@biffo/cli 0.247.1 → 0.247.3

package/_skeletons/sibling-template/apps/frontend/src/lib/api-client.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it, vi, afterEach } from 'vitest'
-import { ApiError, createApiClient, extractErrorMessage } from './api-client'
+import {
+  ApiError,
+  createApiClient,
+  extractErrorMessage,
+  __resetRenewedTokenCacheForTests,
+} from './api-client'
 
 /**
  * A backend's error body is JSON like `{"detail": "..."}`. Throwing the whole
@@ -42,6 +47,7 @@ describe('extractErrorMessage', () => {
 describe('createApiClient error handling', () => {
   afterEach(() => {
     vi.unstubAllGlobals()
+    __resetRenewedTokenCacheForTests()
   })
 
   it('throws an ApiError carrying the message, not the wire format', async () => {
@@ -83,6 +89,7 @@ describe('createApiClient session renewal', () => {
 
   afterEach(() => {
     vi.unstubAllGlobals()
+    __resetRenewedTokenCacheForTests()
   })
 
   function ok(body: unknown) {
@@ -117,6 +124,20 @@ describe('createApiClient session renewal', () => {
     })
   }
 
+  /**
+   * Same shape as `fetchAcceptingOnly`, but for a scenario spanning more than
+   * one session's fresh token — proving a later session is never let in on an
+   * earlier session's renewed credential.
+   */
+  function fetchAcceptingAnyOf(freshTokens: string[], body: unknown = { items: [] }) {
+    return vi.fn((_url: string, init: RequestInit) => {
+      const headers = (init.headers ?? {}) as Record<string, string>
+      const sent = headers['Authorization']
+      const accepted = freshTokens.some((token) => sent === `Bearer ${token}`)
+      return Promise.resolve(accepted ? ok(body) : unauthorized())
+    })
+  }
+
   it('renews the session and retries once, so the call succeeds', async () => {
     const fetchMock = fetchAcceptingOnly('fresh', { items: ['course'] })
     vi.stubGlobal('fetch', fetchMock)
@@ -267,6 +288,89 @@ describe('createApiClient session renewal', () => {
     expect(retry[1].body).toBe(JSON.stringify({ title: 'New' }))
   })
 
+  /**
+   * The claim this PR (biffo-template#1283) exists to prove, not the retry
+   * behaviour #1277 already covers above. #1277 fixed the user-visible half —
+   * the FIRST 401 after expiry renews and retries so the call still succeeds.
+   * What it left is every LATER request on the same page: nothing wrote the
+   * renewed token back to the state `getIdToken()` reads, so a second request
+   * with the same stale closure paid the identical 401 + renew + retry cycle
+   * all over again, for the rest of the page's life. Without the fix in this
+   * PR, the second `api.get` below would fetch twice and renew a second time
+   * — exactly like the first request did — rather than sending the renewed
+   * token straight away.
+   */
+  it('sends the renewed token directly on a later request, and does not 401 again', async () => {
+    const fetchMock = fetchAcceptingOnly('fresh')
+    vi.stubGlobal('fetch', fetchMock)
+    const refresh = vi.fn(() => Promise.resolve<string | null>('fresh'))
+
+    // Every real caller passes `() => token` closing over React state that a
+    // renewal outside React never updates — so this closure keeps returning
+    // 'expired' for the rest of the page's life, exactly like the reporter's
+    // hours-long authoring session.
+    const api = createApiClient(() => 'expired', refresh)
+
+    // First request: pays the full cycle, exactly as #1277 fixed it.
+    await expect(api.get('/api/v1/courses')).resolves.toEqual({ items: [] })
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    expect(refresh).toHaveBeenCalledTimes(1)
+
+    // Second request: same client, same stale `getIdToken()` value. Assert
+    // the actual claim — exactly ONE fetch, carrying the renewed token
+    // directly, with no second 401 and no second renewal.
+    fetchMock.mockClear()
+    await expect(api.get('/api/v1/modules')).resolves.toEqual({ items: [] })
+
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [, init] = fetchMock.mock.calls[0]
+    expect((init.headers as Record<string, string>)['Authorization']).toBe('Bearer fresh')
+    expect(refresh).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * The hazard called out when this fix was scoped: a module-level cache is
+   * shared mutable state, so sign-out — or a different user signing in, in
+   * the same tab, which `tabsii-marketplace`'s public self-service flow makes
+   * real — must not let the previous session's renewed token leak into the
+   * next one. That would be a security defect, not a latency one.
+   */
+  it('does not leak a renewed token across sign-out to a different session', async () => {
+    const fetchMock = fetchAcceptingAnyOf(['fresh-a', 'fresh-b'])
+    vi.stubGlobal('fetch', fetchMock)
+
+    let currentToken = 'expired-a'
+    const refresh = vi.fn(() =>
+      Promise.resolve<string | null>(currentToken === 'expired-a' ? 'fresh-a' : 'fresh-b'),
+    )
+    const api = createApiClient(() => currentToken, refresh)
+
+    // User A's session: first call renews and retries; second call is served
+    // straight from the cache (this is the behaviour under test above).
+    await expect(api.get('/api/v1/courses')).resolves.toEqual({ items: [] })
+    await expect(api.get('/api/v1/courses')).resolves.toEqual({ items: [] })
+    expect(refresh).toHaveBeenCalledTimes(1)
+
+    // Sign-out, then a DIFFERENT user signs in — a brand new stale token from
+    // `getIdToken()`, simulating React state now belonging to a new session.
+    currentToken = 'expired-b'
+    const callsBeforeSwitch = fetchMock.mock.calls.length
+
+    await expect(api.get('/api/v1/courses')).resolves.toEqual({ items: [] })
+
+    const callsSinceSwitch = fetchMock.mock.calls.slice(callsBeforeSwitch)
+    // If user A's cached token had leaked, this request would succeed on its
+    // FIRST fetch by reusing 'fresh-a'. Instead it must pay its own renewal —
+    // proof the new session's first request sent its OWN stale token, not the
+    // previous session's cached fresh one.
+    expect(callsSinceSwitch).toHaveLength(2)
+    const firstAuthHeader = (callsSinceSwitch[0][1].headers as Record<string, string>)[
+      'Authorization'
+    ]
+    expect(firstAuthHeader).toBe('Bearer expired-b')
+    expect(refresh).toHaveBeenCalledTimes(2)
+  })
+
   it('leaves a non-401 failure entirely alone', async () => {
     const fetchMock = vi.fn().mockResolvedValue({
       ok: false,

package/_skeletons/sibling-template/apps/frontend/src/lib/api-client.ts

@@ -179,6 +179,51 @@ async function refreshViaPortalSession(): Promise<string | null> {
   return session?.getIdToken().getJwtToken() ?? null
 }
 
+/**
+ * The freshest token this module has renewed a specific stale one into.
+ *
+ * Every caller passes `getIdToken` as `() => token` closing over React state
+ * that a renewal happening outside React never updates (see `send` below).
+ * Without this, the SAME stale value keeps coming back from `getIdToken()` for
+ * the rest of the page's life, so every request after the first expiry pays a
+ * full 401 + renew + retry cycle even though the previous renewal already
+ * produced a token that would have worked.
+ *
+ * Keyed by the stale token it replaced — not just "the freshest token" — and
+ * consulted in `send` only when the caller's own `getIdToken()` result still
+ * equals that key. That is what makes it safe to share at module scope:
+ *
+ * - **Safe across sign-out, or a different user signing in.** Either changes
+ *   what `getIdToken()` returns, and a Cognito id token is unique per session,
+ *   so the new value cannot equal a previous session's `staleToken`. The
+ *   cache simply stops matching — nothing has to remember to clear it.
+ *   Rejected: a bare "freshest known token" cache with no key would keep
+ *   answering with the previous session's token until something explicitly
+ *   cleared it on sign-out, which is a security defect (a stale credential
+ *   handed to the wrong session) far worse than the latency this fixes.
+ * - **Safe for concurrent requests and multiple `createApiClient` instances.**
+ *   They all read the same React state through their own `getIdToken`
+ *   closures, so they all see the same stale value and all benefit from the
+ *   one cache entry — there is nothing per-instance to keep in step, the same
+ *   reasoning as `inFlightRenewal` above.
+ *
+ * Rejected alternative: an optional `onTokenRenewed` callback for callers to
+ * update their own state themselves. Cleaner ownership in principle, but it
+ * only helps callers that wire it up — every sibling's call sites today do
+ * not — so the default path would stay slow. This fixes the default path
+ * with no caller changes required.
+ */
+let renewedTokenCache: { staleToken: string; freshToken: string } | null = null
+
+/**
+ * Test-only: clear the module-scope renewal cache so one test's renewal
+ * cannot leak into the next. Production code never calls this — the cache is
+ * meant to live for the whole page.
+ */
+export function __resetRenewedTokenCacheForTests(): void {
+  renewedTokenCache = null
+}
+
 export function createApiClient(
   getIdToken: () => string | null,
   refreshIdToken: () => Promise<string | null> = refreshViaPortalSession,
@@ -197,13 +242,24 @@ export function createApiClient(
    * makes "once" structural: there is no path back to the top, so a genuinely
    * revoked session cannot spin however many 401s it produces.
    *
-   * It also carries the token the renewal returned rather than re-reading
-   * `getIdToken()`. Every caller passes `() => token` closing over React state,
-   * which a renewal outside React has not updated — so re-reading it would
-   * re-send the credential the gateway just rejected and burn the one retry.
+   * The first attempt prefers `renewedTokenCache` over `getIdToken()` when the
+   * caller's own state is still the exact value a previous renewal in this
+   * module already replaced — see the doc on `renewedTokenCache` above for why
+   * that is safe. That is what stops a page from paying the full cycle on
+   * every request for the rest of its life once React state has gone stale.
+   *
+   * The retry itself carries the token the renewal returned rather than
+   * re-reading `getIdToken()`. Every caller passes `() => token` closing over
+   * React state, which a renewal outside React has not updated — so re-reading
+   * it would re-send the credential the gateway just rejected and burn the one
+   * retry.
    */
   async function send<T>(path: string, init: RequestInit): Promise<T> {
-    const sentToken = getIdToken()
+    const callerToken = getIdToken()
+    const sentToken =
+      callerToken !== null && renewedTokenCache?.staleToken === callerToken
+        ? renewedTokenCache.freshToken
+        : callerToken
     const res = await fetch(`${API_URL}${path}`, { ...init, headers: authHeaders(sentToken) })
     if (res.status !== 401) return handleResponse<T>(res)
 
@@ -214,6 +270,14 @@ export function createApiClient(
       throw new ApiError(401, unauthorizedMessage(await bodyOf(res)))
     }
 
+    // Cache against the caller's OWN stale value, not `sentToken` (which may
+    // already have been substituted from a previous cache hit) — that is the
+    // value `getIdToken()` keeps returning for the rest of the page's life, so
+    // it is the correct key for the next call to match against.
+    if (callerToken !== null) {
+      renewedTokenCache = { staleToken: callerToken, freshToken: renewed }
+    }
+
     const retried = await fetch(`${API_URL}${path}`, { ...init, headers: authHeaders(renewed) })
     if (retried.status === 401) {
       throw new ApiError(401, unauthorizedMessage(await bodyOf(retried)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.247.1",
+  "version": "0.247.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",