@bounded-sh/core 0.0.21 → 0.0.22

package/dist/client/subscription-v2.d.ts

@@ -60,7 +60,7 @@ export declare function hasActiveConnection(): boolean;
  * room authority — the connection is already routed to the room DO, so the
  * client never names a destination.
  */
-export declare function wsIntent(appId: string, roomRoutePath: string, intent: unknown): boolean;
+export declare function wsIntent(appId: string, roomRoutePath: string, intent: unknown, isServer: boolean): Promise<boolean>;
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being
@@ -69,6 +69,6 @@ export declare function wsIntent(appId: string, roomRoutePath: string, intent: u
  * Promise that resolves on ack / rejects on error, or `undefined` if no live
  * socket exists yet (caller falls back to HTTP, which also surfaces errors).
  */
-export declare function wsIntentReliable(appId: string, roomRoutePath: string, intent: unknown): Promise<{
+export declare function wsIntentReliable(appId: string, roomRoutePath: string, intent: unknown, isServer: boolean): Promise<{
     ok: true;
-}> | undefined;
+} | undefined>;

package/dist/index.js

@@ -5435,6 +5435,48 @@ function getCacheKey(path, prompt, shape, limit, cursor, filter, identity) {
 function principalFromIdToken(idToken) {
     return idToken ? `t${hashForKey(idToken)}` : null;
 }
+function livePrincipalFromIdToken(idToken) {
+    if (!idToken)
+        return null;
+    try {
+        const payload = JSON.parse(decodeBase64Url(idToken.split('.')[1]));
+        const userId = payload['custom:userId'];
+        if (typeof userId === 'string' && userId.length > 0)
+            return userId;
+        const walletAddress = payload['custom:walletAddress'];
+        if (typeof walletAddress === 'string' && walletAddress.length > 0)
+            return walletAddress;
+        const subject = payload.sub;
+        return typeof subject === 'string' && subject.length > 0 ? subject : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function authSnapshotFromToken(idToken) {
+    return {
+        tokenFingerprint: principalFromIdToken(idToken),
+        principal: livePrincipalFromIdToken(idToken),
+    };
+}
+function connectionMatchesAuthToken(connection, idToken) {
+    const current = authSnapshotFromToken(idToken);
+    if (!current.tokenFingerprint) {
+        return connection.authTokenFingerprint === null && connection.authPrincipal === null;
+    }
+    if (connection.authTokenFingerprint && connection.authTokenFingerprint === current.tokenFingerprint) {
+        return true;
+    }
+    return !!connection.authPrincipal && !!current.principal && connection.authPrincipal === current.principal;
+}
+async function canSendAuthenticatedLiveIntent(connection, isServer) {
+    const currentToken = await getIdToken(isServer);
+    if (!currentToken)
+        return false;
+    if (!connection.authTokenFingerprint && !connection.authPrincipal)
+        return false;
+    return connectionMatchesAuthToken(connection, currentToken);
+}
 async function getSubscriptionIdentity(effectiveAppId, isServer, overrides) {
     // Per-subscription wallet override (server WalletClient.subscribe): key by
     // the wallet's own opaque token material, mirroring getReadPrincipalKey. Do
@@ -5510,6 +5552,9 @@ function rememberAmbientAuthFailure(error) {
 function failConnectionAuth(connection, error) {
     connection.authFailure = error;
     connection.pendingAuthToken = null;
+    connection.pendingAuthSnapshot = null;
+    connection.authTokenFingerprint = null;
+    connection.authPrincipal = null;
     connection.isConnecting = false;
     connection.isConnected = false;
     connection.isAuthenticating = false;
@@ -5728,16 +5773,37 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         if (connection.authFailure) {
             throw connection.authFailure;
         }
+        let currentAuthToken;
         try {
-            await getConnectionAuthToken(isServer, authTokenProvider);
+            currentAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
         }
         catch (error) {
             const authError = normalizeAuthExpiredError(error, 'Authentication expired and refresh failed');
             failConnectionAuth(connection, authError);
             throw authError;
         }
+        if (connection.isConnected &&
+            !connection.isAuthenticating &&
+            !connectionMatchesAuthToken(connection, currentAuthToken)) {
+            if (connection.tokenRefreshTimer) {
+                clearInterval(connection.tokenRefreshTimer);
+                connection.tokenRefreshTimer = null;
+            }
+            try {
+                connection.ws.close();
+            }
+            catch (_a) {
+                // Already closing.
+            }
+            connection.ws = null;
+            connection.isConnected = false;
+            connections.delete(connection.key);
+        }
+        else {
+            connection.authFailure = null;
+            return connection;
+        }
         connection.authFailure = null;
-        return connection;
     }
     let initialAuthToken = await getConnectionAuthToken(isServer, authTokenProvider);
     // Create new connection
@@ -5755,6 +5821,9 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         routePath: roomKey ? routePath : undefined,
         authTokenProvider,
         pendingAuthToken: null,
+        pendingAuthSnapshot: null,
+        authTokenFingerprint: null,
+        authPrincipal: null,
         tokenRefreshTimer: null,
         consecutiveAuthFailures: 0,
         authFailure: null,
@@ -5792,6 +5861,7 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
             throw authError;
         }
         connection.pendingAuthToken = authToken || null;
+        connection.pendingAuthSnapshot = authSnapshotFromToken(authToken);
         if (authToken) {
             // Successful token acquisition — reset failure counter
             connection.consecutiveAuthFailures = 0;
@@ -5831,6 +5901,8 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
         }
         else {
             connection.isAuthenticating = false;
+            connection.authTokenFingerprint = null;
+            connection.authPrincipal = null;
             replaySubscriptions(connection);
         }
     });
@@ -5870,10 +5942,12 @@ async function getOrCreateConnection(appId, isServer, routePath, authTokenProvid
     return connection;
 }
 function handleServerMessage(connection, message) {
-    var _a;
+    var _a, _b, _c, _d, _e;
     switch (message.type) {
         case 'authenticated': {
             connection.isAuthenticating = false;
+            connection.authTokenFingerprint = (_b = (_a = connection.pendingAuthSnapshot) === null || _a === void 0 ? void 0 : _a.tokenFingerprint) !== null && _b !== void 0 ? _b : null;
+            connection.authPrincipal = (_d = (_c = connection.pendingAuthSnapshot) === null || _c === void 0 ? void 0 : _c.principal) !== null && _d !== void 0 ? _d : null;
             replaySubscriptions(connection);
             break;
         }
@@ -5944,7 +6018,7 @@ function handleServerMessage(connection, message) {
                 connection.pendingRequests.delete(message.requestId);
                 clearTimeout(pendingSet.timer);
                 if (message.statusCode >= 400) {
-                    pendingSet.reject(new Error(((_a = message.body) === null || _a === void 0 ? void 0 : _a.message) || `Set failed with status ${message.statusCode}`));
+                    pendingSet.reject(new Error(((_e = message.body) === null || _e === void 0 ? void 0 : _e.message) || `Set failed with status ${message.statusCode}`));
                 }
                 else {
                     pendingSet.resolve(message.body);
@@ -6472,13 +6546,16 @@ function hasActiveConnection() {
  * room authority — the connection is already routed to the room DO, so the
  * client never names a destination.
  */
-function wsIntent(appId, roomRoutePath, intent) {
+async function wsIntent(appId, roomRoutePath, intent, isServer) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
+    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+        return false;
+    }
     try {
         connection.ws.send(JSON.stringify({ type: 'intent', intent }));
         return true;
@@ -6495,13 +6572,16 @@ function wsIntent(appId, roomRoutePath, intent) {
  * Promise that resolves on ack / rejects on error, or `undefined` if no live
  * socket exists yet (caller falls back to HTTP, which also surfaces errors).
  */
-function wsIntentReliable(appId, roomRoutePath, intent) {
+async function wsIntentReliable(appId, roomRoutePath, intent, isServer) {
     const roomKey = roomKeyFromRoutePath(roomRoutePath);
     const connKey = roomKey ? `${appId}#room#${roomKey}` : appId;
     const connection = connections.get(connKey);
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return undefined;
     }
+    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+        return undefined;
+    }
     const requestId = generateRequestId();
     return new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
@@ -6913,13 +6993,13 @@ async function intent(roomPath, intent, opts = {}) {
     const hasAuthOverride = !!((_a = opts._overrides) === null || _a === void 0 ? void 0 : _a._getAuthHeaders);
     if (!hasAuthOverride) {
         if (opts.fireAndForget) {
-            if (wsIntent(config.appId, normalizedRoomPath, intent))
+            if (await wsIntent(config.appId, normalizedRoomPath, intent, config.isServer))
                 return { ok: true };
         }
         else {
-            const ack = wsIntentReliable(config.appId, normalizedRoomPath, intent);
+            const ack = await wsIntentReliable(config.appId, normalizedRoomPath, intent, config.isServer);
             if (ack)
-                return await ack;
+                return ack;
         }
     }
     const base = realtimeHttpBase(config.wsApiUrl);