@acorex-platform/framework-client 0.0.38 → 0.0.48

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -2,6 +2,7 @@ import * as i0 from '@angular/core';
 import { InjectionToken, Injector, Injectable, signal, inject, Input, Directive, Optional, Inject, NgModule, input, output, ChangeDetectionStrategy, Component } from '@angular/core';
 import { map, BehaviorSubject, shareReplay, defaultIfEmpty, switchMap, filter, distinctUntilChanged, of, from, combineLatest, first } from 'rxjs';
 import { AXPDebugService, AXPBroadcastEventService, AXP_SESSION_SERVICE, AXP_EXPRESSION_EVALUATOR_SCOPE_PROVIDER, provideAppStartUpTask, AXP_APP_STARTUP_PRIORITY } from '@acorex-platform/framework-client/core';
+import { Router } from '@angular/router';
 import { isEmpty } from 'lodash-es';
 import { AXPCommandService, AXPQueryService } from '@acorex-platform/framework-client/runtime';
 import { AUTH_LOGOUT_DEFAULT, AUTH_REFRESH_DEFAULT, AUTH_UPDATE_SESSION_DEFAULT, AUTH_LIST_OWN_DEVICE_SESSIONS_DEFAULT, AUTH_TERMINATE_OWN_DEVICE_SESSION_DEFAULT, AUTH_LIST_PROVIDERS_DEFAULT } from '@acorex-platform/framework-shared/runtime';
@@ -131,6 +132,10 @@ function traceAuthLifecycle(message, data) {
 function traceAuthLifecycleError(message, data) {
     AXPDebugService.instance?.error(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Lifecycle, message, data);
 }
+/** Always emits (Debug Mode not required) — use for logout / empty-menu diagnosis. */
+function warnAuthLifecycle(message, data) {
+    AXPDebugService.instance?.warn(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Lifecycle, message, data);
+}
 //#endregion
 //#region ----- Restore -----
 function traceAuthRestore(message, data) {
@@ -141,11 +146,17 @@ function traceAuthRestore(message, data) {
 function traceAuthWorkspace(message, data) {
     AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Workspace, message, data);
 }
+function warnAuthWorkspace(message, data) {
+    AXPDebugService.instance?.warn(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.Workspace, message, data);
+}
 //#endregion
 //#region ----- Access policy -----
 function traceAuthAccessPolicy(message, data) {
     AXPDebugService.instance?.trace(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.AccessPolicy, message, data);
 }
+function warnAuthAccessPolicy(message, data) {
+    AXPDebugService.instance?.warn(AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE.AccessPolicy, message, data);
+}
 //#endregion
 //#region ----- Catalog -----
 function traceAuthCatalog(message, data) {
@@ -353,6 +364,87 @@ function isOAuthRedirectInFlight() {
 }
 //#endregion
 
+//#region ---- Auth refresh lock (cross-tab) ----
+/**
+ * Serializes cookie refresh across browser tabs so two restores cannot consume the
+ * same refresh `jti` and trigger server reuse detection (full `sid` revoke).
+ *
+ * 1. Web Locks API (Chrome / Edge / Firefox) — exclusive across tabs of this origin.
+ * 2. localStorage lock — fallback when Web Locks is missing (two JS heaps otherwise race).
+ * 3. In-tab promise chain — last resort (does not coordinate tabs).
+ */
+const AUTH_REFRESH_LOCK_NAME = 'axp.auth.refresh';
+const AUTH_REFRESH_LS_LOCK_KEY = 'axp.auth.refresh.ls-lock';
+const AUTH_REFRESH_LS_TTL_MS = 20_000;
+const AUTH_REFRESH_LS_WAIT_MS = 40;
+let memoryTail = Promise.resolve();
+async function withAuthRefreshLock(run) {
+    const locks = typeof navigator !== 'undefined' ? navigator.locks : undefined;
+    if (typeof locks?.request === 'function') {
+        return locks.request(AUTH_REFRESH_LOCK_NAME, { mode: 'exclusive' }, async () => run());
+    }
+    if (typeof localStorage !== 'undefined') {
+        return withLocalStorageRefreshLock(run);
+    }
+    return withMemoryRefreshLock(run);
+}
+async function withLocalStorageRefreshLock(run) {
+    const owner = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const deadline = Date.now() + AUTH_REFRESH_LS_TTL_MS;
+    while (Date.now() < deadline) {
+        const now = Date.now();
+        const held = readLocalStorageLock();
+        if (held && held.until > now && held.owner !== owner) {
+            await delay(AUTH_REFRESH_LS_WAIT_MS);
+            continue;
+        }
+        writeLocalStorageLock(owner, now + AUTH_REFRESH_LS_TTL_MS);
+        const confirmed = readLocalStorageLock();
+        if (confirmed?.owner !== owner) {
+            await delay(AUTH_REFRESH_LS_WAIT_MS);
+            continue;
+        }
+        try {
+            return await run();
+        }
+        finally {
+            const current = readLocalStorageLock();
+            if (current?.owner === owner) {
+                localStorage.removeItem(AUTH_REFRESH_LS_LOCK_KEY);
+            }
+        }
+    }
+    return withMemoryRefreshLock(run);
+}
+function readLocalStorageLock() {
+    try {
+        const raw = localStorage.getItem(AUTH_REFRESH_LS_LOCK_KEY);
+        if (!raw) {
+            return null;
+        }
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.owner !== 'string' || typeof parsed.until !== 'number') {
+            return null;
+        }
+        return { owner: parsed.owner, until: parsed.until };
+    }
+    catch {
+        return null;
+    }
+}
+function writeLocalStorageLock(owner, until) {
+    localStorage.setItem(AUTH_REFRESH_LS_LOCK_KEY, JSON.stringify({ owner, until }));
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function withMemoryRefreshLock(run) {
+    const runExclusive = memoryTail.then(() => run(), () => run());
+    memoryTail = runExclusive.then(() => undefined, () => undefined);
+    return runExclusive;
+}
+//#endregion
+
 //#region ---- Max active device sessions (client) ----
 /** Stable API / ForbiddenException code from AuthService. */
 const MAX_ACTIVE_DEVICE_SESSIONS_CODE = 'MAX_ACTIVE_DEVICE_SESSIONS';
@@ -447,6 +539,7 @@ class AXPSessionService {
         /** In-memory catalog caches — shared by guards and chooser UI (one List* per bind). */
         this.tenantsListCache = null;
         this.applicationsListCache = null;
+        this.signoutInFlight = null;
         this.status = new BehaviorSubject(AXPSessionStatus.Unauthenticated);
         this.status$ = this.status.asObservable().pipe(shareReplay(1));
         // Add loading state to prevent premature redirects
@@ -581,23 +674,15 @@ class AXPSessionService {
                 applicationId: sessionData.application?.id,
                 strategy: strategyName,
             }));
-            const refreshResult = await strategy.refreshToken(this.getContext());
+            // Cross-tab exclusive refresh — avoids concurrent jti reuse / sid revoke.
+            const refreshResult = await this.refreshCookieSessionExclusive(strategyName, strategy);
             if (!refreshResult?.succeed || !refreshResult.data?.user) {
                 this.clearSession();
                 this.status.next(AXPSessionStatus.Unauthorized);
                 traceAuthRestore('Refresh failed — cleared');
                 return;
             }
-            // Preserve workspace binding from local metadata when refresh omits it.
-            const merged = {
-                succeed: true,
-                data: {
-                    ...refreshResult.data,
-                    tenant: refreshResult.data.tenant ?? sessionData.tenant ?? null,
-                    application: refreshResult.data.application ?? sessionData.application ?? null,
-                },
-            };
-            await this.applySignInResult(strategyName, merged);
+            await this.applySignInResult(strategyName, refreshResult);
             traceAuthRestore('Restore complete', () => ({
                 ms: Date.now() - startedAt,
                 status: this.status.value,
@@ -745,7 +830,9 @@ class AXPSessionService {
             if (!strategy) {
                 throw new Error(`Authentication strategy '${strategyName}' is not supported`);
             }
-            const result = await strategy.updateToken(params);
+            // Same lock as cookie refresh — UpdateSession rotates refresh `jti`.
+            // A restore in another tab must not consume the previous cookie concurrently.
+            const result = await withAuthRefreshLock(() => strategy.updateToken(params));
             if (result?.succeed) {
                 if (params?.['code']) {
                     this.clearSession();
@@ -784,6 +871,11 @@ class AXPSessionService {
             traceAuthLifecycleError('UpdateSession failed', () => ({
                 error: error instanceof Error ? error.message : String(error),
             }));
+            warnAuthWorkspace('UpdateSession failed — clearing session (logout UX)', () => ({
+                error: error instanceof Error ? error.message : String(error),
+                tenantId: params?.['tenant']?.id ?? params?.['tenantId'] ?? null,
+                applicationId: params?.['application']?.id ?? params?.['applicationId'] ?? null,
+            }));
             // Failed workspace bind must not leave a half-authenticated cookie session
             // (that causes splash restore loops after refresh).
             // Exception: max device sessions — keep identity session so the user can
@@ -802,28 +894,51 @@ class AXPSessionService {
         }
     }
     async signout() {
-        traceAuthLifecycle('Sign-out started', () => ({ userId: this.user?.id }));
-        this.isLoading.next(true);
+        if (this.signoutInFlight) {
+            return this.signoutInFlight;
+        }
+        this.signoutInFlight = this.performSignout().finally(() => {
+            this.signoutInFlight = null;
+        });
+        return this.signoutInFlight;
+    }
+    /**
+     * Clears the client session first, then redirects, then revokes the server session.
+     * Waiting on the logout HTTP call (or flipping isLoading) used to skip the login
+     * redirect and let in-flight 401s start a competing navigation back into the app.
+     */
+    async performSignout() {
+        const userId = this.user?.id;
+        const sessionData = this.getSessionData();
+        const strategy = sessionData?.strategy
+            ? this.authStrategyRegistry.get(sessionData.strategy)
+            : null;
+        traceAuthLifecycle('Sign-out started', () => ({ userId }));
+        this.clearSession();
+        this.eventService.publish(AXPSessionStatus.SignedOut, { id: userId });
+        this.status.next(AXPSessionStatus.SignedOut);
+        this.navigateToLoginAfterSignout();
+        if (strategy) {
+            try {
+                await strategy.signout();
+            }
+            catch {
+                // Ignore logout network errors; client session is already cleared.
+            }
+        }
+        traceAuthLifecycle('Sign-out complete', () => ({ userId }));
+    }
+    navigateToLoginAfterSignout() {
         try {
-            const sessionData = this.getSessionData();
-            if (sessionData?.strategy) {
-                const strategy = this.authStrategyRegistry.get(sessionData?.strategy);
-                if (strategy) {
-                    try {
-                        await strategy.signout();
-                    }
-                    catch (error) { }
-                }
+            const router = this.injector.get(Router);
+            const path = (router.url ?? '').split('?')[0];
+            if (path.startsWith('/auth')) {
+                return;
             }
-            const userId = this.user?.id;
-            this.clearSession();
-            this.eventService.publish(AXPSessionStatus.SignedOut, { id: userId });
-            this.isLoading.next(false);
-            this.status.next(AXPSessionStatus.SignedOut);
-            traceAuthLifecycle('Sign-out complete', () => ({ userId }));
+            void router.navigateByUrl('/auth/login', { replaceUrl: true });
         }
-        finally {
-            this.isLoading.next(false);
+        catch {
+            // Router is unavailable in some test / early-boot hosts.
         }
     }
     async refreshToken() {
@@ -831,34 +946,74 @@ class AXPSessionService {
         if (!sessionData?.strategy || !sessionData.cookieSession) {
             throw new Error('No cookie session available');
         }
-        const strategy = this.authStrategyRegistry.get(sessionData.strategy);
+        const strategyName = sessionData.strategy;
+        const strategy = this.authStrategyRegistry.get(strategyName);
         if (!strategy) {
-            throw new Error(`Authentication strategy '${sessionData.strategy}' is not found`);
+            throw new Error(`Authentication strategy '${strategyName}' is not found`);
         }
         try {
-            const result = await strategy.refreshToken(this.getContext());
+            const result = await this.refreshCookieSessionExclusive(strategyName, strategy);
             if (!result.succeed || !result.data?.user) {
+                warnAuthLifecycle('Token refresh failed — clearing session', () => ({
+                    strategy: strategyName,
+                }));
                 this.clearSession();
                 this.status.next(AXPSessionStatus.Expired);
                 throw new Error('Token refresh failed');
             }
-            this.setSession({
-                strategy: sessionData.strategy,
-                user: result.data.user,
-                tenant: result.data.tenant ?? sessionData.tenant ?? null,
-                application: result.data.application ?? sessionData.application ?? null,
-                expiresIn: result.data.expiresIn,
-                cookieSession: true,
-                locked: sessionData.locked === true,
-            });
             return true;
         }
         catch (error) {
+            warnAuthLifecycle('Token refresh error — clearing session', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
             this.clearSession();
             this.status.next(AXPSessionStatus.Expired);
             throw error;
         }
     }
+    /**
+     * One refresh at a time across tabs (Web Locks). Re-reads and writes session
+     * metadata inside the lock so a peer tab never replays the same refresh `jti`.
+     */
+    async refreshCookieSessionExclusive(strategyName, strategy) {
+        return withAuthRefreshLock(async () => {
+            const latest = this.getSessionData();
+            if (!latest?.user || !latest.cookieSession) {
+                return { succeed: false };
+            }
+            const activeStrategyName = latest.strategy?.trim() || strategyName;
+            const activeStrategy = activeStrategyName === strategyName
+                ? strategy
+                : this.authStrategyRegistry.get(activeStrategyName);
+            if (!activeStrategy) {
+                return { succeed: false };
+            }
+            const refreshResult = await activeStrategy.refreshToken(this.getContext());
+            if (!refreshResult?.succeed || !refreshResult.data?.user) {
+                return { succeed: false };
+            }
+            const merged = {
+                succeed: true,
+                data: {
+                    ...refreshResult.data,
+                    tenant: refreshResult.data.tenant ?? latest.tenant ?? null,
+                    application: refreshResult.data.application ?? latest.application ?? null,
+                },
+            };
+            // Persist before releasing the lock so the next tab reads updated metadata.
+            this.setSession({
+                strategy: activeStrategyName,
+                user: merged.data.user,
+                tenant: merged.data.tenant ?? null,
+                application: merged.data.application ?? null,
+                expiresIn: merged.data.expiresIn,
+                cookieSession: true,
+                locked: latest.locked === true,
+            });
+            return merged;
+        });
+    }
     /**
      * Auth:GetAccessPolicy is only meaningful with tenant + application bound.
      * Skipping incomplete contexts cuts 2 redundant calls on the common login path.
@@ -885,6 +1040,14 @@ class AXPSessionService {
             tenantId: this.tenant?.id,
             applicationId: this.application?.id,
         }));
+        if (reason === 'updateToken' && this.permissions.length === 0) {
+            warnAuthAccessPolicy('GetAccessPolicy returned empty permissions after workspace bind', () => ({
+                reason,
+                tenantId: this.tenant?.id ?? null,
+                applicationId: this.application?.id ?? null,
+                featureCount: this.features.length,
+            }));
+        }
     }
     async loadPermissions() {
         try {
@@ -895,6 +1058,11 @@ class AXPSessionService {
             traceAuthLifecycleError('Load permissions failed', () => ({
                 error: error instanceof Error ? error.message : String(error),
             }));
+            warnAuthLifecycle('Load permissions failed — menus may be empty', () => ({
+                error: error instanceof Error ? error.message : String(error),
+                tenantId: this.tenant?.id ?? null,
+                applicationId: this.application?.id ?? null,
+            }));
             this.permissionsSubject.next([]);
         }
     }
@@ -2327,5 +2495,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map