@calimero-network/mero-react 4.3.2 → 4.3.4

package/dist/index.cjs

@@ -67,12 +67,85 @@ function resolveTrustedNodeUrl(params) {
   return { url: null, rejected: true };
 }
 
+// src/auth/token-adoption.ts
+var HOUR_MS = 36e5;
+function decodeJwtClaims(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    while (b64.length % 4) b64 += "=";
+    const payload = JSON.parse(atob(b64));
+    if (!payload || typeof payload !== "object") return null;
+    const { iat, exp } = payload;
+    return {
+      iat: typeof iat === "number" && iat > 0 ? iat : void 0,
+      exp: typeof exp === "number" && exp > 0 ? exp : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function expiresAtFromJwt(token, fallbackMs = Date.now() + HOUR_MS) {
+  const exp = decodeJwtClaims(token)?.exp;
+  return exp ? exp * 1e3 : fallbackMs;
+}
+function isCallbackNewer(callbackAccessToken, stored) {
+  const incoming = decodeJwtClaims(callbackAccessToken);
+  if (!incoming) return false;
+  const current = decodeJwtClaims(stored.access_token);
+  if (current) {
+    if (incoming.iat !== void 0 && current.iat !== void 0 && incoming.iat !== current.iat) {
+      return incoming.iat > current.iat;
+    }
+    if (incoming.exp !== void 0 && current.exp !== void 0 && incoming.exp !== current.exp) {
+      return incoming.exp > current.exp;
+    }
+    return false;
+  }
+  return incoming.exp !== void 0 && incoming.exp * 1e3 > stored.expires_at;
+}
+function resolveTokenAdoption(params) {
+  const { callbackAccessToken, callbackRefreshToken, callbackNodeUrl, stored, storedNodeUrl } = params;
+  const bundle = (refreshToken2) => ({
+    access_token: callbackAccessToken,
+    refresh_token: refreshToken2,
+    expires_at: expiresAtFromJwt(callbackAccessToken)
+  });
+  if (!stored?.access_token) {
+    return { adopt: true, tokens: bundle(callbackRefreshToken), reason: "fresh-login" };
+  }
+  const sameNode = !!storedNodeUrl && sameOrigin(callbackNodeUrl, storedNodeUrl);
+  if (!sameNode) {
+    return { adopt: true, tokens: bundle(callbackRefreshToken), reason: "node-changed" };
+  }
+  const refreshToken = callbackRefreshToken || stored.refresh_token;
+  if (isCallbackNewer(callbackAccessToken, stored)) {
+    return { adopt: true, tokens: bundle(refreshToken), reason: "newer" };
+  }
+  if (!stored.refresh_token && callbackRefreshToken) {
+    return {
+      adopt: true,
+      tokens: { ...stored, refresh_token: callbackRefreshToken },
+      reason: "fill-refresh"
+    };
+  }
+  return { adopt: false, reason: "stale" };
+}
+
 // src/storage/index.ts
 var STORAGE_KEYS = {
   ACCESS_TOKEN: "mero:access_token",
   REFRESH_TOKEN: "mero:refresh_token",
   EXPIRES_AT: "mero:expires_at",
   NODE_URL: "mero:node_url",
+  // The node the token bundle currently in the TokenStore was issued by. Distinct
+  // from NODE_URL, which `connectToNode` overwrites with the *target* node before
+  // redirecting to login — so at callback time NODE_URL names where we are going,
+  // not who minted the tokens we still hold. Telling those apart is what lets the
+  // SSO callback re-seed on a node change without mistaking a different node's
+  // bundle for a rotated one (see auth/token-adoption.ts).
+  TOKEN_NODE_URL: "mero:token_node_url",
   APPLICATION_ID: "mero:application_id",
   CONTEXT_ID: "mero:context_id",
   CONTEXT_IDENTITY: "mero:context_identity"
@@ -153,6 +226,18 @@ function clearNodeUrl() {
   if (!isLocalStorageAvailable()) return;
   localStorage.removeItem(STORAGE_KEYS.NODE_URL);
 }
+function getTokenNodeUrl() {
+  if (!isLocalStorageAvailable()) return null;
+  return localStorage.getItem(STORAGE_KEYS.TOKEN_NODE_URL);
+}
+function setTokenNodeUrl(url) {
+  if (!isLocalStorageAvailable()) return;
+  localStorage.setItem(STORAGE_KEYS.TOKEN_NODE_URL, url);
+}
+function clearTokenNodeUrl() {
+  if (!isLocalStorageAvailable()) return;
+  localStorage.removeItem(STORAGE_KEYS.TOKEN_NODE_URL);
+}
 function getApplicationId() {
   if (!isLocalStorageAvailable()) return null;
   return localStorage.getItem(STORAGE_KEYS.APPLICATION_ID);
@@ -218,21 +303,6 @@ function getPermissionsForMode(mode) {
       throw new Error(`Unsupported application mode: ${mode}`);
   }
 }
-function parseJwtExpiry(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length === 3) {
-      let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      while (b64.length % 4) b64 += "=";
-      const payload = JSON.parse(atob(b64));
-      if (payload.exp && payload.exp > 0) {
-        return payload.exp * 1e3;
-      }
-    }
-  } catch {
-  }
-  return Date.now() + 36e5;
-}
 function MeroProvider({
   children,
   mode,
@@ -330,9 +400,11 @@ function MeroProvider({
       const callback = callbackRef.current;
       let nodeFromCallback = null;
       if (callback) {
+        const initiatedNodeUrl = getNodeUrl();
+        const tokenNodeUrl = getTokenNodeUrl() ?? initiatedNodeUrl;
         const { url, rejected } = resolveTrustedNodeUrl({
           candidate: callback.nodeUrl,
-          initiated: getNodeUrl(),
+          initiated: initiatedNodeUrl,
           allowedNodeUrls
         });
         if (isBrowser) {
@@ -344,11 +416,21 @@ function MeroProvider({
             "[MeroProvider] OAuth callback node_url is not trusted (it does not match the node login was initiated with, nor `allowedNodeUrls`). Ignoring the callback; no tokens stored."
           );
         } else if (url) {
-          tokenStore.setTokens({
-            access_token: callback.accessToken,
-            refresh_token: callback.refreshToken,
-            expires_at: parseJwtExpiry(callback.accessToken)
+          const decision = resolveTokenAdoption({
+            callbackAccessToken: callback.accessToken,
+            callbackRefreshToken: callback.refreshToken,
+            callbackNodeUrl: url,
+            stored: tokenStore.getTokens(),
+            storedNodeUrl: tokenNodeUrl
           });
+          if (decision.adopt) {
+            tokenStore.setTokens(decision.tokens);
+            setTokenNodeUrl(url);
+          } else {
+            console.warn(
+              "[MeroProvider] Ignoring the SSO callback token bundle: it is stale (not newer than the tokens already stored for this node). Adopting it would replay an already-rotated refresh token, which the node revokes the whole token family for."
+            );
+          }
           if (callback.applicationId) {
             setApplicationId(callback.applicationId);
             if (active) setApplicationIdState(callback.applicationId);
@@ -2484,6 +2566,7 @@ exports.clearApplicationId = clearApplicationId;
 exports.clearContextId = clearContextId;
 exports.clearContextIdentity = clearContextIdentity;
 exports.clearNodeUrl = clearNodeUrl;
+exports.clearTokenNodeUrl = clearTokenNodeUrl;
 exports.cssVar = cssVar;
 exports.defaultMeroTheme = defaultMeroTheme;
 exports.discoverLocalNodes = discoverLocalNodes;
@@ -2491,6 +2574,7 @@ exports.getApplicationId = getApplicationId;
 exports.getContextId = getContextId;
 exports.getContextIdentity = getContextIdentity;
 exports.getNodeUrl = getNodeUrl;
+exports.getTokenNodeUrl = getTokenNodeUrl;
 exports.localNodeUrl = localNodeUrl;
 exports.localStorageTokenStorage = localStorageTokenStorage;
 exports.nodeEndpoint = nodeEndpoint;
@@ -2500,6 +2584,7 @@ exports.setApplicationId = setApplicationId;
 exports.setContextId = setContextId;
 exports.setContextIdentity = setContextIdentity;
 exports.setNodeUrl = setNodeUrl;
+exports.setTokenNodeUrl = setTokenNodeUrl;
 exports.themeToCssVars = themeToCssVars;
 exports.useAddGroupMembers = useAddGroupMembers;
 exports.useAppVersion = useAppVersion;