@byline/host-tanstack-start 3.21.0 → 4.0.0

package/src/auth/auth-context.test.node.ts

@@ -28,6 +28,7 @@ const mocks = vi.hoisted(() => ({
   getCookie: vi.fn(),
   setCookie: vi.fn(),
   getRequestHeader: vi.fn(),
+  getRequest: vi.fn(),
 }))
 
 vi.mock('@byline/core', async () => {
@@ -47,6 +48,7 @@ vi.mock('@tanstack/react-start/server', () => ({
   getCookie: mocks.getCookie,
   setCookie: mocks.setCookie,
   getRequestHeader: mocks.getRequestHeader,
+  getRequest: mocks.getRequest,
 }))
 
 const { verifyAccessToken, refreshSession, getCookie, setCookie } = mocks
@@ -70,6 +72,12 @@ function stubActor() {
 describe('getAdminRequestContext', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    // Default: no Start request in scope, so every call resolves fresh.
+    // The per-request memoization tests below override this with a
+    // stable request object.
+    mocks.getRequest.mockImplementation(() => {
+      throw new Error('No StartEvent found in AsyncLocalStorage')
+    })
   })
 
   afterEach(() => {
@@ -212,4 +220,83 @@ describe('getAdminRequestContext', () => {
     const clears = setCookie.mock.calls.filter((c) => c[2]?.maxAge === 0)
     expect(clears.length).toBe(2)
   })
+
+  describe('per-request memoization', () => {
+    it('returns the same context instance — and requestId — for every call in one request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'valid-access',
+        byline_refresh_token: 'some-refresh',
+      })
+      verifyAccessToken.mockResolvedValue({ actor: stubActor() })
+
+      const first = await getAdminRequestContext()
+      const second = await getAdminRequestContext()
+
+      // Reads sharing a ReadContext bind one request authority; the token
+      // includes requestId, so it must be stable within a request.
+      expect(second).toBe(first)
+      expect(second.requestId).toBe(first.requestId)
+      expect(verifyAccessToken).toHaveBeenCalledTimes(1)
+    })
+
+    it('resolves independently across different requests', async () => {
+      cookiesReturn({
+        byline_access_token: 'valid-access',
+        byline_refresh_token: 'some-refresh',
+      })
+      verifyAccessToken.mockResolvedValue({ actor: stubActor() })
+
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      const first = await getAdminRequestContext()
+      mocks.getRequest.mockReturnValue({ id: 'request-b' })
+      const second = await getAdminRequestContext()
+
+      expect(second).not.toBe(first)
+      expect(second.requestId).not.toBe(first.requestId)
+      expect(verifyAccessToken).toHaveBeenCalledTimes(2)
+    })
+
+    it('burns at most one refresh rotation per request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'stale-access',
+        byline_refresh_token: 'valid-refresh',
+      })
+      const actor = stubActor()
+      verifyAccessToken.mockRejectedValueOnce(new Error('expired')).mockResolvedValueOnce({ actor })
+      refreshSession.mockResolvedValueOnce({
+        accessToken: 'fresh-access',
+        refreshToken: 'fresh-refresh',
+        accessTokenExpiresAt: new Date(Date.now() + 15 * 60_000),
+        refreshTokenExpiresAt: new Date(Date.now() + 30 * 24 * 60 * 60_000),
+      })
+
+      const first = await getAdminRequestContext()
+      // A second unmemoized call would re-run the refresh dance against the
+      // request's stale cookie — now already rotated — and sign the admin out.
+      const second = await getAdminRequestContext()
+
+      expect(second).toBe(first)
+      expect(refreshSession).toHaveBeenCalledTimes(1)
+    })
+
+    it('memoizes the unauthenticated rejection within one request', async () => {
+      mocks.getRequest.mockReturnValue({ id: 'request-a' })
+      cookiesReturn({
+        byline_access_token: 'stale',
+        byline_refresh_token: 'bad-refresh',
+      })
+      verifyAccessToken.mockRejectedValue(new Error('expired'))
+      refreshSession.mockRejectedValue(new Error('revoked'))
+
+      await expect(getAdminRequestContext()).rejects.toMatchObject({
+        code: AuthErrorCodes.UNAUTHENTICATED,
+      })
+      await expect(getAdminRequestContext()).rejects.toMatchObject({
+        code: AuthErrorCodes.UNAUTHENTICATED,
+      })
+      expect(refreshSession).toHaveBeenCalledTimes(1)
+    })
+  })
 })

package/src/auth/auth-context.ts

@@ -33,6 +33,19 @@
  * Burns a refresh-token rotation only when the access token actually
  * fails verification — not on every request. The "one session" UX is
  * the consequence of this helper working invisibly behind each call.
+ *
+ * Resolution is memoized per request (`oncePerRequest`): every call within
+ * one logical request returns the same `RequestContext` instance — same
+ * actor snapshot, same `requestId`. Two invariants depend on this:
+ *
+ *   - The read-authorization layer binds each `ReadContext` to one
+ *     immutable authority token that includes `requestId`; a fresh id per
+ *     call makes any two reads sharing a `ReadContext` (the admin tree
+ *     view, hook-threaded nested reads) throw
+ *     'ReadContext cannot be reused across request authorities'.
+ *   - The refresh path rotates the refresh token; a second unmemoized call
+ *     in the same request would re-run the dance against the
+ *     already-rotated cookie and sign the admin out.
  */
 
 import { ERR_UNAUTHENTICATED, type RequestContext } from '@byline/auth'
@@ -45,6 +58,7 @@ import {
   readRefreshTokenCookie,
   setSessionCookies,
 } from './auth-cookies.js'
+import { oncePerRequest } from './request-scope.js'
 
 function requireSessionProvider() {
   const provider = getServerConfig().sessionProvider
@@ -58,6 +72,10 @@ function requireSessionProvider() {
 }
 
 export async function getAdminRequestContext(): Promise<RequestContext> {
+  return oncePerRequest('byline:admin-request-context', resolveAdminRequestContext)
+}
+
+async function resolveAdminRequestContext(): Promise<RequestContext> {
   const provider = requireSessionProvider()
 
   const accessToken = readAccessTokenCookie()

package/src/auth/request-scope.test.node.ts

@@ -0,0 +1,93 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Unit coverage for per-request memoization. Mocks the Start runtime's
+ * `getRequest` so "which request am I in" can be simulated: a stable
+ * object per request, or a throw when running outside a request.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getRequest: vi.fn(),
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: mocks.getRequest,
+}))
+
+import { oncePerRequest } from './request-scope.js'
+
+describe('oncePerRequest', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getRequest.mockImplementation(() => {
+      throw new Error('No StartEvent found in AsyncLocalStorage')
+    })
+  })
+
+  it('resolves the factory once per request per key', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    const first = await oncePerRequest('ctx', factory)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).toBe(first)
+    expect(factory).toHaveBeenCalledTimes(1)
+  })
+
+  it('keys memoization by request identity', async () => {
+    const requestA = { id: 'a' }
+    const requestB = { id: 'b' }
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    mocks.getRequest.mockReturnValue(requestA)
+    const first = await oncePerRequest('ctx', factory)
+    mocks.getRequest.mockReturnValue(requestB)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).not.toBe(first)
+    expect(factory).toHaveBeenCalledTimes(2)
+  })
+
+  it('isolates entries by key within one request', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const admin = vi.fn(async () => 'admin-context')
+    const publicCtx = vi.fn(async () => 'public-context')
+
+    await expect(oncePerRequest('admin', admin)).resolves.toBe('admin-context')
+    await expect(oncePerRequest('public', publicCtx)).resolves.toBe('public-context')
+    await expect(oncePerRequest('admin', admin)).resolves.toBe('admin-context')
+
+    expect(admin).toHaveBeenCalledTimes(1)
+    expect(publicCtx).toHaveBeenCalledTimes(1)
+  })
+
+  it('memoizes rejections for the remainder of the request', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const factory = vi.fn(async () => {
+      throw new Error('no admin session')
+    })
+
+    await expect(oncePerRequest('ctx', factory)).rejects.toThrow('no admin session')
+    await expect(oncePerRequest('ctx', factory)).rejects.toThrow('no admin session')
+    expect(factory).toHaveBeenCalledTimes(1)
+  })
+
+  it('runs unmemoized outside the Start runtime', async () => {
+    const factory = vi.fn(async () => ({ token: Math.random() }))
+
+    const first = await oncePerRequest('ctx', factory)
+    const second = await oncePerRequest('ctx', factory)
+
+    expect(second).not.toBe(first)
+    expect(factory).toHaveBeenCalledTimes(2)
+  })
+})

package/src/auth/request-scope.ts

@@ -0,0 +1,62 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Per-request memoization for `RequestContext` factories.
+ *
+ * `RequestContext.requestId` is documented as "per logical request", and
+ * the read-authorization layer binds every `ReadContext` to one immutable
+ * request authority whose token includes that id. A factory that mints a
+ * fresh context per call breaks both contracts as soon as two reads share
+ * a `ReadContext` (the admin tree view, hook-threaded nested reads):
+ * the second bind sees a different authority token and throws
+ * 'ReadContext cannot be reused across request authorities'.
+ *
+ * Memoizing on the current Start request makes every context factory
+ * request-stable. It also means at most one session verification — and at
+ * most one refresh-token rotation — per request, instead of one per call.
+ */
+
+import { getRequest } from '@tanstack/react-start/server'
+
+const requestScopes = new WeakMap<object, Map<string, Promise<unknown>>>()
+
+/**
+ * Resolve `factory` at most once per HTTP request for a given `key`. The
+ * returned promise is memoized on the current Start request — rejections
+ * included, since a request's cookies cannot change mid-flight and retrying
+ * a failed refresh would burn a second rotation on an already-rotated
+ * token. Outside the Start runtime (seed scripts, unit tests, background
+ * jobs) there is no request to key on and the factory runs unmemoized.
+ */
+export function oncePerRequest<T>(key: string, factory: () => Promise<T>): Promise<T> {
+  const request = currentRequest()
+  if (!request) return factory()
+
+  let scope = requestScopes.get(request)
+  if (!scope) {
+    scope = new Map()
+    requestScopes.set(request, scope)
+  }
+
+  const existing = scope.get(key)
+  if (existing) return existing as Promise<T>
+
+  const pending = factory()
+  scope.set(key, pending)
+  return pending
+}
+
+function currentRequest(): object | undefined {
+  try {
+    return getRequest()
+  } catch {
+    // No StartEvent in AsyncLocalStorage — running outside a request.
+    return undefined
+  }
+}

package/src/integrations/abilities.tsx

@@ -38,15 +38,25 @@
 import type React from 'react'
 import { useRouteContext } from '@tanstack/react-router'
 
-/** Route id of the admin shell — the layout route that owns `user` on context. */
-const ADMIN_ROUTE_ID = '/_byline/admin' as const
+import { getAdminRouteId } from '../routes/admin-path.js'
+
+interface AbilityRouteContext {
+  user: {
+    is_super_admin: boolean
+    abilities: string[]
+  }
+}
+
+function useAbilityRouteContext(): AbilityRouteContext {
+  return useRouteContext({ from: getAdminRouteId() as never }) as AbilityRouteContext
+}
 
 /**
  * `true` when the current admin holds the given ability (or is a
  * super-admin). Cosmetic — see file-level docstring.
  */
 export function useAbility(ability: string): boolean {
-  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  const { user } = useAbilityRouteContext()
   if (user.is_super_admin) return true
   return user.abilities.includes(ability)
 }
@@ -62,7 +72,7 @@ export function useAbilities(): {
   hasAny: (abilities: readonly string[]) => boolean
   isSuperAdmin: boolean
 } {
-  const { user } = useRouteContext({ from: ADMIN_ROUTE_ID })
+  const { user } = useAbilityRouteContext()
   const has = (ability: string): boolean => user.is_super_admin || user.abilities.includes(ability)
   const hasAny = (abilities: readonly string[]): boolean =>
     user.is_super_admin || abilities.some((key) => user.abilities.includes(key))

package/src/integrations/byline-client.ts

@@ -31,10 +31,12 @@ export function getAdminBylineClient(): BylineClient {
   if (cachedClient) return cachedClient
   cachedClient = createBylineClient({
     config: getServerConfig(),
-    // Resolved per-call so each server fn picks up the actor from the
-    // current request's session cookies. `getAdminRequestContext` runs the
-    // refresh dance on its own and throws `ERR_UNAUTHENTICATED` when no
-    // session is present — the client surfaces the throw verbatim.
+    // Resolved from the current request's session cookies, memoized per
+    // request: every read in one request binds the same context instance
+    // (and requestId), which the ReadContext authority check requires.
+    // `getAdminRequestContext` runs the refresh dance on its own and throws
+    // `ERR_UNAUTHENTICATED` when no session is present — the client
+    // surfaces the throw verbatim.
     requestContext: getAdminRequestContext,
   })
   return cachedClient

package/src/integrations/byline-public-client.ts

@@ -33,21 +33,35 @@
  * process lifetime.
  *
  * Companion: `getAdminBylineClient` in `./byline-client.ts` for the
- * admin webapp's authenticated reads (resolves a fresh `RequestContext`
- * from session cookies on every call).
+ * admin webapp's authenticated reads (resolves the `RequestContext`
+ * from session cookies, memoized per request).
  */
 
-import { createRequestContext } from '@byline/auth'
+import { createRequestContext, type RequestContext } from '@byline/auth'
 import { type BylineClient, createBylineClient } from '@byline/client'
 import { getServerConfig } from '@byline/core'
 
+import { oncePerRequest } from '../auth/request-scope.js'
+
+/**
+ * Anonymous, published-only context — memoized per request so the
+ * context (and its requestId) is stable across every read in one
+ * request: reads sharing a ReadContext must bind a single request
+ * authority.
+ */
+export function resolvePublicRequestContext(): Promise<RequestContext> {
+  return oncePerRequest('byline:public-request-context', async () =>
+    createRequestContext({ readMode: 'published' })
+  )
+}
+
 let cachedClient: BylineClient | undefined
 
 export function getPublicBylineClient(): BylineClient {
   if (cachedClient) return cachedClient
   cachedClient = createBylineClient({
     config: getServerConfig(),
-    requestContext: () => createRequestContext({ readMode: 'published' }),
+    requestContext: resolvePublicRequestContext,
   })
   return cachedClient
 }

package/src/integrations/byline-viewer-client.ts

@@ -49,6 +49,7 @@ import { getServerConfig } from '@byline/core'
 
 import { getAdminRequestContext } from '../auth/auth-context.js'
 import { readPreviewCookie } from '../auth/preview-cookies.js'
+import { oncePerRequest } from '../auth/request-scope.js'
 
 let cachedClient: BylineClient | undefined
 
@@ -56,28 +57,39 @@ export function getViewerBylineClient(): BylineClient {
   if (cachedClient) return cachedClient
   cachedClient = createBylineClient({
     config: getServerConfig(),
-    requestContext: async () => {
-      // No preview cookie → behave exactly like the public client.
-      // Cheap path; no JWT verification, no DB lookup.
-      if (!readPreviewCookie()) {
-        return createRequestContext({ readMode: 'published' })
-      }
-
-      // Preview cookie present → try the admin context. A failure means
-      // the cookie is stale (admin signed out, session expired, refresh
-      // rejected). We swallow the error and fall back to the public
-      // context so the page renders instead of erroring.
-      try {
-        const ctx = await getAdminRequestContext()
-        return { ...ctx, readMode: 'any' }
-      } catch {
-        return createRequestContext({ readMode: 'published' })
-      }
-    },
+    requestContext: resolveViewerRequestContext,
   })
   return cachedClient
 }
 
+/**
+ * Preview-aware viewer context — memoized per request so every read in
+ * one request binds the same context instance (and requestId): reads
+ * sharing a ReadContext must resolve a single request authority.
+ */
+export function resolveViewerRequestContext() {
+  return oncePerRequest('byline:viewer-request-context', resolveViewerContext)
+}
+
+async function resolveViewerContext() {
+  // No preview cookie → behave exactly like the public client.
+  // Cheap path; no JWT verification, no DB lookup.
+  if (!readPreviewCookie()) {
+    return createRequestContext({ readMode: 'published' })
+  }
+
+  // Preview cookie present → try the admin context. A failure means
+  // the cookie is stale (admin signed out, session expired, refresh
+  // rejected). We swallow the error and fall back to the public
+  // context so the page renders instead of erroring.
+  try {
+    const ctx = await getAdminRequestContext()
+    return { ...ctx, readMode: 'any' as const }
+  } catch {
+    return createRequestContext({ readMode: 'published' })
+  }
+}
+
 /**
  * Resolve whether the current request should surface non-published
  * versions. True iff the preview cookie is set **and** a valid admin

package/src/integrations/request-context-contract.test.node.ts

@@ -0,0 +1,131 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Cross-layer contract test: a real `BylineClient` wired to the real
+ * cookie-derived host factory (`getAdminRequestContext`) under a mocked
+ * Start request, running two operations that share one `ReadContext`.
+ *
+ * This is the seam every per-layer suite missed when the admin tree view
+ * broke with 'ReadContext cannot be reused across request authorities':
+ * client tests used stable test contexts, host auth tests called the
+ * factory once, and tree tests mocked the handle. Here the factory's
+ * request-stability contract (see `BylineClientConfig.requestContext`)
+ * is exercised end-to-end through the SDK's authority binding.
+ */
+
+import { AdminAuth } from '@byline/auth'
+import { createBylineClient } from '@byline/client'
+import type { CollectionDefinition, IDbAdapter } from '@byline/core'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  verifyAccessToken: vi.fn(),
+  refreshSession: vi.fn(),
+  getCookie: vi.fn(),
+  setCookie: vi.fn(),
+  getRequestHeader: vi.fn(),
+  getRequest: vi.fn(),
+}))
+
+vi.mock('@byline/core', async () => {
+  const actual = await vi.importActual<typeof import('@byline/core')>('@byline/core')
+  return {
+    ...actual,
+    getServerConfig: () => ({
+      sessionProvider: {
+        verifyAccessToken: mocks.verifyAccessToken,
+        refreshSession: mocks.refreshSession,
+      },
+    }),
+  }
+})
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getCookie: mocks.getCookie,
+  setCookie: mocks.setCookie,
+  getRequestHeader: mocks.getRequestHeader,
+  getRequest: mocks.getRequest,
+}))
+
+import { createReadContext } from '@byline/core'
+
+import { getAdminRequestContext } from '../auth/auth-context.js'
+
+const postsCollection: CollectionDefinition = {
+  path: 'posts',
+  labels: { singular: 'Post', plural: 'Posts' },
+  fields: [{ name: 'title', type: 'text', label: 'Title' }],
+}
+
+function mockDb(): IDbAdapter {
+  return {
+    commands: { collections: {}, documents: {}, counters: {} },
+    queries: {
+      collections: {
+        getCollectionByPath: vi.fn().mockResolvedValue({ id: 'col-1', version: 1 }),
+      },
+      documents: {
+        findDocuments: vi.fn().mockResolvedValue({ documents: [], total: 0 }),
+        getDocumentsByDocumentIds: vi.fn().mockResolvedValue([]),
+      },
+    },
+  } as unknown as IDbAdapter
+}
+
+describe('host factory ↔ client authority contract', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getCookie.mockImplementation((name: string) =>
+      name === 'byline_access_token' ? 'valid-access' : undefined
+    )
+    mocks.verifyAccessToken.mockResolvedValue({
+      actor: new AdminAuth({ id: 'admin-1', abilities: ['collections.posts.read'] }),
+    })
+  })
+
+  it('two reads sharing a ReadContext bind one authority within a request', async () => {
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    const db = mockDb()
+    const beforeRead = vi.fn(() => ({ title: 'scoped' }))
+    const client = createBylineClient({
+      db,
+      collections: [{ ...postsCollection, hooks: { beforeRead } }],
+      requestContext: getAdminRequestContext,
+    })
+    const readContext = createReadContext()
+
+    // The admin tree view shape: two top-level reads, one shared ReadContext.
+    await client.collection('posts').find({ status: 'any', _readContext: readContext })
+    await client.collection('posts').find({ status: 'any', _readContext: readContext })
+
+    expect(db.queries.documents.findDocuments).toHaveBeenCalledTimes(2)
+    // One session verification and one beforeRead compile for the whole
+    // request — the factory resolved a single request-stable context.
+    expect(mocks.verifyAccessToken).toHaveBeenCalledTimes(1)
+    expect(beforeRead).toHaveBeenCalledTimes(1)
+  })
+
+  it('still rejects a ReadContext carried across two different requests', async () => {
+    const db = mockDb()
+    const client = createBylineClient({
+      db,
+      collections: [{ ...postsCollection, hooks: { beforeRead: () => ({ title: 'scoped' }) } }],
+      requestContext: getAdminRequestContext,
+    })
+    const readContext = createReadContext()
+
+    mocks.getRequest.mockReturnValue({ id: 'request-a' })
+    await client.collection('posts').find({ status: 'any', _readContext: readContext })
+
+    mocks.getRequest.mockReturnValue({ id: 'request-b' })
+    await expect(
+      client.collection('posts').find({ status: 'any', _readContext: readContext })
+    ).rejects.toThrow('cannot be reused across request authorities')
+  })
+})