@acorex-platform/framework-client 0.0.33 → 0.0.37

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -4,8 +4,8 @@ import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, d
 import { AXPDebugService, AXPBroadcastEventService, AXP_SESSION_SERVICE, AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, provideAppStartUpTask, AXP_APP_STARTUP_PRIORITY } from '@acorex-platform/framework-client/core';
 import { isEmpty } from 'lodash-es';
 import { AXPCommandService, AXPQueryService } from '@acorex-platform/framework-client/runtime';
-import { AUTH_LOGOUT_DEFAULT, AUTH_REFRESH_DEFAULT, AUTH_UPDATE_SESSION_DEFAULT, AUTH_LIST_PROVIDERS_DEFAULT } from '@acorex-platform/framework-shared/runtime';
-import { runtimeQueryPayloadData, runtimeCommandPayloadData } from '@acorex-platform/framework-shared/core';
+import { AUTH_LOGOUT_DEFAULT, AUTH_REFRESH_DEFAULT, AUTH_UPDATE_SESSION_DEFAULT, AUTH_LIST_OWN_DEVICE_SESSIONS_DEFAULT, AUTH_TERMINATE_OWN_DEVICE_SESSION_DEFAULT, AUTH_LIST_PROVIDERS_DEFAULT } from '@acorex-platform/framework-shared/runtime';
+import { runtimeQueryCollectionData, runtimeQueryObjectData, runtimeCommandPayloadData } from '@acorex-platform/framework-shared/core';
 
 const AXP_APPLICATION_LOADER = new InjectionToken('AXP_APPLICATION_LOADER', {
     providedIn: 'root',
@@ -325,30 +325,110 @@ const AXP_PERMISSION_CHECKER = new InjectionToken('AXP_PERMISSION_CHECKER');
 const AXP_ACCESS_POLICY_CACHE_PORT = new InjectionToken('AXP_ACCESS_POLICY_CACHE_PORT');
 //#endregion
 
-//#region ---- OAuth pending strategy (survives restoreSession) ----
+//#region ---- OAuth pending strategy (callback routing) ----
 /**
- * Persisted while an authorization-code redirect is in flight.
- * `restoreSession` clears partial `AXP_SESSION` (no user / no cookies) — this key
+ * When the SPA is redirected to `/auth/oauth-callback`, the active auth strategy name
  * must survive so `/auth/oauth-callback` can resolve the strategy.
  */
-const AXP_OAUTH_PENDING_STRATEGY_KEY = 'axp_oauth_pending_strategy';
-/** Set by platform OAuth strategies before redirect (PKCE). */
+const OAUTH_PENDING_STRATEGY_KEY = 'axp_oauth_pending_strategy';
 const AXP_OAUTH_PKCE_VERIFIER_KEY = 'pkce_code_verifier';
 function setOAuthPendingStrategy(strategy) {
-    const trimmed = strategy?.trim();
-    if (!trimmed) {
-        return;
-    }
-    localStorage.setItem(AXP_OAUTH_PENDING_STRATEGY_KEY, trimmed);
+    sessionStorage.setItem(OAUTH_PENDING_STRATEGY_KEY, strategy);
 }
 function getOAuthPendingStrategy() {
-    return localStorage.getItem(AXP_OAUTH_PENDING_STRATEGY_KEY)?.trim() || null;
+    return sessionStorage.getItem(OAUTH_PENDING_STRATEGY_KEY);
 }
 function clearOAuthPendingStrategy() {
-    localStorage.removeItem(AXP_OAUTH_PENDING_STRATEGY_KEY);
+    sessionStorage.removeItem(OAUTH_PENDING_STRATEGY_KEY);
+}
+/** @deprecated Server-side PKCE replaced localStorage verifier; kept for legacy detection only. */
+function hasLegacyOAuthPkceVerifier() {
+    return !!localStorage.getItem(AXP_OAUTH_PKCE_VERIFIER_KEY);
+}
+function hasOAuthPendingFlow() {
+    return !!getOAuthPendingStrategy();
 }
 function isOAuthRedirectInFlight() {
-    return !!localStorage.getItem(AXP_OAUTH_PKCE_VERIFIER_KEY) || !!getOAuthPendingStrategy();
+    return hasOAuthPendingFlow() || hasLegacyOAuthPkceVerifier();
+}
+//#endregion
+
+//#region ---- Max active device sessions (client) ----
+/** Stable API / ForbiddenException code from AuthService. */
+const MAX_ACTIVE_DEVICE_SESSIONS_CODE = 'MAX_ACTIVE_DEVICE_SESSIONS';
+const PENDING_TENANT_STORAGE_KEY = 'axp.auth.sessionLimit.pendingTenant';
+function textContainsMaxSessionsCode(value) {
+    if (typeof value === 'string') {
+        return value === MAX_ACTIVE_DEVICE_SESSIONS_CODE || value.includes(MAX_ACTIVE_DEVICE_SESSIONS_CODE);
+    }
+    if (Array.isArray(value)) {
+        return value.some((item) => textContainsMaxSessionsCode(item));
+    }
+    return false;
+}
+/**
+ * Detects tenant max concurrent device-session rejection from command / HTTP shapes.
+ * Must recognize {@link Error} subclasses (e.g. AuthApiError) via `.message`.
+ */
+function isMaxActiveDeviceSessionsError(error) {
+    if (error == null) {
+        return false;
+    }
+    if (typeof error === 'string') {
+        return textContainsMaxSessionsCode(error);
+    }
+    if (typeof error !== 'object') {
+        return false;
+    }
+    // Error.message is reliable for AuthApiError / Error thrown from UpdateSession.
+    if (error instanceof Error && textContainsMaxSessionsCode(error.message)) {
+        return true;
+    }
+    const err = error;
+    const candidates = [err['message'], err['error'], err['code']];
+    const nestedError = err['error'];
+    if (nestedError && typeof nestedError === 'object') {
+        const nested = nestedError;
+        candidates.push(nested['message'], nested['error'], nested['code']);
+    }
+    const apiError = err['apiError'];
+    if (apiError && typeof apiError === 'object') {
+        const api = apiError;
+        candidates.push(api['message'], api['error'], api['code']);
+    }
+    return candidates.some((value) => textContainsMaxSessionsCode(value));
+}
+function storeSessionLimitPendingTenant(tenant) {
+    try {
+        sessionStorage.setItem(PENDING_TENANT_STORAGE_KEY, JSON.stringify(tenant));
+    }
+    catch {
+        // Ignore quota / private-mode failures; route state may still carry the tenant.
+    }
+}
+function readSessionLimitPendingTenant() {
+    try {
+        const raw = sessionStorage.getItem(PENDING_TENANT_STORAGE_KEY);
+        if (!raw) {
+            return null;
+        }
+        const parsed = JSON.parse(raw);
+        if (!parsed?.id || typeof parsed.id !== 'string') {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function clearSessionLimitPendingTenant() {
+    try {
+        sessionStorage.removeItem(PENDING_TENANT_STORAGE_KEY);
+    }
+    catch {
+        // ignore
+    }
 }
 //#endregion
 
@@ -706,6 +786,11 @@ class AXPSessionService {
             }));
             // Failed workspace bind must not leave a half-authenticated cookie session
             // (that causes splash restore loops after refresh).
+            // Exception: max device sessions — keep identity session so the user can
+            // terminate another device and retry tenant bind.
+            if (isMaxActiveDeviceSessionsError(error)) {
+                throw error;
+            }
             if (params?.['code']) {
                 clearOAuthPendingStrategy();
             }
@@ -1795,6 +1880,7 @@ function parsePlatformExpiresIn(expiresIn) {
 //#region ---- Platform OAuth helpers (PKCE + /connect/*) ----
 const AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID = 'acorex';
 const AXP_DEFAULT_PLATFORM_OAUTH_SCOPE = 'openid profile email offline_access';
+const AXP_PLATFORM_OAUTH_CSRF_COOKIE = 'acx_csrf_token';
 function resolvePlatformOAuthIssuer(baseUrl) {
     const issuer = baseUrl?.replace(/\/$/, '');
     if (!issuer) {
@@ -1812,6 +1898,18 @@ function resolvePlatformOAuthClientConfig(authConfig) {
         scope: authConfig?.scope ?? AXP_DEFAULT_PLATFORM_OAUTH_SCOPE,
     };
 }
+function readPlatformOAuthCsrfToken() {
+    const match = document.cookie.match(new RegExp(`(?:^|; )${AXP_PLATFORM_OAUTH_CSRF_COOKIE.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}=([^;]*)`));
+    if (!match?.[1]) {
+        return null;
+    }
+    try {
+        return decodeURIComponent(match[1]);
+    }
+    catch {
+        return match[1];
+    }
+}
 async function fetchPlatformOAuthDiscoveryDocument(issuer) {
     const response = await fetch(`${issuer}/.well-known/openid-configuration`);
     if (!response.ok) {
@@ -1825,6 +1923,53 @@ function resolvePlatformOAuthAuthorizeEndpoint(issuer, discovery) {
 function resolvePlatformOAuthTokenEndpoint(issuer, discovery) {
     return discovery?.token_endpoint ?? `${issuer}/connect/token`;
 }
+/**
+ * BFF: server generates PKCE verifier/challenge and returns the platform authorize URL.
+ * Verifier never touches browser localStorage.
+ */
+async function initPlatformOAuthAuthorization(input) {
+    const response = await fetch(`${input.issuer}/connect/authorize/init`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_id: input.clientId,
+            redirect_uri: input.redirectUri,
+            scope: input.scope,
+            identity_provider: input.provider,
+        }),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => '');
+        throw new Error(`OAuth authorize init failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ''}`);
+    }
+    return (await response.json());
+}
+async function exchangePlatformOAuthAuthorizationCode(input) {
+    const tokenEndpoint = input.tokenEndpoint ?? resolvePlatformOAuthTokenEndpoint(input.issuer);
+    const csrfToken = readPlatformOAuthCsrfToken();
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: input.clientId,
+        code: input.code,
+        redirect_uri: input.redirectUri,
+    });
+    const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+    if (csrfToken) {
+        headers['X-CSRF-Token'] = csrfToken;
+    }
+    const response = await fetch(tokenEndpoint, {
+        method: 'POST',
+        credentials: 'include',
+        headers,
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => '');
+        throw new Error(`Token exchange failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ''}`);
+    }
+    return (await response.json());
+}
 //#endregion
 
 //#region ---- Auth:ListProviders public DTOs ----
@@ -1885,6 +2030,16 @@ class AXPPlatformAuthRuntimeService {
     async updateSession(input) {
         return this.executeCommand(AUTH_UPDATE_SESSION_DEFAULT, input);
     }
+    async listOwnDeviceSessions(tenantId) {
+        const result = await this.queryService.fetch(AUTH_LIST_OWN_DEVICE_SESSIONS_DEFAULT, { tenantId });
+        return runtimeQueryCollectionData(result)?.items ?? [];
+    }
+    async terminateOwnDeviceSession(id) {
+        const result = await this.commandService.execute(AUTH_TERMINATE_OWN_DEVICE_SESSION_DEFAULT, { id });
+        if (!result?.success) {
+            throw new Error(commandMessageTextForError(result?.message?.text) || 'Failed to terminate device session');
+        }
+    }
     async listProviders() {
         if (this.listProvidersCache) {
             return this.listProvidersCache;
@@ -1895,7 +2050,7 @@ class AXPPlatformAuthRuntimeService {
         this.listProvidersInFlight = this.queryService
             .fetch(AUTH_LIST_PROVIDERS_DEFAULT, {})
             .then((result) => {
-            this.listProvidersCache = asAuthListProvidersResponse(runtimeQueryPayloadData(result));
+            this.listProvidersCache = asAuthListProvidersResponse(runtimeQueryObjectData(result));
             return this.listProvidersCache;
         })
             .finally(() => {
@@ -2172,5 +2327,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PENDING_STRATEGY_KEY, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, commandMessageTextForError, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map