumerable:!0,get:function(){return _authStore.removeSessionUser}}),Object.defineProperty(exports,"removeToken",{enumerable:!0,get:function(){return _authStore.removeToken}}),Object.defineProperty(exports,"setLegacyTokenKeys",{enumerable:!0,get:function(){return _authStore.setLegacyTokenKeys}}),Object.defineProperty(exports,"storeSessionUser",{enumerable:!0,get:function(){return _authStore.storeSessionUser}}),Object.defineProperty(exports,"storeToken",{enumerable:!0,get:function(){return _authStore.storeToken}});var _authStore=require("./authStore.js"),_jwt=require("./jwt.js");