@chaosity/location-client 0.13.0 → 0.13.1

package/README.md

@@ -252,7 +252,14 @@ tiles receive the new token no other way — they read `getToken` through
 `createTransformRequest` — so a `refreshToken` that leaves `getToken` unchanged
 reloads nothing. A 403 is never retried: a new token cannot change it. A token
 `refreshToken` could not replace is not asked about again for 30 seconds, by
-any helper handed the same `tokens` object. `stop()` removes the listener.
+any helper handed the same `tokens` object. For 30 seconds after a refresh
+brought a new token, a refused tile is reloaded once with it rather than asked
+about: a tile requested with the old token can be refused after the new one
+arrived. A tile the helper reloaded with the new token, refused again, means
+the API refuses that token too, and it is held like the first. So an API that
+refuses every token, such as a map pointed at an API its tokens are not for,
+costs one new token per 30 seconds rather than one per reload, however many
+maps share the `tokens` object. `stop()` removes the listener.
 
 A bare `getToken` works as it always has: one request, and its 401 to you.
 

package/dist/cjs/maps/mapToken.d.ts

@@ -66,8 +66,11 @@ export interface TokenRefreshMap {
  *
  * What it learns is held as the fetch helpers hold it, and shared with them
  * when they are handed the same `tokens` object (#38): a token `refreshToken`
- * could not replace, and a failure that says when to ask again, are not asked
- * about again until they lapse or the token in hand changes.
+ * could not replace, a token it brought that the API refused on a tile
+ * reloaded with it, and a failure that says when to ask again, are not asked
+ * about again until they lapse or the token in hand changes. While the token
+ * a refresh brought is in hand, any other refused tile is reloaded once with
+ * it, without asking.
  *
  * Returns a function that stops listening.
  *

package/dist/cjs/maps/mapToken.js

@@ -19,6 +19,13 @@ function holdOf(tokens) {
         holds.set(tokens, (hold = new tokenHold_js_1.TokenHold()));
     return hold;
 }
+/**
+ * The token each `MapTokens` object's refresh last brought, and until when a
+ * 401 while it is in hand is not news (#72). One per object, beside its hold:
+ * a note per helper had each of two helpers handed one object take the
+ * other's token as news, and ask again for every refusal.
+ */
+const broughtBy = new WeakMap();
 /**
  * Send with the token in hand, and after a 401 once more with a different one
  * from `refreshToken`, all within the call's signal and deadline (#62). A 403
@@ -53,8 +60,11 @@ async function sendWithTokenRefresh(source, noTokenAdvice, call, send) {
  *
  * What it learns is held as the fetch helpers hold it, and shared with them
  * when they are handed the same `tokens` object (#38): a token `refreshToken`
- * could not replace, and a failure that says when to ask again, are not asked
- * about again until they lapse or the token in hand changes.
+ * could not replace, a token it brought that the API refused on a tile
+ * reloaded with it, and a failure that says when to ask again, are not asked
+ * about again until they lapse or the token in hand changes. While the token
+ * a refresh brought is in hand, any other refused tile is reloaded once with
+ * it, without asking.
  *
  * Returns a function that stops listening.
  *
@@ -70,16 +80,26 @@ async function sendWithTokenRefresh(source, noTokenAdvice, call, send) {
 function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
     const hold = holdOf(tokens);
     // Each source's refused tiles, keyed `z/x/y` so a tile refused twice is
-    // reloaded once.
+    // reloaded once. Tiles refused while a hold stands are kept, so the next ask
+    // reloads them; MapLibre ignores ids no longer in view.
     const refused = new Map();
+    // The token each tile was reloaded with here, keyed `source:z/x/y`.
+    const reloadedWith = new Map();
     let asking = false;
+    const reload = (sourceId, tiles, token) => {
+        for (const { x, y, z } of tiles)
+            reloadedWith.set(`${sourceId}:${z}/${x}/${y}`, token);
+        map.refreshTiles(sourceId, tiles);
+    };
     const onError = ({ error, sourceId, tile }) => {
         if (error?.status !== 401 || !error.url || !(0, createTransformRequest_js_1.isOurApi)(error.url, apiUrl))
             return;
+        let refusedTile;
         if (sourceId && tile) {
             const { x, y, z } = tile.tileID.canonical;
             const tiles = refused.get(sourceId) ?? new Map();
             refused.set(sourceId, tiles.set(`${z}/${x}/${y}`, { x, y, z }));
+            refusedTile = [sourceId, { x, y, z }];
         }
         if (asking)
             return;
@@ -87,6 +107,32 @@ function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
         const held = hold.check(inHand);
         if (held && !held.askAgain)
             return;
+        // A 401 while the token a refresh brought is in hand. The event does not
+        // say which token the refused request carried, and a tile requested with
+        // the token before, answered late, looks like the new token refused. So
+        // only a tile reloaded here with the token in hand is that token refused:
+        // the API refuses every token, as it does a map pointed at an API its
+        // tokens are not for, and asking again minted a token and reloaded the
+        // tiles several times a second. That is remembered, as a send path
+        // remembers its retry refused, and the next ask is after the hold. Any
+        // other tile is reloaded once with the token in hand; anything else (a
+        // glyph, a sprite) asks nothing.
+        const brought = broughtBy.get(tokens);
+        if (inHand && inHand === brought?.token && Date.now() < brought.until) {
+            if (!refusedTile)
+                return;
+            const [id, coordinates] = refusedTile;
+            const key = `${coordinates.z}/${coordinates.x}/${coordinates.y}`;
+            if (reloadedWith.get(`${id}:${key}`) !== inHand) {
+                refused.get(id)?.delete(key);
+                reload(id, [coordinates], inHand);
+                return;
+            }
+            // Kept in `refused`, as every tile refused during the hold is.
+            broughtBy.delete(tokens);
+            hold.remember(unauthorized('The API refused a tile reloaded with the token refreshToken brought.'), inHand);
+            return;
+        }
         asking = true;
         // Asked inside an executor, so a `refreshToken` that throws instead of
         // rejecting lands in the catch below rather than in MapLibre's emitter.
@@ -100,15 +146,18 @@ function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
             if (!now || now === inHand) {
                 // MapLibre's error carries none of the API's fields, so the refusal
                 // is remembered as the 401 it was.
-                hold.remember(new LocationServiceException_js_1.LocationServiceException({
-                    code: 'UnauthorizedException',
-                    message: 'The API refused the token, and getToken has no other since refreshToken settled.',
-                    statusCode: 401,
-                }), inHand);
+                hold.remember(unauthorized('The API refused the token, and getToken has no other since refreshToken settled.'), inHand);
                 return;
             }
+            broughtBy.set(tokens, {
+                token: now,
+                until: Date.now() + tokenHold_js_1.TOKEN_REFUSAL_HOLD_MS,
+            });
+            // What was reloaded with an earlier token can no longer match.
+            reloadedWith.clear();
             for (const [id, tiles] of refused)
-                map.refreshTiles(id, [...tiles.values()]);
+                if (tiles.size)
+                    reload(id, [...tiles.values()], now);
         })
             .catch((refusal) => {
             // Only a failure that says when to ask again is remembered; any other
@@ -124,3 +173,9 @@ function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
     map.on('error', onError);
     return () => map.off('error', onError);
 }
+/** A refusal MapLibre reported, remembered as the 401 it was. */
+const unauthorized = (message) => new LocationServiceException_js_1.LocationServiceException({
+    code: 'UnauthorizedException',
+    message,
+    statusCode: 401,
+});

package/dist/maps/mapToken.d.ts

@@ -66,8 +66,11 @@ export interface TokenRefreshMap {
  *
  * What it learns is held as the fetch helpers hold it, and shared with them
  * when they are handed the same `tokens` object (#38): a token `refreshToken`
- * could not replace, and a failure that says when to ask again, are not asked
- * about again until they lapse or the token in hand changes.
+ * could not replace, a token it brought that the API refused on a tile
+ * reloaded with it, and a failure that says when to ask again, are not asked
+ * about again until they lapse or the token in hand changes. While the token
+ * a refresh brought is in hand, any other refused tile is reloaded once with
+ * it, without asking.
  *
  * Returns a function that stops listening.
  *

package/dist/maps/mapToken.js

@@ -1,4 +1,4 @@
-import { TokenHold, holdFor, sendRetryingOnce } from '../auth/tokenHold.js';
+import { TOKEN_REFUSAL_HOLD_MS, TokenHold, holdFor, sendRetryingOnce, } from '../auth/tokenHold.js';
 import { LocationServiceException } from '../errors/LocationServiceException.js';
 import { noTokenAvailable } from '../transport/errors.js';
 import { withinCall } from '../transport/http.js';
@@ -15,6 +15,13 @@ function holdOf(tokens) {
         holds.set(tokens, (hold = new TokenHold()));
     return hold;
 }
+/**
+ * The token each `MapTokens` object's refresh last brought, and until when a
+ * 401 while it is in hand is not news (#72). One per object, beside its hold:
+ * a note per helper had each of two helpers handed one object take the
+ * other's token as news, and ask again for every refusal.
+ */
+const broughtBy = new WeakMap();
 /**
  * Send with the token in hand, and after a 401 once more with a different one
  * from `refreshToken`, all within the call's signal and deadline (#62). A 403
@@ -49,8 +56,11 @@ export async function sendWithTokenRefresh(source, noTokenAdvice, call, send) {
  *
  * What it learns is held as the fetch helpers hold it, and shared with them
  * when they are handed the same `tokens` object (#38): a token `refreshToken`
- * could not replace, and a failure that says when to ask again, are not asked
- * about again until they lapse or the token in hand changes.
+ * could not replace, a token it brought that the API refused on a tile
+ * reloaded with it, and a failure that says when to ask again, are not asked
+ * about again until they lapse or the token in hand changes. While the token
+ * a refresh brought is in hand, any other refused tile is reloaded once with
+ * it, without asking.
  *
  * Returns a function that stops listening.
  *
@@ -66,16 +76,26 @@ export async function sendWithTokenRefresh(source, noTokenAdvice, call, send) {
 export function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
     const hold = holdOf(tokens);
     // Each source's refused tiles, keyed `z/x/y` so a tile refused twice is
-    // reloaded once.
+    // reloaded once. Tiles refused while a hold stands are kept, so the next ask
+    // reloads them; MapLibre ignores ids no longer in view.
     const refused = new Map();
+    // The token each tile was reloaded with here, keyed `source:z/x/y`.
+    const reloadedWith = new Map();
     let asking = false;
+    const reload = (sourceId, tiles, token) => {
+        for (const { x, y, z } of tiles)
+            reloadedWith.set(`${sourceId}:${z}/${x}/${y}`, token);
+        map.refreshTiles(sourceId, tiles);
+    };
     const onError = ({ error, sourceId, tile }) => {
         if (error?.status !== 401 || !error.url || !isOurApi(error.url, apiUrl))
             return;
+        let refusedTile;
         if (sourceId && tile) {
             const { x, y, z } = tile.tileID.canonical;
             const tiles = refused.get(sourceId) ?? new Map();
             refused.set(sourceId, tiles.set(`${z}/${x}/${y}`, { x, y, z }));
+            refusedTile = [sourceId, { x, y, z }];
         }
         if (asking)
             return;
@@ -83,6 +103,32 @@ export function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
         const held = hold.check(inHand);
         if (held && !held.askAgain)
             return;
+        // A 401 while the token a refresh brought is in hand. The event does not
+        // say which token the refused request carried, and a tile requested with
+        // the token before, answered late, looks like the new token refused. So
+        // only a tile reloaded here with the token in hand is that token refused:
+        // the API refuses every token, as it does a map pointed at an API its
+        // tokens are not for, and asking again minted a token and reloaded the
+        // tiles several times a second. That is remembered, as a send path
+        // remembers its retry refused, and the next ask is after the hold. Any
+        // other tile is reloaded once with the token in hand; anything else (a
+        // glyph, a sprite) asks nothing.
+        const brought = broughtBy.get(tokens);
+        if (inHand && inHand === brought?.token && Date.now() < brought.until) {
+            if (!refusedTile)
+                return;
+            const [id, coordinates] = refusedTile;
+            const key = `${coordinates.z}/${coordinates.x}/${coordinates.y}`;
+            if (reloadedWith.get(`${id}:${key}`) !== inHand) {
+                refused.get(id)?.delete(key);
+                reload(id, [coordinates], inHand);
+                return;
+            }
+            // Kept in `refused`, as every tile refused during the hold is.
+            broughtBy.delete(tokens);
+            hold.remember(unauthorized('The API refused a tile reloaded with the token refreshToken brought.'), inHand);
+            return;
+        }
         asking = true;
         // Asked inside an executor, so a `refreshToken` that throws instead of
         // rejecting lands in the catch below rather than in MapLibre's emitter.
@@ -96,15 +142,18 @@ export function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
             if (!now || now === inHand) {
                 // MapLibre's error carries none of the API's fields, so the refusal
                 // is remembered as the 401 it was.
-                hold.remember(new LocationServiceException({
-                    code: 'UnauthorizedException',
-                    message: 'The API refused the token, and getToken has no other since refreshToken settled.',
-                    statusCode: 401,
-                }), inHand);
+                hold.remember(unauthorized('The API refused the token, and getToken has no other since refreshToken settled.'), inHand);
                 return;
             }
+            broughtBy.set(tokens, {
+                token: now,
+                until: Date.now() + TOKEN_REFUSAL_HOLD_MS,
+            });
+            // What was reloaded with an earlier token can no longer match.
+            reloadedWith.clear();
             for (const [id, tiles] of refused)
-                map.refreshTiles(id, [...tiles.values()]);
+                if (tiles.size)
+                    reload(id, [...tiles.values()], now);
         })
             .catch((refusal) => {
             // Only a failure that says when to ask again is remembered; any other
@@ -120,3 +169,9 @@ export function refreshTokenOnUnauthorized(map, apiUrl, tokens) {
     map.on('error', onError);
     return () => map.off('error', onError);
 }
+/** A refusal MapLibre reported, remembered as the 401 it was. */
+const unauthorized = (message) => new LocationServiceException({
+    code: 'UnauthorizedException',
+    message,
+    statusCode: 401,
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaosity/location-client",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Client library for Chaosity Location Service with AWS Location Service compatibility",
   "type": "module",
   "main": "dist/cjs/index.js",