tempest-react-sdk 0.81.0 → 0.82.0

package/dist/auth/create-tempest-auth.js

@@ -1,11 +1,12 @@
 import { isDevBuild as e } from "../utils/dev-mode.js";
 import { SessionSupersededError as t } from "../http/errors.js";
 import { createApiClient as n } from "../http/api-client.js";
-import { createAuthStore as r } from "./create-auth-store.js";
-import { createRefreshQueue as i } from "./refresh-queue.js";
+import { bindSessionIdentity as r } from "./session-identity.js";
+import { createAuthStore as i } from "./create-auth-store.js";
+import { createRefreshQueue as a } from "./refresh-queue.js";
 //#region src/auth/create-tempest-auth.ts
-var a = 1e4;
-function o(e, t) {
+var o = 1e4, s = 1e4;
+function c(e, t) {
 	return e.length === 0 ? Promise.resolve() : new Promise((n) => {
 		let r = setTimeout(n, t);
 		Promise.allSettled(e).then(() => {
@@ -13,152 +14,186 @@ function o(e, t) {
 		});
 	});
 }
-function s(e) {
+function ee() {
+	let e = globalThis.crypto;
+	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+var te = "unlineaged", l = /* @__PURE__ */ new Set();
+function ne(t) {
+	e() && !l.has(t) && (l.add(t), console.warn("[tempest-react-sdk] createTempestAuth: withCredentials is set without logoutPath. logout() cannot clear the HttpOnly refresh cookie, so the next refresh() — the boot restore — signs the same account back in. Pass logoutPath (the backend's cookie logout route) so the server revokes it."));
+}
+function re(e) {
 	let t = e ?? {};
 	return {
 		token: t.access_token,
 		refreshToken: t.refresh_token
 	};
 }
-function c(c) {
-	let { baseURL: l, prefix: u, loginPath: d = "/api/auth/login", refreshPath: ee = "/api/auth/refresh", logoutPath: f, onLogoutError: te, mePath: p, storeName: m = "tempest-auth", storage: h = "local", withCredentials: g = !1, csrf: _, fetcher: v, parseTokens: y = s, parseUser: ne, refreshBody: b = (e) => e ? { refresh_token: e } : void 0, retry: re, redirectTo: x, onSessionEnd: S } = c, C = r({
+function u(l) {
+	let { baseURL: u, prefix: d, loginPath: ie = "/api/auth/login", refreshPath: ae = "/api/auth/refresh", logoutPath: f, onLogoutError: oe, mePath: p, storeName: m = "tempest-auth", storage: h = "local", withCredentials: g = !1, csrf: _, fetcher: se, parseTokens: v = re, parseUser: ce, refreshBody: y = (e) => e ? { refresh_token: e } : void 0, retry: le, redirectTo: b, onSessionEnd: x } = l;
+	g && !f && ne(m);
+	let S = i({
 		name: m,
 		storage: h
-	}), w = `${m}-refresh`;
-	function T() {
+	}), C = `${m}-refresh`;
+	function w() {
 		return typeof window > "u" ? null : h === "session" ? window.sessionStorage : window.localStorage;
 	}
-	function E() {
-		return T()?.getItem(w) ?? null;
+	function T() {
+		return w()?.getItem(C) ?? null;
+	}
+	let E = T();
+	function D(e) {
+		E = e;
+		let t = w();
+		t && (e ? t.setItem(C, e) : t.removeItem(C));
 	}
-	let D = E();
-	function O(e) {
-		D = e;
-		let t = T();
-		t && (e ? t.setItem(w, e) : t.removeItem(w));
+	let O = `${m}-lineage`, ue = `tempest-react-sdk:${m}:refresh`, k = w()?.getItem(O) ?? null;
+	function A(e) {
+		k = e;
+		let t = w();
+		t && (e ? t.setItem(O, e) : t.removeItem(O));
 	}
-	let k = () => C.getState(), A = () => k().token;
-	async function ie() {
-		if (!p) return k().user;
-		let e = j, n;
+	let j = () => S.getState(), M = () => j().token;
+	async function de() {
+		if (!p) return j().user;
+		let e = N, n;
 		try {
-			n = await Z.get(p, { skipAuthRetry: !0 });
+			n = await Q.get(p, { skipAuthRetry: !0 });
 		} catch (n) {
-			throw j === e ? n : new t();
+			throw N === e ? n : new t();
 		}
-		if (j !== e) throw new t();
-		return k().setUser(n), n;
+		if (N !== e || !Z().continues) throw new t();
+		return j().setUser(n), n;
 	}
-	let j = 0, M = Promise.resolve(), N = 0, P = /* @__PURE__ */ new Set(), F = /* @__PURE__ */ new Set(), I = /* @__PURE__ */ new Set(), L = /* @__PURE__ */ new Set();
-	function R(e) {
+	let N = 0, P = Promise.resolve(), F = 0, I = /* @__PURE__ */ new Set(), L = /* @__PURE__ */ new Set(), R = /* @__PURE__ */ new Set(), z = /* @__PURE__ */ new Set();
+	function B(e) {
 		let t = e.then(() => void 0, () => void 0);
-		return I.add(t), t.then(() => I.delete(t)), e;
+		return R.add(t), t.then(() => R.delete(t)), e;
 	}
-	function ae(t) {
+	function fe(t) {
 		e() && console.warn("[tempest-react-sdk] createTempestAuth: logoutPath revocation failed", t);
 		try {
-			te?.(t);
+			oe?.(t);
 		} catch {
 			return;
 		}
 	}
-	function z(e) {
+	function V(e) {
 		let t = (async () => {
 			try {
 				await e();
 			} catch (e) {
-				ae(e);
+				fe(e);
 			}
 		})();
-		return F.add(t), t.then(() => F.delete(t)), t;
+		return L.add(t), t.then(() => L.delete(t)), t;
 	}
-	function B(e, t) {
-		f && !g && t && z(() => V(e).post(f, { body: b(t) }));
+	function H(e, t) {
+		f && !g && t && V(() => U(e).post(f, { body: y(t) }));
 	}
-	function V(e) {
+	function U(e) {
 		return n({
-			baseURL: l,
-			prefix: u,
+			baseURL: u,
+			prefix: d,
 			withCredentials: g,
 			csrf: _,
-			fetcher: v,
+			fetcher: se,
 			getToken: () => e
 		});
 	}
-	function H() {
-		j += 1, W = i(U);
+	function W() {
+		N += 1, K = a(G);
 	}
-	async function U() {
-		let e = A();
-		if (!X().continues) throw new t();
-		if (A() !== e) return;
-		let n = j;
-		L.add(n);
+	async function G() {
+		let e = M(), t = N;
+		z.add(t);
 		try {
-			let e;
-			try {
-				e = await R(Z.post(ee, {
-					body: b(E()),
-					skipAuth: !0
-				}));
-			} catch (e) {
-				throw j === n ? e : new t();
-			}
-			let { token: r, refreshToken: i } = y(e);
-			if (j !== n || !X().continues) throw B(r ?? null, i), new t();
-			k().setToken(r), i && O(i);
+			await pe(() => me(e));
 		} finally {
-			L.delete(n);
+			z.delete(t);
 		}
 	}
-	let W = i(U);
-	function G(e) {
-		let t = A();
+	async function pe(e) {
+		let t = h === "local" && typeof navigator < "u" ? navigator.locks : void 0;
+		if (!t) return e();
+		let n = new AbortController(), r = setTimeout(() => n.abort(), s), i = !1;
+		try {
+			await t.request(ue, { signal: n.signal }, async () => {
+				i = !0, clearTimeout(r), await e();
+			});
+		} catch (t) {
+			if (i) throw t;
+			clearTimeout(r), await e();
+		}
+	}
+	async function me(e) {
+		let n = e !== null || j().user !== null || E !== null, r = Z();
+		if (!n && M() !== null) return;
+		if (!r.continues) throw new t();
+		if (M() !== e) return;
+		let i = N, a;
+		try {
+			a = await B(Q.post(ae, {
+				body: y(T()),
+				skipAuth: !0
+			}));
+		} catch (e) {
+			throw N === i ? e : new t();
+		}
+		let { token: o, refreshToken: s } = v(a);
+		if (N !== i || !Z().continues) throw H(o ?? null, s), new t();
+		j().setToken(o), s && D(s);
+	}
+	let K = a(G);
+	function q(e) {
+		let t = M();
 		return t === null ? !1 : e.token === null || e.token !== t;
 	}
-	function K() {
-		return A() === null && E() === null;
+	function J() {
+		return M() === null && T() === null;
 	}
-	async function q() {
-		if (!(P.size > 0 && N === 0 && (await Promise.allSettled([...P]), A() !== null))) throw Error("anonymous 401 with no session");
+	async function he() {
+		if (!(I.size > 0 && F === 0 && (await Promise.allSettled([...I]), M() !== null))) throw Error("anonymous 401 with no session");
 	}
-	async function oe(e) {
-		if (e.epoch !== null && e.epoch !== j) throw new t();
-		if (G(e)) {
+	async function ge(e) {
+		if (e.epoch !== null && e.epoch !== N) throw new t();
+		if (q(e)) {
 			if (e.token === null) throw Error("anonymous 401 under a live session");
-		} else return e.token === null && K() ? L.has(j) ? W() : q() : W();
+		} else return e.token === null && J() ? z.has(N) ? K() : he() : K();
 	}
-	async function se(e, n) {
-		if (n.epoch !== null && n.epoch !== j || !X().continues) throw new t();
-		G(n) || n.token === null && K() || await pe();
+	async function _e(e, n) {
+		if (n.epoch !== null && n.epoch !== N || !Z().continues) throw new t();
+		q(n) || n.token === null && J() || await Ce();
 	}
-	async function ce(e) {
-		F.size > 0 && await o([...F], a);
-		let t = le(e);
-		P.add(t);
+	async function ve(e) {
+		L.size > 0 && await c([...L], o);
+		let t = ye(e);
+		I.add(t);
 		try {
 			return await t;
 		} finally {
-			P.delete(t);
+			I.delete(t);
 		}
 	}
-	async function le(e) {
-		let n = j, r = await R(Z.post(d, {
+	async function ye(e) {
+		let n = N, r = await B(Q.post(ie, {
 			body: e,
 			skipAuth: !0
-		})), { token: i, refreshToken: a } = y(r);
-		if (j !== n) throw B(i ?? null, a), new t();
-		let { done: o } = J("switch"), s = j;
-		if (await o.catch(() => void 0), j !== s) throw new t();
-		k().setToken(i), O(a ?? null);
-		let c = ne?.(r);
-		return c == null ? ie() : (k().setUser(c), c);
+		})), { token: i, refreshToken: a } = v(r);
+		if (N !== n) throw H(i ?? null, a), new t();
+		H(M(), T() ?? void 0);
+		let { done: o } = Y("switch"), s = N;
+		if (await o.catch(() => void 0), N !== s) throw new t();
+		A(ee()), j().setToken(i), D(a ?? null);
+		let c = ce?.(r);
+		return c == null ? de() : (j().setUser(c), c);
 	}
-	function J(e) {
-		let { user: t, token: n } = k(), r = n !== null || t !== null || E() !== null;
-		return (r || e !== "expired") && H(), k().logout(), O(null), r ? {
+	function Y(e) {
+		let { user: t, token: n } = j(), r = n !== null || t !== null || T() !== null;
+		return (r || e !== "expired") && W(), j().logout(), D(null), A(null), r ? {
 			live: r,
-			done: Y({
+			done: X({
 				reason: e,
 				user: t,
 				token: n,
@@ -166,124 +201,132 @@ function c(c) {
 			})
 		} : {
 			live: r,
-			done: e === "switch" || N === 0 ? M : Promise.resolve()
+			done: e === "switch" || F === 0 ? P : Promise.resolve()
 		};
 	}
-	function Y(e) {
-		if (!S) return Promise.resolve();
-		let t = V(e.token);
-		N += 1;
+	function X(e) {
+		if (!x) return Promise.resolve();
+		let t = U(e.token);
+		F += 1;
 		let n = (async () => {
 			try {
-				await S({
+				await x({
 					...e,
 					api: t
 				});
 			} finally {
-				--N;
+				--F;
 			}
 		})();
-		return M = n.then(() => void 0, () => void 0), n.then(() => void 0);
+		return P = n.then(() => void 0, () => void 0), n.then(() => void 0);
 	}
-	function ue() {
-		let e = T();
+	function be() {
+		let e = w();
 		if (!e) return null;
-		let t = e.getItem(w), n = e.getItem(m);
-		if (!n) return {
+		let t = e.getItem(C), n = e.getItem(O), r = e.getItem(m);
+		if (!r) return {
 			user: null,
 			token: null,
-			refreshToken: t
+			refreshToken: t,
+			lineage: n
 		};
 		try {
-			let e = JSON.parse(n);
+			let e = JSON.parse(r);
 			return {
 				user: e.state?.user ?? null,
 				token: e.state?.token ?? null,
-				refreshToken: t
+				refreshToken: t,
+				lineage: n
 			};
 		} catch {
 			return {
 				user: null,
 				token: null,
-				refreshToken: t
+				refreshToken: t,
+				lineage: n
 			};
 		}
 	}
-	function X() {
-		let e = ue(), { user: t, token: n } = k();
+	function Z() {
+		let e = be(), { user: t, token: n } = j();
 		if (e === null) return {
 			continues: !0,
 			done: Promise.resolve()
 		};
 		let r = JSON.stringify(e.user) === JSON.stringify(t);
-		if (e.token === n && e.refreshToken === D && r) return {
+		if (e.token === n && e.refreshToken === E && e.lineage === k && r) return {
 			continues: !0,
 			done: Promise.resolve()
 		};
-		let i = e.token !== null && (e.token === n || n !== null && r), a = n !== null || t !== null || D !== null;
-		if (i || H(), D = e.refreshToken, C.setState({
+		let i = e.lineage !== null || k !== null ? e.lineage === k : e.token === n || n !== null && r, a = e.token !== null && i, o = n !== null || t !== null || E !== null;
+		if (a || W(), E = e.refreshToken, k = e.lineage, S.setState({
 			user: e.user,
 			token: e.token,
 			isAuthenticated: e.token !== null
-		}), i || !a) return {
-			continues: i,
+		}), a || !o) return {
+			continues: a,
 			done: Promise.resolve()
 		};
-		let o = Y({
+		let s = X({
 			reason: e.token === null ? "logout" : "switch",
 			user: t,
 			token: n,
 			elsewhere: !0
 		});
-		return o.catch(() => void 0), {
-			continues: i,
-			done: o
+		return s.catch(() => void 0), {
+			continues: a,
+			done: s
 		};
 	}
-	function de() {
+	function xe() {
 		if (!f) return null;
-		let e = f, { token: t, user: n } = k(), r = E();
+		let e = f, { token: t, user: n } = j(), r = T();
 		if (!g && t === null && n === null && r === null) return null;
-		let i = g ? [...I] : [];
-		return z(async () => (await o(i, a), V(t).post(e, { body: b(r) })));
+		let i = g ? [...R] : [];
+		return V(async () => (await c(i, o), U(t).post(e, { body: y(r) })));
 	}
-	function fe() {
-		let e = X();
+	function Se() {
+		let e = Z();
 		if (!e.continues) return e.done;
-		let t = de(), { done: n } = J("logout");
+		let t = xe(), { done: n } = Y("logout");
 		return t ? Promise.all([t, n]).then(() => void 0) : n;
 	}
-	async function pe() {
-		let { live: e, done: t } = J("expired");
-		await t.catch(() => void 0), e && x && typeof window < "u" && window.location.assign(x);
+	async function Ce() {
+		let { live: e, done: t } = Y("expired");
+		await t.catch(() => void 0), e && b && typeof window < "u" && window.location.assign(b);
 	}
-	let Z = n({
-		baseURL: l,
-		prefix: u,
+	let Q = n({
+		baseURL: u,
+		prefix: d,
 		withCredentials: g,
 		csrf: _,
-		fetcher: v,
-		getToken: A,
-		getSessionEpoch: () => j,
-		refresh: oe,
-		retry: re,
-		onUnauthorized: se
-	}), me = () => W();
-	function Q(e) {
-		e.storageArea === T() && (e.key === null || e.key === m || e.key === w) && X();
+		fetcher: se,
+		getToken: M,
+		getSessionEpoch: () => N,
+		refresh: ge,
+		retry: le,
+		onUnauthorized: _e
+	}), we = () => K(), Te = () => M() === null ? null : k ?? te, Ee = {
+		current: Te,
+		subscribe: (e) => S.subscribe(e)
+	};
+	r(Q, Ee), r(M, Ee);
+	function De(e) {
+		e.storageArea === w() && (e.key === null || e.key === m || e.key === C || e.key === O) && Z();
 	}
 	let $ = typeof window > "u" ? null : window;
-	return $?.addEventListener("storage", Q), {
-		useAuthStore: C,
-		api: Z,
-		login: ce,
-		logout: fe,
-		refresh: me,
-		getToken: A,
-		dispose: () => $?.removeEventListener("storage", Q)
+	return $?.addEventListener("storage", De), {
+		useAuthStore: S,
+		api: Q,
+		login: ve,
+		logout: Se,
+		refresh: we,
+		getToken: M,
+		sessionKey: Te,
+		dispose: () => $?.removeEventListener("storage", De)
 	};
 }
 //#endregion
-export { c as createTempestAuth };
+export { u as createTempestAuth };
 
 //# sourceMappingURL=create-tempest-auth.js.map