@arcote.tech/platform 0.7.26 → 0.7.28

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arcote.tech/platform",
   "type": "module",
-  "version": "0.7.26",
+  "version": "0.7.28",
   "private": false,
   "author": "Przemysław Krasiński [arcote.tech]",
   "description": "Arc Platform — module system, router, layout, theme, i18n, platform app shell",
@@ -14,12 +14,12 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "@arcote.tech/arc-ds": "^0.7.26",
-    "@arcote.tech/arc-react": "^0.7.26"
+    "@arcote.tech/arc-ds": "^0.7.28",
+    "@arcote.tech/arc-react": "^0.7.28"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.7.26",
-    "@arcote.tech/arc-otel": "^0.7.26",
+    "@arcote.tech/arc": "^0.7.28",
+    "@arcote.tech/arc-otel": "^0.7.28",
     "@lingui/core": "^5.0.0",
     "@lingui/react": "^5.0.0",
     "framer-motion": "^12.0.0",

package/src/module-loader.ts

@@ -110,27 +110,69 @@ function buildTokensHeader(tokens: Record<string, string>): string {
     .join(",");
 }
 
-function buildHeaders(tokens?: Record<string, string>): HeadersInit {
-  const resolved = tokens ?? getAllPersistedTokens();
+function buildHeaders(tokens: Record<string, string>): HeadersInit {
   const headers: HeadersInit = {};
-  const tokensHeader = buildTokensHeader(resolved);
+  const tokensHeader = buildTokensHeader(tokens);
   if (tokensHeader) headers["X-Arc-Tokens"] = tokensHeader;
   // Also send first token as Authorization for backwards compatibility
-  const firstToken = Object.values(resolved)[0];
+  const firstToken = Object.values(tokens)[0];
   if (firstToken) headers["Authorization"] = `Bearer ${firstToken}`;
   return headers;
 }
 
-/** Fetch manifest from server */
+/** Remove the named token scopes from localStorage (invalid/rejected tokens). */
+function clearPersistedTokens(scopes: string[]): void {
+  if (typeof localStorage === "undefined") return;
+  for (const scope of scopes) localStorage.removeItem(`arc:token:${scope}`);
+}
+
+/** Single manifest request with an explicit token map. `bust` forces a
+ *  cache-busted request (query param + `cache: "reload"`). */
+function fetchManifestOnce(
+  baseUrl: string,
+  tokens: Record<string, string>,
+  bust?: string,
+): Promise<Response> {
+  const url = bust ? `${baseUrl}/api/modules?t=${bust}` : `${baseUrl}/api/modules`;
+  return fetch(url, {
+    headers: buildHeaders(tokens),
+    ...(bust ? { cache: "reload" as RequestCache } : {}),
+  });
+}
+
+/**
+ * Fetch the module manifest. Self-heals a rejected token: if the request
+ * carried token(s) and the server answers 401/403 (e.g. the token was minted
+ * with a rotated secret, or came from another environment), the offending
+ * tokens are dropped from localStorage and the manifest is refetched
+ * anonymously. Without this a single stale token bricks the whole boot with
+ * "Failed to load application" until the user manually clears storage.
+ *
+ * `bust` forces a cache-busted request — used by the group-import recovery
+ * path when a stale cached manifest pointed at chunks that no longer exist.
+ */
 async function fetchManifest(
   baseUrl: string,
   tokens?: Record<string, string>,
+  bust?: string,
 ): Promise<BuildManifest> {
-  const headers = buildHeaders(tokens);
-  const res = await fetch(`${baseUrl}/api/modules`, { headers });
-  if (!res.ok)
-    throw new Error(`Failed to fetch module manifest: ${res.status}`);
-  return res.json();
+  const resolved = tokens ?? getAllPersistedTokens();
+  const res = await fetchManifestOnce(baseUrl, resolved, bust);
+  if (res.ok) return res.json();
+
+  const sentScopes = Object.keys(resolved);
+  if ((res.status === 401 || res.status === 403) && sentScopes.length > 0) {
+    console.warn(
+      `[arc] Manifest fetch ${res.status} with token(s) [${sentScopes.join(", ")}]; ` +
+        `clearing them and retrying anonymously.`,
+    );
+    clearPersistedTokens(sentScopes);
+    const retry = await fetchManifestOnce(baseUrl, {}, bust);
+    if (retry.ok) return retry.json();
+    throw new Error(`Failed to fetch module manifest: ${retry.status}`);
+  }
+
+  throw new Error(`Failed to fetch module manifest: ${res.status}`);
 }
 
 /** Track hashes of token-group bundles already imported so hot-swaps re-import on change. */
@@ -143,29 +185,81 @@ const importedGroupHashes = new Map<string, string>();
 const knownGroupModuleNames = new Set<string>();
 
 /**
- * Attempt a dynamic import. If it fails (network error, evaluation error,
- * stale signed URL), discard the token tied to this module's chunk and let
- * the next reload refetch a clean manifest. Without this, a single stale
- * token bricks the entire boot path because Promise.all rejects on first
- * failure.
+ * Attempt a dynamic import of a token-group bundle. Returns `true` on success,
+ * `false` on failure (network error, evaluation error, stale signed URL).
+ * Deliberately does NOT mutate tokens: recovery is orchestrated by the caller
+ * so a stale cached manifest can be refetched before we give up on the token.
+ * Never rejects, so a single failing group can't brick the whole boot path.
  */
-async function safeImportGroup(
+async function tryImportGroup(
   baseUrl: string,
-  groupName: string,
   group: BuildManifestGroup,
   bust?: string,
-): Promise<void> {
+): Promise<boolean> {
   try {
     await import(/* @vite-ignore */ groupUrl(baseUrl, group, bust));
+    return true;
   } catch (err) {
+    console.error(`[arc] Failed to load group "${group.file}".`, err);
+    return false;
+  }
+}
+
+/**
+ * Import the named groups from `manifest`. On any failure — typically a 404/403
+ * from a stale cached manifest after a deploy — refetch a cache-busted manifest
+ * ONCE and retry only the still-failing groups with the fresh hashes/signed
+ * URLs. Only if a group still fails against the fresh manifest (genuinely broken
+ * bundle) or has vanished from it (access revoked) do we clear its token. This
+ * self-heals the "manifest error / token disappeared" symptom even when an
+ * intermediary cache/CDN ignores `no-cache`.
+ *
+ * Returns the manifest that actually satisfied the imports (the fresh one if a
+ * refetch happened), so callers compute their active-module set from it.
+ */
+async function importGroupsWithRecovery(
+  baseUrl: string,
+  manifest: BuildManifest,
+  names: string[],
+  tokens?: Record<string, string>,
+  bust?: string,
+): Promise<BuildManifest> {
+  const first = await Promise.all(
+    names.map(async (name) => ({
+      name,
+      ok: await tryImportGroup(baseUrl, manifest.groups[name], bust),
+    })),
+  );
+  const failed = first.filter((r) => !r.ok).map((r) => r.name);
+  if (failed.length === 0) return manifest;
+
+  console.warn(
+    `[arc] ${failed.length} group(s) failed to load; refetching manifest to recover.`,
+  );
+  const fresh = await fetchManifest(baseUrl, tokens, String(Date.now()));
+  const freshBust = String(Date.now());
+  const retry = await Promise.all(
+    failed
+      .filter((name) => fresh.groups[name])
+      .map(async (name) => {
+        const group = fresh.groups[name];
+        importedGroupHashes.set(name, group.hash);
+        return { name, ok: await tryImportGroup(baseUrl, group, freshBust) };
+      }),
+  );
+
+  const unrecoverable = new Set(retry.filter((r) => !r.ok).map((r) => r.name));
+  // Groups absent from the fresh manifest = access revoked → unrecoverable too.
+  for (const name of failed) if (!fresh.groups[name]) unrecoverable.add(name);
+  for (const name of unrecoverable) {
     console.error(
-      `[arc] Failed to load group "${groupName}". Clearing token; refresh to retry without it.`,
-      err,
+      `[arc] Group "${name}" still failing after manifest refresh; clearing token.`,
     );
     if (typeof localStorage !== "undefined") {
-      localStorage.removeItem(`arc:token:${groupName}`);
+      localStorage.removeItem(`arc:token:${name}`);
     }
   }
+  return fresh;
 }
 
 /**
@@ -177,14 +271,10 @@ export async function loadModules(
 ): Promise<BuildManifest> {
   const manifest = await fetchManifest(baseUrl, tokens);
 
-  await Promise.all(
-    Object.entries(manifest.groups).map(([name, group]) => {
-      importedGroupHashes.set(name, group.hash);
-      return safeImportGroup(baseUrl, name, group);
-    }),
-  );
+  const names = Object.keys(manifest.groups);
+  for (const name of names) importedGroupHashes.set(name, manifest.groups[name].hash);
 
-  return manifest;
+  return importGroupsWithRecovery(baseUrl, manifest, names, tokens);
 }
 
 /**
@@ -199,24 +289,23 @@ export async function syncModules(
 ): Promise<BuildManifest> {
   const manifest = await fetchManifest(baseUrl, tokens);
 
-  const toImport = Object.entries(manifest.groups).filter(
-    ([name, g]) => importedGroupHashes.get(name) !== g.hash,
-  );
+  const toImport = Object.entries(manifest.groups)
+    .filter(([name, g]) => importedGroupHashes.get(name) !== g.hash)
+    .map(([name]) => name);
 
+  // Recovery may refetch a fresh manifest; the active set must be computed from
+  // whatever manifest actually satisfied the imports.
+  let effective = manifest;
   if (toImport.length > 0) {
-    await Promise.all(
-      toImport.map(([name, group]) => {
-        importedGroupHashes.set(name, group.hash);
-        return safeImportGroup(baseUrl, name, group);
-      }),
-    );
+    for (const name of toImport) importedGroupHashes.set(name, manifest.groups[name].hash);
+    effective = await importGroupsWithRecovery(baseUrl, manifest, toImport, tokens);
   }
 
   // Compute active set: every registered module EXCEPT protected-group members
   // not present in the current manifest (e.g. after logout). Public modules,
   // never observed in a group, stay visible automatically.
   const currentlyAllowed = new Set<string>();
-  for (const group of Object.values(manifest.groups)) {
+  for (const group of Object.values(effective.groups)) {
     for (const name of group.modules) {
       currentlyAllowed.add(name);
       knownGroupModuleNames.add(name);
@@ -229,7 +318,7 @@ export async function syncModules(
   }
   setActiveModules(active);
 
-  return manifest;
+  return effective;
 }
 
 /**
@@ -246,10 +335,13 @@ export async function reloadModules(
   // Clear all modules — fresh code will re-register them
   clearModules();
 
+  // Dev full-reload: the cache-bust already guarantees fresh code on disk, so a
+  // failure here is a genuine build/eval error — log it, don't nuke tokens.
   await Promise.all(
-    Object.entries(manifest.groups).map(([name, group]) =>
-      safeImportGroup(baseUrl, name, group, bust),
-    ),
+    Object.entries(manifest.groups).map(([name, group]) => {
+      importedGroupHashes.set(name, group.hash);
+      return tryImportGroup(baseUrl, group, bust);
+    }),
   );
 
   return manifest;

package/tests/manifest-401-recovery.test.ts

@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { loadModules } from "../src/module-loader";
+
+/**
+ * Regression for "Failed to fetch module manifest: 401".
+ *
+ * The platform server rejects ANY request carrying an invalid token with 401
+ * (global auth gate) — including /api/modules. A stale token in localStorage
+ * (e.g. minted with a rotated secret) therefore bricks the whole boot. The
+ * loader must self-heal: drop the rejected token(s) and refetch the manifest
+ * anonymously instead of throwing.
+ */
+
+// --- Minimal in-memory localStorage --------------------------------------
+class MemoryStorage {
+  private map = new Map<string, string>();
+  get length() {
+    return this.map.size;
+  }
+  key(i: number) {
+    return [...this.map.keys()][i] ?? null;
+  }
+  getItem(k: string) {
+    return this.map.get(k) ?? null;
+  }
+  setItem(k: string, v: string) {
+    this.map.set(k, v);
+  }
+  removeItem(k: string) {
+    this.map.delete(k);
+  }
+  clear() {
+    this.map.clear();
+  }
+}
+
+// A JWT-shaped string with no `exp` claim so getAllPersistedTokens keeps it.
+const dummyJwt = "aaa.eyJ0b2tlbk5hbWUiOiJ1c2VyIn0.bbb";
+const emptyManifest = {
+  initial: { file: "initial.abc.js", hash: "abc" },
+  groups: {},
+  sharedChunks: [],
+  stylesHash: "s",
+  buildTime: "t",
+};
+
+let originalFetch: typeof globalThis.fetch;
+let originalLocalStorage: any;
+let calls: { url: string; hasAuth: boolean }[];
+
+beforeEach(() => {
+  originalFetch = globalThis.fetch;
+  originalLocalStorage = (globalThis as any).localStorage;
+  (globalThis as any).localStorage = new MemoryStorage();
+  calls = [];
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  (globalThis as any).localStorage = originalLocalStorage;
+});
+
+describe("manifest fetch — 401 self-heal", () => {
+  it("drops the rejected token and retries anonymously", async () => {
+    localStorage.setItem("arc:token:user", dummyJwt);
+
+    // First (tokened) request → 401; anonymous retry → 200 manifest.
+    globalThis.fetch = (async (input: any, init: any) => {
+      const url = String(input);
+      const hasAuth = Boolean(new Headers(init?.headers).get("Authorization"));
+      calls.push({ url, hasAuth });
+      if (hasAuth) {
+        return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
+      }
+      return new Response(JSON.stringify(emptyManifest), { status: 200 });
+    }) as any;
+
+    const manifest = await loadModules("http://x");
+
+    // Recovered: resolved with the manifest, did not throw.
+    expect(manifest.groups).toEqual({});
+    // Two requests: one with the token, then the anonymous retry.
+    expect(calls).toHaveLength(2);
+    expect(calls[0].hasAuth).toBe(true);
+    expect(calls[1].hasAuth).toBe(false);
+    // The rejected token was cleared from storage.
+    expect(localStorage.getItem("arc:token:user")).toBeNull();
+  });
+
+  it("does not clear tokens or retry on a successful fetch", async () => {
+    localStorage.setItem("arc:token:user", dummyJwt);
+
+    globalThis.fetch = (async (input: any, init: any) => {
+      const hasAuth = Boolean(new Headers(init?.headers).get("Authorization"));
+      calls.push({ url: String(input), hasAuth });
+      return new Response(JSON.stringify(emptyManifest), { status: 200 });
+    }) as any;
+
+    await loadModules("http://x");
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].hasAuth).toBe(true);
+    expect(localStorage.getItem("arc:token:user")).toBe(dummyJwt);
+  });
+
+  it("propagates a non-auth error (e.g. 500) without clearing tokens", async () => {
+    localStorage.setItem("arc:token:user", dummyJwt);
+
+    globalThis.fetch = (async (input: any, init: any) => {
+      const hasAuth = Boolean(new Headers(init?.headers).get("Authorization"));
+      calls.push({ url: String(input), hasAuth });
+      return new Response("boom", { status: 500 });
+    }) as any;
+
+    await expect(loadModules("http://x")).rejects.toThrow(/500/);
+    expect(calls).toHaveLength(1);
+    // A server error is not a token problem — keep the token.
+    expect(localStorage.getItem("arc:token:user")).toBe(dummyJwt);
+  });
+});