@winwinmbs/portal-auth

Auth + session lifecycle SDK for WINWIN Portal. Handles login, token refresh, activity-gated session keep-alive, and WebSocket-based session revocation notifications.

Install

npm install @winwinmbs/portal-auth axios

axios is a peer dependency.

Modes

• same-origin — app and portal API share a domain; refresh token is a same-origin HttpOnly cookie. Used by the portal itself.
• sso — app lives on a different origin; login goes through the portal launch-code flow. Used by external apps.

Usage

import { AuthClient } from '@winwinmbs/portal-auth';

const auth = new AuthClient({
  apiUrl: 'https://api.winwinmbs.com',
  mode: 'sso',
  portalUrl: 'https://portal.winwinmbs.com',
  appId: 'your-app-id',
});

// Events
auth.on('session_expiring', ({ remainingSeconds }) => { /* show warning UI */ });
auth.on('session_revoked', ({ reason }) => { /* redirect to login */ });
auth.on('session_expired', () => { /* redirect to login */ });

// Lifecycle
auth.start();                           // begin refresh timer + WS
const token = auth.getAccessToken();    // for manual API calls
await auth.refresh();                   // force refresh (on "continue session")
await auth.logout();
auth.stop();                            // cleanup on unmount

Pattern

JWT TTL equals the server's configured inactivity timeout. The client refreshes when the JWT has 20% or less time remaining and the user has been active within the timeout window. A browser left idle stops calling refresh, and the server terminates the session naturally at timeout.

React bindings

See @winwinmbs/portal-auth-react for a React AuthProvider + useAuth + useSession hooks.

License

MIT