@bitrix24/b24jssdk 1.2.0 → 2.0.0

package/dist/esm/pullClient/client.mjs

@@ -1,6 +1,6 @@
 /**
  * @package @bitrix24/b24jssdk
- * @version 1.2.0
+ * @version 2.0.0
  * @copyright (c) 2026 Bitrix24
  * @license MIT
  * @see https://github.com/bitrix24/b24jssdk
@@ -9,12 +9,13 @@
 import { Type } from '../tools/type.mjs';
 import { Text } from '../tools/text.mjs';
 import { Browser } from '../tools/browser.mjs';
+import { REDACTED_PLACEHOLDER, redactSensitiveUrl, redactSensitiveParams } from '../core/http/redact.mjs';
 import { StorageManager } from './storage-manager.mjs';
 import { JsonRpc } from './json-rpc.mjs';
 import { SharedConfig } from './shared-config.mjs';
 import { ChannelManager } from './channel-manager.mjs';
 import { Receiver, IncomingMessage, RequestBatch, ResponseBatch } from './protobuf/index.mjs';
-import { ConnectionType, PullStatus, CloseReasons, SubscriptionType, LsKeys, RpcMethod, ServerMode, SenderType, SystemCommands } from '../types/pull.mjs';
+import { ConnectionType, PullStatus, CloseReasons, LsKeys, SubscriptionType, RpcMethod, ServerMode, SenderType, SystemCommands } from '../types/pull.mjs';
 import { WebSocketConnector } from './web-socket-connector.mjs';
 import { LongPollingConnector } from './long-polling-connector.mjs';
 import { LoggerFactory } from '../logger/logger-factory.mjs';
@@ -101,9 +102,15 @@ class PullClient {
   _pingWaitTimeout = null;
   // manual stop workaround ////
   _isManualDisconnect = false;
+  // set once destroy() has run; gates reconnect / watch / online so a torn-down
+  // client never schedules new work (#141) ////
+  _disposed = false;
   _loggingEnabled = false;
-  // bound event handlers ////
+  // bound event handlers, stored so they can be removed in destroy() (#141) ////
   _onPingTimeoutHandler;
+  _onBeforeUnloadHandler;
+  _onOfflineHandler;
+  _onOnlineHandler;
   // [userId] => array of callbacks
   _userStatusCallbacks = {};
   _connectPromise = null;
@@ -164,6 +171,9 @@ class PullClient {
     });
     this._loggingEnabled = this._sharedConfig.isLoggingEnabled();
     this._onPingTimeoutHandler = this.onPingTimeout.bind(this);
+    this._onBeforeUnloadHandler = this.onBeforeUnload.bind(this);
+    this._onOfflineHandler = this.onOffline.bind(this);
+    this._onOnlineHandler = this.onOnline.bind(this);
   }
   setLogger(logger) {
     this._logger = logger;
@@ -177,11 +187,29 @@ class PullClient {
   getLogger() {
     return this._logger;
   }
+  /**
+   * Terminal teardown: removes the window listeners, cancels every pending timer,
+   * persists the session for a quick re-init, and disconnects. Irreversible — a
+   * destroyed client schedules no further work and `start()` rejects with
+   * `PULL_DISPOSED`; create a new instance to reconnect.
+   */
   destroy() {
+    this._disposed = true;
     this.stop(CloseReasons.NORMAL_CLOSURE, "manual stop");
-    this.onBeforeUnload();
+    if (typeof window !== "undefined") {
+      window.removeEventListener("beforeunload", this._onBeforeUnloadHandler);
+      window.removeEventListener("offline", this._onOfflineHandler);
+      window.removeEventListener("online", this._onOnlineHandler);
+    }
+    if (this._storage) {
+      this._storage.remove(LsKeys.PullConfig);
+    }
+    this.persistSession();
   }
   init() {
+    if (this._disposed) {
+      return;
+    }
     this._connectors.webSocket = new WebSocketConnector({
       parent: this,
       onOpen: this.onWebSocketOpen.bind(this),
@@ -197,9 +225,11 @@ class PullClient {
       onError: this.onLongPollingError.bind(this)
     });
     this._connectionType = this.isWebSocketAllowed() ? ConnectionType.WebSocket : ConnectionType.LongPolling;
-    window.addEventListener("beforeunload", this.onBeforeUnload.bind(this));
-    window.addEventListener("offline", this.onOffline.bind(this));
-    window.addEventListener("online", this.onOnline.bind(this));
+    if (typeof window !== "undefined") {
+      window.addEventListener("beforeunload", this._onBeforeUnloadHandler);
+      window.addEventListener("offline", this._onOfflineHandler);
+      window.addEventListener("online", this._onOnlineHandler);
+    }
     this._jsonRpcAdapter = new JsonRpc({
       connector: this._connectors.webSocket,
       handlers: {
@@ -351,7 +381,8 @@ class PullClient {
           if (this._debug && this._context !== "master") {
             this.getLogger().warning(
               `${Text.getDateForLog()}: Pull.attachCommandHandler: result of handler.getModuleId() is not a string`,
-              { data }
+              // data.params / data.extra are app-defined and may carry a credential key (#43)
+              redactSensitiveParams({ data })
             );
           }
           method(data.params, data.extra, data.command);
@@ -360,9 +391,21 @@ class PullClient {
     });
   }
   /**
+   * Connects the client and begins receiving events.
+   *
    * @param config
+   * @throws Rejects with `{ ex: { error: 'PULL_DISPOSED' } }` when called after
+   *   `destroy()` — a destroyed client cannot be restarted; create a new instance.
    */
   async start(config = null) {
+    if (this._disposed) {
+      return Promise.reject({
+        ex: {
+          error: "PULL_DISPOSED",
+          error_description: "PullClient has been destroyed; create a new instance"
+        }
+      });
+    }
     let allowConfigCaching = true;
     if (this.isConnected()) {
       return Promise.resolve(true);
@@ -429,6 +472,9 @@ class PullClient {
    * @param disconnectReason
    */
   restart(disconnectCode = CloseReasons.NORMAL_CLOSURE, disconnectReason = "manual restart") {
+    if (this._disposed) {
+      return;
+    }
     if (this._restartTimeout) {
       clearTimeout(this._restartTimeout);
       this._restartTimeout = null;
@@ -471,6 +517,34 @@ class PullClient {
   stop(disconnectCode = CloseReasons.NORMAL_CLOSURE, disconnectReason = "manual stop") {
     this.disconnect(disconnectCode, disconnectReason);
     this.stopCheckConfig();
+    this.clearAllTimers();
+  }
+  // Cancel every pending timer so a stopped/destroyed client leaves nothing
+  // running. Previously only _checkInterval was cleared, so the other six timers
+  // (including the self-rescheduling watch-extend) survived teardown (#141).
+  clearAllTimers() {
+    for (const timer of [
+      this._reconnectTimeout,
+      this._restartTimeout,
+      this._restoreWebSocketTimeout,
+      this._offlineTimeout,
+      this._watchUpdateTimeout,
+      this._pingWaitTimeout
+    ]) {
+      if (timer) {
+        clearTimeout(timer);
+      }
+    }
+    if (this._checkInterval) {
+      clearInterval(this._checkInterval);
+    }
+    this._reconnectTimeout = null;
+    this._restartTimeout = null;
+    this._restoreWebSocketTimeout = null;
+    this._offlineTimeout = null;
+    this._watchUpdateTimeout = null;
+    this._pingWaitTimeout = null;
+    this._checkInterval = null;
   }
   reconnect(disconnectCode, disconnectReason, delay = 1) {
     this.disconnect(disconnectCode, disconnectReason);
@@ -689,7 +763,10 @@ class PullClient {
     let configDump;
     if (this._config && this._config.channels) {
       configDump = {
-        ChannelID: this._config.channels.private?.id || "n/a",
+        // The private channel id is a subscription secret — mask it here too, not
+        // just in `Path` below, so the debug dump never surfaces it (#148). Expiry
+        // timestamps are non-sensitive and kept for diagnostics.
+        ChannelID: this._config.channels.private?.id ? REDACTED_PLACEHOLDER : "n/a",
         ChannelDie: this._config.channels.private?.end || "n/a",
         ChannelDieShared: this._config.channels.shared?.end || "n/a"
       };
@@ -706,6 +783,7 @@ class PullClient {
         websocketMode = this._connectors.webSocket?.socket?.url.search("binaryMode=true") != -1 ? "protobuf" : "text";
       }
     }
+    const connectionPath = this.connector?.connectionPath;
     return {
       "UserId": this._userId + (this._userId > 0 ? "" : "(guest)"),
       "Guest userId": this._guestMode && this._guestUserId !== 0 ? this._guestUserId : "-",
@@ -717,7 +795,9 @@ class PullClient {
       "WebSocket mode": websocketMode,
       "Try connect": this._reconnectTimeout ? "Y" : "N",
       "Try number": this._connectionAttempt,
-      "Path": this.connector?.connectionPath || "-",
+      // Mask the push JWT (`token`) and private `CHANNEL_ID`s before exposing
+      // the connection path through this developer-facing debug dump (#148).
+      "Path": connectionPath ? redactSensitiveUrl(connectionPath, ["CHANNEL_ID"]) : "-",
       ...configDump,
       "Last message": this._session.mid || "-",
       "Session history": this._session.history,
@@ -748,13 +828,10 @@ class PullClient {
       params["token"] = this._config?.jwt;
     } else {
       const channels = [];
-      if (this._config?.channels?.private) {
-        channels.push(this._config.channels.private?.id || "");
-      }
-      if (this._config?.channels.private?.id) {
+      if (this._config?.channels?.private?.id) {
         channels.push(this._config.channels.private.id);
       }
-      if (this._config?.channels.shared?.id) {
+      if (this._config?.channels?.shared?.id) {
         channels.push(this._config.channels.shared.id);
       }
       if (channels.length === 0) {
@@ -1003,7 +1080,8 @@ class PullClient {
       this.getLogger().warning("PULL ERROR", {
         errorType: "broadcastMessages execute error",
         errorEvent: error,
-        message
+        // app-defined message.params / extra may carry a credential key (#43)
+        message: redactSensitiveParams(message)
       });
     }
     if (message.extra && message.extra.revision_web) {
@@ -1233,6 +1311,9 @@ class PullClient {
     return true;
   }
   startCheckConfig() {
+    if (this._disposed) {
+      return;
+    }
     if (this._checkInterval) {
       clearInterval(this._checkInterval);
       this._checkInterval = null;
@@ -1273,7 +1354,7 @@ class PullClient {
       this.setPublicIds(Object.values(config.publicChannels));
     }
     this._configTimestamp = Number(config.server.config_timestamp);
-    if (this._storage && allowCaching) {
+    if (this._storage && allowCaching && !this._disposed) {
       try {
         this._storage.set(LsKeys.PullConfig, config);
       } catch (error) {
@@ -1334,7 +1415,7 @@ class PullClient {
    * @param connectionDelay
    */
   scheduleReconnect(connectionDelay = 0) {
-    if (!this._enabled) {
+    if (this._disposed || !this._enabled) {
       return;
     }
     if (!connectionDelay) {
@@ -1358,6 +1439,9 @@ class PullClient {
     }, connectionDelay * 1e3);
   }
   scheduleRestoreWebSocketConnection() {
+    if (this._disposed) {
+      return;
+    }
     this.logToConsole(
       `Pull: scheduling restoration of websocket connection in ${RESTORE_WEBSOCKET_TIMEOUT} seconds`
     );
@@ -1373,7 +1457,7 @@ class PullClient {
    * @returns {Promise}
    */
   async connect() {
-    if (!this._enabled) {
+    if (this._disposed || !this._enabled) {
       return Promise.reject();
     }
     if (this.connector?.connected) {
@@ -1399,6 +1483,9 @@ class PullClient {
    * @param restartDelay
    */
   scheduleRestart(disconnectCode, disconnectReason, restartDelay = 0) {
+    if (this._disposed) {
+      return;
+    }
     if (this._restartTimeout) {
       clearTimeout(this._restartTimeout);
       this._restartTimeout = null;
@@ -1481,13 +1568,13 @@ class PullClient {
           if (typeChanel === "private" && this._config?.channels?.private) {
             this._config.channels.private = message.params.new_channel;
             this.logToConsole(
-              `Pull: new config for ${message.params.channel.type} channel set: ${this._config.channels.private}`
+              `Pull: new config for ${message.params.channel.type} channel set: [updated]`
             );
           }
           if (typeChanel === "shared" && this._config?.channels?.shared) {
             this._config.channels.shared = message.params.new_channel;
             this.logToConsole(
-              `Pull: new config for ${message.params.channel.type} channel set: ${this._config.channels.shared}`
+              `Pull: new config for ${message.params.channel.type} channel set: [updated]`
             );
           }
           this.reconnect(CloseReasons.CONFIG_REPLACED, "config was replaced");
@@ -1744,7 +1831,10 @@ class PullClient {
     if (dataArray === null) {
       this.getLogger().warning("PULL ERROR", {
         errorType: "parseResponse error parsing message",
-        dataString: pullEvent
+        // The frame failed the NGINX-delimiter match, so its content is
+        // unparseable anyway and could carry a credential (e.g. a channel
+        // `signature`); log only its size, never the bytes (#43).
+        byteLength: pullEvent.length
       });
       return [];
     }
@@ -1797,15 +1887,28 @@ class PullClient {
   // endregion ////
   // region Events.Status /////
   onOffline() {
+    if (this._disposed) {
+      return;
+    }
     this.disconnect(CloseReasons.NORMAL_CLOSURE, "offline");
   }
   onOnline() {
+    if (this._disposed) {
+      return;
+    }
     this.connect().catch((error) => {
       this.getLogger().error("onOnline", { error });
     });
   }
   onBeforeUnload() {
     this._unloading = true;
+    this.persistSession();
+    this.scheduleReconnect(15);
+  }
+  // Persist the current session (with a short TTL) so a quick reload / re-init can
+  // resume it. Shared by onBeforeUnload and destroy() — destroy() saves WITHOUT
+  // scheduling a reconnect (#141).
+  persistSession() {
     const session = Type.clone(this.session);
     session.ttl = Date.now() + LS_SESSION_CACHE_TIME * 1e3;
     if (this._storage) {
@@ -1822,7 +1925,6 @@ class PullClient {
         );
       }
     }
-    this.scheduleReconnect(15);
   }
   // endregion ////
   // region PullStatus ////
@@ -1831,6 +1933,9 @@ class PullClient {
    * @param delay
    */
   sendPullStatusDelayed(status, delay) {
+    if (this._disposed) {
+      return;
+    }
     if (this._offlineTimeout) {
       clearTimeout(this._offlineTimeout);
       this._offlineTimeout = null;
@@ -1876,6 +1981,9 @@ class PullClient {
    * @param force
    */
   updateWatch(force = false) {
+    if (this._disposed) {
+      return;
+    }
     if (this._watchUpdateTimeout) {
       clearTimeout(this._watchUpdateTimeout);
       this._watchUpdateTimeout = null;
@@ -1916,6 +2024,9 @@ class PullClient {
     this.connector?.send(JSON_RPC_PONG);
   }
   updatePingWaitTimeout() {
+    if (this._disposed) {
+      return;
+    }
     if (this._pingWaitTimeout) {
       clearTimeout(this._pingWaitTimeout);
       this._pingWaitTimeout = null;
@@ -1933,7 +2044,7 @@ class PullClient {
   }
   onPingTimeout() {
     this._pingWaitTimeout = null;
-    if (!this._enabled || !this.isConnected()) {
+    if (this._disposed || !this._enabled || !this.isConnected()) {
       return;
     }
     this.getLogger().warning(`No pings are received in ${PING_TIMEOUT * 2} seconds. Reconnecting`);
@@ -1994,30 +2105,30 @@ class PullClient {
     if (message.extra?.sender && message.extra.sender.type === SenderType.Client) {
       this.getLogger().info(
         `onPullClientEvent-${message.module_id}`,
-        {
+        redactSensitiveParams({
           command: message.command,
           params: message.params,
           extra: message.extra
-        }
+        })
       );
     } else if (message.module_id == "online") {
       this.getLogger().info(
         `onPullOnlineEvent`,
-        {
+        redactSensitiveParams({
           command: message.command,
           params: message.params,
           extra: message.extra
-        }
+        })
       );
     } else {
       this.getLogger().info(
         `onPullEvent`,
-        {
+        redactSensitiveParams({
           moduleId: message.module_id,
           command: message.command,
           params: message.params,
           extra: message.extra
-        }
+        })
       );
     }
   }