@athenaintel/react 0.26.6 → 0.28.0

package/dist/runtime/auth.js

@@ -1,6 +1,17 @@
 import { useMemo, useState, useRef, useEffect, useCallback } from "react";
 import { athenaDiagnostics } from "../diagnostics/athena-diagnostics.js";
-function isTrustedOrigin({
+import { AthenaSdkError } from "../diagnostics/errors.js";
+const CUSTOMER_APP_HOST = /^.+\.(?:(?:[a-z0-9-]+-)?app(?:\.[a-z0-9-]+)*|computer(?:-[a-z0-9-]+)?\.stg|code-sandpack(?:\.[a-z0-9-]+)*)\.athenaintel\.com$/i;
+function isCustomerAppHost(hostname) {
+  return CUSTOMER_APP_HOST.test(hostname);
+}
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function isAthenaHost(hostname) {
+  return hostname === "athenaintel.com" || hostname.endsWith(".athenaintel.com");
+}
+function isTrustedParentOrigin({
   origin,
   trustedOrigins
 }) {
@@ -10,11 +21,37 @@ function isTrustedOrigin({
       return true;
     }
     const { hostname } = new URL(normalizedOrigin);
-    return hostname === "athenaintel.com" || hostname.endsWith(".athenaintel.com") || hostname === "localhost";
+    if (isCustomerAppHost(hostname)) {
+      return false;
+    }
+    return isAthenaHost(hostname) || hostname === "localhost";
   } catch {
     return false;
   }
 }
+function refuseBridgeUrl({
+  url,
+  parentOrigin
+}) {
+  let parsed;
+  let parentHostname;
+  try {
+    parsed = new URL(url);
+    parentHostname = new URL(parentOrigin).hostname;
+  } catch {
+    return "invalid";
+  }
+  if (parsed.username || parsed.password) return "invalid";
+  const { hostname } = parsed;
+  const loopbackPair = isLoopbackHost(hostname) && isLoopbackHost(parentHostname);
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopbackPair)) {
+    return "insecure";
+  }
+  if (isCustomerAppHost(hostname)) return "customer_app_host";
+  if (loopbackPair || isAthenaHost(hostname)) return null;
+  if (isAthenaHost(parentHostname) || isLoopbackHost(parentHostname)) return "other_domain";
+  return hostname === parentHostname || hostname.endsWith(`.${parentHostname}`) ? null : "other_domain";
+}
 const BRIDGE_URL_FIELDS = ["statewireSyncUrl", "backendBaseUrl", "appUrl"];
 const EMPTY_BRIDGE_URLS = {
   statewireSyncUrl: null,
@@ -35,16 +72,51 @@ function mergeBridgeConfigMessage(previous, payload) {
   }
   return next;
 }
+function acceptBridgeConfigMessage({
+  previous,
+  payload,
+  parentOrigin,
+  locked = false
+}) {
+  const urls = {
+    statewireSyncUrl: previous.statewireSyncUrl,
+    backendBaseUrl: previous.backendBaseUrl,
+    appUrl: previous.appUrl
+  };
+  const rejected = [];
+  for (const field of BRIDGE_URL_FIELDS) {
+    const value = payload[field];
+    if (typeof value !== "string") continue;
+    const held = previous[field];
+    if (locked || held !== null) {
+      if (held !== value) rejected.push({ field, reason: "changed" });
+      continue;
+    }
+    const refusal = refuseBridgeUrl({ url: value, parentOrigin });
+    if (refusal !== null) {
+      rejected.push({ field, reason: refusal });
+      continue;
+    }
+    urls[field] = value;
+  }
+  return { urls, rejected };
+}
 function readAuthMintUrls(data) {
   return mergeBridgeConfigMessage(EMPTY_BRIDGE_URLS, data);
 }
 const BRIDGE_TIMEOUT_MS = 2e3;
 const PARENT_TOKEN_RENEWAL_TIMEOUT_MS = 5e3;
 const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-const TOKEN_REFRESH_RETRY_BASE_MS = 60 * 1e3;
-const TOKEN_REFRESH_RETRY_MAX_MS = 5 * 60 * 1e3;
+const TOKEN_REFRESH_MIN_DELAY_MS = 60 * 1e3;
 const DEFAULT_TOKEN_REFRESH_MS = 55 * 60 * 1e3;
 const EMPTY_TRUSTED_ORIGINS = [];
+const DEFAULT_MINT_RETRY_POLICY = {
+  maxAttempts: 4,
+  baseDelayMs: 500,
+  maxDelayMs: 4e3,
+  timeoutMs: BRIDGE_TIMEOUT_MS,
+  random: Math.random
+};
 const normalizeOrigin = (value) => {
   try {
     return new URL(value).origin;
@@ -60,14 +132,74 @@ const getTokenRefreshDelay = (expiresAt, nowMs) => {
   if (!Number.isFinite(expiresAtMs)) {
     return DEFAULT_TOKEN_REFRESH_MS;
   }
-  return Math.max(TOKEN_REFRESH_RETRY_BASE_MS, expiresAtMs - nowMs - TOKEN_REFRESH_BUFFER_MS);
-};
-const getAuthRetryDelay = (retryAttempt) => {
-  const safeAttempt = Number.isFinite(retryAttempt) ? Math.max(0, Math.floor(retryAttempt)) : 0;
-  return Math.min(TOKEN_REFRESH_RETRY_MAX_MS, TOKEN_REFRESH_RETRY_BASE_MS * 2 ** safeAttempt);
+  return Math.max(TOKEN_REFRESH_MIN_DELAY_MS, expiresAtMs - nowMs - TOKEN_REFRESH_BUFFER_MS);
 };
+function getMintRetryDelay({
+  retry,
+  policy = DEFAULT_MINT_RETRY_POLICY
+}) {
+  const safeRetry = Number.isFinite(retry) ? Math.max(1, Math.floor(retry)) : 1;
+  const ceiling = Math.min(policy.maxDelayMs, policy.baseDelayMs * 2 ** (safeRetry - 1));
+  const jitter = Math.min(1, Math.max(0, policy.random()));
+  return Math.round(ceiling / 2 + ceiling / 2 * jitter);
+}
+function isRetryableMintStatus(status) {
+  return status >= 500 || status === 408 || status === 429;
+}
+async function readHostError(resp) {
+  try {
+    const body = await resp.json();
+    if (body && typeof body === "object" && "error" in body) {
+      const value = body.error;
+      return typeof value === "string" ? value.slice(0, 100) : null;
+    }
+  } catch {
+  }
+  return null;
+}
+const MINT_RETRY_NOTE = "The SDK stopped retrying and does not connect without a credential. Remount the provider, or call renewToken({ force: true }), to try again.";
+function mintFailureHint(failure) {
+  if (failure.kind === "transient") {
+    return `The host could not mint a viewer token. Check the Marathon and Agora logs. ${MINT_RETRY_NOTE}`;
+  }
+  if (failure.reason === "invalid_body") {
+    return `The host answered /_athena/auth without a JSON mint body, so this origin is not a Marathon bridge. Pass token, getToken or apiKey. ${MINT_RETRY_NOTE}`;
+  }
+  if (failure.status === 401) {
+    return `The host has no session for this viewer. Sign in again through the app URL. ${MINT_RETRY_NOTE}`;
+  }
+  if (failure.status === 403) {
+    return `The host does not give this viewer access to the app. ${MINT_RETRY_NOTE}`;
+  }
+  return `The host refused the mint request. ${MINT_RETRY_NOTE}`;
+}
+function mintFailureError({
+  failure,
+  attempts,
+  phase
+}) {
+  const timedOut = failure.kind === "transient" && failure.reason === "timeout";
+  const answer = failure.status !== null ? `HTTP ${failure.status}` : timedOut ? "a timeout" : "a network error";
+  const message = failure.kind === "transient" ? `The host auth bridge (/_athena/auth) failed ${attempts} time${attempts === 1 ? "" : "s"} (last: ${answer}).` : failure.reason === "invalid_body" ? `The host auth bridge (/_athena/auth) answered ${answer} without a JSON mint body.` : `The host auth bridge (/_athena/auth) refused the mint (${answer}).`;
+  return new AthenaSdkError({
+    code: timedOut ? "auth_bridge_timeout" : "auth_bridge_failed",
+    message,
+    hint: mintFailureHint(failure),
+    ...failure.status !== null && { status: failure.status },
+    ...failure.hostError !== null && { detail: { code: failure.hostError } },
+    ...failure.kind === "transient" && failure.cause !== void 0 && { cause: failure.cause },
+    context: {
+      mode: "marathon",
+      phase,
+      attempts,
+      reason: failure.reason,
+      host_error: failure.hostError
+    }
+  });
+}
 function useParentBridge({
-  trustedOrigins = EMPTY_TRUSTED_ORIGINS
+  trustedOrigins = EMPTY_TRUSTED_ORIGINS,
+  mintRetryPolicy = DEFAULT_MINT_RETRY_POLICY
 } = {}) {
   const isInIframe = typeof window !== "undefined" && window.parent !== window;
   const runtimeTrustedOrigins = useMemo(() => {
@@ -87,10 +219,14 @@ function useParentBridge({
     token: null,
     ...EMPTY_BRIDGE_URLS,
     hostAnswered: false,
-    ready: false
+    ready: false,
+    error: null
   });
+  const mintRetryPolicyRef = useRef(mintRetryPolicy);
+  mintRetryPolicyRef.current = mintRetryPolicy;
   const readySignalSent = useRef(false);
   const configReceived = useRef(false);
+  const parentUrlsRef = useRef(EMPTY_BRIDGE_URLS);
   const tokenRef = useRef(state.token);
   tokenRef.current = state.token;
   const renewerRef = useRef(null);
@@ -107,15 +243,29 @@ function useParentBridge({
     };
     const tokenWaiters = /* @__PURE__ */ new Set();
     const handler = (event) => {
-      if (!isTrustedOrigin({ origin: event.origin, trustedOrigins: runtimeTrustedOrigins })) {
+      if (event.source !== window.parent) return;
+      if (!isTrustedParentOrigin({ origin: event.origin, trustedOrigins: runtimeTrustedOrigins })) {
         return;
       }
       if (!event.data || typeof event.data !== "object") return;
       if (event.data.type === "athena-config") {
+        const { urls, rejected } = acceptBridgeConfigMessage({
+          previous: parentUrlsRef.current,
+          payload: event.data,
+          parentOrigin: event.origin,
+          locked: configReceived.current
+        });
         configReceived.current = true;
+        parentUrlsRef.current = urls;
+        for (const { field, reason } of rejected) {
+          athenaDiagnostics.emit("auth.bridge.config_rejected", {
+            level: "warn",
+            data: { mode: "iframe", field, reason }
+          });
+        }
         setState((prev) => ({
           ...prev,
-          ...mergeBridgeConfigMessage(prev, event.data),
+          ...urls,
           hostAnswered: true
           // Don't set ready here — wait for athena-auth (token) or the timeout.
           // Setting ready on config alone causes a race: the thread list fires
@@ -179,147 +329,189 @@ function useParentBridge({
     let refreshTimer = null;
     let controller = null;
     let inFlight = null;
-    let retryAttempt = 0;
+    let retryWait = null;
     const clearRefreshTimer = () => {
       if (refreshTimer) {
         clearTimeout(refreshTimer);
         refreshTimer = null;
       }
     };
-    const markReady = () => {
-      if (cancelled) return;
-      setState((prev) => prev.ready ? prev : { ...prev, ready: true });
+    const endRetryWait = () => {
+      if (!retryWait) return;
+      clearTimeout(retryWait.timer);
+      const { resolve } = retryWait;
+      retryWait = null;
+      resolve();
     };
+    const waitBeforeRetry = (delayMs) => new Promise((resolve) => {
+      retryWait = { timer: setTimeout(endRetryWait, delayMs), resolve };
+    });
     const scheduleRefresh = (expiresAt) => {
       clearRefreshTimer();
-      retryAttempt = 0;
       const delay = getTokenRefreshDelay(expiresAt, Date.now());
       refreshTimer = setTimeout(() => {
-        void fetchAuth({ markReadyOnFailure: false });
-      }, delay);
-    };
-    const scheduleRetry = () => {
-      clearRefreshTimer();
-      const delay = getAuthRetryDelay(retryAttempt);
-      retryAttempt += 1;
-      refreshTimer = setTimeout(() => {
-        void fetchAuth({ markReadyOnFailure: false });
+        refreshTimer = null;
+        void fetchAuth({ initial: false });
       }, delay);
     };
-    const mintAuth = async ({
-      markReadyOnFailure
-    }) => {
+    const mintOnce = async (timeoutMs) => {
       const requestController = new AbortController();
       controller = requestController;
-      const isInitial = markReadyOnFailure;
-      const rawEndSpan = isInitial ? athenaDiagnostics.span("auth.bridge", "auth.bridge.start", { mode: "marathon" }) : null;
-      let spanEnded = false;
-      const endBridgeSpan = rawEndSpan ? (name, options) => {
-        if (spanEnded) return 0;
-        spanEnded = true;
-        return rawEndSpan(name, options);
-      } : null;
+      let timedOut = false;
       const requestTimer = setTimeout(() => {
+        timedOut = true;
         requestController.abort();
-        endBridgeSpan == null ? void 0 : endBridgeSpan("auth.bridge.timeout", {
-          data: { mode: "marathon", timeout_ms: BRIDGE_TIMEOUT_MS }
-        });
-        if (markReadyOnFailure) {
-          markReady();
-        }
-      }, BRIDGE_TIMEOUT_MS);
+      }, timeoutMs);
       try {
         const resp = await fetch("/_athena/auth", {
           credentials: "include",
           headers: { Accept: "application/json" },
           signal: requestController.signal
         });
-        if (cancelled) return null;
+        if (cancelled) return { kind: "cancelled" };
+        if (resp.status === 404) return { kind: "absent", status: resp.status };
         if (!resp.ok) {
-          if (resp.status === 404) {
-            endBridgeSpan == null ? void 0 : endBridgeSpan("auth.bridge.absent", {
-              data: { mode: "marathon", status: resp.status }
-            });
-            markReady();
-          } else {
-            const failure = {
-              level: "warn",
-              data: { mode: "marathon", status: resp.status }
-            };
-            if (endBridgeSpan) {
-              endBridgeSpan("auth.bridge.error", failure);
-            } else {
-              athenaDiagnostics.emit("auth.token.refresh_failed", failure);
-            }
-            if (markReadyOnFailure) {
-              markReady();
-            }
-            scheduleRetry();
+          const hostError = await readHostError(resp);
+          if (cancelled) return { kind: "cancelled" };
+          if (timedOut && isRetryableMintStatus(resp.status)) {
+            return { kind: "transient", status: null, reason: "timeout", hostError: null };
           }
-          return null;
-        }
-        const data = await resp.json();
-        if (cancelled) return null;
-        if (endBridgeSpan) {
-          endBridgeSpan("auth.bridge.ready", {
-            data: { mode: "marathon", has_token: typeof data.token === "string" }
-          });
-          athenaDiagnostics.emit("auth.token.acquired", {
-            level: "debug",
-            data: { source: "marathon", expires_at: data.expires_at }
-          });
-        } else {
-          athenaDiagnostics.emit("auth.token.refreshed", {
-            level: "debug",
-            data: { source: "marathon", expires_at: data.expires_at }
-          });
+          return isRetryableMintStatus(resp.status) ? { kind: "transient", status: resp.status, reason: "status", hostError } : { kind: "refused", status: resp.status, reason: "status", hostError };
         }
-        const token = typeof data.token === "string" ? data.token : null;
-        setState({
-          token,
-          ...readAuthMintUrls(data),
-          hostAnswered: true,
-          ready: true
-        });
-        tokenRef.current = token;
-        scheduleRefresh(data.expires_at);
-        return token;
-      } catch (error) {
-        if (!cancelled && !(error instanceof DOMException && error.name === "AbortError")) {
-          const failure = { level: "warn", data: { mode: "marathon" }, error };
-          if (endBridgeSpan) {
-            endBridgeSpan("auth.bridge.error", failure);
-          } else {
-            athenaDiagnostics.emit("auth.token.refresh_failed", failure);
+        let data;
+        try {
+          data = await resp.json();
+        } catch (error) {
+          if (cancelled) return { kind: "cancelled" };
+          if (timedOut) {
+            return { kind: "transient", status: null, reason: "timeout", hostError: null, cause: error };
           }
+          return { kind: "refused", status: resp.status, reason: "invalid_body", hostError: null };
         }
-        if (markReadyOnFailure) {
-          markReady();
+        if (cancelled) return { kind: "cancelled" };
+        const token = data && typeof data === "object" ? data.token : null;
+        if (typeof token !== "string" || token === "") {
+          return { kind: "refused", status: resp.status, reason: "invalid_body", hostError: null };
         }
-        if (!cancelled) {
-          scheduleRetry();
+        return { kind: "minted", data };
+      } catch (error) {
+        if (cancelled) return { kind: "cancelled" };
+        if (timedOut) {
+          return { kind: "transient", status: null, reason: "timeout", hostError: null, cause: error };
         }
-        return null;
+        return { kind: "transient", status: null, reason: "network", hostError: null, cause: error };
       } finally {
         clearTimeout(requestTimer);
         if (controller === requestController) controller = null;
       }
     };
+    const runMintCycle = async ({ initial }) => {
+      const policy = mintRetryPolicyRef.current;
+      const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));
+      const phase = initial ? "initial" : "renewal";
+      const endBridgeSpan = initial ? athenaDiagnostics.span("auth.bridge", "auth.bridge.start", { mode: "marathon" }) : null;
+      let attempts = 0;
+      let lastFailure = null;
+      while (attempts < maxAttempts) {
+        attempts += 1;
+        const outcome = await mintOnce(policy.timeoutMs);
+        if (cancelled || outcome.kind === "cancelled") return null;
+        if (outcome.kind === "absent") {
+          endBridgeSpan == null ? void 0 : endBridgeSpan("auth.bridge.absent", {
+            data: { mode: "marathon", status: outcome.status }
+          });
+          setState(
+            (prev) => prev.ready && prev.error == null ? prev : { ...prev, ready: true, error: null }
+          );
+          return null;
+        }
+        if (outcome.kind === "minted") {
+          const { data } = outcome;
+          if (endBridgeSpan) {
+            endBridgeSpan("auth.bridge.ready", {
+              data: { mode: "marathon", has_token: typeof data.token === "string", attempts }
+            });
+            athenaDiagnostics.emit("auth.token.acquired", {
+              level: "debug",
+              data: { source: "marathon", expires_at: data.expires_at }
+            });
+          } else {
+            athenaDiagnostics.emit("auth.token.refreshed", {
+              level: "debug",
+              data: { source: "marathon", expires_at: data.expires_at, attempts }
+            });
+          }
+          const token = typeof data.token === "string" ? data.token : null;
+          setState({
+            token,
+            ...readAuthMintUrls(data),
+            hostAnswered: true,
+            ready: true,
+            error: null
+          });
+          tokenRef.current = token;
+          scheduleRefresh(data.expires_at);
+          return token;
+        }
+        lastFailure = outcome;
+        if (outcome.kind === "refused" || attempts >= maxAttempts) break;
+        const delayMs = getMintRetryDelay({ retry: attempts, policy });
+        athenaDiagnostics.emit("auth.bridge.retry", {
+          level: "warn",
+          data: {
+            mode: "marathon",
+            phase,
+            status: outcome.status,
+            reason: outcome.reason,
+            host_error: outcome.hostError,
+            attempt: attempts,
+            max_attempts: maxAttempts,
+            delay_ms: delayMs
+          }
+        });
+        await waitBeforeRetry(delayMs);
+        if (cancelled) return null;
+      }
+      if (!lastFailure) return null;
+      const error = mintFailureError({ failure: lastFailure, attempts, phase });
+      const failureData = {
+        mode: "marathon",
+        phase,
+        status: lastFailure.status,
+        reason: lastFailure.reason,
+        attempts
+      };
+      if (endBridgeSpan) {
+        endBridgeSpan(
+          error.code === "auth_bridge_timeout" ? "auth.bridge.timeout" : "auth.bridge.error",
+          { data: failureData, error }
+        );
+      } else {
+        athenaDiagnostics.emit("auth.token.refresh_failed", {
+          level: "error",
+          data: failureData,
+          error
+        });
+      }
+      setState((prev) => ({ ...prev, error, ready: true }));
+      return null;
+    };
     const fetchAuth = (options) => {
-      inFlight ?? (inFlight = mintAuth(options).finally(() => {
+      inFlight ?? (inFlight = runMintCycle(options).finally(() => {
         inFlight = null;
       }));
       return inFlight;
     };
     renewerRef.current = ({ force }) => {
       if (!force) return Promise.resolve(tokenRef.current);
-      return fetchAuth({ markReadyOnFailure: false }).then((token) => token ?? tokenRef.current);
+      return fetchAuth({ initial: false }).then((token) => token ?? tokenRef.current);
     };
-    void fetchAuth({ markReadyOnFailure: true });
+    void fetchAuth({ initial: true });
     return () => {
       cancelled = true;
       controller == null ? void 0 : controller.abort();
       clearRefreshTimer();
+      endRetryWait();
       renewerRef.current = null;
     };
   }, [isInIframe]);
@@ -336,10 +528,17 @@ function useParentAuth() {
   return useParentBridge().token;
 }
 export {
-  getAuthRetryDelay,
+  DEFAULT_MINT_RETRY_POLICY,
+  acceptBridgeConfigMessage,
+  getMintRetryDelay,
   getTokenRefreshDelay,
+  isCustomerAppHost,
+  isRetryableMintStatus,
+  isTrustedParentOrigin,
   mergeBridgeConfigMessage,
+  mintFailureError,
   readAuthMintUrls,
+  refuseBridgeUrl,
   useParentAuth,
   useParentBridge
 };