feat: external wallet session management by hieu-w · Pull Request #2432 · Web3Auth/web3auth-web

hieu-w · 2026-04-01T05:47:56Z

Jira Link

Description

Fix verifySignedChallenge call in the WalletConnect v2 connector to match the updated VerifySignedChallengeParams interface from @toruslabs/base-controllers.

The baseEvmConnector and baseSolanaConnector were already updated but walletConnectV2Connector was missed:

Added missing deviceInfo: getDeviceInfo() parameter (required by VerifySignedChallengeParams)
Updated return type handling: verifySignedChallenge now returns SiwwTokens (with idToken, accessToken, refreshToken) instead of a plain string
Aligned token handling to use IdentityTokenInfo pattern, matching the other two connectors

How has this been tested?

TypeScript type-check passes with no errors
Verified the fix matches the existing pattern in baseEvmConnector.ts and baseSolanaConnector.ts

Screenshots (if appropriate)

N/A

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

My code follows the code style of this project. (run lint)
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have added tests to cover my changes.
All new and existing tests passed.

Note

Medium Risk
Touches authentication/session persistence for external wallet connectors by introducing cached/refreshable token storage and changing the token API surface; regressions could break login/rehydration or token lifecycle across connectors. Dependency bumps (Torus controllers/Auth/MetaMask kit) also increase integration risk.

Overview
Adds a new auth token info flow that replaces getIdentityToken/useIdentityToken with getAuthTokenInfo/useAuthTokenInfo across Modal + No-Modal SDKs and demo apps, standardizing on returning { idToken, accessToken?, refreshToken? }.

Implements external wallet session management in @web3auth/no-modal by introducing AuthSessionManager-backed token caching/refresh + best-effort logout cleanup, wiring it through connector init/connection events (including WalletConnect v2) and persisting tokens in core state (supports SSR token fetch).

Adds configurable token storage adapters (storage/cookieOptions) and exposes a Vue demo setting to select token storage, while updating dependencies to newer @toruslabs/*/@web3auth/auth versions and adding ox.

^{Reviewed by Cursor Bugbot for commit b232857. Bugbot is set up for automated code reviews on this repo. Configure here.}

vercel · 2026-04-01T05:48:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web3auth-web	Ready	Preview, Comment	Apr 5, 2026 7:22am

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts

packages/no-modal/src/connectors/base-evm-connector/baseEvmConnector.ts

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts

chaitanyapotti

i think we should use the AuthSessionManager to manage the session here and not write custom saving of tokens.

packages/no-modal/src/base/connector/baseConnector.ts

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts

arch1995 · 2026-04-01T17:53:11Z

packages/no-modal/src/base/core/IWeb3Auth.ts

   */
-  // TODO: rename this to match customauth, sfa
-  storageType?: "session" | "local" | "cookies";
+  accessTokenProvider?: AccessTokenProvider;


i think we dont need to pass it here

arch1995 · 2026-04-01T17:53:35Z

packages/no-modal/src/base/connector/interfaces.ts

 export type CONNECTOR_STATUS_TYPE = (typeof CONNECTOR_STATUS)[keyof typeof CONNECTOR_STATUS];

-export type IdentityTokenInfo = { idToken: string };
+export type IdentityTokenInfo = { idToken: string; accessToken?: string; refreshToken?: string };


pls rename this key

arch1995 · 2026-04-01T17:54:05Z

packages/no-modal/src/base/connector/baseConnector.ts

+      apiClientConfig: { baseURL: citadelServerUrl(this.coreOptions.authBuildEnv) },
+      storage: this.coreOptions.storage,
+      cookieOptions: this.coreOptions.cookieOptions,
+      accessTokenProvider: this.coreOptions.accessTokenProvider,


i think no need to pass

arch1995 · 2026-04-02T06:48:33Z

packages/no-modal/src/base/connector/baseConnector.ts

+
+    const idToken = await this.authSessionManager.getIdToken();
+    if (!idToken || checkIfTokenIsExpired(idToken)) {
+      return this.tryRefreshIdentityToken();


idToken is never refreshed, it remains same for the entire session

arch1995 · 2026-04-02T06:51:26Z

packages/no-modal/src/base/connector/baseConnector.ts

+
+    try {
+      const response = await this.authSessionManager.ensureRefresh();
+      const refreshedIdToken = await this.authSessionManager.getIdToken();


idtoken is never refreshed currently

arch1995 · 2026-04-02T06:53:41Z

packages/no-modal/src/noModal.ts

    return this.state.idToken || null;
  }

+  get accessToken(): string | null {


why do we need this ?

I removed it

arch1995 · 2026-04-02T06:55:06Z

packages/no-modal/package.json

    "@toruslabs/loglevel-sentry": "^9.0.0",
    "@toruslabs/metadata-helpers": "^8.2.0",
    "@toruslabs/secure-pub-sub": "4.3.0",
+    "@toruslabs/session-manager": "^5.6.0",


do we need this ? i think I exported everything from the auth package.

@arch1995 we miss AuthSessionManager, do we will export from auth sdk?

lwin-kyaw · 2026-04-02T10:51:59Z

packages/no-modal/src/connectors/base-evm-connector/baseEvmConnector.ts

      });

-      const idToken = await verifySignedChallenge(
+      const tokens: SiwwTokens = await verifySignedChallenge({


Hey, I saw this usage in multiple places (baseSolanaConnector, walletConnectV2Connector).
Would be nice if we could refactor this to shared func/method

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e46b571. Configure here.}

packages/no-modal/src/base/connector/baseConnector.ts

hieu-w added 2 commits April 1, 2026 12:39

feat: external wallet session management

06f0a1c

fix: wallet connect connector

0476c91

hieu-w requested review from a team as code owners April 1, 2026 05:47

cursor bot reviewed Apr 1, 2026

View reviewed changes

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts Show resolved Hide resolved

fix: update demo lock file

384e7bf

hieu-w changed the title ~~Feat/external wallet session management~~ feat: external wallet session management Apr 1, 2026

vercel bot deployed to Preview April 1, 2026 06:55 View deployment

cursor bot reviewed Apr 1, 2026

View reviewed changes

packages/no-modal/src/connectors/base-evm-connector/baseEvmConnector.ts Outdated Show resolved Hide resolved

fix: comment

c04de45

vercel bot had a problem deploying to Preview April 1, 2026 07:05 Failure

fix: build

a9e2c16

vercel bot deployed to Preview April 1, 2026 07:09 View deployment

cursor bot reviewed Apr 1, 2026

View reviewed changes

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts Outdated Show resolved Hide resolved

fix: comment

2a68d3e

vercel bot deployed to Preview April 1, 2026 07:58 View deployment

chaitanyapotti reviewed Apr 1, 2026

View reviewed changes

fix: use authSessionManager

59fd5c7

vercel bot deployed to Preview April 1, 2026 08:38 View deployment

cursor bot reviewed Apr 1, 2026

View reviewed changes

packages/no-modal/src/base/connector/baseConnector.ts Outdated Show resolved Hide resolved

fix: save accessToken & refreshToken in state

5779f40

vercel bot deployed to Preview April 1, 2026 08:54 View deployment

hieu-w requested a review from chaitanyapotti April 1, 2026 10:00

fix: refresh token

b0603f4

vercel bot deployed to Preview April 1, 2026 11:52 View deployment

hieu-w added 2 commits April 1, 2026 23:20

fix: storage adapters for authSessionManager

8429f38

fix: add demo option for tokenStorage

da20052

vercel bot deployed to Preview April 1, 2026 16:36 View deployment

cursor bot reviewed Apr 1, 2026

View reviewed changes

packages/no-modal/src/connectors/wallet-connect-v2-connector/walletConnectV2Connector.ts Show resolved Hide resolved

arch1995 reviewed Apr 1, 2026

View reviewed changes

arch1995 reviewed Apr 2, 2026

View reviewed changes

lwin-kyaw reviewed Apr 2, 2026

View reviewed changes

hieu-w added 3 commits April 5, 2026 13:35

fix: comment

85cba7c

fix: rename IdentityToken -> AuthToken

fe9e5ed

fix: comment

cc7ea17

vercel bot deployed to Preview April 5, 2026 06:44 View deployment

hieu-w added 2 commits April 5, 2026 13:50

fix: pull verifyAndAuthorize logic to baseConnector

e2a1e21

Merge branch 'master' into feat/External-wallet-session-management

5f847af

vercel bot deployed to Preview April 5, 2026 06:52 View deployment

fix: remove tryRefreshAuthTokenInfo

e46b571

hieu-w requested a review from arch1995 April 5, 2026 06:57

vercel bot deployed to Preview April 5, 2026 06:58 View deployment

cursor bot reviewed Apr 5, 2026

View reviewed changes

packages/no-modal/src/base/connector/baseConnector.ts Show resolved Hide resolved

fix: comments

b232857

vercel bot deployed to Preview April 5, 2026 07:22 View deployment

hieu-w requested a review from lwin-kyaw April 5, 2026 07:29

Conversation

hieu-w commented Apr 1, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Jira Link

Description

How has this been tested?

Screenshots (if appropriate)

Types of changes

Checklist

Uh oh!

vercel bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chaitanyapotti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hieu-w commented Apr 1, 2026 •

edited by cursor bot

Loading

vercel bot commented Apr 1, 2026 •

edited

Loading