@c1m-public/platform-auth 0.2.0 → 0.4.0

package/dist/session-gate.js

@@ -0,0 +1,33 @@
+import { decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon } from "./token.js";
+// Pure decision for a BFF proxy/middleware: given the request's session cookies and path
+// class, decide pass / bounce / clear. The proxy owns response construction.
+export function hasSessionShape(token) {
+    if (!token)
+        return false;
+    const payload = decodeTokenPayload(token);
+    return Boolean(payload?.user_id || payload?.actor_id || payload?.customer_id || payload?.sub);
+}
+export async function evaluateSessionGate(input) {
+    const { accessToken, refreshToken, audience, refresher, isPublic, isLoginPath, isApiPath } = input;
+    const live = !!accessToken && hasSessionShape(accessToken) && hasTokenAudience(accessToken, audience) && !isTokenExpired(accessToken);
+    if (live) {
+        if (isPublic && isLoginPath)
+            return { kind: "redirect_home" };
+        if (refreshToken && isTokenExpiringSoon(accessToken, input.expiringSoonBufferSeconds)) {
+            const refreshed = await refresher.refresh(refreshToken);
+            if (refreshed)
+                return { kind: "pass", refreshed };
+        }
+        return { kind: "pass" };
+    }
+    if (refreshToken) {
+        const refreshed = await refresher.refresh(refreshToken);
+        if (refreshed)
+            return isPublic ? { kind: "redirect_home", refreshed } : { kind: "pass", refreshed };
+    }
+    if (isPublic)
+        return { kind: "anonymous_public" };
+    if (isApiPath)
+        return { kind: "unauthorized_api" };
+    return { kind: "redirect_login" };
+}

package/dist/session-refresh.d.ts

@@ -1,33 +1,24 @@
+import { type Resolvable } from "./internal.js";
 /**
- * Coalesced refresh-token exchange for a BFF proxy/middleware. Concurrent
- * requests carrying the same refresh token share one backend call for a short
- * window, so a burst of parallel page/API requests after expiry cannot rotate
- * the family more than once. Best-effort inside a single process only — the
- * backend's reuse detection remains the correctness guarantee.
+ * Coalesced refresh-token exchange for a BFF proxy: same refresh token within
+ * a short window shares one backend call. Per-process best effort; backend
+ * reuse detection is the correctness guarantee.
  */
 export interface RefreshedSession {
     accessToken: string;
     refreshToken?: string;
 }
 export interface SessionRefresherConfig {
-    /** Backend origin (no /api/v1). */
-    apiUrl: string | (() => string);
-    /** Refresh endpoint path, e.g. /api/v1/platform/auth/refresh. */
+    apiUrl: Resolvable;
     refreshPath: string;
-    /** X-Client-Type sent to the backend. */
     clientType: string;
-    /** Audience the refreshed access token must carry; anything else is rejected. */
     audience: string;
-    /** How long a completed refresh keeps answering for the same token. Default 5 s. */
     singleflightTtlMs?: number;
-    /** Bound on remembered in-flight/recent refreshes. Default 1000. */
     maxSingleflights?: number;
     fetchTimeoutMs?: number;
 }
 export declare function createSessionRefresher(config: SessionRefresherConfig): {
-    /** Exchange a refresh token; identical concurrent calls share one backend request. */
     refresh(refreshToken: string): Promise<RefreshedSession | null>;
-    /** Test/inspection hook: number of remembered refreshes. */
     size(): number;
 };
 export type SessionRefresher = ReturnType<typeof createSessionRefresher>;

package/dist/session-refresh.js

@@ -1,23 +1,21 @@
+import { DEFAULT_FETCH_TIMEOUT_MS, resolveValue, timedFetch } from "./internal.js";
 import { hasTokenAudience, parseAuthResponse } from "./token.js";
 const DEFAULT_TTL_MS = 5000;
 const DEFAULT_MAX = 1000;
-const DEFAULT_TIMEOUT_MS = 10_000;
 export function createSessionRefresher(config) {
     const ttl = config.singleflightTtlMs ?? DEFAULT_TTL_MS;
     const max = config.maxSingleflights ?? DEFAULT_MAX;
-    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const timeoutMs = config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
     const inflight = new Map();
     async function perform(refreshToken) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), timeoutMs);
         try {
-            const apiUrl = typeof config.apiUrl === "function" ? config.apiUrl() : config.apiUrl;
-            const response = await fetch(`${apiUrl}${config.refreshPath}`, {
-                method: "POST",
-                headers: { "Content-Type": "application/json", "X-Client-Type": config.clientType },
-                body: JSON.stringify({ refresh_token: refreshToken }),
-                cache: "no-store",
-                signal: controller.signal,
+            const response = await timedFetch(`${resolveValue(config.apiUrl)}${config.refreshPath}`, {
+                init: {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "X-Client-Type": config.clientType },
+                    body: JSON.stringify({ refresh_token: refreshToken }),
+                },
+                timeoutMs,
             });
             if (!response.ok)
                 return null;
@@ -29,9 +27,6 @@ export function createSessionRefresher(config) {
         catch {
             return null;
         }
-        finally {
-            clearTimeout(timer);
-        }
     }
     function prune(now) {
         for (const [token, entry] of inflight) {
@@ -46,7 +41,6 @@ export function createSessionRefresher(config) {
         }
     }
     return {
-        /** Exchange a refresh token; identical concurrent calls share one backend request. */
         refresh(refreshToken) {
             const now = Date.now();
             prune(now);
@@ -61,7 +55,6 @@ export function createSessionRefresher(config) {
             inflight.set(refreshToken, { expiresAt: now + ttl, promise });
             return promise;
         },
-        /** Test/inspection hook: number of remembered refreshes. */
         size() {
             return inflight.size;
         },

package/dist/token.d.ts

@@ -1,8 +1,3 @@
-/**
- * Read-only access-token payload helpers. Decoding is not verification: these
- * helpers exist so a BFF can route on audience/expiry before calling the
- * backend, which remains the security boundary.
- */
 export interface SessionUser {
     id: string;
     email: string;
@@ -25,6 +20,7 @@ export type TokenPayload = Record<string, unknown> & {
     exp?: number;
     iat?: number;
     actor_id?: string;
+    effective_user_id?: string;
     customer_id?: string;
     user_id?: string;
     aud?: string | string[];

package/dist/token.js

@@ -1,8 +1,4 @@
-/**
- * Read-only access-token payload helpers. Decoding is not verification: these
- * helpers exist so a BFF can route on audience/expiry before calling the
- * backend, which remains the security boundary.
- */
+// Access-token payload reads for BFF routing. Decoding is not verification; the backend is the boundary.
 function readStringClaim(value, fallback = "") {
     return typeof value === "string" ? value : fallback;
 }
@@ -13,7 +9,6 @@ export function decodeBase64Url(input) {
     const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
     const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
     try {
-        // Node >= 20 and every browser expose atob globally.
         const binary = globalThis.atob(padded);
         const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
         return new TextDecoder().decode(bytes);
@@ -69,7 +64,9 @@ export function decodeDefaultSession(token) {
     const decoded = decodeTokenPayload(token);
     if (!decoded)
         return null;
-    const actorId = decoded.actor_id ||
+    // effective_user_id wins: a support-session token re-identifies as the impersonated user.
+    const actorId = decoded.effective_user_id ||
+        decoded.actor_id ||
         decoded.customer_id ||
         decoded.user_id ||
         (typeof decoded.sub === "string" ? decoded.sub : undefined);

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "type": "module",
   "license": "MIT",
-  "description": "Framework-neutral session helpers for C1M platform surfaces: token payload reads, forwarded client headers, safe return paths, device identity cookies, and the first-party session handoff (target callback + source start) built on Web Request/Response",
+  "description": "Server-side session and authorization helpers for C1M platform surfaces: token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh, plus the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings under ./access",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cloud1mediaLtd/mml-js.git",
@@ -19,6 +19,18 @@
     "./next": {
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
+    },
+    "./access": {
+      "types": "./dist/access/index.d.ts",
+      "default": "./dist/access/index.js"
+    },
+    "./access/next": {
+      "types": "./dist/access/next.d.ts",
+      "default": "./dist/access/next.js"
+    },
+    "./access/react": {
+      "types": "./dist/access/react.d.ts",
+      "default": "./dist/access/react.js"
     }
   },
   "files": [
@@ -31,13 +43,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "server-only": "0.0.1"
-  },
-  "devDependencies": {
-    "typescript": "5.9.3",
-    "vitest": "^4.1.4"
-  },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "pnpm clean && tsc -p tsconfig.build.json",
@@ -45,5 +50,29 @@
     "test": "vitest",
     "test:run": "vitest run",
     "type-check": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "server-only": "0.0.1"
+  },
+  "devDependencies": {
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "next": "16.3.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "typescript": "5.9.3",
+    "vitest": "^4.1.4"
+  },
+  "peerDependencies": {
+    "next": ">=15",
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
   }
-}
+}