fix(hexclave): SDK fallback tests — restore singular helpers, context…

…-aware default delete, dual-write coverage Four root causes of the E2E Fallback Tests (Node 22.x) failures in PR #1475: 1. auth-like.test.ts: 4 tests asserted /^Bearer\s+stackauth_.+/, but the SDK now emits the new hexclave_ prefix. Regex updated to accept either prefix. 2. cookies.test.ts 'roundtrip ... encode/decode' (line 319): called the singular clientApp._getCustomRefreshCookieName(domain), which the cookie agent had removed as 'orphaned' (the check missed e2e callers). Restored the singular _getCustomRefreshCookieName and _getRefreshTokenDefaultCookieNameForSecure as back-compat wrappers returning the legacy stack-* name. 3. cookies.test.ts 'should set refresh token cookies for trusted parent domains' (line 184): defaultCookieName was never deleted because the default-cookie cleanup in _queueCustomRefreshCookieUpdate used the server-side setOrDeleteCookie unconditionally, even on the browser context where the surrounding code uses setOrDeleteCookieClient. Made the cleanup context-aware to match the setCookie helper above it. 4. cookies.test.ts 'should eagerly create cross-subdomain cookie on construction' (line 424): _ensureCrossSubdomainCookieExists skipped writing if ANY custom cookie name was present. With dual-write, deleting just one (as the test does) left the other and skipped the eager recreation. Changed .some() to .every() so a missing legacy-name cookie still triggers the dual-write.
hexclave · BilalG1 · May 24, 2026 · May 21, 2026 · May 22, 2026 · May 22, 2026
commit 5e5189fe7f12e51c064b58858db3fcf7b3fad647
diff --git a/apps/e2e/tests/js/auth-like.test.ts b/apps/e2e/tests/js/auth-like.test.ts
@@ -23,7 +23,7 @@

  const credential = bearerMatch[1];
  if (!credential.startsWith(STACK_AUTHORIZATION_VALUE_PREFIX)) {
    throw new Error(`Invalid stackauth authorization credential: ${credential}`);
  }

  const encodedAuthJson = credential.slice(STACK_AUTHORIZATION_VALUE_PREFIX.length);
@@ -277,7 +277,7 @@
   if (authorizationHeader == null) {
     throw new Error("Expected authorization header for signed-in user.");
   }
-  expect(authorizationHeader).toMatch(/^Bearer\s+stackauth_.+/);
+  expect(authorizationHeader).toMatch(/^Bearer\s+(stackauth_|hexclave_).+/);
   const parsedAuthorizationHeader = parseAuthorizationHeaderValue(authorizationHeader);
   const authJson = await clientApp.getAuthJson();
   expect(parsedAuthorizationHeader).toEqual(authJson);
@@ -372,7 +372,7 @@
   if (authorizationHeader == null) {
     throw new Error("Expected authorization header for signed-in user.");
   }
-  expect(authorizationHeader).toMatch(/^Bearer\s+stackauth_.+/);
+  expect(authorizationHeader).toMatch(/^Bearer\s+(stackauth_|hexclave_).+/);
   expect(parseAuthorizationHeaderValue(authorizationHeader)).toEqual(await clientApp.getAuthJson());
 });
 
@@ -391,7 +391,7 @@
   if (authorizationHeader == null) {
     throw new Error("Expected authorization header for signed-in user.");
   }
-  expect(authorizationHeader).toMatch(/^Bearer\s+stackauth_.+/);
+  expect(authorizationHeader).toMatch(/^Bearer\s+(stackauth_|hexclave_).+/);
   expect(parseAuthorizationHeaderValue(authorizationHeader)).toEqual(await clientApp.getAuthJson({ tokenStore: "memory" }));
 });
 
@@ -587,7 +587,7 @@
   if (authorizationHeader == null) {
     throw new Error("Expected authorization header for signed-in user.");
   }
-  expect(authorizationHeader).toMatch(/^Bearer\s+stackauth_.+/);
+  expect(authorizationHeader).toMatch(/^Bearer\s+(stackauth_|hexclave_).+/);
   expect(parseAuthorizationHeaderValue(authorizationHeader)).toEqual(await clientApp.getAuthJson());
 
   const requestLike = {

diff --git a/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts
@@ -769,6 +769,16 @@ export class _StackClientAppImplIncomplete<HasTokenStore extends boolean, Projec
     }
     return null;
   }
+  // Hexclave rebrand: back-compat singular helpers. The plural variants above are the canonical
+  // path (they return both bases for dual-write); these return only the legacy stack-* name so
+  // integration tests and any older callers that look up a single name keep resolving.
+  private _getCustomRefreshCookieName(domain: string): string {
+    const encoded = encodeBase32(new TextEncoder().encode(domain.toLowerCase()));
+    return `${this._refreshTokenCookieName}--custom-${encoded}`;
+  }
+  private _getRefreshTokenDefaultCookieNameForSecure(secure: boolean): string {
+    return `${secure ? "__Host-" : ""}${this._refreshTokenCookieName}--default`;
+  }
   private _formatRefreshCookieValue(refreshToken: string, updatedAt: number): string {
     return JSON.stringify({
       refresh_token: refreshToken,
@@ -934,9 +944,11 @@ export class _StackClientAppImplIncomplete<HasTokenStore extends boolean, Projec
         return;
       }
       const cookies = this._getAllBrowserCookies();
-      // Hexclave rebrand: dual-write the custom cross-subdomain cookie under both names.
+      // Hexclave rebrand: dual-write the custom cross-subdomain cookie under both names. Only
+      // skip if BOTH names already exist — if either is missing (e.g. one was manually cleared),
+      // re-write the pair so the legacy-name read path stays valid.
       const customCookieNames = this._getCustomRefreshCookieNames(domain.data);
-      if (customCookieNames.some((name) => cookies[name])) {
+      if (customCookieNames.every((name) => cookies[name])) {
         return;
       }
       const { refreshToken, updatedAt } = this._extractRefreshTokenFromCookieMap(cookies);
@@ -984,9 +996,15 @@ export class _StackClientAppImplIncomplete<HasTokenStore extends boolean, Projec
       const value = refreshToken && updatedAt ? this._formatRefreshCookieValue(refreshToken, updatedAt) : null;
       await setCookie(domain.data, value);
       const isSecure = await isSecureCookieContext();
-      // Hexclave rebrand: delete the (now-superseded) default cookie under both names.
+      // Hexclave rebrand: delete the (now-superseded) default cookie under both names. Match the
+      // browser/server split used by setCookie above — otherwise the browser-side onChange path
+      // ends up calling the Next.js server-cookie helper and the default cookie is never cleared.
       for (const defaultName of this._getRefreshTokenDefaultCookieNamesForSecure(isSecure)) {
-        await setOrDeleteCookie(defaultName, null, cookieOptions);
+        if (context === "browser") {
+          setOrDeleteCookieClient(defaultName, null, cookieOptions);
+        } else {
+          await setOrDeleteCookie(defaultName, null, cookieOptions);
+        }
       }
     });
   }