@anchrd/intel-api 0.6.1 → 0.6.2

package/dist/adapters/session-cookie/session-cookie.js

@@ -30,6 +30,9 @@ const ConnectionPendingSession = z.strictObject({
     // Older cookies carry no `silent`, and one in flight across a deploy must not become an invalid
     // session: absent means the visible flow, which is what those attempts were.
     silent: z.boolean().default(false),
+    // Same for `resumed`: absent means a first attempt, so a handoff written before the deploy still
+    // gets its one restart rather than dying at the parser.
+    resumed: z.boolean().default(false),
     expiresAt: z.number().int().positive(),
 });
 const Session = z.discriminatedUnion("kind", [

package/dist/auth/auth.js

@@ -3,6 +3,14 @@ import { IntelError } from "../shared/intel-error/intel-error.js";
 import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 import { SafeReturnPath } from "../shared/safe-return-path/safe-return-path.js";
 const cookieName = "intel_session";
+// ⚠️ The cookie outlives the handoff on purpose. Ten minutes is right for something carrying a PKCE
+// verifier, but the portal's consent screen can stand open longer — it waits for every server to
+// connect, and a person steps away meanwhile. An expired handoff that is still *readable* tells the
+// callback what was being attempted, where the person wanted to go, and whether their Intel session
+// survived; a cookie that vanished with it leaves nothing but a raw error page (#95). `expiresAt`
+// remains the only authority — a stale verifier is never exchanged, no matter how long it is legible.
+const HandoffValidSeconds = 10 * 60;
+const HandoffCookieSeconds = 60 * 60;
 // What an authorization server answers when `prompt=none` would have worked, but only with somebody
 // looking at a screen. It is the expected answer to a silent attempt, not a broken deployment.
 const InteractionRequired = new Set([
@@ -11,12 +19,14 @@ const InteractionRequired = new Set([
     "consent_required",
     "account_selection_required",
 ]);
-// One fixed marker, never the portal's own words. `error_description` is a sentence written by the
+// Fixed markers, never the portal's own words. `error_description` is a sentence written by the
 // authorization server about somebody else's policy: putting it in the URL would hand whatever
-// renders the page next a string Intel does not control.
-function withConnectError(returnTo) {
+// renders the page next a string Intel does not control. Which marker matters — a refusal is about
+// access, running out of time is not, and a screen that confuses the two sends the reader hunting
+// in the wrong place (#93).
+function withConnectError(returnTo, code = "portal_sign_in_refused") {
     const url = new URL(returnTo, "https://intel.invalid");
-    url.searchParams.set("connectError", "portal_sign_in_refused");
+    url.searchParams.set("connectError", code);
     return `${url.pathname}${url.search}`;
 }
 function cookieValue(headers) {
@@ -131,6 +141,7 @@ export function createBrowserAuth(deps) {
             // session is already the person the portal would ask about. `prompt=none` says exactly that:
             // answer from the session that exists, and refuse rather than show anybody a login (#60).
             const silent = requestUrl.searchParams.get("silent") === "1";
+            const resumed = requestUrl.searchParams.get("resumed") === "1";
             if (!deps.portalUrl) {
                 throw new IntelError(503, "portal_not_configured", "No MCP portal is configured for this deployment");
             }
@@ -152,7 +163,8 @@ export function createBrowserAuth(deps) {
                 userId,
                 user,
                 silent,
-                expiresAt: deps.now().getTime() + 10 * 60 * 1_000,
+                resumed,
+                expiresAt: deps.now().getTime() + HandoffValidSeconds * 1_000,
             };
             const authorizationUrl = await deps.oauth.authorizationUrl({
                 issuer: discovered.issuer,
@@ -164,13 +176,25 @@ export function createBrowserAuth(deps) {
                 ...(discovered.scope ? { scope: discovered.scope } : {}),
                 ...(silent ? { prompt: "none" } : {}),
             });
-            return redirect(authorizationUrl.href, sessionCookie(await deps.sessions.seal(pending), secure, 10 * 60));
+            return redirect(authorizationUrl.href, sessionCookie(await deps.sessions.seal(pending), secure, HandoffCookieSeconds));
         },
         async callback(requestUrl, headers) {
             const encoded = cookieValue(headers);
             const pending = encoded ? await deps.sessions.open(encoded) : null;
-            if ((pending?.kind !== "pending" && pending?.kind !== "connection-pending") ||
-                pending.expiresAt <= deps.now().getTime()) {
+            if (pending?.kind !== "pending" && pending?.kind !== "connection-pending") {
+                throw new IntelError(400, "oauth_session_invalid", "OAuth session is missing or expired");
+            }
+            // A handoff that ran out while somebody was still on the consent screen is not a failure they
+            // caused, and everything needed to carry on is in it: their parked Intel session and where
+            // they were going. `restore` decides which — it sends them back to the Gate login when that
+            // session is gone too, rather than into an attempt that could not finish (#95).
+            if (pending.kind === "connection-pending" && pending.expiresAt <= deps.now().getTime()) {
+                return await restore(pending.user, pending.returnTo, pending.resumed
+                    ? withConnectError(pending.returnTo, "portal_sign_in_expired")
+                    : `/auth/connect?returnTo=${encodeURIComponent(pending.returnTo)}&resumed=1`);
+            }
+            // The Gate login handoff parks nothing, so an expired one has nowhere to return to.
+            if (pending.expiresAt <= deps.now().getTime()) {
                 throw new IntelError(400, "oauth_session_invalid", "OAuth session is missing or expired");
             }
             // ⚠️ An authorization server reports a refusal on the redirect URI, not by failing the token

package/dist/auth/auth.types.d.ts

@@ -78,6 +78,7 @@ export type AuthSession = {
     userId: string;
     user: UserAuthSession;
     silent: boolean;
+    resumed: boolean;
     expiresAt: number;
 } | UserAuthSession;
 export interface SessionCodec {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {