chore: improve MFA session handling and add public session APIs#392
chore: improve MFA session handling and add public session APIs#392chaitanyapotti merged 2 commits intomasterfrom
Conversation
- Add public getAccessToken() and refreshSession() methods to Auth class - refreshSession() validates session and clears SDK state on failure - Replace all rehydrateSession() calls with refreshSession() for consistent error handling; remove dead rehydrateSession() method - Update enableMFA, manageMFA, and all factor management methods to use refreshSession() and pass accessToken in request payloads - Extract clearState() helper from logout() to avoid duplication - Remove authSessionManager getter that exposed internal session manager - Restore MFA_LEVELS.DEFAULT to avoid breaking change - Vue example: track MFA status via reactive ref and reset on logout Made-with: Cursor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Made-with: Cursor
Updating flag after enableMFA popupExported on 20/03/2026 at 17:18:33 GMT+7 from Cursor (2.6.20) User /code-reviewer review the code Cursor The review confirmed the critical issue flagged by Bugbot. Here's the summary: Review ResultsCRITICAL —
|

Jira Link
EMBED-211
Description
getAccessToken()method toAuthclass — exposes access token with null-safety guard (throwsuserNotLoggedInif token is missing)refreshSession()method — re-authorizes the session against the server; if the session is invalid or expired, cleans up viasessionManager.logout(), clears all local SDK state, and throwsuserNotLoggedInenableMFA,manageMFA,manageSocialFactor,addAuthenticatorFactor, andaddPasskeyFactornow all userefreshSession()withaccessTokenin request payloads, replacing inconsistentrehydrateSession()/ rawsessionIdchecksclearState()helper fromlogout()to eliminate state-clearing duplication betweenlogout()andrefreshSession()authSessionManagergetter that leaked the internalAuthSessionManagerinstance — public methods (getAccessToken(),refreshSession()) now cover the needed surface arearehydrateSession()method — fully replaced byrefreshSession()everywhereMFA_LEVELS.DEFAULTto avoid a breaking change for external consumersrefso the UI updates immediately afterenableMFApopup completes; resetmfaEnabledon logout@toruslabs/session-manager,@toruslabs/constants, and related packages; migrated toCITADEL_SERVER_MAP,STORAGE_SERVER_MAP,STORAGE_SERVER_SOCKET_URL_MAPfrom@toruslabs/constantssocketUrl/serverUrlrequired (always provided byAuth)cb()fire-and-forget for asynchandleRequest; added comprehensive testsHow has this been tested?
Screenshots (if appropriate)
N/A
Types of changes
Checklist
Note
Medium Risk
Medium risk because it changes session/token handling for login and all MFA-related flows, and updates several core dependencies (
@toruslabs/session-manager,@toruslabs/customauth,vite/vitest). It also changes JSON-RPC stream write semantics to be non-blocking, which could affect request ordering and error timing.Overview
Improves session robustness and MFA flows by introducing
Auth.refreshSession()(server re-authorization with automatic logout/state clear on invalid sessions) andAuth.getAccessToken()for guarded access-token retrieval.All MFA/protected operations (
enableMFA,manageMFA, social/passkey/authenticator factor ops) now refresh session first and includeaccessTokenin theAuthRequestPayload; logout/state reset is centralized via a newclearState()helper, and token field names passed tosessionManager.setTokensare updated.Defaults for citadel/storage server URLs are switched to
@toruslabs/constantsenv maps,PopupHandlernow requires explicitserverUrl/socketUrl, and the Vue example updates MFA UI state reactively after enabling MFA and resets it on logout.createEngineStreamV2is changed to call the stream write callback synchronously (fire-and-forget request handling), with extensive new tests covering concurrency/out-of-order behavior. Dependency and lockfile updates bump Torus packages and tooling versions.Written by Cursor Bugbot for commit d2bd27e. This will update automatically on new commits. Configure here.