@chipmobilesdk/rn-auth 0.2.1 → 0.3.1

package/src/tokens/accessToken.ts

@@ -1,105 +1,159 @@
-/**
- * Per-resource delegated access-token acquisition with an in-memory cache and
- * silent refresh (FR-007, PERF-003, R4). Access tokens are never persisted to
- * disk (FR-021) — only kept in memory keyed by resource until expiry.
- */
-
-import type {
-	AccessTokenResult,
-	ResourceConfig,
-} from '../config/types';
-import type { OidcAuthClient } from '../oidc/authClient';
-import { isAuthError } from '../diagnostics/errors';
-
-const EXPIRY_SKEW_MS = 60_000;
-
-interface CachedToken {
-	token: string;
-	expiresAt: number;
-	scopes: string[];
-}
-
-export interface AccessTokenManagerDeps {
-	authority: string;
-	clientId: string;
-	redirectUrl: string;
-	resources: ResourceConfig[];
-	authClient: OidcAuthClient;
-	getRefreshToken: () => string | null;
-	setRefreshToken: (token: string) => void;
-}
-
-export interface AccessTokenManager {
-	request(resourceKey: string): Promise<AccessTokenResult>;
-	clear(): void;
-}
-
-export function createAccessTokenManager(
-	deps: AccessTokenManagerDeps,
-): AccessTokenManager {
-	const cache = new Map<string, CachedToken>();
-
-	return {
-		clear() {
-			cache.clear();
-		},
-		async request(resourceKey): Promise<AccessTokenResult> {
-			const resource = deps.resources.find(entry => entry.key === resourceKey);
-			if (!resource) {
-				return { resourceKey, status: 'error', errorCode: 'configuration-error' };
-			}
-
-			const cached = cache.get(resourceKey);
-			if (cached && cached.expiresAt - EXPIRY_SKEW_MS > Date.now()) {
-				return {
-					resourceKey,
-					status: 'success',
-					token: cached.token,
-					expiresAt: cached.expiresAt,
-				};
-			}
-
-			const refreshToken = deps.getRefreshToken();
-			if (!refreshToken) {
-				return { resourceKey, status: 'unavailable', errorCode: 'session-expired' };
-			}
-
-			try {
-				const tokens = await deps.authClient.refresh({
-					authority: deps.authority,
-					clientId: deps.clientId,
-					redirectUrl: deps.redirectUrl,
-					refreshToken,
-					scopes: resource.scopes,
-				});
-				if (tokens.refreshToken) {
-					deps.setRefreshToken(tokens.refreshToken);
-				}
-				if (!tokens.accessToken) {
-					return { resourceKey, status: 'error', errorCode: 'token-acquisition-failed' };
-				}
-				const expiresAt = tokens.accessTokenExpiresAt ?? Date.now() + 3_600_000;
-				cache.set(resourceKey, {
-					token: tokens.accessToken,
-					expiresAt,
-					scopes: resource.scopes,
-				});
-				return { resourceKey, status: 'success', token: tokens.accessToken, expiresAt };
-			} catch (error) {
-				if (isAuthError(error)) {
-					if (error.code === 'consent-denied') {
-						return { resourceKey, status: 'denied', errorCode: error.code };
-					}
-					if (error.code === 'network-unavailable') {
-						return { resourceKey, status: 'unavailable', errorCode: error.code };
-					}
-					if (error.code === 'session-expired') {
-						return { resourceKey, status: 'unavailable', errorCode: error.code };
-					}
-					return { resourceKey, status: 'error', errorCode: error.code };
-				}
-				return { resourceKey, status: 'error', errorCode: 'token-acquisition-failed' };
-			}
-		},
-	};
-}
+/**
+ * Per-resource delegated access-token acquisition with an in-memory cache and
+ * silent refresh (FR-007, PERF-003, R4). Access tokens are never persisted to
+ * disk (FR-021) — only kept in memory keyed by resource until expiry.
+ */
+
+import type { AccessTokenResult, ResourceConfig } from '../config/types';
+import type { OidcAuthClient } from '../oidc/authClient';
+import { isAuthError } from '../diagnostics/errors';
+
+const EXPIRY_SKEW_MS = 60_000;
+
+interface CachedToken {
+	token: string;
+	expiresAt: number;
+	scopes: string[];
+}
+
+export interface AccessTokenManagerDeps {
+	authority: string;
+	clientId: string;
+	redirectUrl: string;
+	resources: ResourceConfig[];
+	authClient: OidcAuthClient;
+	getRefreshToken: () => string | null;
+	/**
+	 * The session generation, bumped by every sign-in, sign-out and restore. A
+	 * refresh that started under one generation and finished under another
+	 * belongs to a session that no longer exists, so its result is discarded.
+	 */
+	sessionEpoch: () => number;
+	/**
+	 * The provider rotated the refresh token. Resolves once the new token is
+	 * live, and persisted where it can be: the old one may already be dead, so a
+	 * restart must not come back with it.
+	 */
+	onRefreshTokenRotated: (token: string, epoch: number) => Promise<void>;
+}
+
+export interface AccessTokenManager {
+	request(resourceKey: string): Promise<AccessTokenResult>;
+	/** Whether `request` would answer from the cache, without touching the network. */
+	hasFreshToken(resourceKey: string): boolean;
+	clear(): void;
+}
+
+const SESSION_ENDED: Omit<AccessTokenResult, 'resourceKey'> = {
+	status: 'unavailable',
+	errorCode: 'session-expired',
+};
+
+export function createAccessTokenManager(deps: AccessTokenManagerDeps): AccessTokenManager {
+	const cache = new Map<string, CachedToken>();
+	/**
+	 * Refreshes in progress, by resource. Concurrent callers for one resource
+	 * share a single network call; with a rotating refresh token, a second call
+	 * would race the first with a token the first may have just retired.
+	 */
+	const inFlight = new Map<string, Promise<AccessTokenResult>>();
+
+	const fresh = (resourceKey: string): CachedToken | undefined => {
+		const cached = cache.get(resourceKey);
+		return cached && cached.expiresAt - EXPIRY_SKEW_MS > Date.now() ? cached : undefined;
+	};
+
+	const refresh = async (resource: ResourceConfig): Promise<AccessTokenResult> => {
+		const resourceKey = resource.key;
+		const epoch = deps.sessionEpoch();
+		const refreshToken = deps.getRefreshToken();
+		if (!refreshToken) {
+			return { resourceKey, ...SESSION_ENDED };
+		}
+
+		try {
+			const tokens = await deps.authClient.refresh({
+				authority: deps.authority,
+				clientId: deps.clientId,
+				redirectUrl: deps.redirectUrl,
+				refreshToken,
+				scopes: resource.scopes,
+			});
+			// Signed out, or signed in as someone else, while this was in flight:
+			// nothing from it may be written back, and its token is not handed out.
+			if (deps.sessionEpoch() !== epoch) {
+				return { resourceKey, ...SESSION_ENDED };
+			}
+			if (tokens.refreshToken && tokens.refreshToken !== refreshToken) {
+				await deps.onRefreshTokenRotated(tokens.refreshToken, epoch);
+				if (deps.sessionEpoch() !== epoch) {
+					return { resourceKey, ...SESSION_ENDED };
+				}
+			}
+			if (!tokens.accessToken) {
+				return { resourceKey, status: 'error', errorCode: 'token-acquisition-failed' };
+			}
+			const expiresAt = tokens.accessTokenExpiresAt ?? Date.now() + 3_600_000;
+			cache.set(resourceKey, {
+				token: tokens.accessToken,
+				expiresAt,
+				scopes: resource.scopes,
+			});
+			return { resourceKey, status: 'success', token: tokens.accessToken, expiresAt };
+		} catch (error) {
+			if (isAuthError(error)) {
+				if (error.code === 'consent-denied') {
+					return { resourceKey, status: 'denied', errorCode: error.code };
+				}
+				if (error.code === 'network-unavailable') {
+					return { resourceKey, status: 'unavailable', errorCode: error.code };
+				}
+				if (error.code === 'session-expired') {
+					return { resourceKey, status: 'unavailable', errorCode: error.code };
+				}
+				return { resourceKey, status: 'error', errorCode: error.code };
+			}
+			return { resourceKey, status: 'error', errorCode: 'token-acquisition-failed' };
+		}
+	};
+
+	return {
+		clear() {
+			cache.clear();
+			inFlight.clear();
+		},
+
+		hasFreshToken(resourceKey) {
+			return fresh(resourceKey) !== undefined;
+		},
+
+		request(resourceKey): Promise<AccessTokenResult> {
+			const resource = deps.resources.find(entry => entry.key === resourceKey);
+			if (!resource) {
+				return Promise.resolve({ resourceKey, status: 'error', errorCode: 'configuration-error' });
+			}
+
+			const cached = fresh(resourceKey);
+			if (cached) {
+				return Promise.resolve({
+					resourceKey,
+					status: 'success',
+					token: cached.token,
+					expiresAt: cached.expiresAt,
+				});
+			}
+
+			const running = inFlight.get(resourceKey);
+			if (running) {
+				return running;
+			}
+			const flight = refresh(resource).finally(() => {
+				if (inFlight.get(resourceKey) === flight) {
+					inFlight.delete(resourceKey);
+				}
+			});
+			inFlight.set(resourceKey, flight);
+			return flight;
+		},
+	};
+}

package/src/tokens/secureStore.ts

@@ -1,52 +1,51 @@
-/**
- * SecureTokenStore port + default react-native-keychain adapter (FR-021, R2).
- *
- * Refresh tokens and the session-restore artifact persist ONLY through this
- * port, backed by platform secure storage (iOS Keychain / Android Keystore).
- * Access tokens are never written here — they stay in memory (see accessToken).
- * The default adapter lazily requires the native module so unit tests that
- * inject a fake never load native code.
- */
-
-/** Single key under which the persisted session artifact is stored. */
-export const AUTH_STORAGE_KEY = '@chipmobilesdk/rn-auth/session';
-
-export interface SecureTokenStore {
-	getItem(key: string): Promise<string | null>;
-	setItem(key: string, value: string): Promise<void>;
-	removeItem(key: string): Promise<void>;
-}
-
-export interface KeychainSecureStoreOptions {
-	/** Optional Keychain access-control accessibility constant. */
-	accessible?: string;
-}
-
-/**
- * Default secure store backed by react-native-keychain. Each logical key maps to
- * a Keychain "service" so multiple keys can coexist. Validated on device.
- */
-export function createKeychainSecureStore(
-	options: KeychainSecureStoreOptions = {},
-): SecureTokenStore {
-	// Lazy require: only loaded when the default adapter is actually used.
-	const Keychain = require('react-native-keychain');
-	const accessible =
-		options.accessible ?? Keychain.ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
-
-	return {
-		async getItem(key) {
-			const result = await Keychain.getGenericPassword({ service: key });
-			return result ? result.password : null;
-		},
-		async setItem(key, value) {
-			await Keychain.setGenericPassword('token', value, {
-				service: key,
-				accessible,
-			});
-		},
-		async removeItem(key) {
-			await Keychain.resetGenericPassword({ service: key });
-		},
-	};
-}
+/**
+ * SecureTokenStore port + default react-native-keychain adapter (FR-021, R2).
+ *
+ * Refresh tokens and the session-restore artifact persist ONLY through this
+ * port, backed by platform secure storage (iOS Keychain / Android Keystore).
+ * Access tokens are never written here — they stay in memory (see accessToken).
+ * The default adapter lazily requires the native module so unit tests that
+ * inject a fake never load native code.
+ */
+
+/** Single key under which the persisted session artifact is stored. */
+export const AUTH_STORAGE_KEY = '@chipmobilesdk/rn-auth/session';
+
+export interface SecureTokenStore {
+	getItem(key: string): Promise<string | null>;
+	setItem(key: string, value: string): Promise<void>;
+	removeItem(key: string): Promise<void>;
+}
+
+export interface KeychainSecureStoreOptions {
+	/** Optional Keychain access-control accessibility constant. */
+	accessible?: string;
+}
+
+/**
+ * Default secure store backed by react-native-keychain. Each logical key maps to
+ * a Keychain "service" so multiple keys can coexist. Validated on device.
+ */
+export function createKeychainSecureStore(
+	options: KeychainSecureStoreOptions = {},
+): SecureTokenStore {
+	// Lazy require: only loaded when the default adapter is actually used.
+	const Keychain = require('react-native-keychain');
+	const accessible = options.accessible ?? Keychain.ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+
+	return {
+		async getItem(key) {
+			const result = await Keychain.getGenericPassword({ service: key });
+			return result ? result.password : null;
+		},
+		async setItem(key, value) {
+			await Keychain.setGenericPassword('token', value, {
+				service: key,
+				accessible,
+			});
+		},
+		async removeItem(key) {
+			await Keychain.resetGenericPassword({ service: key });
+		},
+	};
+}