@burtson-labs/bandit-engine 2.0.165 → 2.0.166

package/dist/management/management.js

@@ -1556,31 +1556,42 @@ var init_anthropic_provider = __esm({
 });
 
 // src/store/authenticationStore.ts
-var import_zustand2, TOKEN_KEY, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
+var import_zustand2, TOKEN_KEY, decodeClaims, validOrNull, readLegacyStorage, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
 var init_authenticationStore = __esm({
   "src/store/authenticationStore.ts"() {
     "use strict";
     import_zustand2 = require("zustand");
     TOKEN_KEY = "authToken";
-    validToken = null;
-    user = null;
-    rawToken = localStorage.getItem(TOKEN_KEY);
-    if (rawToken) {
+    decodeClaims = (token) => {
       try {
-        const base64Url = rawToken.split(".")[1];
+        const base64Url = token.split(".")[1];
         const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
         const jsonPayload = decodeURIComponent(
           atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
         );
-        const decoded = JSON.parse(jsonPayload);
-        if (decoded.exp * 1e3 > Date.now()) {
-          validToken = rawToken;
-          user = decoded;
-        }
+        return JSON.parse(jsonPayload);
       } catch {
-        validToken = null;
-        user = null;
+        return null;
       }
+    };
+    validOrNull = (raw) => {
+      if (!raw) return null;
+      const decoded = decodeClaims(raw);
+      return decoded && decoded.exp * 1e3 > Date.now() ? raw : null;
+    };
+    readLegacyStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY);
+      } catch {
+        return null;
+      }
+    };
+    validToken = null;
+    user = null;
+    rawToken = readLegacyStorage();
+    if (rawToken) {
+      validToken = validOrNull(rawToken);
+      user = validToken ? decodeClaims(validToken) : null;
     }
     useAuthenticationStore = (0, import_zustand2.create)((set) => ({
       token: validToken,
@@ -1588,16 +1599,10 @@ var init_authenticationStore = __esm({
       authError: null,
       setToken: (token) => {
         if (token) {
-          try {
-            const base64Url = token.split(".")[1];
-            const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-            const jsonPayload = decodeURIComponent(
-              atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-            );
-            const user2 = JSON.parse(jsonPayload);
-            localStorage.setItem(TOKEN_KEY, token);
-            set({ token, authError: null, user: user2 });
-          } catch {
+          const decoded = decodeClaims(token);
+          if (decoded) {
+            set({ token, authError: null, user: decoded });
+          } else {
             set({ token: null, authError: "Invalid token", user: null });
           }
         } else {
@@ -1605,23 +1610,11 @@ var init_authenticationStore = __esm({
         }
       },
       clearToken: () => {
-        localStorage.removeItem(TOKEN_KEY);
         set({ token: null, authError: null, user: null });
       }
     }));
     readPersistedToken = () => {
-      try {
-        const raw = localStorage.getItem(TOKEN_KEY);
-        if (!raw) return null;
-        const base64 = raw.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
-        const json2 = decodeURIComponent(
-          atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-        );
-        const decoded = JSON.parse(json2);
-        return decoded.exp * 1e3 > Date.now() ? raw : null;
-      } catch {
-        return null;
-      }
+      return validOrNull(readLegacyStorage()) ?? validOrNull(useAuthenticationStore.getState().token);
     };
   }
 });
@@ -1635,7 +1628,7 @@ function emitAuthTokenChanged(token) {
     detail: { token }
   }));
 }
-var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, AuthenticationService, authenticationService;
+var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, readLocalStorage, writeLocalStorage, AuthenticationService, authenticationService;
 var init_authenticationService = __esm({
   "src/services/auth/authenticationService.ts"() {
     "use strict";
@@ -1643,21 +1636,103 @@ var init_authenticationService = __esm({
     init_debugLogger();
     TOKEN_KEY2 = "authToken";
     AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+    readLocalStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY2);
+      } catch {
+        return null;
+      }
+    };
+    writeLocalStorage = (token) => {
+      try {
+        if (typeof localStorage === "undefined") return;
+        if (token) localStorage.setItem(TOKEN_KEY2, token);
+        else localStorage.removeItem(TOKEN_KEY2);
+      } catch {
+      }
+    };
     AuthenticationService = class {
+      storageMode = "localStorage";
+      persistence = null;
+      handlers = {};
+      /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+      revision = 0;
+      refreshInFlight = null;
+      lastPersist = Promise.resolve();
+      /**
+       * Pick the storage contract for this host. Call once at boot, before the
+       * first `setToken`. Switching modes never moves a token by itself: the
+       * host migrates (e.g. reads the legacy localStorage value, then clears it).
+       */
+      configureSession(config) {
+        this.storageMode = config.storage;
+        this.persistence = config.persistence ?? null;
+        this.handlers = config.handlers ?? {};
+      }
+      getStorageMode() {
+        return this.storageMode;
+      }
+      getSessionRevision() {
+        return this.revision;
+      }
       getToken() {
-        const token = localStorage.getItem(TOKEN_KEY2);
-        return token;
+        if (this.storageMode === "memory") {
+          return useAuthenticationStore.getState().token;
+        }
+        return readLocalStorage();
       }
       setToken(token) {
-        localStorage.setItem(TOKEN_KEY2, token);
+        this.revision += 1;
+        if (this.storageMode === "localStorage") {
+          writeLocalStorage(token);
+        } else {
+          writeLocalStorage(null);
+        }
         useAuthenticationStore.getState().setToken(token);
+        this.mirror(() => this.persistence?.write(token));
         emitAuthTokenChanged(token);
       }
       clearToken() {
-        localStorage.removeItem(TOKEN_KEY2);
+        this.revision += 1;
+        const current = this.getToken() ?? useAuthenticationStore.getState().token;
+        try {
+          this.handlers.beforeClear?.(current);
+        } catch (error) {
+          debugLogger.warn("Auth beforeClear handler failed", { error });
+        }
+        writeLocalStorage(null);
         useAuthenticationStore.getState().clearToken();
+        this.mirror(() => this.persistence?.clear());
         emitAuthTokenChanged(null);
       }
+      /** True when the host registered a silent refresh path. */
+      canRefresh() {
+        return typeof this.handlers.refresh === "function";
+      }
+      /**
+       * Ask the host for a fresh token. Concurrent callers share one attempt.
+       * Resolves false when no refresh path exists or it did not produce a token.
+       */
+      tryRefresh() {
+        const refresh = this.handlers.refresh;
+        if (!refresh) return Promise.resolve(false);
+        if (this.refreshInFlight) return this.refreshInFlight;
+        this.refreshInFlight = (async () => {
+          try {
+            return await refresh();
+          } catch (error) {
+            debugLogger.warn("Auth refresh handler failed", { error });
+            return false;
+          } finally {
+            this.refreshInFlight = null;
+          }
+        })();
+        return this.refreshInFlight;
+      }
+      /** Resolves once the most recent persistence write/clear has settled. */
+      whenPersisted() {
+        return this.lastPersist;
+      }
       isAuthenticated() {
         const token = useAuthenticationStore.getState().token;
         return !!token && !this.isTokenExpired(token);
@@ -1687,6 +1762,16 @@ var init_authenticationService = __esm({
           return null;
         }
       }
+      mirror(run) {
+        const attempt = (async () => {
+          try {
+            await run();
+          } catch (error) {
+            debugLogger.warn("Auth token persistence failed", { error });
+          }
+        })();
+        this.lastPersist = attempt;
+      }
     };
     authenticationService = new AuthenticationService();
   }
@@ -1742,13 +1827,35 @@ var init_gateway_service = __esm({
         });
         instance.interceptors.response.use(
           (response) => response,
-          (error) => {
+          async (error) => {
+            const retried = await this._retryAfterRefresh(instance, error);
+            if (retried) return retried;
             this._handleAuthFailure(error);
             return Promise.reject(this._normalizeAxiosError(error));
           }
         );
         return instance;
       }
+      /**
+       * A bare 401 on a host with a silent refresh path (HttpOnly refresh cookie,
+       * native device token) usually means the access token aged out mid-session.
+       * Refresh once and replay the request with the new token instead of
+       * signing the user out; a failed refresh falls through to the sign-out path.
+       */
+      async _retryAfterRefresh(instance, error) {
+        const config = error.config;
+        if (!config || config._banditAuthRetried || error.response?.status !== 401) return null;
+        if (!authenticationService.canRefresh()) return null;
+        const data = error.response?.data;
+        if (data?.code && data.code !== "TOKEN_EXPIRED") return null;
+        try {
+          if (!await authenticationService.tryRefresh()) return null;
+        } catch {
+          return null;
+        }
+        config._banditAuthRetried = true;
+        return instance.request(config);
+      }
       _normalizeAxiosError(error) {
         if (error.response) {
           return this._createHttpError(
@@ -6437,6 +6544,7 @@ var init_FeatureFlagContext = __esm({
     import_react = require("react");
     init_featureFlags();
     init_debugLogger();
+    init_authenticationService();
     import_jsx_runtime = require("react/jsx-runtime");
     FeatureFlagContext = (0, import_react.createContext)(void 0);
     useFeatureFlag = () => {
@@ -40941,6 +41049,11 @@ init_common_types();
 init_authenticationService();
 init_debugLogger();
 init_indexedDBService();
+var sessionTokenFactory = (label) => () => {
+  const token = authenticationService.getToken();
+  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });
+  return token;
+};
 var AIProviderInitService = class _AIProviderInitService {
   static instance;
   constructor() {
@@ -41020,25 +41133,7 @@ var AIProviderInitService = class _AIProviderInitService {
       providerConfig = {
         type: "ollama" /* OLLAMA */,
         baseUrl: settings.ollamaUrl,
-        tokenFactory: () => {
-          let token = authenticationService.getToken();
-          if (!token) {
-            token = localStorage.getItem("authToken");
-          }
-          if (!token) {
-            try {
-              const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-              const authStore = useAuthenticationStore2.getState();
-              token = authStore.token;
-            } catch (e) {
-            }
-          }
-          debugLogger.info("AIProviderInit: Token factory called", {
-            hasToken: !!token,
-            localStorage: !!localStorage.getItem("authToken")
-          });
-          return token;
-        }
+        tokenFactory: sessionTokenFactory("Token factory called")
       };
       debugLogger.info("Using legacy Ollama config", providerConfig);
     }
@@ -41061,25 +41156,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const fallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: settings.ollamaUrl || "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(fallbackConfig);
@@ -41092,25 +41169,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const localFallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Local fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Local fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(localFallbackConfig);
@@ -41182,27 +41241,7 @@ var AIProviderInitService = class _AIProviderInitService {
         });
         return config;
       }
-      config.tokenFactory = () => {
-        let token = authenticationService.getToken();
-        if (!token && typeof localStorage !== "undefined") {
-          try {
-            token = localStorage.getItem("authToken");
-          } catch {
-          }
-        }
-        if (!token) {
-          try {
-            const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-            const authStore = useAuthenticationStore2.getState();
-            token = authStore.token;
-          } catch {
-          }
-        }
-        debugLogger.info("AIProviderInit: Token factory resolved auth token", {
-          hasToken: !!token
-        });
-        return token;
-      };
+      config.tokenFactory = sessionTokenFactory("Token factory resolved auth token");
     }
     return config;
   }