@burtson-labs/bandit-engine 2.0.165 → 2.0.167

package/README.md

@@ -961,7 +961,10 @@ const chatPackageSettings = {
     rolesClaimKey: "roles", // JWT claim key for user roles
     subscriptionTypeClaimKey: "subscriptionType", // JWT claim for subscription type
     isSubscribedClaimKey: "isSubscribed", // JWT claim for subscription status
-    jwtStorageKey: "authToken", // Local storage key for JWT token
+    // Where to look for the JWT when the engine's own session (authenticationService)
+    // holds none, e.g. a host that keeps its token under a different localStorage key.
+    // The engine's session is read first and may live in memory only.
+    jwtStorageKey: "authToken",
     adminRole: "admin", // Admin role name for elevated access
     
     // Development settings

package/dist/aiProviderStore-HY5G4QAK.mjs

@@ -0,0 +1,8 @@
+import {
+  useAIProviderStore
+} from "./chunk-GRPTCHFN.mjs";
+import "./chunk-HNXPDIWC.mjs";
+export {
+  useAIProviderStore
+};
+//# sourceMappingURL=aiProviderStore-HY5G4QAK.mjs.map

package/dist/chat-6N5B7A7F.mjs

@@ -0,0 +1,15 @@
+import {
+  chat_default
+} from "./chunk-SHYNXDRO.mjs";
+import "./chunk-ONQMRE2G.mjs";
+import "./chunk-5BZWJQ5O.mjs";
+import "./chunk-E5WMDLE3.mjs";
+import "./chunk-KDIL5WUL.mjs";
+import "./chunk-46OGYEME.mjs";
+import "./chunk-SZJB5FLZ.mjs";
+import "./chunk-GRPTCHFN.mjs";
+import "./chunk-HNXPDIWC.mjs";
+export {
+  chat_default as default
+};
+//# sourceMappingURL=chat-6N5B7A7F.mjs.map

package/dist/chat-provider.js

@@ -46,31 +46,42 @@ var init_packageSettingsStore = __esm({
 });
 
 // src/store/authenticationStore.ts
-var import_zustand2, TOKEN_KEY, validToken, user, rawToken, useAuthenticationStore;
+var import_zustand2, TOKEN_KEY, decodeClaims, validOrNull, readLegacyStorage, validToken, user, rawToken, useAuthenticationStore;
 var init_authenticationStore = __esm({
   "src/store/authenticationStore.ts"() {
     "use strict";
     import_zustand2 = require("zustand");
     TOKEN_KEY = "authToken";
-    validToken = null;
-    user = null;
-    rawToken = localStorage.getItem(TOKEN_KEY);
-    if (rawToken) {
+    decodeClaims = (token) => {
       try {
-        const base64Url = rawToken.split(".")[1];
+        const base64Url = token.split(".")[1];
         const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
         const jsonPayload = decodeURIComponent(
           atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
         );
-        const decoded = JSON.parse(jsonPayload);
-        if (decoded.exp * 1e3 > Date.now()) {
-          validToken = rawToken;
-          user = decoded;
-        }
+        return JSON.parse(jsonPayload);
       } catch {
-        validToken = null;
-        user = null;
+        return null;
       }
+    };
+    validOrNull = (raw) => {
+      if (!raw) return null;
+      const decoded = decodeClaims(raw);
+      return decoded && decoded.exp * 1e3 > Date.now() ? raw : null;
+    };
+    readLegacyStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY);
+      } catch {
+        return null;
+      }
+    };
+    validToken = null;
+    user = null;
+    rawToken = readLegacyStorage();
+    if (rawToken) {
+      validToken = validOrNull(rawToken);
+      user = validToken ? decodeClaims(validToken) : null;
     }
     useAuthenticationStore = (0, import_zustand2.create)((set) => ({
       token: validToken,
@@ -78,16 +89,10 @@ var init_authenticationStore = __esm({
       authError: null,
       setToken: (token) => {
         if (token) {
-          try {
-            const base64Url = token.split(".")[1];
-            const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-            const jsonPayload = decodeURIComponent(
-              atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-            );
-            const user2 = JSON.parse(jsonPayload);
-            localStorage.setItem(TOKEN_KEY, token);
-            set({ token, authError: null, user: user2 });
-          } catch {
+          const decoded = decodeClaims(token);
+          if (decoded) {
+            set({ token, authError: null, user: decoded });
+          } else {
             set({ token: null, authError: "Invalid token", user: null });
           }
         } else {
@@ -95,7 +100,6 @@ var init_authenticationStore = __esm({
         }
       },
       clearToken: () => {
-        localStorage.removeItem(TOKEN_KEY);
         set({ token: null, authError: null, user: null });
       }
     }));
@@ -227,7 +231,7 @@ function emitAuthTokenChanged(token) {
     detail: { token }
   }));
 }
-var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, AuthenticationService, authenticationService;
+var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, readLocalStorage, writeLocalStorage, AuthenticationService, authenticationService;
 var init_authenticationService = __esm({
   "src/services/auth/authenticationService.ts"() {
     "use strict";
@@ -235,21 +239,103 @@ var init_authenticationService = __esm({
     init_debugLogger();
     TOKEN_KEY2 = "authToken";
     AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+    readLocalStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY2);
+      } catch {
+        return null;
+      }
+    };
+    writeLocalStorage = (token) => {
+      try {
+        if (typeof localStorage === "undefined") return;
+        if (token) localStorage.setItem(TOKEN_KEY2, token);
+        else localStorage.removeItem(TOKEN_KEY2);
+      } catch {
+      }
+    };
     AuthenticationService = class {
+      storageMode = "localStorage";
+      persistence = null;
+      handlers = {};
+      /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+      revision = 0;
+      refreshInFlight = null;
+      lastPersist = Promise.resolve();
+      /**
+       * Pick the storage contract for this host. Call once at boot, before the
+       * first `setToken`. Switching modes never moves a token by itself: the
+       * host migrates (e.g. reads the legacy localStorage value, then clears it).
+       */
+      configureSession(config) {
+        this.storageMode = config.storage;
+        this.persistence = config.persistence ?? null;
+        this.handlers = config.handlers ?? {};
+      }
+      getStorageMode() {
+        return this.storageMode;
+      }
+      getSessionRevision() {
+        return this.revision;
+      }
       getToken() {
-        const token = localStorage.getItem(TOKEN_KEY2);
-        return token;
+        if (this.storageMode === "memory") {
+          return useAuthenticationStore.getState().token;
+        }
+        return readLocalStorage();
       }
       setToken(token) {
-        localStorage.setItem(TOKEN_KEY2, token);
+        this.revision += 1;
+        if (this.storageMode === "localStorage") {
+          writeLocalStorage(token);
+        } else {
+          writeLocalStorage(null);
+        }
         useAuthenticationStore.getState().setToken(token);
+        this.mirror(() => this.persistence?.write(token));
         emitAuthTokenChanged(token);
       }
       clearToken() {
-        localStorage.removeItem(TOKEN_KEY2);
+        this.revision += 1;
+        const current = this.getToken() ?? useAuthenticationStore.getState().token;
+        try {
+          this.handlers.beforeClear?.(current);
+        } catch (error) {
+          debugLogger.warn("Auth beforeClear handler failed", { error });
+        }
+        writeLocalStorage(null);
         useAuthenticationStore.getState().clearToken();
+        this.mirror(() => this.persistence?.clear());
         emitAuthTokenChanged(null);
       }
+      /** True when the host registered a silent refresh path. */
+      canRefresh() {
+        return typeof this.handlers.refresh === "function";
+      }
+      /**
+       * Ask the host for a fresh token. Concurrent callers share one attempt.
+       * Resolves false when no refresh path exists or it did not produce a token.
+       */
+      tryRefresh() {
+        const refresh = this.handlers.refresh;
+        if (!refresh) return Promise.resolve(false);
+        if (this.refreshInFlight) return this.refreshInFlight;
+        this.refreshInFlight = (async () => {
+          try {
+            return await refresh();
+          } catch (error) {
+            debugLogger.warn("Auth refresh handler failed", { error });
+            return false;
+          } finally {
+            this.refreshInFlight = null;
+          }
+        })();
+        return this.refreshInFlight;
+      }
+      /** Resolves once the most recent persistence write/clear has settled. */
+      whenPersisted() {
+        return this.lastPersist;
+      }
       isAuthenticated() {
         const token = useAuthenticationStore.getState().token;
         return !!token && !this.isTokenExpired(token);
@@ -279,6 +365,16 @@ var init_authenticationService = __esm({
           return null;
         }
       }
+      mirror(run) {
+        const attempt = (async () => {
+          try {
+            await run();
+          } catch (error) {
+            debugLogger.warn("Auth token persistence failed", { error });
+          }
+        })();
+        this.lastPersist = attempt;
+      }
     };
     authenticationService = new AuthenticationService();
   }
@@ -2331,13 +2427,35 @@ var init_gateway_service = __esm({
         });
         instance.interceptors.response.use(
           (response) => response,
-          (error) => {
+          async (error) => {
+            const retried = await this._retryAfterRefresh(instance, error);
+            if (retried) return retried;
             this._handleAuthFailure(error);
             return Promise.reject(this._normalizeAxiosError(error));
           }
         );
         return instance;
       }
+      /**
+       * A bare 401 on a host with a silent refresh path (HttpOnly refresh cookie,
+       * native device token) usually means the access token aged out mid-session.
+       * Refresh once and replay the request with the new token instead of
+       * signing the user out; a failed refresh falls through to the sign-out path.
+       */
+      async _retryAfterRefresh(instance, error) {
+        const config = error.config;
+        if (!config || config._banditAuthRetried || error.response?.status !== 401) return null;
+        if (!authenticationService.canRefresh()) return null;
+        const data = error.response?.data;
+        if (data?.code && data.code !== "TOKEN_EXPIRED") return null;
+        try {
+          if (!await authenticationService.tryRefresh()) return null;
+        } catch {
+          return null;
+        }
+        config._banditAuthRetried = true;
+        return instance.request(config);
+      }
       _normalizeAxiosError(error) {
         if (error.response) {
           return this._createHttpError(
@@ -9074,7 +9192,21 @@ var OSS_DEFAULT_FEATURES = {
 
 // src/contexts/FeatureFlagContext.tsx
 init_debugLogger();
+init_authenticationService();
 var import_jsx_runtime = require("react/jsx-runtime");
+var readSessionToken = (jwtStorageKey) => {
+  const fromStorage = () => {
+    try {
+      return localStorage.getItem(jwtStorageKey);
+    } catch {
+      return null;
+    }
+  };
+  if (jwtStorageKey && jwtStorageKey !== TOKEN_KEY2) {
+    return fromStorage() ?? authenticationService.getToken();
+  }
+  return authenticationService.getToken() ?? fromStorage();
+};
 var FeatureFlagContext = (0, import_react.createContext)(void 0);
 function decodeJWT(token) {
   try {
@@ -9140,7 +9272,7 @@ var FeatureFlagProvider = ({ config, children }) => {
     let effectiveTier = currentTier || subscriptionType || "oss";
     if (typeof window !== "undefined") {
       try {
-        const token = localStorage.getItem(jwtStorageKey);
+        const token = readSessionToken(jwtStorageKey);
         if (token) {
           jwtFound = true;
           const payload = decodeJWT(token);
@@ -9226,10 +9358,13 @@ var FeatureFlagProvider = ({ config, children }) => {
         setCurrentTier(e.detail.tier);
       }
     };
+    const handleSessionChange = () => refreshEvaluation();
     window.addEventListener("storage", handleStorageChange);
+    window.addEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
     window.addEventListener("bandit:tier-updated", handleTierUpdate);
     return () => {
       window.removeEventListener("storage", handleStorageChange);
+      window.removeEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
       window.removeEventListener("bandit:tier-updated", handleTierUpdate);
     };
   }, [refreshEvaluation, config.jwtStorageKey]);
@@ -10304,6 +10439,11 @@ init_common_types();
 init_authenticationService();
 init_debugLogger();
 init_indexedDBService();
+var sessionTokenFactory = (label) => () => {
+  const token = authenticationService.getToken();
+  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });
+  return token;
+};
 var AIProviderInitService = class _AIProviderInitService {
   static instance;
   constructor() {
@@ -10383,25 +10523,7 @@ var AIProviderInitService = class _AIProviderInitService {
       providerConfig = {
         type: "ollama" /* OLLAMA */,
         baseUrl: settings.ollamaUrl,
-        tokenFactory: () => {
-          let token = authenticationService.getToken();
-          if (!token) {
-            token = localStorage.getItem("authToken");
-          }
-          if (!token) {
-            try {
-              const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-              const authStore = useAuthenticationStore2.getState();
-              token = authStore.token;
-            } catch (e) {
-            }
-          }
-          debugLogger.info("AIProviderInit: Token factory called", {
-            hasToken: !!token,
-            localStorage: !!localStorage.getItem("authToken")
-          });
-          return token;
-        }
+        tokenFactory: sessionTokenFactory("Token factory called")
       };
       debugLogger.info("Using legacy Ollama config", providerConfig);
     }
@@ -10424,25 +10546,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const fallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: settings.ollamaUrl || "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(fallbackConfig);
@@ -10455,25 +10559,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const localFallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Local fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Local fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(localFallbackConfig);
@@ -10545,27 +10631,7 @@ var AIProviderInitService = class _AIProviderInitService {
         });
         return config;
       }
-      config.tokenFactory = () => {
-        let token = authenticationService.getToken();
-        if (!token && typeof localStorage !== "undefined") {
-          try {
-            token = localStorage.getItem("authToken");
-          } catch {
-          }
-        }
-        if (!token) {
-          try {
-            const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-            const authStore = useAuthenticationStore2.getState();
-            token = authStore.token;
-          } catch {
-          }
-        }
-        debugLogger.info("AIProviderInit: Token factory resolved auth token", {
-          hasToken: !!token
-        });
-        return token;
-      };
+      config.tokenFactory = sessionTokenFactory("Token factory resolved auth token");
     }
     return config;
   }