@calimero-network/mero-react 4.3.2 → 4.3.4

package/dist/index.d.cts

@@ -761,6 +761,18 @@ declare function setNodeUrl(url: string): void;
  * Clear the node URL
  */
 declare function clearNodeUrl(): void;
+/**
+ * Get the node URL that minted the token bundle currently in the TokenStore.
+ */
+declare function getTokenNodeUrl(): string | null;
+/**
+ * Record the node URL that minted the token bundle now in the TokenStore.
+ */
+declare function setTokenNodeUrl(url: string): void;
+/**
+ * Clear the token bundle's node URL
+ */
+declare function clearTokenNodeUrl(): void;
 /**
  * Get the stored application ID
  */
@@ -802,4 +814,4 @@ declare function clearContextIdentity(): void;
  */
 declare function clearAllStorage(): void;
 
-export { type AppContext, AppMode, type ApplicationContextRecord, CalimeroLogo, type CalimeroLogoProps, ConnectButton, type ConnectButtonProps, ConnectionType, type ContextDiscoveryOptions, type ContextDiscoveryState, type CustomConnectionConfig, DEFAULT_LOCAL_NODE_PORTS, type DiscoverLocalNodesOptions, type ExecutionResult, LoginModal, type LoginModalProps, MERO_CSS_VARS, MeroContext, type MeroContextValue, MeroProvider, type MeroProviderConfig, type MeroProviderProps, type MeroTheme, MigrationAdminPanel, type MigrationAdminPanelProps, MigrationPendingBanner, type MigrationPendingBannerProps, type ResolvedMeroTheme, type SetMetadataInput, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };
+export { type AppContext, AppMode, type ApplicationContextRecord, CalimeroLogo, type CalimeroLogoProps, ConnectButton, type ConnectButtonProps, ConnectionType, type ContextDiscoveryOptions, type ContextDiscoveryState, type CustomConnectionConfig, DEFAULT_LOCAL_NODE_PORTS, type DiscoverLocalNodesOptions, type ExecutionResult, LoginModal, type LoginModalProps, MERO_CSS_VARS, MeroContext, type MeroContextValue, MeroProvider, type MeroProviderConfig, type MeroProviderProps, type MeroTheme, MigrationAdminPanel, type MigrationAdminPanelProps, MigrationPendingBanner, type MigrationPendingBannerProps, type ResolvedMeroTheme, type SetMetadataInput, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, clearTokenNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, getTokenNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, setTokenNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };

package/dist/index.d.ts

@@ -761,6 +761,18 @@ declare function setNodeUrl(url: string): void;
  * Clear the node URL
  */
 declare function clearNodeUrl(): void;
+/**
+ * Get the node URL that minted the token bundle currently in the TokenStore.
+ */
+declare function getTokenNodeUrl(): string | null;
+/**
+ * Record the node URL that minted the token bundle now in the TokenStore.
+ */
+declare function setTokenNodeUrl(url: string): void;
+/**
+ * Clear the token bundle's node URL
+ */
+declare function clearTokenNodeUrl(): void;
 /**
  * Get the stored application ID
  */
@@ -802,4 +814,4 @@ declare function clearContextIdentity(): void;
  */
 declare function clearAllStorage(): void;
 
-export { type AppContext, AppMode, type ApplicationContextRecord, CalimeroLogo, type CalimeroLogoProps, ConnectButton, type ConnectButtonProps, ConnectionType, type ContextDiscoveryOptions, type ContextDiscoveryState, type CustomConnectionConfig, DEFAULT_LOCAL_NODE_PORTS, type DiscoverLocalNodesOptions, type ExecutionResult, LoginModal, type LoginModalProps, MERO_CSS_VARS, MeroContext, type MeroContextValue, MeroProvider, type MeroProviderConfig, type MeroProviderProps, type MeroTheme, MigrationAdminPanel, type MigrationAdminPanelProps, MigrationPendingBanner, type MigrationPendingBannerProps, type ResolvedMeroTheme, type SetMetadataInput, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };
+export { type AppContext, AppMode, type ApplicationContextRecord, CalimeroLogo, type CalimeroLogoProps, ConnectButton, type ConnectButtonProps, ConnectionType, type ContextDiscoveryOptions, type ContextDiscoveryState, type CustomConnectionConfig, DEFAULT_LOCAL_NODE_PORTS, type DiscoverLocalNodesOptions, type ExecutionResult, LoginModal, type LoginModalProps, MERO_CSS_VARS, MeroContext, type MeroContextValue, MeroProvider, type MeroProviderConfig, type MeroProviderProps, type MeroTheme, MigrationAdminPanel, type MigrationAdminPanelProps, MigrationPendingBanner, type MigrationPendingBannerProps, type ResolvedMeroTheme, type SetMetadataInput, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, clearTokenNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, getTokenNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, setTokenNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };

package/dist/index.js

@@ -67,12 +67,85 @@ function resolveTrustedNodeUrl(params) {
   return { url: null, rejected: true };
 }
 
+// src/auth/token-adoption.ts
+var HOUR_MS = 36e5;
+function decodeJwtClaims(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    while (b64.length % 4) b64 += "=";
+    const payload = JSON.parse(atob(b64));
+    if (!payload || typeof payload !== "object") return null;
+    const { iat, exp } = payload;
+    return {
+      iat: typeof iat === "number" && iat > 0 ? iat : void 0,
+      exp: typeof exp === "number" && exp > 0 ? exp : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function expiresAtFromJwt(token, fallbackMs = Date.now() + HOUR_MS) {
+  const exp = decodeJwtClaims(token)?.exp;
+  return exp ? exp * 1e3 : fallbackMs;
+}
+function isCallbackNewer(callbackAccessToken, stored) {
+  const incoming = decodeJwtClaims(callbackAccessToken);
+  if (!incoming) return false;
+  const current = decodeJwtClaims(stored.access_token);
+  if (current) {
+    if (incoming.iat !== void 0 && current.iat !== void 0 && incoming.iat !== current.iat) {
+      return incoming.iat > current.iat;
+    }
+    if (incoming.exp !== void 0 && current.exp !== void 0 && incoming.exp !== current.exp) {
+      return incoming.exp > current.exp;
+    }
+    return false;
+  }
+  return incoming.exp !== void 0 && incoming.exp * 1e3 > stored.expires_at;
+}
+function resolveTokenAdoption(params) {
+  const { callbackAccessToken, callbackRefreshToken, callbackNodeUrl, stored, storedNodeUrl } = params;
+  const bundle = (refreshToken2) => ({
+    access_token: callbackAccessToken,
+    refresh_token: refreshToken2,
+    expires_at: expiresAtFromJwt(callbackAccessToken)
+  });
+  if (!stored?.access_token) {
+    return { adopt: true, tokens: bundle(callbackRefreshToken), reason: "fresh-login" };
+  }
+  const sameNode = !!storedNodeUrl && sameOrigin(callbackNodeUrl, storedNodeUrl);
+  if (!sameNode) {
+    return { adopt: true, tokens: bundle(callbackRefreshToken), reason: "node-changed" };
+  }
+  const refreshToken = callbackRefreshToken || stored.refresh_token;
+  if (isCallbackNewer(callbackAccessToken, stored)) {
+    return { adopt: true, tokens: bundle(refreshToken), reason: "newer" };
+  }
+  if (!stored.refresh_token && callbackRefreshToken) {
+    return {
+      adopt: true,
+      tokens: { ...stored, refresh_token: callbackRefreshToken },
+      reason: "fill-refresh"
+    };
+  }
+  return { adopt: false, reason: "stale" };
+}
+
 // src/storage/index.ts
 var STORAGE_KEYS = {
   ACCESS_TOKEN: "mero:access_token",
   REFRESH_TOKEN: "mero:refresh_token",
   EXPIRES_AT: "mero:expires_at",
   NODE_URL: "mero:node_url",
+  // The node the token bundle currently in the TokenStore was issued by. Distinct
+  // from NODE_URL, which `connectToNode` overwrites with the *target* node before
+  // redirecting to login — so at callback time NODE_URL names where we are going,
+  // not who minted the tokens we still hold. Telling those apart is what lets the
+  // SSO callback re-seed on a node change without mistaking a different node's
+  // bundle for a rotated one (see auth/token-adoption.ts).
+  TOKEN_NODE_URL: "mero:token_node_url",
   APPLICATION_ID: "mero:application_id",
   CONTEXT_ID: "mero:context_id",
   CONTEXT_IDENTITY: "mero:context_identity"
@@ -153,6 +226,18 @@ function clearNodeUrl() {
   if (!isLocalStorageAvailable()) return;
   localStorage.removeItem(STORAGE_KEYS.NODE_URL);
 }
+function getTokenNodeUrl() {
+  if (!isLocalStorageAvailable()) return null;
+  return localStorage.getItem(STORAGE_KEYS.TOKEN_NODE_URL);
+}
+function setTokenNodeUrl(url) {
+  if (!isLocalStorageAvailable()) return;
+  localStorage.setItem(STORAGE_KEYS.TOKEN_NODE_URL, url);
+}
+function clearTokenNodeUrl() {
+  if (!isLocalStorageAvailable()) return;
+  localStorage.removeItem(STORAGE_KEYS.TOKEN_NODE_URL);
+}
 function getApplicationId() {
   if (!isLocalStorageAvailable()) return null;
   return localStorage.getItem(STORAGE_KEYS.APPLICATION_ID);
@@ -218,21 +303,6 @@ function getPermissionsForMode(mode) {
       throw new Error(`Unsupported application mode: ${mode}`);
   }
 }
-function parseJwtExpiry(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length === 3) {
-      let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      while (b64.length % 4) b64 += "=";
-      const payload = JSON.parse(atob(b64));
-      if (payload.exp && payload.exp > 0) {
-        return payload.exp * 1e3;
-      }
-    }
-  } catch {
-  }
-  return Date.now() + 36e5;
-}
 function MeroProvider({
   children,
   mode,
@@ -330,9 +400,11 @@ function MeroProvider({
       const callback = callbackRef.current;
       let nodeFromCallback = null;
       if (callback) {
+        const initiatedNodeUrl = getNodeUrl();
+        const tokenNodeUrl = getTokenNodeUrl() ?? initiatedNodeUrl;
         const { url, rejected } = resolveTrustedNodeUrl({
           candidate: callback.nodeUrl,
-          initiated: getNodeUrl(),
+          initiated: initiatedNodeUrl,
           allowedNodeUrls
         });
         if (isBrowser) {
@@ -344,11 +416,21 @@ function MeroProvider({
             "[MeroProvider] OAuth callback node_url is not trusted (it does not match the node login was initiated with, nor `allowedNodeUrls`). Ignoring the callback; no tokens stored."
           );
         } else if (url) {
-          tokenStore.setTokens({
-            access_token: callback.accessToken,
-            refresh_token: callback.refreshToken,
-            expires_at: parseJwtExpiry(callback.accessToken)
+          const decision = resolveTokenAdoption({
+            callbackAccessToken: callback.accessToken,
+            callbackRefreshToken: callback.refreshToken,
+            callbackNodeUrl: url,
+            stored: tokenStore.getTokens(),
+            storedNodeUrl: tokenNodeUrl
           });
+          if (decision.adopt) {
+            tokenStore.setTokens(decision.tokens);
+            setTokenNodeUrl(url);
+          } else {
+            console.warn(
+              "[MeroProvider] Ignoring the SSO callback token bundle: it is stale (not newer than the tokens already stored for this node). Adopting it would replay an already-rotated refresh token, which the node revokes the whole token family for."
+            );
+          }
           if (callback.applicationId) {
             setApplicationId(callback.applicationId);
             if (active) setApplicationIdState(callback.applicationId);
@@ -2452,6 +2534,6 @@ function MigrationAdminPanel({ namespaceId, pollIntervalMs, className }) {
   ] });
 }
 
-export { AppMode, CalimeroLogo, ConnectButton, ConnectionType, DEFAULT_LOCAL_NODE_PORTS, LoginModal, MERO_CSS_VARS, MeroContext, MeroProvider, MigrationAdminPanel, MigrationPendingBanner, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };
+export { AppMode, CalimeroLogo, ConnectButton, ConnectionType, DEFAULT_LOCAL_NODE_PORTS, LoginModal, MERO_CSS_VARS, MeroContext, MeroProvider, MigrationAdminPanel, MigrationPendingBanner, clearAllStorage, clearApplicationId, clearContextId, clearContextIdentity, clearNodeUrl, clearTokenNodeUrl, cssVar, defaultMeroTheme, discoverLocalNodes, getApplicationId, getContextId, getContextIdentity, getNodeUrl, getTokenNodeUrl, localNodeUrl, localStorageTokenStorage, nodeEndpoint, probeNodeHealth, resolveMeroTheme, setApplicationId, setContextId, setContextIdentity, setNodeUrl, setTokenNodeUrl, themeToCssVars, useAddGroupMembers, useAppVersion, useApplicationContexts, useContextDiscovery, useContextGroup, useContexts, useCreateContext, useCreateGroupInNamespace, useCreateNamespace, useCreateNamespaceInvitation, useDefaultCapabilities, useDeleteContext, useDeleteGroup, useDeleteNamespace, useDetachContextFromGroup, useExecute, useGroupCapabilities, useGroupContexts, useGroupInfo, useGroupInvitations, useGroupMembers, useGroupMetadata, useGroupUpgradeStatus, useJoinContext, useJoinGroup, useJoinNamespace, useJoinSubgroupInheritance, useLatestVersion, useMemberMetadata, useMero, useMigrationStatus, useMyAuthoredMigration, useNamespace, useNamespaceGroups, useNamespaceIdentity, useNamespaces, useNamespacesForApplication, useRegisterGroupSigningKey, useRemoveGroupMembers, useReparentGroup, useResyncContext, useRetryGroupUpgrade, useSetContextMetadata, useSetDefaultCapabilities, useSetGroupMetadata, useSetMemberMetadata, useSetSubgroupVisibility, useSetTeeAdmissionPolicy, useSubgroupVisibility, useSubgroups, useSubscription, useSyncGroup, useUpdateGroupSettings, useUpdateMemberRole, useUpgradeGroup };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map