@aurabase/auth 0.4.0 → 0.4.1

package/README.md

@@ -48,7 +48,10 @@ const refreshed = await aura.auth.refreshSession()
 await aura.auth.setSession('stored-access-token', 'stored-refresh-token')
 
 const sessions = await aura.auth.listSessions()
-await aura.auth.revokeSession(sessions.data![0].id)
+// `data` peut être `null` même en succès (204 / corps vide) : on le teste plutôt
+// que `error`, ce qui évite l'assertion `!` et fait narrower TypeScript.
+const first = sessions.data?.[0]
+if (first) await aura.auth.revokeSession(first.id)
 await aura.auth.revokeAllSessions()
 ```
 
@@ -64,9 +67,10 @@ const { data, error } = await aura.auth.signInWithOAuth('github', {
 })
 
 if (error) throw error
+if (!data) throw new Error("aucune URL de redirection renvoyée")
 
-// Côté serveur / SSR : pas de redirection automatique, il faut rediriger manuellement vers data!.url
-console.log(data!.url)
+// Côté serveur / SSR : pas de redirection automatique, il faut rediriger manuellement vers data.url
+console.log(data.url)
 ```
 
 Retour du provider (flux PKCE) :

package/dist/index.cjs

@@ -116,14 +116,30 @@ function parseMaxAge(cc) {
   const m = cc?.match(/max-age=(\d+)/);
   return m ? Number(m[1]) * 1e3 : null;
 }
-function fetchJwksDeduped(state, fetchFn, baseUrl) {
+function fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs) {
   const existing = state.inflight.get(baseUrl);
   if (existing) return existing;
   const p = (async () => {
+    let timer;
+    let bodyTimer;
     try {
-      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`);
+      let signal;
+      if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+        const ctrl = new AbortController();
+        timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        timer.unref?.();
+        signal = ctrl.signal;
+      }
+      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`, signal ? { signal } : {});
       if (!res.ok) throw new Error("jwks_fetch_failed");
-      const body = await res.json();
+      const body = await Promise.race([
+        res.json(),
+        new Promise((_resolve, reject) => {
+          if (!(timeoutMs > 0)) return;
+          bodyTimer = setTimeout(() => reject(new Error("jwks_body_timeout")), timeoutMs);
+          bodyTimer.unref?.();
+        })
+      ]);
       const parsed = parseMaxAge(res.headers.get("Cache-Control")) ?? DEFAULT_MAX_AGE_MS;
       const maxAge = Math.min(parsed, MAX_AGE_CAP_MS);
       const keys = body.keys ?? [];
@@ -133,12 +149,15 @@ function fetchJwksDeduped(state, fetchFn, baseUrl) {
     } catch {
       state.lastFailedAt.set(baseUrl, Date.now());
       throw new Error("jwks_fetch_failed");
+    } finally {
+      if (timer) clearTimeout(timer);
+      if (bodyTimer) clearTimeout(bodyTimer);
     }
   })().finally(() => state.inflight.delete(baseUrl));
   state.inflight.set(baseUrl, p);
   return p;
 }
-async function loadJwks(state, fetchFn, baseUrl) {
+async function loadJwks(state, fetchFn, baseUrl, timeoutMs) {
   const now = Date.now();
   const c = state.cache.get(baseUrl);
   if (c && now - c.fetchedAt < c.maxAgeMs) return c.keys;
@@ -146,9 +165,9 @@ async function loadJwks(state, fetchFn, baseUrl) {
   if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
     throw new Error("jwks_fetch_failed");
   }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
+  return fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs);
 }
-async function forcedRefetchJwks(state, fetchFn, baseUrl) {
+async function forcedRefetchJwks(state, fetchFn, baseUrl, timeoutMs) {
   const now = Date.now();
   const last = state.lastForcedFetchAt.get(baseUrl);
   if (last !== void 0 && now - last < FORCED_REFETCH_COOLDOWN_MS) return null;
@@ -157,7 +176,7 @@ async function forcedRefetchJwks(state, fetchFn, baseUrl) {
   if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
     throw new Error("jwks_fetch_failed");
   }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
+  return fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs);
 }
 function algParams(alg) {
   if (alg === "RS256") {
@@ -184,11 +203,12 @@ async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
   const params = algParams(d.header.alg);
   if (!params) return { ok: false, code: "unsupported_alg" };
   const state = stateFor(scope);
+  const timeoutMs = opts.timeoutMs ?? 0;
   const matchesAlg = (k) => d.header.alg === "RS256" ? k.kty === "RSA" : k.kty === "EC";
   const candidateKeys = (keys2) => d.header.kid ? keys2.filter((k) => k.kid === d.header.kid && matchesAlg(k)) : keys2.filter((k) => matchesAlg(k));
   let keys;
   try {
-    keys = await loadJwks(state, fetchFn, baseUrl);
+    keys = await loadJwks(state, fetchFn, baseUrl, timeoutMs);
   } catch {
     try {
       opts.onEvent?.(baseUrl);
@@ -200,7 +220,7 @@ async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
   if (candidates.length === 0 && d.header.kid) {
     let refetched;
     try {
-      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl);
+      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl, timeoutMs);
     } catch {
       try {
         opts.onEvent?.(baseUrl);
@@ -766,7 +786,11 @@ var AuthService = class extends core.BaseService {
       allowExpired: options?.allowExpired,
       // LOT 3 (I8) : relie le callback générique de jwks.ts au hook d'observabilité
       // du client (onEvent/debug). jwks.ts reste sans dépendance vers @aurabase/core.
-      onEvent: (baseUrl) => core.emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl })
+      onEvent: (baseUrl) => core.emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl }),
+      // P2-1 : borne le fetch JWKS (et la lecture de son corps) sur le même
+      // budget que les autres requêtes du client. Sans elle, un serveur JWKS
+      // muet figeait `getClaims` définitivement (single-flight `inflight`).
+      timeoutMs: this.client.requestTimeoutMs ?? core.DEFAULT_REQUEST_TIMEOUT_MS
     });
     const checkIssAud = (c) => {
       if (options?.issuer !== void 0 && c.iss !== options.issuer) {
@@ -839,6 +863,17 @@ var AuthService = class extends core.BaseService {
           error: null
         };
       }
+      if (u.error === null) {
+        return {
+          data: null,
+          error: new core.AuraError(0, {
+            error: {
+              code: "invalid_response",
+              message: "getClaims: la validation serveur du token (getUser) a r\xE9pondu sans contenu \u2014 claims ind\xE9terminables"
+            }
+          })
+        };
+      }
       return { data: null, error: u.error };
     }
     return {

package/dist/index.js

@@ -1,4 +1,4 @@
-import { BaseService, isTokenExpired, AuraError, refreshOnce, emitAuraEvent } from '@aurabase/core';
+import { BaseService, isTokenExpired, AuraError, refreshOnce, DEFAULT_REQUEST_TIMEOUT_MS, emitAuraEvent } from '@aurabase/core';
 
 // src/AuthService.ts
 
@@ -114,14 +114,30 @@ function parseMaxAge(cc) {
   const m = cc?.match(/max-age=(\d+)/);
   return m ? Number(m[1]) * 1e3 : null;
 }
-function fetchJwksDeduped(state, fetchFn, baseUrl) {
+function fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs) {
   const existing = state.inflight.get(baseUrl);
   if (existing) return existing;
   const p = (async () => {
+    let timer;
+    let bodyTimer;
     try {
-      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`);
+      let signal;
+      if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+        const ctrl = new AbortController();
+        timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        timer.unref?.();
+        signal = ctrl.signal;
+      }
+      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`, signal ? { signal } : {});
       if (!res.ok) throw new Error("jwks_fetch_failed");
-      const body = await res.json();
+      const body = await Promise.race([
+        res.json(),
+        new Promise((_resolve, reject) => {
+          if (!(timeoutMs > 0)) return;
+          bodyTimer = setTimeout(() => reject(new Error("jwks_body_timeout")), timeoutMs);
+          bodyTimer.unref?.();
+        })
+      ]);
       const parsed = parseMaxAge(res.headers.get("Cache-Control")) ?? DEFAULT_MAX_AGE_MS;
       const maxAge = Math.min(parsed, MAX_AGE_CAP_MS);
       const keys = body.keys ?? [];
@@ -131,12 +147,15 @@ function fetchJwksDeduped(state, fetchFn, baseUrl) {
     } catch {
       state.lastFailedAt.set(baseUrl, Date.now());
       throw new Error("jwks_fetch_failed");
+    } finally {
+      if (timer) clearTimeout(timer);
+      if (bodyTimer) clearTimeout(bodyTimer);
     }
   })().finally(() => state.inflight.delete(baseUrl));
   state.inflight.set(baseUrl, p);
   return p;
 }
-async function loadJwks(state, fetchFn, baseUrl) {
+async function loadJwks(state, fetchFn, baseUrl, timeoutMs) {
   const now = Date.now();
   const c = state.cache.get(baseUrl);
   if (c && now - c.fetchedAt < c.maxAgeMs) return c.keys;
@@ -144,9 +163,9 @@ async function loadJwks(state, fetchFn, baseUrl) {
   if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
     throw new Error("jwks_fetch_failed");
   }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
+  return fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs);
 }
-async function forcedRefetchJwks(state, fetchFn, baseUrl) {
+async function forcedRefetchJwks(state, fetchFn, baseUrl, timeoutMs) {
   const now = Date.now();
   const last = state.lastForcedFetchAt.get(baseUrl);
   if (last !== void 0 && now - last < FORCED_REFETCH_COOLDOWN_MS) return null;
@@ -155,7 +174,7 @@ async function forcedRefetchJwks(state, fetchFn, baseUrl) {
   if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
     throw new Error("jwks_fetch_failed");
   }
-  return fetchJwksDeduped(state, fetchFn, baseUrl);
+  return fetchJwksDeduped(state, fetchFn, baseUrl, timeoutMs);
 }
 function algParams(alg) {
   if (alg === "RS256") {
@@ -182,11 +201,12 @@ async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
   const params = algParams(d.header.alg);
   if (!params) return { ok: false, code: "unsupported_alg" };
   const state = stateFor(scope);
+  const timeoutMs = opts.timeoutMs ?? 0;
   const matchesAlg = (k) => d.header.alg === "RS256" ? k.kty === "RSA" : k.kty === "EC";
   const candidateKeys = (keys2) => d.header.kid ? keys2.filter((k) => k.kid === d.header.kid && matchesAlg(k)) : keys2.filter((k) => matchesAlg(k));
   let keys;
   try {
-    keys = await loadJwks(state, fetchFn, baseUrl);
+    keys = await loadJwks(state, fetchFn, baseUrl, timeoutMs);
   } catch {
     try {
       opts.onEvent?.(baseUrl);
@@ -198,7 +218,7 @@ async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
   if (candidates.length === 0 && d.header.kid) {
     let refetched;
     try {
-      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl);
+      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl, timeoutMs);
     } catch {
       try {
         opts.onEvent?.(baseUrl);
@@ -764,7 +784,11 @@ var AuthService = class extends BaseService {
       allowExpired: options?.allowExpired,
       // LOT 3 (I8) : relie le callback générique de jwks.ts au hook d'observabilité
       // du client (onEvent/debug). jwks.ts reste sans dépendance vers @aurabase/core.
-      onEvent: (baseUrl) => emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl })
+      onEvent: (baseUrl) => emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl }),
+      // P2-1 : borne le fetch JWKS (et la lecture de son corps) sur le même
+      // budget que les autres requêtes du client. Sans elle, un serveur JWKS
+      // muet figeait `getClaims` définitivement (single-flight `inflight`).
+      timeoutMs: this.client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS
     });
     const checkIssAud = (c) => {
       if (options?.issuer !== void 0 && c.iss !== options.issuer) {
@@ -837,6 +861,17 @@ var AuthService = class extends BaseService {
           error: null
         };
       }
+      if (u.error === null) {
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "invalid_response",
+              message: "getClaims: la validation serveur du token (getUser) a r\xE9pondu sans contenu \u2014 claims ind\xE9terminables"
+            }
+          })
+        };
+      }
       return { data: null, error: u.error };
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/auth",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Service d'authentification du SDK Aurabase (sessions, OAuth/PKCE, MFA, magic link, OTP, admin)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -46,9 +46,10 @@
     "authentication"
   ],
   "dependencies": {
-    "@aurabase/core": "0.4.0"
+    "@aurabase/core": "0.4.1"
   },
   "devDependencies": {
+    "@types/node": "20.14.15",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.1.6"
@@ -56,6 +57,7 @@
   "scripts": {
     "build": "tsup",
     "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json"
   }
 }