lemma-sdk 0.2.21 → 0.2.23

package/dist/auth.d.ts

@@ -102,6 +102,14 @@ export declare class AuthManager {
     private setState;
     private assertBrowserContext;
     private getCookie;
+    private getCookieDomainCandidates;
+    private expireCookie;
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    private clearFrontendSessionMarkers;
+    private applyUnauthenticatedState;
     private clearInjectedToken;
     private rawSignOutViaBackend;
     /**

package/dist/auth.js

@@ -18,6 +18,14 @@
 import Session from "supertokens-web-js/recipe/session";
 import { ensureCookieSessionSupport } from "./supertokens.js";
 const DEFAULT_BLOCKED_REDIRECT_PATHS = ["/login", "/signup", "/auth"];
+const SUPERTOKENS_FRONTEND_MARKER_KEYS = [
+    "sFrontToken",
+    "st-last-access-token-update",
+    "sIRTFrontend",
+    "sAntiCsrf",
+    "st-access-token",
+    "st-refresh-token",
+];
 const LOCALSTORAGE_TOKEN_KEY = "lemma_token";
 function readStorageToken() {
     if (typeof window === "undefined")
@@ -214,6 +222,68 @@ export class AuthManager {
         const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`));
         return match ? decodeURIComponent(match[1]) : undefined;
     }
+    getCookieDomainCandidates() {
+        if (typeof window === "undefined") {
+            return [undefined];
+        }
+        const host = window.location.hostname;
+        const isIpv4 = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+        const isIpv6 = host.includes(":");
+        if (!host || host === "localhost" || isIpv4 || isIpv6) {
+            return [undefined];
+        }
+        const domains = new Set();
+        const parts = host.split(".").filter(Boolean);
+        for (let i = 0; i < parts.length - 1; i += 1) {
+            const candidate = parts.slice(i).join(".");
+            if (!candidate)
+                continue;
+            domains.add(candidate);
+            domains.add(`.${candidate}`);
+        }
+        return [undefined, ...domains];
+    }
+    expireCookie(name, domain) {
+        if (typeof document === "undefined")
+            return;
+        const domainPart = domain ? `;domain=${domain}` : "";
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart};samesite=lax`;
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart}`;
+    }
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    clearFrontendSessionMarkers() {
+        if (typeof window === "undefined")
+            return;
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            try {
+                window.localStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+            try {
+                window.sessionStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+        }
+        const domains = this.getCookieDomainCandidates();
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            for (const domain of domains) {
+                this.expireCookie(key, domain);
+            }
+        }
+    }
+    applyUnauthenticatedState() {
+        this.clearFrontendSessionMarkers();
+        const next = { status: "unauthenticated", user: null };
+        this.setState(next);
+        return next;
+    }
     clearInjectedToken() {
         this.injectedToken = null;
         clearTestingToken();
@@ -322,15 +392,11 @@ export class AuthManager {
             const response = await fetch(`${this.apiUrl}/users/me`, this.getRequestInit({ method: "GET" }));
             // Only 401 means not authenticated — 403 means authenticated but forbidden
             if (response.status === 401) {
-                const next = { status: "unauthenticated", user: null };
-                this.setState(next);
-                return next;
+                return this.applyUnauthenticatedState();
             }
             if (!response.ok) {
                 // For non-401 errors on /users/me, treat as unauthenticated (conservative)
-                const next = { status: "unauthenticated", user: null };
-                this.setState(next);
-                return next;
+                return this.applyUnauthenticatedState();
             }
             const user = (await response.json());
             const next = { status: "authenticated", user };
@@ -338,9 +404,7 @@ export class AuthManager {
             return next;
         }
         catch {
-            const next = { status: "unauthenticated", user: null };
-            this.setState(next);
-            return next;
+            return this.applyUnauthenticatedState();
         }
     }
     /**
@@ -348,7 +412,7 @@ export class AuthManager {
      * Does NOT redirect — call redirectToAuth() explicitly if desired.
      */
     markUnauthenticated() {
-        this.setState({ status: "unauthenticated", user: null });
+        this.applyUnauthenticatedState();
     }
     /**
      * Sign out the current user session.
@@ -376,6 +440,9 @@ export class AuthManager {
                 // best effort fallback only
             }
         }
+        // Always clear frontend markers on logout attempt, even if backend session
+        // cleanup is partial. This avoids stale local "EXISTS" signals.
+        this.clearFrontendSessionMarkers();
         const isAuthenticated = await this.isAuthenticatedViaCookie();
         if (!isAuthenticated) {
             this.markUnauthenticated();

package/dist/browser/lemma-client.js

@@ -204,6 +204,14 @@ exports.resolveSafeRedirectUri = resolveSafeRedirectUri;
 const session_1 = require("supertokens-web-js/recipe/session");
 const supertokens_js_1 = require("./supertokens.js");
 const DEFAULT_BLOCKED_REDIRECT_PATHS = ["/login", "/signup", "/auth"];
+const SUPERTOKENS_FRONTEND_MARKER_KEYS = [
+    "sFrontToken",
+    "st-last-access-token-update",
+    "sIRTFrontend",
+    "sAntiCsrf",
+    "st-access-token",
+    "st-refresh-token",
+];
 const LOCALSTORAGE_TOKEN_KEY = "lemma_token";
 function readStorageToken() {
     if (typeof window === "undefined")
@@ -397,6 +405,68 @@ class AuthManager {
         const match = document.cookie.match(new RegExp(`(?:^|; )${escaped}=([^;]*)`));
         return match ? decodeURIComponent(match[1]) : undefined;
     }
+    getCookieDomainCandidates() {
+        if (typeof window === "undefined") {
+            return [undefined];
+        }
+        const host = window.location.hostname;
+        const isIpv4 = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+        const isIpv6 = host.includes(":");
+        if (!host || host === "localhost" || isIpv4 || isIpv6) {
+            return [undefined];
+        }
+        const domains = new Set();
+        const parts = host.split(".").filter(Boolean);
+        for (let i = 0; i < parts.length - 1; i += 1) {
+            const candidate = parts.slice(i).join(".");
+            if (!candidate)
+                continue;
+            domains.add(candidate);
+            domains.add(`.${candidate}`);
+        }
+        return [undefined, ...domains];
+    }
+    expireCookie(name, domain) {
+        if (typeof document === "undefined")
+            return;
+        const domainPart = domain ? `;domain=${domain}` : "";
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart};samesite=lax`;
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;max-age=0;path=/${domainPart}`;
+    }
+    /**
+     * Defensive cleanup for stale SuperTokens frontend marker cookies/storage.
+     * This helps recover when signout/session-expiry paths leave local markers behind.
+     */
+    clearFrontendSessionMarkers() {
+        if (typeof window === "undefined")
+            return;
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            try {
+                window.localStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+            try {
+                window.sessionStorage.removeItem(key);
+            }
+            catch {
+                // ignore storage errors
+            }
+        }
+        const domains = this.getCookieDomainCandidates();
+        for (const key of SUPERTOKENS_FRONTEND_MARKER_KEYS) {
+            for (const domain of domains) {
+                this.expireCookie(key, domain);
+            }
+        }
+    }
+    applyUnauthenticatedState() {
+        this.clearFrontendSessionMarkers();
+        const next = { status: "unauthenticated", user: null };
+        this.setState(next);
+        return next;
+    }
     clearInjectedToken() {
         this.injectedToken = null;
         clearTestingToken();
@@ -505,15 +575,11 @@ class AuthManager {
             const response = await fetch(`${this.apiUrl}/users/me`, this.getRequestInit({ method: "GET" }));
             // Only 401 means not authenticated — 403 means authenticated but forbidden
             if (response.status === 401) {
-                const next = { status: "unauthenticated", user: null };
-                this.setState(next);
-                return next;
+                return this.applyUnauthenticatedState();
             }
             if (!response.ok) {
                 // For non-401 errors on /users/me, treat as unauthenticated (conservative)
-                const next = { status: "unauthenticated", user: null };
-                this.setState(next);
-                return next;
+                return this.applyUnauthenticatedState();
             }
             const user = (await response.json());
             const next = { status: "authenticated", user };
@@ -521,9 +587,7 @@ class AuthManager {
             return next;
         }
         catch {
-            const next = { status: "unauthenticated", user: null };
-            this.setState(next);
-            return next;
+            return this.applyUnauthenticatedState();
         }
     }
     /**
@@ -531,7 +595,7 @@ class AuthManager {
      * Does NOT redirect — call redirectToAuth() explicitly if desired.
      */
     markUnauthenticated() {
-        this.setState({ status: "unauthenticated", user: null });
+        this.applyUnauthenticatedState();
     }
     /**
      * Sign out the current user session.
@@ -559,6 +623,9 @@ class AuthManager {
                 // best effort fallback only
             }
         }
+        // Always clear frontend markers on logout attempt, even if backend session
+        // cleanup is partial. This avoids stale local "EXISTS" signals.
+        this.clearFrontendSessionMarkers();
         const isAuthenticated = await this.isAuthenticatedViaCookie();
         if (!isAuthenticated) {
             this.markUnauthenticated();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemma-sdk",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Official TypeScript SDK for Lemma pod-scoped APIs",
   "type": "module",
   "main": "dist/index.js",