@biffo/cli 0.168.2 → 0.168.4

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.ts

@@ -4,6 +4,7 @@ import {
   type ICognitoUserPoolData,
 } from 'amazon-cognito-identity-js'
 
+import { pruneForeignCognitoCredentials } from './cognito-hygiene'
 import { resolveCoreIdentity } from './identity'
 
 // ---------------------------------------------------------------------------
@@ -60,6 +61,12 @@ async function getUserPool(): Promise<CognitoUserPool | null> {
   const identity = await resolveCoreIdentity()
   if (!identity) return null
 
+  // Once per page load, and only with a resolved client id: drop credentials
+  // left behind by pools this deployment no longer uses (biffo-template#834).
+  // Cheap, and it keeps the shared origin from accumulating dead tokens for
+  // every pool the portal has ever pointed at.
+  pruneForeignCognitoCredentials(identity.clientId)
+
   const poolData: ICognitoUserPoolData = {
     UserPoolId: identity.userPoolId,
     ClientId: identity.clientId,

package/_skeletons/sibling-template/apps/frontend/src/lib/cognito-hygiene.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+
+import { pruneForeignCognitoCredentials } from './cognito-hygiene'
+
+/**
+ * A minimal Storage over a Map — enough for the length/key/removeItem trio the
+ * implementation uses. Backed by a Map rather than a plain object so the fake
+ * needs no dynamic `delete` (banned by @typescript-eslint/no-dynamic-delete,
+ * which `next build`'s lint enforces and a bare `pnpm run lint` does not).
+ */
+function fakeStorage(entries: Record<string, string>): Storage {
+  const map = new Map(Object.entries(entries))
+  return {
+    get length() {
+      return map.size
+    },
+    clear: () => {
+      map.clear()
+    },
+    getItem: (k: string) => map.get(k) ?? null,
+    key: (i: number) => [...map.keys()][i] ?? null,
+    removeItem: (k: string) => {
+      map.delete(k)
+    },
+    setItem: (k: string, v: string) => {
+      map.set(k, v)
+    },
+  }
+}
+
+const LIVE = '1ccelkl84t2o4euir3op3nco5j'
+
+describe('pruneForeignCognitoCredentials', () => {
+  it('removes credentials belonging to other client ids', () => {
+    const storage = fakeStorage({
+      [`CognitoIdentityServiceProvider.${LIVE}.someone.idToken`]: 'keep',
+      [`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`]: 'keep',
+      'CognitoIdentityServiceProvider.5vjn6648jtcsguaodtn786lsi6.someone.idToken': 'dead',
+      'CognitoIdentityServiceProvider.5vjn6648jtcsguaodtn786lsi6.LastAuthUser': 'dead',
+      'CognitoIdentityServiceProvider.2tvepqhn2j4aje4uqvu9fiu1ge.someone.accessToken': 'dead',
+    })
+
+    const removed = pruneForeignCognitoCredentials(LIVE, storage)
+
+    expect(removed).toHaveLength(3)
+    expect(storage.length).toBe(2)
+    expect(storage.getItem(`CognitoIdentityServiceProvider.${LIVE}.someone.idToken`)).toBe('keep')
+    expect(storage.getItem(`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`)).toBe('keep')
+    expect(
+      storage.getItem('CognitoIdentityServiceProvider.5vjn6648jtcsguaodtn786lsi6.LastAuthUser'),
+    ).toBeNull()
+  })
+
+  it('leaves unrelated keys alone', () => {
+    const storage = fakeStorage({
+      theme: 'dark',
+      'amplify-signin-with-hostedUI': 'false',
+      [`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`]: 'keep',
+      'CognitoIdentityServiceProvider.dead.LastAuthUser': 'dead',
+    })
+
+    pruneForeignCognitoCredentials(LIVE, storage)
+
+    expect(storage.getItem('theme')).toBe('dark')
+    expect(storage.getItem('amplify-signin-with-hostedUI')).toBe('false')
+  })
+
+  it('does nothing when the client id is unresolved', () => {
+    // The dangerous case: treating "no identity" as "nothing matches" would
+    // delete the live session along with the residue.
+    const storage = fakeStorage({
+      [`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`]: 'keep',
+      'CognitoIdentityServiceProvider.dead.LastAuthUser': 'dead',
+    })
+
+    expect(pruneForeignCognitoCredentials(null, storage)).toEqual([])
+    expect(pruneForeignCognitoCredentials('', storage)).toEqual([])
+    expect(storage.getItem(`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`)).toBe('keep')
+    expect(storage.getItem('CognitoIdentityServiceProvider.dead.LastAuthUser')).toBe('dead')
+  })
+
+  it('is a no-op without storage, so a Node prerender cannot crash on it', () => {
+    expect(pruneForeignCognitoCredentials(LIVE, undefined)).toEqual([])
+  })
+
+  it('removes every key of a stale client, not just the first', () => {
+    // removeItem() mutates the live key set; index-based iteration would skip
+    // entries as it shrinks and leave half the residue behind.
+    const entries: Record<string, string> = {
+      [`CognitoIdentityServiceProvider.${LIVE}.LastAuthUser`]: 'keep',
+    }
+    for (let i = 0; i < 12; i++) entries[`CognitoIdentityServiceProvider.dead.k${String(i)}`] = 'x'
+    const storage = fakeStorage(entries)
+
+    expect(pruneForeignCognitoCredentials(LIVE, storage)).toHaveLength(12)
+    expect(storage.getItem('CognitoIdentityServiceProvider.dead.k11')).toBeNull()
+  })
+})

package/_skeletons/sibling-template/apps/frontend/src/lib/cognito-hygiene.ts

@@ -0,0 +1,60 @@
+// Removing Cognito credentials belonging to pools this deployment no longer uses.
+//
+// `amazon-cognito-identity-js` stores tokens under keys shaped
+// `CognitoIdentityServiceProvider.<ClientId>.<username>.<tokenType>` and reads
+// them back scoped by Client ID. Replacing a user pool therefore does not clear
+// the old one's keys: they are simply never read again, and they accumulate for
+// as long as the browser profile lives. `dev.biffo.io` was measured carrying
+// four pools' credentials — three of them dead — where AWS has one pool and one
+// client (biffo-template#834).
+//
+// What this is NOT: a fix for a wrong-identity read. Because every consumer
+// resolves its pool from the runtime identity document (#403) and lets
+// amazon-cognito-identity-js scope the lookup by Client ID, a stale pool's
+// tokens are never enumerated and never selected. That claim was made and
+// withdrawn on #834.
+//
+// What it IS: dead bearer tokens for real identities should not sit in browser
+// storage forever, and any future code that enumerates
+// `CognitoIdentityServiceProvider.*` — a debug helper, a sign-out-everywhere
+// action, a migration — should not inherit a growing minefield.
+
+/** `CognitoIdentityServiceProvider.<clientId>.<rest…>` — capture the client id. */
+const COGNITO_KEY = /^CognitoIdentityServiceProvider\.([^.]+)\./
+
+/**
+ * Delete every Cognito credential key whose Client ID is not `clientId`.
+ *
+ * Returns the keys removed, so a caller can log or assert on them. A no-op when
+ * `clientId` is falsy — an unresolved identity must never be treated as "no
+ * client matches", which would delete the live session along with the residue.
+ *
+ * Storage is injected for tests and to stay safe where there is none: this
+ * module is imported during `next build`'s prerender in Node, where
+ * `localStorage` does not exist.
+ */
+export function pruneForeignCognitoCredentials(
+  clientId: string | null | undefined,
+  storage: Storage | undefined = typeof localStorage === 'undefined' ? undefined : localStorage,
+): string[] {
+  if (!clientId || !storage) return []
+
+  // Snapshot the keys first, via the Storage API rather than Object.keys:
+  // removeItem() mutates the live key set, so index-based iteration would skip
+  // entries as it shrinks and leave half the residue behind.
+  const keys: string[] = []
+  for (let i = 0; i < storage.length; i++) {
+    const key = storage.key(i)
+    if (key !== null) keys.push(key)
+  }
+
+  const removed: string[] = []
+  for (const key of keys) {
+    const match = COGNITO_KEY.exec(key)
+    if (match && match[1] !== clientId) {
+      storage.removeItem(key)
+      removed.push(key)
+    }
+  }
+  return removed
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.168.2",
+  "version": "0.168.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",