@adonis-agora/authkit-server 0.82.0 → 0.82.1

package/build/src/accounts/lucid_store/organizations.js

@@ -79,9 +79,17 @@ export function buildOrganizations(ctx) {
         },
         async listOrgsForAccount(accountId) {
             const memberships = await MemberModel.query().where('account_id', accountId);
+            if (memberships.length === 0)
+                return [];
+            // One query for every org (by primary key, like `find`), instead of one per
+            // membership. The result keeps the memberships' order.
+            const ids = [...new Set(memberships.map((m) => m.organizationId))];
+            const orgs = new Map();
+            for (const org of await OrgModel.findMany(ids))
+                orgs.set(String(org.id), org);
             const result = [];
             for (const m of memberships) {
-                const org = await OrgModel.find(m.organizationId);
+                const org = orgs.get(String(m.organizationId));
                 if (org)
                     result.push({ ...toOrgSummary(org), role: m.role });
             }

package/build/src/adapters/database_adapter.js

@@ -119,7 +119,8 @@ export class DatabaseAdapter {
             const accountId = payload.accountId;
             row.account_id = typeof accountId === 'string' && accountId ? accountId : null;
         }
-        const existing = await this.#query().where('id', id).first();
+        // Only whether the row exists matters: don't read the (possibly large) payload back.
+        const existing = await this.#query().where('id', id).select('id').first();
         if (existing) {
             await this.#query().where('id', id).update(row);
         }

package/build/src/adapters/redis_adapter.js

@@ -101,15 +101,23 @@ export class RedisAdapter {
         return this.find(id);
     }
     async consume(id) {
-        const found = await this.find(id);
-        if (!found)
+        const key = this.#key(id);
+        // GET + TTL in one round trip (a pipeline, read-only: nothing changes before the SET).
+        const results = await this.redis.pipeline().get(key).ttl(key).exec();
+        const [getError, data] = results?.[0] ?? [null, null];
+        if (getError)
+            throw getError;
+        if (!data)
             return;
+        const [ttlError, ttl] = results?.[1] ?? [null, -1];
+        if (ttlError)
+            throw ttlError;
+        const found = JSON.parse(data);
         found.consumed = Math.floor(Date.now() / 1000);
-        const ttl = await this.redis.ttl(this.#key(id));
         if (ttl > 0)
-            await this.redis.set(this.#key(id), JSON.stringify(found), 'EX', ttl);
+            await this.redis.set(key, JSON.stringify(found), 'EX', ttl);
         else
-            await this.redis.set(this.#key(id), JSON.stringify(found));
+            await this.redis.set(key, JSON.stringify(found));
     }
     async destroy(id) {
         await this.redis.del(this.#key(id));

package/build/src/host/persistent_rp_session.js

@@ -1,6 +1,25 @@
 import { ACCOUNT_IDP_SESSION_KEY, readIdpSession } from './idp_session_bridge.js';
 import { impersonationState } from './impersonation_session.js';
 import { assertAccountEnabled } from './login_attempt.js';
+/**
+ * How long (seconds) a renewal stays good enough: a linked RP whose IdP session was
+ * renewed less than this ago, with the current TTL, is not renewed again. Without
+ * it every authenticated request wrote the IdP session row and re-sent its cookie.
+ */
+const RENEW_RESOLUTION_SEC = 60;
+/**
+ * The linked RP's IdP session already expires between `ttl - RENEW_RESOLUTION_SEC`
+ * and `ttl` from now, i.e. it was renewed with this TTL moments ago. Renewing again
+ * would only move the expiry by those few seconds. A session that expires LATER
+ * than `now + ttl` (the TTL was lowered) is still renewed, which shortens it.
+ * Restoration (no local login yet) always renews.
+ */
+function renewedRecently(idp, ttl, current, linkedUid) {
+    if (!current || linkedUid !== idp.uid || typeof idp.exp !== 'number')
+        return false;
+    const remaining = idp.exp - Date.now() / 1000;
+    return remaining <= ttl && remaining > ttl - RENEW_RESOLUTION_SEC;
+}
 /** Same-host RP restoration: the signed IdP cookie is the persistent credential. */
 export async function ensureRpSession(ctx, sessionKey) {
     const service = await ctx.containerResolver.make('authkit.server');
@@ -39,7 +58,7 @@ export async function ensureRpSession(ctx, sessionKey) {
     }
     const adapter = service.provider.Session.adapter;
     const ttl = service.sessionTtlHolder.rememberSec;
-    if (adapter.renewSession) {
+    if (adapter.renewSession && !renewedRecently(idp, ttl, current, linkedUid)) {
         if (!(await adapter.renewSession(idp.id, ttl))) {
             if (linkedUid)
                 ctx.session.clear();