https://cafemonza.com/src/js/modules/auth-storage.js

1/**
2 * auth-storage.js — shared login/logout storage writes, used across several
3 * independent modules that each end or begin an authenticated session
4 * (wa_login_return.js, wa_order_login_return.js, userProfile.js, membership.js,
5 * activeOrders.js). Previously duplicated identically in each — one file
6 * getting a key added or removed without the others keeping in sync.
7 */
8
9/**
10 * Persist a userdata payload as an authenticated session, exactly like a normal
11 * OTP login would. `justLoggedIn` is read by firstLoginProfile.js (the welcome /
12 * name-capture form); `pending_login_method` is read by base.php's deferred
13 * analytics block (trackLogin/trackRegistration/identifyUser).
14 * @param {object} rows - userdata object; must have a `token`.
15 */
16export function commitAuthToStorage(rows) {
17    localStorage.setItem('userdata', JSON.stringify(rows));
18    localStorage.setItem('token', rows.token);
19    try { localStorage.setItem('justLoggedIn', '1'); } catch { /* ignore */ }
20    try { localStorage.setItem('pending_login_method', 'whatsapp'); } catch { /* ignore */ }
21}
22
23/**
24 * Clear the entry_channel cookie (set by WhatsappOrderAuthFilter on a
25 * successful `wo` nonce redeem — see wa_entry_channel() in wla_helper.php for
26 * why it's a plain cookie, not session data). Call this everywhere a session
27 * ends — a real logout or an automatic force-logout on a dead token — so a
28 * WhatsApp-entry session never leaks into whatever happens next in that
29 * browser (nav-hiding, os=waba order tagging, the confirm/order/status call).
30 */
31export function clearEntryChannel() {
32    document.cookie = 'entry_channel=; Max-Age=0; path=/';
33}