feat: migrate to use js-utils and refresh token support

Author: DanielRivers

CHANGELOG.md

@@ -1,6 +1,60 @@
 # Changelog
 
 
+## 0.7.1...fix/refresh_insecure_token_storage
+
+[compare changes](https://github.com/kinde-oss/js-utils/compare/0.7.1...fix/refresh_insecure_token_storage)
+
+### 🩹 Fixes
+
+- Insecure token storage when using no non custom domain ([7338321](https://github.com/kinde-oss/js-utils/commit/7338321))
+- Only show production warning when explicity setting the 'useInsecureForRefreshToken' ([958f4ed](https://github.com/kinde-oss/js-utils/commit/958f4ed))
+- Non prod kinde domains ([24be712](https://github.com/kinde-oss/js-utils/commit/24be712))
+
+### ✅ Tests
+
+- Add tests ([979974d](https://github.com/kinde-oss/js-utils/commit/979974d))
+
+### ❤️ Contributors
+
+- Daniel Rivers ([@DanielRivers](http://github.com/DanielRivers))
+
+## 0.7.1...fix/refresh_insecure_token_storage
+
+[compare changes](https://github.com/kinde-oss/js-utils/compare/0.7.1...fix/refresh_insecure_token_storage)
+
+### 🩹 Fixes
+
+- Insecure token storage when using no non custom domain ([7338321](https://github.com/kinde-oss/js-utils/commit/7338321))
+- Only show production warning when explicity setting the 'useInsecureForRefreshToken' ([958f4ed](https://github.com/kinde-oss/js-utils/commit/958f4ed))
+- Non prod kinde domains ([24be712](https://github.com/kinde-oss/js-utils/commit/24be712))
+
+### ✅ Tests
+
+- Add tests ([979974d](https://github.com/kinde-oss/js-utils/commit/979974d))
+
+### ❤️ Contributors
+
+- Daniel Rivers ([@DanielRivers](http://github.com/DanielRivers))
+
+## 0.7.1...fix/refresh_insecure_token_storage
+
+[compare changes](https://github.com/kinde-oss/js-utils/compare/0.7.1...fix/refresh_insecure_token_storage)
+
+### 🩹 Fixes
+
+- Insecure token storage when using no non custom domain ([7338321](https://github.com/kinde-oss/js-utils/commit/7338321))
+- Only show production warning when explicity setting the 'useInsecureForRefreshToken' ([958f4ed](https://github.com/kinde-oss/js-utils/commit/958f4ed))
+- Non prod kinde domains ([24be712](https://github.com/kinde-oss/js-utils/commit/24be712))
+
+### ✅ Tests
+
+- Add tests ([979974d](https://github.com/kinde-oss/js-utils/commit/979974d))
+
+### ❤️ Contributors
+
+- Daniel Rivers ([@DanielRivers](http://github.com/DanielRivers))
+
 ## 0.7.0...main
 
 [compare changes](https://github.com/kinde-oss/js-utils/compare/0.7.0...main)

lib/utils/exchangeAuthCode.ts

@@ -97,7 +97,7 @@ export const exchangeAuthCode = async ({
     headers["Kinde-SDK"] =
       `${frameworkSettings.framework}/${frameworkSettings.frameworkVersion}`;
   }
-  const response = await fetch(`${domain}/oauth2/token`, {
+  const fetchOptions: RequestInit = {
     method: "POST",
     ...(isCustomDomain(domain) && { credentials: "include" }),
     headers: new Headers(headers),
@@ -108,7 +108,9 @@ export const exchangeAuthCode = async ({
       grant_type: "authorization_code",
       redirect_uri: redirectURL,
     }),
-  });
+  };
+  console.log("fetchOptions", fetchOptions);
+  const response = await fetch(`${domain}/oauth2/token`, fetchOptions);
   if (!response?.ok) {
     const errorText = await response.text();
     console.error("Token exchange failed:", response.status, errorText);
@@ -135,7 +137,7 @@ export const exchangeAuthCode = async ({
     });
   }
 
-  if (storageSettings.useInsecureForRefreshToken) {
+  if (storageSettings.useInsecureForRefreshToken || !isCustomDomain(domain)) {
     activeStorage.setSessionItem(StorageKeys.refreshToken, data.refresh_token);
   }
 

lib/utils/isCustomDomain.test.ts

@@ -15,7 +15,7 @@ describe("isCustomDomain", () => {
     expect(result).toEqual(false);
   });
   it("works on no prod kinde domains", () => {
-    const result = isCustomDomain("https://stakesocial-dave.au.kinde.com");
+    const result = isCustomDomain("https://test-test.au.kinde.com");
     expect(result).toEqual(false);
   });
 });

package.json

@@ -14,7 +14,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.7.1",
+  "version": "0.7.2-5",
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",