lemma-sdk 0.2.21 → 0.2.22

package/dist/auth.d.ts

@@ -102,6 +102,13 @@ export declare class AuthManager {
     private setState;
     private assertBrowserContext;
     private getCookie;
+    private getCookieDomainCandidates;
+    private expireCookie;
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    private clearFrontendSessionMarkers;
     private clearInjectedToken;
     private rawSignOutViaBackend;
     /**

package/dist/auth.js

@@ -18,6 +18,14 @@
 import Session from "supertokens-web-js/recipe/session";
 import { ensureCookieSessionSupport } from "./supertokens.js";
 const DEFAULT_BLOCKED_REDIRECT_PATHS = ["/login", "/signup", "/auth"];
+const SUPERTOKENS_FRONTEND_MARKER_KEYS = [
+    "sFrontToken",
+    "st-last-access-token-update",
+    "sIRTFrontend",
+    "sAntiCsrf",
+    "st-access-token",
+    "st-refresh-token",
+];
 const LOCALSTORAGE_TOKEN_KEY = "lemma_token";
 function readStorageToken() {
     if (typeof window === "undefined")
@@ -214,6 +222,62 @@ export class AuthManager {
         const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`));
         return match ? decodeURIComponent(match[1]) : undefined;
     }
+    getCookieDomainCandidates() {
+        if (typeof window === "undefined") {
+            return [undefined];
+        }
+        const host = window.location.hostname;
+        const isIpv4 = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+        const isIpv6 = host.includes(":");
+        if (!host || host === "localhost" || isIpv4 || isIpv6) {
+            return [undefined];
+        }
+        const domains = new Set();
+        const parts = host.split(".").filter(Boolean);
+        for (let i = 0; i < parts.length - 1; i += 1) {
+            const candidate = parts.slice(i).join(".");
+            if (!candidate)
+                continue;
+            domains.add(candidate);
+            domains.add(`.${candidate}`);
+        }
+        return [undefined, ...domains];
+    }
+    expireCookie(name, domain) {
+        if (typeof document === "undefined")
+            return;
+        const domainPart = domain ? `;domain=${domain}` : "";
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart};samesite=lax`;
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart}`;
+    }
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    clearFrontendSessionMarkers() {
+        if (typeof window === "undefined")
+            return;
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            try {
+                window.localStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+            try {
+                window.sessionStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+        }
+        const domains = this.getCookieDomainCandidates();
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            for (const domain of domains) {
+                this.expireCookie(key, domain);
+            }
+        }
+    }
     clearInjectedToken() {
         this.injectedToken = null;
         clearTestingToken();
@@ -322,6 +386,7 @@ export class AuthManager {
             const response = await fetch(`${this.apiUrl}/users/me`, this.getRequestInit({ method: "GET" }));
             // Only 401 means not authenticated — 403 means authenticated but forbidden
             if (response.status === 401) {
+                this.clearFrontendSessionMarkers();
                 const next = { status: "unauthenticated", user: null };
                 this.setState(next);
                 return next;
@@ -348,6 +413,7 @@ export class AuthManager {
      * Does NOT redirect — call redirectToAuth() explicitly if desired.
      */
     markUnauthenticated() {
+        this.clearFrontendSessionMarkers();
         this.setState({ status: "unauthenticated", user: null });
     }
     /**

package/dist/browser/lemma-client.js

@@ -204,6 +204,14 @@ exports.resolveSafeRedirectUri = resolveSafeRedirectUri;
 const session_1 = require("supertokens-web-js/recipe/session");
 const supertokens_js_1 = require("./supertokens.js");
 const DEFAULT_BLOCKED_REDIRECT_PATHS = ["/login", "/signup", "/auth"];
+const SUPERTOKENS_FRONTEND_MARKER_KEYS = [
+    "sFrontToken",
+    "st-last-access-token-update",
+    "sIRTFrontend",
+    "sAntiCsrf",
+    "st-access-token",
+    "st-refresh-token",
+];
 const LOCALSTORAGE_TOKEN_KEY = "lemma_token";
 function readStorageToken() {
     if (typeof window === "undefined")
@@ -397,6 +405,62 @@ class AuthManager {
         const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`));
         return match ? decodeURIComponent(match[1]) : undefined;
     }
+    getCookieDomainCandidates() {
+        if (typeof window === "undefined") {
+            return [undefined];
+        }
+        const host = window.location.hostname;
+        const isIpv4 = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+        const isIpv6 = host.includes(":");
+        if (!host || host === "localhost" || isIpv4 || isIpv6) {
+            return [undefined];
+        }
+        const domains = new Set();
+        const parts = host.split(".").filter(Boolean);
+        for (let i = 0; i < parts.length - 1; i += 1) {
+            const candidate = parts.slice(i).join(".");
+            if (!candidate)
+                continue;
+            domains.add(candidate);
+            domains.add(`.${candidate}`);
+        }
+        return [undefined, ...domains];
+    }
+    expireCookie(name, domain) {
+        if (typeof document === "undefined")
+            return;
+        const domainPart = domain ? `;domain=${domain}` : "";
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart};samesite=lax`;
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart}`;
+    }
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    clearFrontendSessionMarkers() {
+        if (typeof window === "undefined")
+            return;
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            try {
+                window.localStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+            try {
+                window.sessionStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+        }
+        const domains = this.getCookieDomainCandidates();
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            for (const domain of domains) {
+                this.expireCookie(key, domain);
+            }
+        }
+    }
     clearInjectedToken() {
         this.injectedToken = null;
         clearTestingToken();
@@ -505,6 +569,7 @@ class AuthManager {
             const response = await fetch(`${this.apiUrl}/users/me`, this.getRequestInit({ method: "GET" }));
             // Only 401 means not authenticated — 403 means authenticated but forbidden
             if (response.status === 401) {
+                this.clearFrontendSessionMarkers();
                 const next = { status: "unauthenticated", user: null };
                 this.setState(next);
                 return next;
@@ -531,6 +596,7 @@ class AuthManager {
      * Does NOT redirect — call redirectToAuth() explicitly if desired.
      */
     markUnauthenticated() {
+        this.clearFrontendSessionMarkers();
         this.setState({ status: "unauthenticated", user: null });
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemma-sdk",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "Official TypeScript SDK for Lemma pod-scoped APIs",
   "type": "module",
   "main": "dist/index.js",