@acorex-platform/framework-client 2.0.0-next.0 → 2.0.0-next.1

package/fesm2022/acorex-platform-framework-client-auth.mjs

@@ -534,6 +534,18 @@ function collectErrorCodes(error) {
     }
     return codes;
 }
+/**
+ * True when the API rejected the call because no access cookie / bearer was sent.
+ * An expired HttpOnly access cookie is omitted by the browser, so the server says
+ * "required" rather than "invalid or expired".
+ */
+function isMissingAccessTokenError(error) {
+    const text = collectErrorText(error);
+    if (!text.trim()) {
+        return false;
+    }
+    return /bearer access token is required/i.test(text) || /access token is required/i.test(text);
+}
 /**
  * True only when refresh failed because the refresh cookie / session family is dead.
  * Network / 5xx / Redis unavailable / empty transient results → false.
@@ -1047,59 +1059,31 @@ class AXPSessionService {
             this.applicationsListCache = null;
         }
         try {
-            const strategyName = this.resolveStrategyName();
-            if (!strategyName) {
-                throw new Error('Strategy not found');
-            }
-            const strategy = this.authStrategyRegistry.get(strategyName);
-            if (!strategy) {
-                throw new Error(`Authentication strategy '${strategyName}' is not supported`);
+            // Refresh outside the UpdateSession lock. The access cookie expires sooner than
+            // the refresh cookie; a stale click must not run UpdateSession while that lock is held,
+            // or the 401 refresh path deadlocks on the same Web Lock.
+            await this.refreshAccessCookieIfStale();
+            try {
+                await this.commitSessionUpdate(params, isApplicationUpdate, isTenantUpdate, startedAt);
             }
-            // Same lock as cookie refresh — UpdateSession rotates refresh `jti`.
-            // A restore in another tab must not consume the previous cookie concurrently.
-            const result = await withAuthRefreshLock(() => strategy.updateToken(params));
-            if (result?.succeed) {
-                if (params?.['code']) {
-                    // OAuth code exchange replaces identity metadata; wipe stale local fields first.
-                    this.clearSession();
-                    clearOAuthPendingStrategy();
-                }
-                else {
-                    this.permissionsSubject.next([]);
-                    this.featuresSubject.next([]);
-                    this.invalidateAccessPolicyCache();
+            catch (error) {
+                if (!isMissingAccessTokenError(error)) {
+                    throw error;
                 }
-                this.setSession({
-                    strategy: strategyName,
-                    user: result.data.user,
-                    tenant: result.data?.tenant ?? null,
-                    application: this.resolveApplicationAfterUpdate(result.data?.application ?? null, isApplicationUpdate, isTenantUpdate),
-                    expiresIn: result.data?.expiresIn,
-                    locked: false,
-                    cookieSession: true,
-                });
-                await this.reloadAccessPolicyIfReady('updateToken');
-                await this.syncSessionAuthorization();
-                traceAuthWorkspace('UpdateSession complete', () => ({
-                    ms: Date.now() - startedAt,
-                    status: this.status.value,
-                    tenantId: this.tenant?.id,
-                    applicationId: this.application?.id,
+                warnAuthWorkspace('UpdateSession missing access cookie — refreshing', () => ({
+                    error: error instanceof Error ? error.message : String(error),
                 }));
-            }
-            else {
-                throw new Error('UpdateSession failed');
+                const refreshed = await this.refreshToken();
+                if (!refreshed) {
+                    throw error;
+                }
+                await this.commitSessionUpdate(params, isApplicationUpdate, isTenantUpdate, startedAt);
             }
         }
         catch (error) {
             traceAuthLifecycleError('UpdateSession failed', () => ({
                 error: error instanceof Error ? error.message : String(error),
             }));
-            warnAuthWorkspace('UpdateSession failed — identity session kept', () => ({
-                error: error instanceof Error ? error.message : String(error),
-                tenantId: params?.['tenant']?.id ?? params?.['tenantId'] ?? null,
-                applicationId: params?.['application']?.id ?? params?.['applicationId'] ?? null,
-            }));
             if (params?.['code']) {
                 clearOAuthPendingStrategy();
             }
@@ -1108,6 +1092,11 @@ class AXPSessionService {
             this.syncContextSubjectsFromStorage();
             const stored = this.getSessionData();
             if (stored?.user && stored.cookieSession) {
+                warnAuthWorkspace('UpdateSession failed — identity session kept', () => ({
+                    error: error instanceof Error ? error.message : String(error),
+                    tenantId: params?.['tenant']?.id ?? params?.['tenantId'] ?? null,
+                    applicationId: params?.['application']?.id ?? params?.['applicationId'] ?? null,
+                }));
                 await this.syncSessionAuthorization();
             }
             throw error;
@@ -1571,6 +1560,85 @@ class AXPSessionService {
     invalidateAccessPolicyCache() {
         this.accessPolicyCache?.invalidate();
     }
+    /**
+     * Access cookie max-age matches the JWT (often 15m) while the refresh cookie lasts days.
+     * After it expires the browser omits it, and UpdateSession is not retried by the HTTP
+     * interceptor (auth commands skip 401 refresh to avoid a lock deadlock).
+     */
+    isAccessCookieStale() {
+        const expiresIn = this.getSessionData()?.expiresIn;
+        if (!expiresIn) {
+            return false;
+        }
+        const expiresAt = new Date(expiresIn).getTime();
+        if (Number.isNaN(expiresAt)) {
+            return false;
+        }
+        const skewMs = 15_000;
+        return expiresAt <= Date.now() + skewMs;
+    }
+    async refreshAccessCookieIfStale() {
+        if (!this.isAccessCookieStale() || !this.hasSessionCredentials()) {
+            return;
+        }
+        traceAuthWorkspace('Access cookie stale — refreshing before UpdateSession', () => ({
+            expiresIn: this.getSessionData()?.expiresIn ?? null,
+        }));
+        try {
+            await this.refreshToken();
+        }
+        catch (error) {
+            if (isDefinitiveAuthRefreshFailure(error)) {
+                throw error;
+            }
+            warnAuthWorkspace('Stale access refresh failed — continuing UpdateSession', () => ({
+                error: error instanceof Error ? error.message : String(error),
+            }));
+        }
+    }
+    async commitSessionUpdate(params, isApplicationUpdate, isTenantUpdate, startedAt) {
+        const strategyName = this.resolveStrategyName();
+        if (!strategyName) {
+            throw new Error('Strategy not found');
+        }
+        const strategy = this.authStrategyRegistry.get(strategyName);
+        if (!strategy) {
+            throw new Error(`Authentication strategy '${strategyName}' is not supported`);
+        }
+        // Same lock as cookie refresh — UpdateSession rotates refresh `jti`.
+        // A restore in another tab must not consume the previous cookie concurrently.
+        const result = await withAuthRefreshLock(() => strategy.updateToken(params));
+        if (!result?.succeed) {
+            throw new Error('UpdateSession failed');
+        }
+        if (params?.['code']) {
+            // OAuth code exchange replaces identity metadata; wipe stale local fields first.
+            this.clearSession();
+            clearOAuthPendingStrategy();
+        }
+        else {
+            this.permissionsSubject.next([]);
+            this.featuresSubject.next([]);
+            this.invalidateAccessPolicyCache();
+        }
+        this.setSession({
+            strategy: strategyName,
+            user: result.data.user,
+            tenant: result.data?.tenant ?? null,
+            application: this.resolveApplicationAfterUpdate(result.data?.application ?? null, isApplicationUpdate, isTenantUpdate),
+            expiresIn: result.data?.expiresIn,
+            locked: false,
+            cookieSession: true,
+        });
+        await this.reloadAccessPolicyIfReady('updateToken');
+        await this.syncSessionAuthorization();
+        traceAuthWorkspace('UpdateSession complete', () => ({
+            ms: Date.now() - startedAt,
+            status: this.status.value,
+            tenantId: this.tenant?.id,
+            applicationId: this.application?.id,
+        }));
+    }
     isApplicationContextUpdate(params) {
         return params?.['application'] != null || params?.['applicationId'] != null;
     }
@@ -2826,5 +2894,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, DEFINITIVE_AUTH_REFRESH_CODES, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isDefinitiveAuthRefreshFailure, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, resolveStatusAfterSoftRestore, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, shouldRetryAccessPolicyAuthorization, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, DEFINITIVE_AUTH_REFRESH_CODES, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isDefinitiveAuthRefreshFailure, isMaxActiveDeviceSessionsError, isMissingAccessTokenError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, resolveStatusAfterSoftRestore, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, shouldRetryAccessPolicyAuthorization, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
 //# sourceMappingURL=acorex-platform-framework-client-auth.mjs.map