fix(oauth): remove OAuth session caching to prevent authentication issues

changelog.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 2025-07-22 - 3.1.2 - fix(oauth)
+Remove OAuth session caching to prevent authentication issues
+
+- Removed static OAuth session cache that was causing incomplete session issues
+- Each OAuth token now creates a fresh session without caching
+- Removed cache management methods (clearOAuthCache, clearOAuthCacheForToken, getOAuthCacheSize)
+- Simplified init() method to treat OAuth tokens the same as regular API keys
+- OAuth tokens still handle "Superfluous authentication" errors with initWithExistingInstallation
+
+## 2025-07-22 - 3.1.1 - fix(oauth)
+Fix OAuth token authentication flow for existing installations
+
+- Fixed initWithExistingInstallation to properly create new sessions with existing installation/device
+- OAuth tokens now correctly skip installation/device steps when they already exist
+- Session creation still uses OAuth token as the secret parameter
+- Properly handles "Superfluous authentication" errors by reusing existing installation
+- Renamed initWithExistingSession to initWithExistingInstallation for clarity
+
+## 2025-07-22 - 3.1.0 - feat(oauth)
+Add OAuth session caching to prevent multiple authentication attempts
+
+- Implemented static OAuth session cache in BunqAccount class
+- Added automatic session reuse for OAuth tokens across multiple instances
+- Added handling for "Superfluous authentication" and "Authentication token already has a user session" errors
+- Added initWithExistingSession() method to reuse OAuth tokens as session tokens
+- Added cache management methods: clearOAuthCache(), clearOAuthCacheForToken(), getOAuthCacheSize()
+- Added hasValidSession() method to check session validity
+- OAuth tokens now properly cache and reuse sessions to prevent authentication conflicts
+
+## 2025-07-22 - 3.0.8 - fix(oauth)
+Correct OAuth implementation to match bunq documentation
+
+- Removed OAuth mode from HTTP client - OAuth tokens use normal request signing
+- OAuth tokens now work exactly like regular API keys (per bunq docs)
+- Fixed test comments to reflect correct OAuth behavior
+- Simplified OAuth handling by removing unnecessary special cases
+- OAuth tokens properly go through full auth flow with request signing
+
+## 2025-07-22 - 3.0.7 - fix(oauth)
+Fix OAuth token authentication flow
+
+- OAuth tokens now go through full initialization (installation → device → session)
+- Fixed "Insufficient authentication" errors by treating OAuth tokens as API keys
+- OAuth tokens are used as the 'secret' parameter, not as session tokens
+- Follows bunq documentation: "Just use the OAuth Token as a normal bunq API key"
+- Removed incorrect session skip logic for OAuth tokens
+
+## 2025-07-22 - 3.0.6 - fix(oauth)
+Fix OAuth token private key error
+
+- Fixed "Private key not generated yet" error for OAuth tokens
+- Added OAuth mode to HTTP client to skip request signing
+- Skip response signature verification for OAuth tokens
+- Properly handle missing private keys in OAuth mode
+
 ## 2025-07-22 - 3.0.5 - feat(oauth)
 Add OAuth token support
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@apiclient.xyz/bunq",
-  "version": "3.0.1",
+  "version": "3.0.9",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@apiclient.xyz/bunq",
-      "version": "3.0.1",
+      "version": "3.0.9",
       "license": "MIT",
       "dependencies": {
         "@bunq-community/bunq-js-client": "^1.1.2",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apiclient.xyz/bunq",
-  "version": "3.0.5",
+  "version": "3.1.2",
   "private": false,
   "description": "A full-featured TypeScript/JavaScript client for the bunq API",
   "type": "module",

readme.md

@@ -436,17 +436,19 @@ const bunq = new BunqAccount({
   apiKey: 'your-oauth-access-token',  // OAuth token from bunq OAuth flow
   deviceName: 'OAuth App',
   environment: 'PRODUCTION',
-  isOAuthToken: true  // Important: Set this flag for OAuth tokens
+  isOAuthToken: true  // Optional: Set for OAuth-specific handling
 });
 
 await bunq.init();
 
-// OAuth tokens already have an associated session from the OAuth flow,
-// so the library will skip session creation and use the token directly
+// OAuth tokens work just like regular API keys:
+// 1. They go through installation → device → session creation
+// 2. The OAuth token is used as the 'secret' during authentication
+// 3. A session token is created and used for all API calls
 const accounts = await bunq.getAccounts();
 
-// Note: OAuth tokens have their own expiry mechanism managed by bunq's OAuth server
-// The library will not attempt to refresh OAuth tokens
+// According to bunq documentation: 
+// "Just use the OAuth Token (access_token) as a normal bunq API key"
 ```
 
 ### Error Handling

test/test.oauth.ts

@@ -15,7 +15,8 @@ tap.test('should handle OAuth token initialization', async () => {
   
   // Mock test - in reality this would connect to bunq
   try {
-    // The init should skip session creation for OAuth tokens
+    // OAuth tokens should go through full initialization flow
+    // (installation → device → session)
     await oauthBunq.init();
     console.log('OAuth token initialization successful (mock)');
   } catch (error) {
@@ -24,7 +25,7 @@ tap.test('should handle OAuth token initialization', async () => {
   }
 });
 
-tap.test('should not attempt session refresh for OAuth tokens', async () => {
+tap.test('should handle OAuth token session management', async () => {
   const oauthBunq = new bunq.BunqAccount({
     apiKey: 'test-oauth-token',
     deviceName: 'OAuth Test App',
@@ -32,7 +33,8 @@ tap.test('should not attempt session refresh for OAuth tokens', async () => {
     isOAuthToken: true
   });
   
-  // Test that ensureValidSession doesn't try to refresh OAuth tokens
+  // OAuth tokens now behave the same as regular API keys
+  // They go through normal session management
   try {
     await oauthBunq.apiContext.ensureValidSession();
     console.log('OAuth session management test passed');
@@ -41,4 +43,27 @@ tap.test('should not attempt session refresh for OAuth tokens', async () => {
   }
 });
 
+tap.test('should handle OAuth tokens through full initialization', async () => {
+  const oauthBunq = new bunq.BunqAccount({
+    apiKey: 'test-oauth-token',
+    deviceName: 'OAuth Test App',
+    environment: 'SANDBOX',
+    isOAuthToken: true
+  });
+  
+  try {
+    // OAuth tokens go through full initialization flow
+    // The OAuth token is used as the API key/secret
+    await oauthBunq.init();
+    
+    // The HTTP client works normally with OAuth tokens (including request signing)
+    const httpClient = oauthBunq.apiContext.getHttpClient();
+    
+    console.log('OAuth initialization test passed - full flow completed');
+  } catch (error) {
+    // Expected to fail with invalid token error, not initialization skip
+    console.log('OAuth initialization test completed (expected auth failure with mock token)');
+  }
+});
+
 tap.start();

ts/bunq.classes.account.ts

@@ -2,6 +2,7 @@ import * as plugins from './bunq.plugins.js';
 import { BunqApiContext } from './bunq.classes.apicontext.js';
 import { BunqMonetaryAccount } from './bunq.classes.monetaryaccount.js';
 import { BunqUser } from './bunq.classes.user.js';
+import { BunqApiError } from './bunq.classes.httpclient.js';
 import type { IBunqSessionServerResponse } from './bunq.interfaces.js';
 
 export interface IBunqConstructorOptions {
@@ -31,7 +32,7 @@ export class BunqAccount {
    * Initialize the bunq account
    */
   public async init() {
-    // Create API context
+    // Create API context for both OAuth tokens and regular API keys
     this.apiContext = new BunqApiContext({
       apiKey: this.options.apiKey,
       environment: this.options.environment,
@@ -40,8 +41,24 @@ export class BunqAccount {
       isOAuthToken: this.options.isOAuthToken
     });
 
-    // Initialize API context (handles installation, device registration, session)
+    try {
       await this.apiContext.init();
+    } catch (error) {
+      // Handle "Superfluous authentication" or "Authentication token already has a user session" errors
+      if (error instanceof BunqApiError && this.options.isOAuthToken) {
+        const errorMessages = error.errors.map(e => e.error_description).join(' ');
+        if (errorMessages.includes('Superfluous authentication') ||
+            errorMessages.includes('Authentication token already has a user session')) {
+          console.log('OAuth token already has installation/device, attempting to create new session...');
+          // Try to create a new session with existing installation/device
+          await this.apiContext.initWithExistingInstallation();
+        } else {
+          throw error;
+        }
+      } else {
+        throw error;
+      }
+    }
 
     // Create user instance
     this.bunqUser = new BunqUser(this.apiContext);

ts/bunq.classes.apicontext.ts

@@ -44,15 +44,6 @@ export class BunqApiContext {
    * Initialize the API context (installation, device, session)
    */
   public async init(): Promise<void> {
-    // If using OAuth token, skip session creation
-    if (this.options.isOAuthToken) {
-      // OAuth tokens already have an associated session
-      this.context.sessionToken = this.options.apiKey;
-      this.session = new BunqSession(this.crypto, this.context);
-      this.session.setOAuthMode(true);
-      return;
-    }
-    
     // Try to load existing context
     const existingContext = await this.loadContext();
     
@@ -79,6 +70,11 @@ export class BunqApiContext {
       this.options.permittedIps || []
     );
     
+    // Set OAuth mode if applicable (for session expiry handling)
+    if (this.options.isOAuthToken) {
+      this.session.setOAuthMode(true);
+    }
+
     // Save context
     await this.saveContext();
   }
@@ -135,11 +131,6 @@ export class BunqApiContext {
    * Refresh session if needed
    */
   public async ensureValidSession(): Promise<void> {
-    // OAuth tokens don't need session refresh
-    if (this.options.isOAuthToken) {
-      return;
-    }
-    
     await this.session.refreshSession();
     await this.saveContext();
   }
@@ -171,4 +162,58 @@ export class BunqApiContext {
   public getBaseUrl(): string {
     return this.context.baseUrl;
   }
+
+  /**
+   * Check if the context has a valid session
+   */
+  public hasValidSession(): boolean {
+    return this.session && this.session.isSessionValid();
+  }
+
+  /**
+   * Initialize with existing installation and device (for OAuth tokens that already completed these steps)
+   */
+  public async initWithExistingInstallation(): Promise<void> {
+    // For OAuth tokens that already have installation/device but need a new session
+    // We need to:
+    // 1. Try to load existing installation/device info
+    // 2. Create a new session using the OAuth token as the secret
+    
+    const existingContext = await this.loadContext();
+    
+    if (existingContext && existingContext.clientPrivateKey && existingContext.clientPublicKey) {
+      // Restore crypto keys from previous installation
+      this.crypto.setKeys(
+        existingContext.clientPrivateKey,
+        existingContext.clientPublicKey
+      );
+      
+      // Update context with existing installation data
+      this.context = { ...this.context, ...existingContext };
+      
+      // Create new session instance
+      this.session = new BunqSession(this.crypto, this.context);
+      
+      // Try to create a new session with the OAuth token
+      try {
+        await this.session.init(
+          this.options.deviceDescription,
+          this.options.permittedIps || [],
+          true // skipInstallationAndDevice = true
+        );
+        
+        if (this.options.isOAuthToken) {
+          this.session.setOAuthMode(true);
+        }
+        
+        await this.saveContext();
+        console.log('Successfully created new session with existing installation');
+      } catch (error) {
+        throw new Error(`Failed to create session with OAuth token: ${error.message}`);
+      }
+    } else {
+      // No existing installation, fall back to full init
+      throw new Error('No existing installation found, full initialization required');
+    }
+  }
 }

ts/bunq.classes.session.ts

@@ -24,14 +24,16 @@ export class BunqSession {
   /**
    * Initialize a new bunq API session
    */
-  public async init(deviceDescription: string, permittedIps: string[] = []): Promise<void> {
+  public async init(deviceDescription: string, permittedIps: string[] = [], skipInstallationAndDevice: boolean = false): Promise<void> {
+    if (!skipInstallationAndDevice) {
       // Step 1: Installation
       await this.createInstallation();
       
       // Step 2: Device registration
       await this.registerDevice(deviceDescription, permittedIps);
+    }
     
-    // Step 3: Session creation
+    // Step 3: Session creation (always required)
     await this.createSession();
   }
 
@@ -156,11 +158,6 @@ export class BunqSession {
    * Check if session is still valid
    */
   public isSessionValid(): boolean {
-    // OAuth tokens are always considered valid (they have their own expiry mechanism)
-    if (this.isOAuthMode) {
-      return true;
-    }
-    
     if (!this.sessionExpiryTime) {
       return false;
     }
@@ -173,11 +170,6 @@ export class BunqSession {
    * Refresh the session if needed
    */
   public async refreshSession(): Promise<void> {
-    // OAuth tokens don't need session refresh
-    if (this.isOAuthMode) {
-      return;
-    }
-    
     if (!this.isSessionValid()) {
       await this.createSession();
     }