@antelopejs/dms 0.8.3 → 0.9.0

package/frontend-vue/layers/dms-auth/server/oauth.ts

@@ -0,0 +1,260 @@
+import { timingSafeEqual } from "node:crypto";
+import type { DmsServerEvent } from "#dms/server";
+import { privateSecret } from "../../../server/private-options";
+import { persistAccountSession } from "./accounts";
+import { type SessionTokens, sessionFrom } from "./session";
+
+// The provider sign-in, on the frontend's origin: the backend builds the
+// provider's URL and its callback (`relay.ts`, `config.ts`) and checks the
+// relay header this server sends, from the DMS module's private options.
+
+const FLOW = "dms_oauth_flow";
+const HANDOFF = "dms_oauth_handoff";
+const FLOW_PATH = "/auth/oauth";
+const COMPLETE = "/auth/oauth/complete";
+const SIGN_IN = "/auth";
+const OAUTH_ERROR = "error.oauth.";
+const FAILED = "error.oauth.failed";
+const FLOW_LIFETIME_MS = 10 * 60 * 1000;
+const HANDOFF_LIFETIME_S = 300;
+const RATE_WINDOW_MS = 60 * 1000;
+const RATE_LIMIT = 10;
+const MAX_RATE_LIMIT_CLIENTS = 10_000;
+const MAX_CALLBACK_PARAMETER_LENGTH = 2048;
+const PROVIDER = /^[a-z0-9-]{1,32}$/;
+
+interface RateWindow {
+  count: number;
+  startedAt: number;
+}
+
+interface OAuthFlow {
+  state: string;
+  expiresAt: number;
+  redirect: string;
+  language: string;
+  invite: string;
+}
+
+interface OAuthResult extends SessionTokens {
+  requires_2fa?: boolean;
+  requires_tenant_assignment?: boolean;
+  two_factor_token?: string;
+  tenant_assignment_token?: string;
+  methods?: unknown;
+}
+
+// Process-local, like the session refresh: one frontend process per sticky
+// client. A development reload of this file starts it over.
+const attempts = new Map<string, RateWindow>();
+
+function sweepAttempts(now: number) {
+  for (const [key, window] of attempts)
+    if (now - window.startedAt >= RATE_WINDOW_MS) attempts.delete(key);
+  while (attempts.size >= MAX_RATE_LIMIT_CLIENTS)
+    attempts.delete(attempts.keys().next().value as string);
+}
+
+/** Counts an attempt for `key`; false once over the limit of the window. */
+export function hitOAuthRateLimitKey(key: string, now = Date.now()): boolean {
+  sweepAttempts(now);
+  const window = attempts.get(key);
+  if (!window || now - window.startedAt >= RATE_WINDOW_MS) {
+    attempts.set(key, { count: 1, startedAt: now });
+    return true;
+  }
+  window.count += 1;
+  return window.count <= RATE_LIMIT;
+}
+
+function rateLimited(event: DmsServerEvent, scope: string): boolean {
+  return !hitOAuthRateLimitKey(`${scope}:${event.clientIp()}`);
+}
+
+export function isValidOAuthProvider(provider: unknown): provider is string {
+  return typeof provider === "string" && PROVIDER.test(provider);
+}
+
+function safePath(value: string | null): string {
+  if (
+    typeof value !== "string" ||
+    !value.startsWith("/") ||
+    value.startsWith("//") ||
+    value.includes("\\")
+  )
+    return "";
+  try {
+    const decoded = decodeURIComponent(value);
+    return decoded.startsWith("//") || decoded.includes("\\") ? "" : value;
+  } catch {
+    return "";
+  }
+}
+
+function redirect(location: string): Response {
+  return new Response(null, { status: 302, headers: { location } });
+}
+
+function errorRedirect(key: string): Response {
+  return redirect(`${SIGN_IN}?oauth_error=${encodeURIComponent(key)}`);
+}
+
+// The backend's own OAuth key says why a provider sign-in failed; any other
+// failure keeps the generic one.
+function failureRedirect(error: unknown): Response {
+  const message = error instanceof Error ? error.message : "";
+  const status = (error as { status?: unknown }).status;
+  return errorRedirect(
+    typeof status === "number" && message.startsWith(OAUTH_ERROR)
+      ? message
+      : FAILED,
+  );
+}
+
+function relayHeaders(event: DmsServerEvent): Record<string, string> {
+  const secret = privateSecret(
+    event,
+    "oauth",
+    "relaySecret",
+    "DMS_OAUTH_RELAY_SECRET",
+  );
+  return { "x-dms-oauth-relay": secret ?? "" };
+}
+
+/** `GET /auth/oauth/:provider/start`: on to the provider's sign-in page. */
+export async function oauthStart(event: DmsServerEvent): Promise<Response> {
+  const { provider } = event.params;
+  if (
+    !isValidOAuthProvider(provider) ||
+    event.request.headers.get("sec-fetch-site") === "cross-site" ||
+    rateLimited(event, "start")
+  )
+    return errorRedirect(FAILED);
+  try {
+    const result = await event.backend<{
+      state: string;
+      authorizeUrl: string;
+    }>(`/api/auth/oauth/${provider}/authorize-url`, {
+      headers: relayHeaders(event),
+    });
+    const query = event.url.searchParams;
+    event.cookies.writeSealed(
+      FLOW,
+      {
+        state: result.state,
+        expiresAt: Date.now() + FLOW_LIFETIME_MS,
+        redirect: safePath(query.get("redirect")),
+        language: query.get("language") ?? "",
+        invite: query.get("invite") ?? "",
+      } satisfies OAuthFlow,
+      { maxAge: FLOW_LIFETIME_MS / 1000, path: FLOW_PATH },
+    );
+    return redirect(result.authorizeUrl);
+  } catch (error) {
+    return failureRedirect(error);
+  }
+}
+
+function sameState(left: unknown, right: unknown): boolean {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+function validCallback(flow: OAuthFlow | undefined, query: URLSearchParams) {
+  const code = query.get("code");
+  const state = query.get("state");
+  return Boolean(
+    flow &&
+      flow.expiresAt >= Date.now() &&
+      typeof code === "string" &&
+      code.length <= MAX_CALLBACK_PARAMETER_LENGTH &&
+      typeof state === "string" &&
+      state.length <= MAX_CALLBACK_PARAMETER_LENGTH &&
+      sameState(state, flow.state),
+  );
+}
+
+function storeOAuthResult(
+  event: DmsServerEvent,
+  provider: string,
+  result: OAuthResult,
+) {
+  const handoff = { maxAge: HANDOFF_LIFETIME_S, path: FLOW_PATH };
+  if (result.requires_2fa)
+    event.cookies.writeSealed(
+      HANDOFF,
+      { kind: "2fa", token: result.two_factor_token, methods: result.methods },
+      handoff,
+    );
+  else if (result.requires_tenant_assignment)
+    event.cookies.writeSealed(
+      HANDOFF,
+      {
+        kind: "no-workspace",
+        token: result.tenant_assignment_token,
+        provider,
+      },
+      handoff,
+    );
+  else persistAccountSession(event, sessionFrom(result));
+}
+
+async function completeOAuth(
+  event: DmsServerEvent,
+  provider: string,
+  flow: OAuthFlow,
+): Promise<Response> {
+  const query = event.url.searchParams;
+  try {
+    const result = await event.backend<OAuthResult>(
+      `/api/auth/oauth/${provider}/callback`,
+      {
+        method: "POST",
+        headers: relayHeaders(event),
+        body: {
+          code: query.get("code"),
+          state: query.get("state"),
+          state_cookie: flow.state,
+          language: flow.language || undefined,
+          invite: flow.invite || undefined,
+        },
+      },
+    );
+    storeOAuthResult(event, provider, result);
+    return redirect(
+      flow.redirect &&
+        !result.requires_2fa &&
+        !result.requires_tenant_assignment
+        ? `${COMPLETE}?redirect=${encodeURIComponent(flow.redirect)}`
+        : COMPLETE,
+    );
+  } catch (error) {
+    return failureRedirect(error);
+  }
+}
+
+/** `GET /auth/oauth/:provider/callback`: back from the provider. */
+export async function oauthCallback(event: DmsServerEvent): Promise<Response> {
+  const { provider } = event.params;
+  if (!isValidOAuthProvider(provider) || rateLimited(event, "callback"))
+    return errorRedirect(FAILED);
+  const flow = event.cookies.readSealed<OAuthFlow>(FLOW);
+  event.cookies.clear(FLOW, { path: FLOW_PATH });
+  const query = event.url.searchParams;
+  if (query.has("error")) return errorRedirect("error.oauth.cancelled");
+  if (!flow || !validCallback(flow, query))
+    return errorRedirect("error.oauth.invalid_state");
+  return completeOAuth(event, provider, flow);
+}
+
+/**
+ * `POST /auth/oauth/handoff`: what the provider sign-in left for the page to
+ * finish (a 2FA step, a workspace to pick), once.
+ */
+export function oauthHandoff(event: DmsServerEvent) {
+  const handoff = event.cookies.readSealed(HANDOFF) ?? { kind: "none" };
+  event.cookies.clear(HANDOFF, { path: FLOW_PATH });
+  return handoff;
+}

package/frontend-vue/layers/dms-auth/server/session.ts

@@ -0,0 +1,158 @@
+import { createHash } from "node:crypto";
+import type { DmsPublicSession, DmsServerEvent, DmsSession } from "#dms/server";
+import { isPersistent, persistAccountSession, removeAccount } from "./accounts";
+
+const REFRESH_TTL_MS = 15_000;
+const REFUSED = [400, 401, 403];
+
+/** A backend answer that opens a session: a token pair and the user. */
+export interface SessionTokens {
+  access_token: string;
+  refresh_token?: string;
+  user?: DmsSession["user"];
+}
+
+interface RefreshFlight {
+  promise: Promise<SessionTokens>;
+  expiresAt?: number;
+}
+
+const refreshes = new Map<string, RefreshFlight>();
+
+export function isRefusal(error: unknown): boolean {
+  const status = (error as { status?: unknown } | undefined)?.status;
+  return typeof status === "number" && REFUSED.includes(status);
+}
+
+/**
+ * The session a token pair opens.
+ *
+ * @param result Backend answer carrying the tokens and the user
+ * @param persistent Whether the session outlives the browser
+ */
+export function sessionFrom(
+  result: SessionTokens,
+  persistent = true,
+): DmsSession {
+  const payload = JSON.parse(
+    Buffer.from(
+      result.access_token.split(".")[1] ?? "",
+      "base64url",
+    ).toString() || "{}",
+  ) as { tenantId?: string };
+  return {
+    user: result.user,
+    accessToken: result.access_token,
+    refreshToken: result.refresh_token,
+    activeTenantId: payload.tenantId ?? "default",
+    persistent,
+  };
+}
+
+/** What a signed-in session shows the browser; the server adds `updatedAt`. */
+export function publicSession(session: DmsSession): DmsPublicSession {
+  return {
+    user: session.user,
+    session: {
+      accountId: session.accountId,
+      activeTenantId: session.activeTenantId,
+    },
+  };
+}
+
+/**
+ * One backend refresh per refresh token at a time: the requests a page fires
+ * together after its access token expired share it, rather than spending the
+ * rotating refresh token several times over. Kept a while after it settles
+ * for the requests that were already on their way.
+ */
+function singleFlight(
+  token: string,
+  operation: () => Promise<SessionTokens>,
+): Promise<SessionTokens> {
+  const now = Date.now();
+  for (const [key, entry] of refreshes)
+    if (entry.expiresAt && entry.expiresAt <= now) refreshes.delete(key);
+  const key = createHash("sha256").update(token).digest("base64url");
+  const current = refreshes.get(key);
+  if (current) return current.promise;
+  const entry: RefreshFlight = { promise: Promise.resolve().then(operation) };
+  refreshes.set(key, entry);
+  const retain = () => {
+    entry.expiresAt = Date.now() + REFRESH_TTL_MS;
+    setTimeout(() => {
+      if (refreshes.get(key) === entry) refreshes.delete(key);
+    }, REFRESH_TTL_MS).unref();
+  };
+  entry.promise.then(retain, retain);
+  return entry.promise;
+}
+
+/**
+ * Renews `session` with its refresh token, writes it and returns it; the rest
+ * of the request runs with it. A refused refresh signs the browser out.
+ * The frontend server calls it when the backend refuses a signed-in page
+ * visit, and `POST /api/_auth/session` when the browser asks.
+ */
+export async function renewSession(
+  event: DmsServerEvent,
+  session: DmsSession | undefined = event.session.read(),
+): Promise<DmsSession | undefined> {
+  const refreshToken = session?.refreshToken;
+  if (!session || !refreshToken) return undefined;
+  try {
+    const tokens = await singleFlight(refreshToken, () =>
+      event.backend<SessionTokens>("/api/auth/refresh", {
+        method: "POST",
+        token: session.accessToken,
+        body: { token: refreshToken },
+      }),
+    );
+    const user = await event.backend<DmsSession["user"]>("/api/auth/me", {
+      token: tokens.access_token,
+    });
+    const refreshed = sessionFrom({ ...tokens, user }, isPersistent(session));
+    persistAccountSession(event, refreshed, session.accountId);
+    event.session.useForRequest(refreshed);
+    return refreshed;
+  } catch (error) {
+    if (isRefusal(error)) event.session.clear();
+    event.session.useForRequest(undefined);
+    return undefined;
+  }
+}
+
+/** `GET /api/_auth/session`: the session as the browser sees it. */
+export function readSessionRoute(event: DmsServerEvent) {
+  return event.session.view();
+}
+
+/** `POST /api/_auth/session`: renews the session, then shows it. */
+export async function refreshSessionRoute(event: DmsServerEvent) {
+  await renewSession(event);
+  return event.session.view();
+}
+
+/** `DELETE /api/_auth/session`: signs out, on the backend too. */
+export async function logoutRoute(event: DmsServerEvent) {
+  const session = event.session.read();
+  if (session?.refreshToken && session.accessToken)
+    await event
+      .backend("/api/auth/logout", {
+        method: "POST",
+        token: session.accessToken,
+        body: { token: session.refreshToken },
+      })
+      .catch(() => {});
+  event.session.clear();
+  if (session?.accountId) removeAccount(event, session.accountId);
+  return {};
+}
+
+/** Any other method on `/api/_auth/session`. */
+export function sessionMethodNotAllowed() {
+  return Response.json(
+    { error: "Method Not Allowed" },
+    { status: 405, headers: { allow: "GET, POST, DELETE" } },
+  );
+}

package/frontend-vue/layers/dms-core/app/build/utils/asyncDataScope.ts

@@ -0,0 +1,47 @@
+/** The part of the session the data scope follows. */
+export interface ScopedSession {
+  accountId?: string;
+  activeTenantId?: string;
+}
+
+const HASH_SEED_LOW = 0xdeadbeef;
+const HASH_SEED_HIGH = 0x41c6ce57;
+const HASH_MULTIPLIER_LOW = 2_654_435_761;
+const HASH_MULTIPLIER_HIGH = 1_597_334_677;
+const HASH_MIX_LOW = 2_246_822_507;
+const HASH_MIX_HIGH = 3_266_489_909;
+const HIGH_WORD = 2 ** 32;
+const HIGH_BITS_MASK = 2_097_151;
+const RADIX = 36;
+
+/**
+ * A 53-bit digest of `text` (cyrb53): the same in a server render and in the
+ * browser, and synchronous, so the scope is set before the page renders.
+ * Not a secret: it only keeps the identifiers out of the page.
+ */
+function digest(text: string): string {
+  let low = HASH_SEED_LOW;
+  let high = HASH_SEED_HIGH;
+  for (let index = 0; index < text.length; index++) {
+    const code = text.charCodeAt(index);
+    low = Math.imul(low ^ code, HASH_MULTIPLIER_LOW);
+    high = Math.imul(high ^ code, HASH_MULTIPLIER_HIGH);
+  }
+  low = Math.imul(low ^ (low >>> 16), HASH_MIX_LOW);
+  low ^= Math.imul(high ^ (high >>> 13), HASH_MIX_HIGH);
+  high = Math.imul(high ^ (high >>> 16), HASH_MIX_LOW);
+  high ^= Math.imul(low ^ (low >>> 13), HASH_MIX_HIGH);
+  return (HIGH_WORD * (HIGH_BITS_MASK & high) + (low >>> 0)).toString(RADIX);
+}
+
+/**
+ * The scope the async data of a session is kept under: a digest of its
+ * account and workspace, or none when signed out. The same key read by
+ * another account, or in another workspace, is another entry.
+ */
+export function asyncDataScopeOf(
+  session: ScopedSession | null | undefined,
+): string | undefined {
+  if (!session?.accountId) return undefined;
+  return digest(`${session.accountId}\n${session.activeTenantId ?? ""}`);
+}

package/frontend-vue/layers/dms-core/app/build/utils/permission-preview.ts

@@ -1,3 +1,4 @@
+import { pageRoutePath } from "#dms-core/app/utils/pageRoutes";
 // "Preview as role" (roles editor): the shapes the preview endpoint answers
 // with, how a preview session travels from the editor tab to the preview tab,
 // and which requests a preview tab may still send. Pure: no Vue, no window.
@@ -9,7 +10,7 @@ export type PermissionPreviewBlock =
 
 export type PermissionPreviewState = PermissionPreviewBlock["state"];
 
-/** Answer of `POST /settings/workspace/roles/preview`. */
+/** Answer of `POST /dms/pages/settings/workspace/roles/preview`. */
 export interface PermissionPreviewResult {
   page: { fullId: string; displayName: string; hidden: boolean } | null;
   /** Blocks keyed by layout path (component key, then child ids). */
@@ -44,7 +45,10 @@ export interface PermissionPreviewSession {
 }
 
 /** Endpoint the preview tab asks; a POST, so the request guard lets it through. */
-export const PERMISSION_PREVIEW_ENDPOINT = "/settings/workspace/roles/preview";
+export const PERMISSION_PREVIEW_ENDPOINT = pageRoutePath(
+  "/settings/workspace/roles",
+  "/preview",
+);
 /** Query parameter that hands a preview session to a new tab. */
 export const PERMISSION_PREVIEW_QUERY_KEY = "dms-preview";
 /** `localStorage` key prefix of the sessions the editor shares with its preview tabs. */

package/frontend-vue/layers/dms-core/app/composables/auth/useApiData.ts

@@ -0,0 +1,148 @@
+import type {
+  DmsAsyncDataKey,
+  DmsAsyncDataResult,
+  DmsPagedDataResult,
+  UseAsyncDataOptions,
+  UseDmsPagedDataOptions,
+  UseFetchOptions,
+} from "#dms/frontend-module";
+import type { MaybeRefOrGetter } from "vue";
+
+/** The authenticated fetch `useAuthFetch` returns. */
+type AuthFetch = ReturnType<typeof useAuthFetch>["$authFetch"];
+
+/** What a handler loading API data receives. */
+export interface ApiDataContext {
+  /** `useAuthFetch`'s fetch: the session retry, the language and realtime headers. */
+  $authFetch: AuthFetch;
+  /** Aborted once the result is no longer wanted: pass it to each request. */
+  signal: AbortSignal;
+}
+
+export type ApiDataHandler<T> = (context: ApiDataContext) => Promise<T>;
+
+/** `useDmsFetch`'s options, the fetch function aside: it is `$authFetch`. */
+export type UseApiDataOptions<T> = Omit<UseFetchOptions<T>, "$fetch">;
+
+/** A backend URL to read, or nothing to read while it is null or undefined. */
+export type ApiDataRequest = MaybeRefOrGetter<string | null | undefined>;
+
+/**
+ * What `useApiData` returns: `data`, `status`, `pending`, `error`, the `key`
+ * the data is loaded under, `placeholder` (a reactive request still showing
+ * the previous answer), `execute()`, `refresh()` and `clear()`. Usable at
+ * once, or awaited until the data is there.
+ */
+export type ApiDataResult<T> = DmsAsyncDataResult<T>;
+
+/**
+ * Reads backend data for a component: the one way a module loads what it
+ * renders. A server render waits for it and hands it to the browser with the
+ * page, which then does not ask again; the callers of one request share it.
+ * Data read before shows at once and is read again in the background on each
+ * mount (stale while revalidate).
+ *
+ * - `useApiData(url, options)` reads one URL, like Nuxt's `useFetch`. The URL,
+ *   `method`, `query`, `params` and `body` may be refs or getters, read again
+ *   for each request: the data follows them. A URL that is null or undefined
+ *   reads nothing until it has a value.
+ * - `useApiData(key, handler, options)` loads what the handler returns, like
+ *   Nuxt's `useAsyncData`: for data made of several requests. The handler
+ *   receives `$authFetch` and the `signal` to pass to each request.
+ *
+ * Requests go through `$authFetch` (session retry, language and realtime
+ * headers), and the data is kept per account and workspace: a switch of
+ * either reads it again. The options are the renderer's:
+ *
+ * - `lazy` spares a client navigation the wait; `server: false` leaves the
+ *   data to the browser (for what only the browser knows).
+ * - `immediate: false` waits for `execute()`: a dialog or a drawer reads
+ *   what it shows once it opens.
+ * - `refreshInterval: ms` reads again on an interval while the caller shows
+ *   the data and the page is visible: polling. A ref or a getter changes it,
+ *   and `0` or `null` stops it; a call from a plugin polls for as long as
+ *   the application runs.
+ * - The page's refreshes (`refreshPageBlocks()`) and the events of its
+ *   realtime topics read the data again; `refreshOnPageRefresh: false` opts
+ *   out, for data with refresh triggers of its own.
+ * - `data` is a shallow ref: replace the value to change it, or pass
+ *   `deep: true`.
+ *
+ * A write stays an `$authFetch` call; once it is done, the page's refresh
+ * reads what changed, or `useDmsData(key)` puts its answer in the data in
+ * place (the URL form names its key with `key`).
+ */
+export function useApiData<T>(
+  url: ApiDataRequest,
+  options?: UseApiDataOptions<T>,
+): ApiDataResult<T>;
+export function useApiData<T>(
+  key: MaybeRefOrGetter<DmsAsyncDataKey>,
+  handler: ApiDataHandler<T>,
+  options?: UseAsyncDataOptions<T>,
+): ApiDataResult<T>;
+export function useApiData<T>(
+  source: ApiDataRequest,
+  handlerOrOptions?: ApiDataHandler<T> | UseApiDataOptions<T>,
+  options?: UseAsyncDataOptions<T>,
+): ApiDataResult<T> {
+  const { $authFetch } = useAuthFetch();
+  if (typeof handlerOrOptions === "function")
+    return useDmsAsyncData<T>(
+      source,
+      ({ signal }) => handlerOrOptions({ $authFetch, signal }),
+      options,
+    );
+  return useDmsFetch<T>(source, {
+    ...handlerOrOptions,
+    $fetch: $authFetch as UseFetchOptions<T>["$fetch"],
+  });
+}
+
+/** What a handler reading one page of API data receives. */
+export interface ApiPagedDataContext<TCursor> extends ApiDataContext {
+  /** The page to read: `initialCursor` (none by default) for the first one. */
+  cursor: TCursor | undefined;
+  /** Its position, from `0`. */
+  index: number;
+}
+
+export type ApiPagedDataHandler<TPage, TCursor> = (
+  context: ApiPagedDataContext<TCursor>,
+) => Promise<TPage>;
+
+/**
+ * What `useApiPagedData` returns: `useApiData`'s result over the pages
+ * loaded, with `pages`, `hasMore`, `loadingMore` and `loadMore()`.
+ */
+export type ApiPagedDataResult<TPage, TCursor> = DmsPagedDataResult<
+  TPage,
+  TCursor
+>;
+
+/**
+ * Reads a backend list page by page under one key: a "load more" button, an
+ * infinite list. The handler reads the page at `cursor` through `$authFetch`;
+ * `nextCursor(page, pages)` gives the next page's cursor, or `null` at the
+ * end. A server render shows the first page, `loadMore()` appends the next
+ * one, and a revalidation (a mount, the page's refreshes, the polling)
+ * reads every page loaded so far again. Put what filters the list in the
+ * key (a ref or a getter for it): a new key starts from its first page.
+ *
+ * @param key The key, or a ref or getter for it
+ * @param handler Reads one page
+ * @param options `nextCursor`, `initialCursor` and `useApiData`'s options
+ */
+export function useApiPagedData<TPage, TCursor = unknown>(
+  key: MaybeRefOrGetter<DmsAsyncDataKey>,
+  handler: ApiPagedDataHandler<TPage, TCursor>,
+  options: UseDmsPagedDataOptions<TPage, TCursor>,
+): ApiPagedDataResult<TPage, TCursor> {
+  const { $authFetch } = useAuthFetch();
+  return useDmsPagedData<TPage, TCursor>(
+    key,
+    ({ cursor, index, signal }) =>
+      handler({ $authFetch, cursor, index, signal }),
+    options,
+  );
+}

package/frontend-vue/layers/dms-core/app/composables/auth/useAuthFetch.ts

@@ -1,5 +1,3 @@
-import type { UseFetchOptions } from "#dms/frontend-module";
-
 export const CONTENT_LANGUAGE_HEADER = "x-content-language";
 
 const RETRY_HEADER = "x-auth-retry";
@@ -38,7 +36,7 @@ function isUnauthorized(error: unknown): boolean {
 }
 
 export const useAuthFetch = () => {
-  const { loggedIn: isLoggedIn } = useUserSession();
+  const { loggedIn: isLoggedIn } = useDmsUserSession();
   const { refreshSession, reconcileSession, redirectToAuth } =
     useSessionRecovery();
   const config = useDmsRuntimeConfig();
@@ -51,10 +49,12 @@ export const useAuthFetch = () => {
 
   const baseFetch = $fetch.create({
     baseURL: config.public.dms.baseURL,
-    headers: {
-      [CONTENT_LANGUAGE_HEADER]: dmsApp.$i18n.locale.value,
-    },
     onRequest({ options }) {
+      // Read as each request leaves: a `$authFetch` kept across a language
+      // change asks in the new language. A header the caller sets wins.
+      if (!options.headers.has(CONTENT_LANGUAGE_HEADER)) {
+        options.headers.set(CONTENT_LANGUAGE_HEADER, dmsApp.$i18n.locale.value);
+      }
       if (realtimeSessionId.value) {
         options.headers.set(REALTIME_SESSION_HEADER, realtimeSessionId.value);
       }
@@ -117,18 +117,5 @@ export const useAuthFetch = () => {
     baseFetch.raw(request, options),
   ) as AuthFetch["raw"];
 
-  function useFetchAuth<T>(
-    url: string | (() => string),
-    options?: UseFetchOptions<T>,
-  ) {
-    return useDmsFetch(url, {
-      ...options,
-      $fetch: $authFetch,
-    });
-  }
-
-  return {
-    $authFetch,
-    useFetchAuth,
-  };
+  return { $authFetch };
 };