@calimero-network/mero-js 7.0.0 → 7.0.2

package/dist/index.mjs

@@ -32,6 +32,7 @@ function createTimeoutSignal(timeoutMs) {
 }
 
 // src/http-client/web-client.ts
+var TERMINAL_AUTH_ERRORS = /* @__PURE__ */ new Set(["token_reuse", "token_revoked"]);
 var HTTPError = class extends Error {
   constructor(status, statusText, url, headers, bodyText) {
     super(`HTTP ${status} ${statusText}`);
@@ -52,6 +53,14 @@ var HTTPError = class extends Error {
     };
   }
 };
+var AuthRevokedError = class extends HTTPError {
+  constructor(reason, status, statusText, url, headers, bodyText) {
+    super(status, statusText, url, headers, bodyText);
+    this.reason = reason;
+    this.name = "AuthRevokedError";
+    this.message = `Authentication revoked (${reason}): HTTP ${status} ${statusText}`;
+  }
+};
 function headersToRecord(headers) {
   const record = {};
   headers.forEach((value, key) => {
@@ -196,8 +205,27 @@ var WebHttpClient = class {
           response.headers,
           bodyText
         );
+        const authError = response.headers.get("x-auth-error");
+        if ((response.status === 401 || response.status === 403) && authError && TERMINAL_AUTH_ERRORS.has(authError)) {
+          this.refreshTokenPromise = null;
+          this.onTokenRefreshPromise = null;
+          if (this.transport.onAuthRevoked) {
+            try {
+              await this.transport.onAuthRevoked();
+            } catch {
+            }
+          }
+          throw new AuthRevokedError(
+            authError,
+            response.status,
+            response.statusText,
+            url,
+            response.headers,
+            bodyText
+          );
+        }
         const userAborted = init?.signal?.aborted === true;
-        if (response.status === 401 && this.transport.refreshToken && response.headers.get("x-auth-error") === "token_expired" && retryCount < MAX_RETRY_ATTEMPTS && !isStreamBody && !userAborted) {
+        if (response.status === 401 && this.transport.refreshToken && authError === "token_expired" && retryCount < MAX_RETRY_ATTEMPTS && !isStreamBody && !userAborted) {
           try {
             let refreshPromise = this.refreshTokenPromise;
             if (!refreshPromise) {
@@ -364,6 +392,7 @@ function createBrowserHttpClient(options) {
     getAuthToken: options.getAuthToken,
     onTokenRefresh: options.onTokenRefresh,
     refreshToken: options.refreshToken,
+    onAuthRevoked: options.onAuthRevoked,
     defaultHeaders: options.defaultHeaders,
     timeoutMs: options.timeoutMs,
     credentials: options.credentials,
@@ -389,6 +418,7 @@ function createNodeHttpClient(options) {
     getAuthToken: options.getAuthToken,
     onTokenRefresh: options.onTokenRefresh,
     refreshToken: options.refreshToken,
+    onAuthRevoked: options.onAuthRevoked,
     defaultHeaders: options.defaultHeaders,
     timeoutMs: options.timeoutMs,
     credentials: options.credentials,
@@ -1852,6 +1882,12 @@ _WsClient.MAX_BACKOFF_MS = 3e4;
 var WsClient = _WsClient;
 
 // src/mero-js.ts
+var REFRESH_LOCK_NAME = "mero-js:token-refresh";
+function getLockManager() {
+  const nav = globalThis.navigator;
+  const locks = nav?.locks;
+  return locks && typeof locks.request === "function" ? locks : null;
+}
 function expiresAtFromJwt(token, fallbackMs) {
   try {
     const parts = token.split(".");
@@ -1900,6 +1936,9 @@ var MeroJs = class {
           this.tokenStore?.setTokens(this.tokenData);
         }
       },
+      onAuthRevoked: () => {
+        this.clearToken();
+      },
       timeoutMs: this.config.timeoutMs,
       credentials: this.config.requestCredentials ?? (isTauri ? "omit" : void 0)
     });
@@ -2022,27 +2061,52 @@ var MeroJs = class {
     return this.tokenData;
   }
   /**
-   * Refresh the access token using the refresh token
+   * Refresh the access token. Single-flight: every caller (including the HTTP
+   * transport's 401 hook) goes through here.
+   *
+   * Refresh tokens are single-use (calimero-network/core#3083): each refresh
+   * consumes the presented token and returns a new one, and replaying a consumed
+   * token makes the server revoke the whole family. A refresh must therefore
+   * happen exactly once per rotation, which needs three layers:
+   *  - an in-process promise, so concurrent 401s in this instance share one call;
+   *  - a Web Lock (when available), so other tabs/webviews don't refresh at the
+   *    same time on the same stored token;
+   *  - a re-read of the token store inside the lock, so a bundle that another
+   *    instance already rotated is adopted instead of replaying a stale token.
    */
-  async refreshToken() {
-    if (!this.tokenData?.refresh_token) {
-      throw new Error("No refresh token available");
-    }
+  async performTokenRefresh() {
     if (this.refreshPromise) {
       return this.refreshPromise;
     }
-    this.refreshPromise = this.performTokenRefresh();
+    const triggeringAccessToken = this.tokenData?.access_token;
+    const promise = this.withRefreshLock(
+      () => this.performTokenRefreshLocked(triggeringAccessToken)
+    );
+    this.refreshPromise = promise;
     try {
-      const newToken = await this.refreshPromise;
-      return newToken;
+      return await promise;
     } finally {
-      this.refreshPromise = null;
+      if (this.refreshPromise === promise) {
+        this.refreshPromise = null;
+      }
     }
   }
+  /** Run `fn` under the cross-tab refresh lock, or directly if Web Locks are unavailable. */
+  withRefreshLock(fn) {
+    const locks = getLockManager();
+    return locks ? locks.request(REFRESH_LOCK_NAME, fn) : fn();
+  }
   /**
-   * Perform the actual token refresh
+   * Perform the actual token refresh. Runs with the refresh lock held.
    */
-  async performTokenRefresh() {
+  async performTokenRefreshLocked(triggeringAccessToken) {
+    const stored = this.tokenStore?.getTokens() ?? null;
+    if (stored?.refresh_token) {
+      this.tokenData = stored;
+      if (triggeringAccessToken && stored.access_token !== triggeringAccessToken) {
+        return stored;
+      }
+    }
     if (!this.tokenData?.refresh_token) {
       throw new Error("No refresh token available");
     }
@@ -2054,6 +2118,8 @@ var MeroJs = class {
       const accessToken = response.data.access_token;
       this.tokenData = {
         access_token: accessToken,
+        // The refresh token is rotated on every refresh — persist the new one or
+        // the next refresh replays a consumed token.
         refresh_token: response.data.refresh_token,
         expires_at: expiresAtFromJwt(accessToken, Date.now() + 36e5)
       };
@@ -2069,6 +2135,7 @@ var MeroJs = class {
    * Clear the current token
    */
   clearToken() {
+    this.refreshPromise = null;
     this.tokenData = null;
     this.tokenStore?.clear();
   }
@@ -2224,6 +2291,7 @@ function withoutCap(mask, cap) {
 export {
   AdminApiClient,
   AuthApiClient,
+  AuthRevokedError,
   CAPABILITIES,
   CloudClient,
   HTTPError,