@assembly-js/app-foundation 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -19,6 +19,12 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.5.3
+- [fix] Sign-in renewal is now bounded to one attempt per 30 seconds per tab, so a burst of expired requests renews once and a late response can no longer undo a fresh renewal.
+
+## 0.5.2
+- [fix] The builder preview no longer counts a page marked as an error document in its server HTML as the app having painted, even when it streams in before the page finishes hydrating.
+
 ## 0.5.1
 - [guidance] The build agent now detects PDF form fields with `detectPdfFields` and gives XFA, text-only and empty PDFs their own UI instead of reporting "no fields".
 

package/dist/lib-client.d.ts

@@ -1,4 +1,5 @@
 import type { NavigateDestination, NavigateToOptions } from './bridge-vnext.js';
+export declare function resetRenewalStateForTests(): void;
 export declare function reexchangeBearer(): Promise<boolean>;
 export declare function authFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
 export declare function downloadViaBlob(url: string, filename: string): Promise<void>;

package/dist/lib-client.js

@@ -5,7 +5,8 @@
 // never be dragged into the Edge middleware bundle that imports ./client
 // (proxy.ts pulls constants from that barrel).
 import { AssemblyBridge } from '@assembly-js/app-bridge';
-import { APP_CSRF_HEADER, logRenewOutcome, TOKEN_EXPIRED_HEADER, } from './session-exchange.js';
+import { APP_CSRF_HEADER, COOKIE_PROBE_NAME, logRenewOutcome, TOKEN_EXPIRED_HEADER, } from './session-exchange.js';
+import { readCookie } from './origin-bootstrap.js';
 import { cookielessReexchangeHeaders, cookiesAreBlocked, getCookielessBearer, setCookielessBearer, } from './cookieless-bearer.js';
 const REEXCHANGE_PATH = '/api/assembly-reexchange';
 // Single-flight gate for renewals. Session tokens are single-use for exchange:
@@ -13,18 +14,65 @@ const REEXCHANGE_PATH = '/api/assembly-reexchange';
 // once, and uncoordinated renewals would race each other for the token — the
 // first mints the bearer and the losers surface their original 401 even though
 // a valid bearer was just installed. All concurrent callers share this one
-// promise instead; it is cleared on settle so a later expiry renews afresh.
+// promise instead.
 let renewalInFlight = null;
+// After a renewal POST settles, its verdict stands for this long so a burst of
+// 401s (and a failing route that keeps answering 401) costs one mint, not one
+// per response.
+const RENEWAL_WINDOW_MS = 30_000;
+let lastVerdict = null;
+let probeEverSet = false;
+const probeIsSet = () => {
+    const set = readCookie(COOKIE_PROBE_NAME) !== null;
+    if (set)
+        probeEverSet = true;
+    return set;
+};
+// The probe is gone by the time the first 401 triggers a renewal, so it has to
+// be seen while the page still holds a valid bearer: at load and before each
+// request.
+probeIsSet();
+// Test seam: module state otherwise outlives a single test.
+export function resetRenewalStateForTests() {
+    renewalInFlight = null;
+    lastVerdict = null;
+    probeEverSet = false;
+}
+// A late 401 response carries the proxy's cookie deletion and can erase the
+// bearer a sibling call just renewed. The probe is cleared together with the
+// bearer and is readable from script (the bearer is HttpOnly), so its absence
+// is the only signal that the cached success no longer holds.
+function verdictInWindow() {
+    if (!lastVerdict || Date.now() - lastVerdict.at >= RENEWAL_WINDOW_MS) {
+        return null;
+    }
+    if (lastVerdict.ok && lastVerdict.probeSeen && !probeIsSet())
+        return null;
+    return lastVerdict.ok;
+}
 // Silently renews the bearer cookie after a 60-minute expiry. Asks the bridge
 // for the freshest session token (the parent keeps it alive) and posts it to the
 // re-exchange route, which mints a new bearer and sets the HttpOnly cookie — no
-// page reload. Returns true iff a fresh bearer was set. This is the only place
-// app code touches the raw session token, to re-mint and keep the URL aligned
-// with the cookie; it is never sent to the platform API.
+// page reload. Returns true iff a fresh bearer is in place. Inside the window
+// after a POST it answers from that POST's outcome without sending another, so
+// authFetch gets false for the window after a failed renewal instead of a fresh
+// mint per 401. A no_token outcome sends nothing and starts no window. This is
+// the only place app code touches the raw session token, to re-mint and keep the
+// URL aligned with the cookie; it is never sent to the platform API.
 export function reexchangeBearer() {
     if (renewalInFlight)
         return renewalInFlight;
-    const renewal = renewBearer().finally(() => {
+    probeIsSet();
+    const cached = verdictInWindow();
+    if (cached !== null)
+        return Promise.resolve(cached);
+    const renewal = renewBearer()
+        .then(({ ok, sent }) => {
+        probeIsSet();
+        lastVerdict = sent ? { at: Date.now(), ok, probeSeen: probeEverSet } : null;
+        return ok;
+    })
+        .finally(() => {
         renewalInFlight = null;
     });
     renewalInFlight = renewal;
@@ -52,7 +100,7 @@ async function renewBearer() {
     }
     if (!token) {
         logRenewOutcome('no_token', { bridgeRefreshFailed, cookieless });
-        return false;
+        return { ok: false, sent: false };
     }
     try {
         const res = await fetch(REEXCHANGE_PATH, {
@@ -91,11 +139,11 @@ async function renewBearer() {
                 // A history update failure must not invalidate the cookie just renewed.
             }
         }
-        return res.ok;
+        return { ok: res.ok, sent: true };
     }
     catch {
         logRenewOutcome('unavailable', { bridgeRefreshFailed, cookieless });
-        return false;
+        return { ok: false, sent: true };
     }
 }
 // Whether a denial is worth a renew-and-retry. A 401 is an authentication
@@ -116,6 +164,7 @@ function shouldRenewBearer(res) {
 // once via reexchangeBearer and retries; a genuine forbidden just returns.
 export async function authFetch(input, init) {
     const headers = { ...(init?.headers ?? {}), [APP_CSRF_HEADER]: '1' };
+    probeIsSet();
     const res = await fetch(input, { ...init, headers });
     if (!shouldRenewBearer(res)) {
         return res;

package/dist/paint-beacon.js

@@ -17,8 +17,12 @@ let fired = false;
 // the schedule latch, so the boundary can re-install it once the app has
 // rendered in its place.
 const ERROR_DOCUMENT_FLAG = '__assemblyErrorDocument';
+// The same pages also carry this attribute in their server HTML. A page streamed
+// in under Suspense can reach load before React hydrates it and sets the flag.
+const ERROR_DOCUMENT_SELECTOR = '[data-assembly-error-document]';
 function isErrorDocument() {
-    return window[ERROR_DOCUMENT_FLAG] === true;
+    return (window[ERROR_DOCUMENT_FLAG] === true ||
+        document.querySelector(ERROR_DOCUMENT_SELECTOR) !== null);
 }
 function firePaintBeacon() {
     if (fired)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [