@acosmi/sdk-ts 2.20.0 → 2.20.1

package/dist/node/index.cjs

@@ -1097,6 +1097,18 @@ var abort = (signal) => {
   if (signal?.aborted) throw new Error("aborted");
 };
 var sameRequestOwner = (snapshot, expected) => snapshot.storeInstanceId === expected.storeInstanceId && snapshot.authSessionId === expected.authSessionId && snapshot.principal?.issuer === expected.principal?.issuer && snapshot.principal?.subject === expected.principal?.subject && snapshot.principal?.organizationId === expected.principal?.organizationId;
+var REFRESH_TEMPORARILY_UNAVAILABLE = "refresh_temporarily_unavailable";
+var REFRESH_RETRY_BASE_MS = 5e3;
+var REFRESH_RETRY_MAX_MS = 6e4;
+var REFRESH_RETRY_AFTER_CAP_MS = 3e5;
+function retryAfterMs(response) {
+  const raw = response.headers.get("retry-after");
+  if (!raw) return null;
+  const seconds = Number(raw);
+  const ms = Number.isFinite(seconds) ? seconds * 1e3 : Date.parse(raw) - Date.now();
+  if (!Number.isFinite(ms)) return null;
+  return Math.min(Math.max(ms, 0), REFRESH_RETRY_AFTER_CAP_MS);
+}
 var CredentialLifecycle = class {
   constructor(store, protocol) {
     this.store = store;
@@ -1107,6 +1119,8 @@ var CredentialLifecycle = class {
   listeners = /* @__PURE__ */ new Set();
   notificationKey = "";
   observations = /* @__PURE__ */ new Map();
+  /** Last refusal of a refresh token that was not rotated; see `REFRESH_RETRY_BASE_MS`. */
+  refreshDeferral = null;
   read(signal) {
     return this.store.readSnapshot(signal);
   }
@@ -1296,6 +1310,19 @@ var CredentialLifecycle = class {
   usable(s) {
     return !!s.tokenSet && Date.parse(s.tokenSet.expires_at) > Date.now() + 3e5;
   }
+  refreshDeferred(s) {
+    const d = this.refreshDeferral;
+    return !!d && d.refreshToken === s.tokenSet?.refresh_token && Date.now() < d.until;
+  }
+  deferRefresh(refreshToken2, retryAfter) {
+    const failures = this.refreshDeferral?.refreshToken === refreshToken2 ? this.refreshDeferral.failures + 1 : 1;
+    const backoff = Math.min(REFRESH_RETRY_MAX_MS, REFRESH_RETRY_BASE_MS * 2 ** (failures - 1));
+    this.refreshDeferral = {
+      refreshToken: refreshToken2,
+      failures,
+      until: Date.now() + Math.max(backoff, retryAfter ?? 0)
+    };
+  }
   async bindIdentity(sessionId, signal) {
     const s = await this.ensureSnapshot(signal, void 0, true);
     if (s.authSessionId !== sessionId) throw new Error("superseded");
@@ -1409,6 +1436,10 @@ var CredentialLifecycle = class {
       if (live && (refreshed || s.revision !== (rejected?.revision ?? initialRevision) && (rejected !== void 0 || s.tokenSet.access_token !== initialAccess)))
         return s;
       if (this.usable(s) && !rejected) return s;
+      if (this.refreshDeferred(s)) {
+        if (live && !rejected) return s;
+        throw new Error(REFRESH_TEMPORARILY_UNAVAILABLE);
+      }
       const metadata = await this.metadata(s, signal);
       abort(signal);
       const operationId = uuid();
@@ -1431,7 +1462,13 @@ var CredentialLifecycle = class {
       );
       if (r.status !== "committed") continue;
       const owner = this.refresh(r.snapshot, metadata);
-      await this.wait(owner, signal);
+      try {
+        await this.wait(owner, signal);
+      } catch (error) {
+        const deferred = error instanceof Error && error.message === REFRESH_TEMPORARILY_UNAVAILABLE;
+        if (rejected || !deferred) throw error;
+        continue;
+      }
       refreshed = true;
       rejected = void 0;
     }
@@ -1472,59 +1509,9 @@ var CredentialLifecycle = class {
     const s = r.snapshot;
     const ctl = new AbortController();
     const timeout = setTimeout(() => ctl.abort(), 3e4);
-    let tokens;
+    let outcome;
     try {
-      const result = await this.wait(
-        (async () => {
-          const response = await this.protocol.fetch(metadata.token_endpoint, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-              grant_type: "refresh_token",
-              client_id: s.tokenSet.client_id,
-              refresh_token: s.tokenSet.refresh_token
-            }),
-            signal: ctl.signal
-          });
-          const body2 = await response.json();
-          return { response, body: body2 };
-        })(),
-        ctl.signal
-      );
-      if (!result.response.ok) {
-        const code = result.body.error;
-        let reason = "refresh_outcome_unknown";
-        let state = "reauth_required";
-        if (code === "invalid_grant") reason = code;
-        else if (["invalid_client", "invalid_scope", "unsupported_grant_type"].includes(code)) {
-          reason = code;
-          state = "configuration_error";
-        } else if (result.body.rotationOutcome === "not_committed" && ["temporarily_unavailable", "server_error"].includes(code)) {
-          await this.commit(s, {
-            credentialState: s.refreshOperation.returnState,
-            refreshOperation: null
-          });
-          throw new Error("refresh_temporarily_unavailable");
-        }
-        await this.commit(s, {
-          credentialState: state,
-          tokenSet: null,
-          refreshOperation: null,
-          reason
-        });
-        throw new Error(reason);
-      }
-      const body = result.body;
-      if (!Number.isFinite(body.expires_in) || body.expires_in <= 0)
-        throw new Error("invalid_response");
-      tokens = {
-        ...s.tokenSet,
-        access_token: body.access_token,
-        refresh_token: body.refresh_token,
-        expires_at: new Date(Date.now() + body.expires_in * 1e3).toISOString(),
-        scope: body.scope ?? s.tokenSet.scope
-      };
-      this.validateTokens(tokens);
+      outcome = await this.wait(this.exchange(metadata, s.tokenSet, ctl.signal), ctl.signal);
     } catch (error) {
       await this.commit(s, {
         credentialState: "reauth_required",
@@ -1536,6 +1523,24 @@ var CredentialLifecycle = class {
     } finally {
       clearTimeout(timeout);
     }
+    if (outcome.kind === "not_committed") {
+      this.deferRefresh(s.tokenSet.refresh_token, outcome.retryAfterMs);
+      await this.commit(s, {
+        credentialState: s.refreshOperation.returnState,
+        refreshOperation: null
+      });
+      throw new Error(REFRESH_TEMPORARILY_UNAVAILABLE);
+    }
+    if (outcome.kind === "rejected") {
+      await this.commit(s, {
+        credentialState: outcome.state,
+        tokenSet: null,
+        refreshOperation: null,
+        reason: outcome.reason
+      });
+      throw new Error(outcome.reason);
+    }
+    const tokens = outcome.tokens;
     const started = performance.now(), mutationId = uuid();
     for (; ; ) {
       if (Date.now() >= Date.parse(s.refreshOperation.deadlineAt)) {
@@ -1558,6 +1563,7 @@ var CredentialLifecycle = class {
         mutationId
       );
       if (result.status === "committed") {
+        this.refreshDeferral = null;
         await this.notify(result.snapshot);
         return;
       }
@@ -1569,6 +1575,47 @@ var CredentialLifecycle = class {
       await pause();
     }
   }
+  /**
+   * One refresh-token exchange. Settles with what the authority said; rejects only when there is
+   * no answer or the answer cannot be read, which leaves the rotation outcome unknown.
+   */
+  async exchange(metadata, current, signal) {
+    const response = await this.protocol.fetch(metadata.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: current.client_id,
+        refresh_token: current.refresh_token
+      }),
+      signal
+    });
+    if (response.status === 429)
+      return { kind: "not_committed", retryAfterMs: retryAfterMs(response) };
+    const body = await response.json();
+    if (!response.ok) {
+      const code = body.error;
+      if (code === "invalid_grant")
+        return { kind: "rejected", state: "reauth_required", reason: code };
+      if (["invalid_client", "invalid_scope", "unsupported_grant_type"].includes(code))
+        return { kind: "rejected", state: "configuration_error", reason: code };
+      if (body.rotationOutcome === "not_committed" && ["temporarily_unavailable", "server_error"].includes(code))
+        return { kind: "not_committed", retryAfterMs: retryAfterMs(response) };
+      return { kind: "rejected", state: "reauth_required", reason: "refresh_outcome_unknown" };
+    }
+    const tokenResponse = body;
+    if (!Number.isFinite(tokenResponse.expires_in) || tokenResponse.expires_in <= 0)
+      throw new Error("invalid_response");
+    const tokens = {
+      ...current,
+      access_token: tokenResponse.access_token,
+      refresh_token: tokenResponse.refresh_token,
+      expires_at: new Date(Date.now() + tokenResponse.expires_in * 1e3).toISOString(),
+      scope: tokenResponse.scope ?? current.scope
+    };
+    this.validateTokens(tokens);
+    return { kind: "tokens", tokens };
+  }
   async revoke(tokens, metadata, authority) {
     const ctl = new AbortController();
     const timer = setTimeout(() => ctl.abort(), 3e4);