fix(sdk,api): align SDK auth types with API and fix refresh token flow - #548
Merged
Xhristin3 merged 2 commits intoAug 24, 2026
Merged
Conversation
- Replace AuthTokens with AuthResponse in SDK types — add `user` field, remove the non-existent `expiresIn` field that the API never returns. AuthTokens is kept as a deprecated type alias for backward compatibility. - Fix refreshToken() to POST the refresh token in the request body instead of relying on httpOnly cookies, which were inaccessible to the SDK in Node and cross-origin browser contexts. - Add POST /auth/refresh endpoint that accepts the refresh token either from the request body (`refreshToken`) or from the `refresh_token` httpOnly cookie, keeping the existing Next.js proxy flow working. - Include a refresh token in login() and register() API responses so the SDK has a token to send on refresh. - Add findById() to UsersRepository for refresh-token user lookup. - Add cookie-parser middleware to parse cookies for the cookie-based refresh path. - Add comprehensive unit tests: AuthController.refresh, AuthService.refresh, SDK client auth flows (login, register, refreshToken, 401 auto-refresh). - Update SDK README with corrected types and refresh usage examples. - Bump both @stellar/streaming-sdk and stellar-streaming-api to v1.1.0. Closes XStreamRollz#527 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #527. This PR fixes two critical issues where the SDK's auth surface drifted from the API's wire contract, and the refresh token flow was broken end-to-end.
Problem
Type drift —
expiresIndoes not exist on the wire.AuthTokensinxstreamroll-sdk/src/types.tsdeclaredexpiresIn: number, butPOST /auth/loginandPOST /auth/registerreturn{ user, accessToken, refreshToken }— noexpiresIn. Every consumer readingtokens.expiresIngotundefined, and theuserobject the server returns was completely missing from the SDK type.refreshToken()could not authenticate.StreamingClient.refreshToken()POSTed to/auth/refreshwith no cookie and no credentials. The server's refresh endpoint read the refresh token exclusively from thehttpOnlycookie (req.cookies?.refresh_token), and the SDK never setcredentials: "include". In Node there is no cookie jar at all; in the browser cross-origin fetches omit cookies. SorefreshToken()always threw, and the 401 auto-refresh retry always failed.Root cause
AuthTokensinterface independently of the actual API response shape.httpOnlycookies.Solution
SDK (
xstreamroll-sdk)src/types.tsAuthTokenswithAuthResponse— includesuser,accessToken,refreshToken.expiresInremoved.AuthTokenskept as deprecated alias.src/client.tslogin,register,refreshToken) returnAuthResponse.refreshToken()sends the storedrefreshTokenin the request body. 401 interceptor uses the stored token.src/index.tsAuthResponse.package.json1.1.0(minor —expiresInnever worked,AuthTokensalias preserved).API (
api)src/auth/auth.controller.tsPOST /auth/refreshendpoint. AcceptsrefreshTokenfrom request body ORrefresh_tokenhttpOnly cookie (backward compatible).src/auth/auth.service.tsrefresh()method — verifies token, looks up user, returns fresh pair. AddedsignRefreshToken()with 7-day expiry.login()/register()now returnrefreshToken.src/auth/users.repository.tsfindById()for refresh-token user lookup.src/main.tscookie-parsermiddleware for cookie-based refresh flow.package.jsoncookie-parser+@types/cookie-parser. Bump to1.1.0.Backward compatibility
httpOnlycookie, so the existing Next.js proxy (app/api/auth/refresh/route.ts) continues working.AuthTokensis kept as a deprecated type alias — existing consumers who import it get a deprecation warning but no breakage.Tests
New tests:
api/src/auth/auth.controller.spec.ts— 5 tests covering body token, cookie fallback, body preference, and missing-token cases.api/src/auth/auth.service.spec.ts— 4 new tests forrefresh(): valid token, expired token, missing user, payload structure.Expanded tests:
xstreamroll-sdk/__tests__/client.test.ts— 14 new tests covering login/register/refreshToken response shapes, token storage, logout, and the 401 auto-refresh interceptor round-trip.Test results: 97/97 passing across all packages.
CI verification
Files changed
xstreamroll-sdk/src/types.tsxstreamroll-sdk/src/client.tsxstreamroll-sdk/src/index.tsxstreamroll-sdk/__tests__/client.test.tsxstreamroll-sdk/README.mdxstreamroll-sdk/package.jsonapi/src/auth/auth.controller.tsapi/src/auth/auth.service.tsapi/src/auth/users.repository.tsapi/src/main.tsapi/src/auth/auth.service.spec.tsapi/src/auth/auth.controller.spec.tsapi/package.json🤖 Generated with Codebuff