@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.1

package/dist/core/webSession.js

@@ -0,0 +1,137 @@
+/**
+ * Client for the shared web session on ingest (`/api/auth/session*`). It only
+ * sends and classifies: retries, boot rules, and sign-out belong to callers.
+ * Identity proof is an opaque string from the caller, so no provider leaks in.
+ */
+import { zCreateSessionResponse, zDeleteSessionResponse, zErrorResponse, zGetSessionResponse, zRevokeAllSessionsResponse } from '@comfyorg/ingest-types/zod';
+const UNAUTHORIZED_CODES = {
+    no_session: 'NO_SESSION',
+    session_expired: 'SESSION_EXPIRED',
+    session_revoked: 'SESSION_REVOKED',
+    TOKEN_REVOKED: 'SESSION_REVOKED'
+};
+const FORBIDDEN_CODES = {
+    csrf_invalid: 'CSRF_STALE',
+    workspace_access_denied: 'WORKSPACE_ACCESS_DENIED'
+};
+function failure(code, httpStatus, serverCode) {
+    return {
+        status: 'error',
+        code,
+        retryable: code === 'SESSION_UNAVAILABLE',
+        ...(httpStatus === undefined ? {} : { httpStatus }),
+        ...(serverCode === undefined ? {} : { serverCode })
+    };
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function classifyFailure(response) {
+    const { status } = response;
+    if (status === 429 || status >= 500) {
+        return failure('SESSION_UNAVAILABLE', status);
+    }
+    const parsed = zErrorResponse.safeParse(await readJson(response));
+    if (!parsed.success)
+        return failure('SESSION_REQUEST_REFUSED', status);
+    const serverCode = parsed.data.code;
+    const byServerCode = status === 401
+        ? (UNAUTHORIZED_CODES[serverCode] ?? 'NO_SESSION')
+        : status === 403
+            ? (FORBIDDEN_CODES[serverCode] ?? 'SESSION_REQUEST_REFUSED')
+            : 'SESSION_REQUEST_REFUSED';
+    return failure(byServerCode, status, serverCode);
+}
+async function send(options, path, init) {
+    let response;
+    try {
+        response = await options.fetchImpl(`${options.apiBaseUrl.replace(/\/+$/, '')}${path}`, { ...init, credentials: 'include', signal: options.signal });
+    }
+    catch {
+        return failure('SESSION_UNAVAILABLE');
+    }
+    return response.ok ? { response } : classifyFailure(response);
+}
+export async function readWebSession(options, { expectedUserId } = {}) {
+    const sent = await send(options, '/auth/session', {
+        method: 'GET',
+        cache: 'no-store'
+    });
+    if (!('response' in sent))
+        return sent;
+    const { status } = sent.response;
+    const parsed = zGetSessionResponse.safeParse(await readJson(sent.response));
+    if (!parsed.success)
+        return failure('SESSION_UNAVAILABLE', status);
+    const { user, csrf_token, expires_at, absolute_expires_at } = parsed.data;
+    if (expectedUserId !== undefined && user.id !== expectedUserId) {
+        return failure('IDENTITY_CHANGED', status);
+    }
+    return {
+        status: 'ok',
+        session: {
+            user: {
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                emailVerified: user.email_verified,
+                signInProvider: user.sign_in_provider
+            },
+            csrfToken: csrf_token,
+            expiresAt: Date.parse(expires_at),
+            absoluteExpiresAt: Date.parse(absolute_expires_at)
+        }
+    };
+}
+/**
+ * Creates the session, then reads it back for the user and CSRF token. A
+ * failure to produce the proof is the provider's error and propagates.
+ */
+export async function createWebSession(options, getIdentityProof, { expectedUserId } = {}) {
+    const proof = await getIdentityProof();
+    const sent = await send(options, '/auth/session', {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${proof}` }
+    });
+    if (!('response' in sent))
+        return sent;
+    const parsed = zCreateSessionResponse.safeParse(await readJson(sent.response));
+    if (!parsed.success || !parsed.data.success) {
+        return failure('SESSION_UNAVAILABLE', sent.response.status);
+    }
+    return readWebSession(options, { expectedUserId });
+}
+/** Sends no CSRF token: sign-out must work against a dead session. */
+export async function deleteWebSession(options) {
+    const sent = await send(options, '/auth/session', { method: 'DELETE' });
+    if (!('response' in sent))
+        return sent;
+    const parsed = zDeleteSessionResponse.safeParse(await readJson(sent.response));
+    if (!parsed.success || !parsed.data.success) {
+        return failure('SESSION_UNAVAILABLE', sent.response.status);
+    }
+    return { status: 'ok' };
+}
+/**
+ * Signs the user out of every device. Only a body the contract recognises is
+ * ok: the caller tells the user every device is signed out on that answer.
+ */
+export async function revokeAllWebSessions(options, csrfToken, getIdentityProof) {
+    const proof = await getIdentityProof();
+    const sent = await send(options, '/auth/sessions/revoke-all', {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${proof}`, 'X-CSRF-Token': csrfToken }
+    });
+    if (!('response' in sent))
+        return sent;
+    const parsed = zRevokeAllSessionsResponse.safeParse(await readJson(sent.response));
+    if (!parsed.success) {
+        return failure('SESSION_UNAVAILABLE', sent.response.status);
+    }
+    return { status: 'ok' };
+}

package/dist/core/webSessionFlag.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `unified_web_session` for a site with no sign-in of its own to ask with.
+ * The anonymous `/api/features` document's global `web_session_probe` only
+ * decides whether to ask; the answer is the credentialed read's
+ * `unified_web_session` (cloud#10689). `web_session_probe` is a backend
+ * follow-up to cloud#10689 and not served yet. Every failure is `false`.
+ */
+export interface FeaturesReadOptions {
+    /** Cloud origin, e.g. `https://cloud.comfy.org`. */
+    readonly cloudBaseUrl: string;
+    readonly fetchImpl: typeof fetch;
+    readonly timeoutMs?: number;
+}
+export interface UnifiedWebSessionOptions extends FeaturesReadOptions {
+    /** Settles the anonymous document's `web_session_probe`. */
+    readonly probe: () => Promise<boolean>;
+}
+/** A plain anonymous GET: no cookie, no custom header, so no CORS preflight. */
+export declare function readWebSessionProbe(options: FeaturesReadOptions): Promise<boolean>;
+export declare function resolveUnifiedWebSession({ probe, ...options }: UnifiedWebSessionOptions): Promise<boolean>;

package/dist/core/webSessionFlag.js

@@ -0,0 +1,62 @@
+/**
+ * `unified_web_session` for a site with no sign-in of its own to ask with.
+ * The anonymous `/api/features` document's global `web_session_probe` only
+ * decides whether to ask; the answer is the credentialed read's
+ * `unified_web_session` (cloud#10689). `web_session_probe` is a backend
+ * follow-up to cloud#10689 and not served yet. Every failure is `false`.
+ */
+const DEFAULT_TIMEOUT_MS = 5000;
+function readsLiteralTrue(body, key) {
+    return (typeof body === 'object' && body !== null && Reflect.get(body, key) === true);
+}
+async function readFeatures({ cloudBaseUrl, fetchImpl, timeoutMs = DEFAULT_TIMEOUT_MS }, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(`${cloudBaseUrl}/api/features`, {
+            ...init,
+            signal: controller.signal
+        });
+        return response.ok ? await response.json() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/** A plain anonymous GET: no cookie, no custom header, so no CORS preflight. */
+export async function readWebSessionProbe(options) {
+    return readsLiteralTrue(await readFeatures(options, { credentials: 'omit' }), 'web_session_probe');
+}
+async function probeIsOn(probe) {
+    try {
+        return await probe();
+    }
+    catch {
+        return false;
+    }
+}
+async function loadClientHeader() {
+    try {
+        const { COMFY_CLIENT } = await import('./requestAuth.js');
+        return COMFY_CLIENT;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function resolveUnifiedWebSession({ probe, ...options }) {
+    if (!(await probeIsOn(probe)))
+        return false;
+    const client = await loadClientHeader();
+    if (client === undefined)
+        return false;
+    const body = await readFeatures(options, {
+        credentials: 'include',
+        cache: 'no-store',
+        headers: { 'X-Comfy-Client': client }
+    });
+    return readsLiteralTrue(body, 'unified_web_session');
+}

package/dist/core/webSessionIdentity.d.ts

@@ -0,0 +1,291 @@
+/**
+ * The session-backed identity source: boots a site from `GET /auth/session`
+ * and follows the server's answer. It keeps no record of past sessions, and
+ * the remembered provider login is an opaque port, so no provider leaks in.
+ */
+import { z } from 'zod';
+import type { CrossTabRefreshPort, WebSession, WebSessionCommandResult, WebSessionResult } from './sessionContracts.js';
+import type { WebSessionOptions } from './webSession.js';
+export interface RememberedLogin {
+    /** The Comfy user id of the login this browser remembers, or null. */
+    currentUserId: () => Promise<string | null>;
+    /** Null when the provider has no usable login; a throw is transient. */
+    getProof: () => Promise<string | null>;
+    signOutLocally: () => Promise<void>;
+}
+export type WebSessionPrincipal = {
+    readonly kind: 'account';
+    readonly rememberedLogin: RememberedLogin;
+} | {
+    readonly kind: 'api_key';
+};
+export type WebSessionBootOutcome = 'signed_in' | 'restored' | 'signed_out' | 'revoked' | 'restore_failed';
+export interface WebSessionBootstrapEvent {
+    readonly outcome: WebSessionBootOutcome;
+    readonly origin: string;
+}
+type SignedOutOutcome = Exclude<WebSessionBootOutcome, 'signed_in' | 'restored'>;
+/** The account this tab holds changed under it, or went away. */
+export type WebSessionAccountChange = {
+    readonly reason: 'user_changed';
+    readonly session: WebSession;
+} | {
+    readonly reason: 'signed_out';
+    readonly outcome: SignedOutOutcome;
+};
+export type WebSessionIdentityState = {
+    readonly phase: 'idle';
+} | {
+    readonly phase: 'api_key';
+} | {
+    readonly phase: 'reading' | 'retry_wait' | 'restoring';
+    readonly failures: number;
+} | {
+    readonly phase: 'signed_in';
+    readonly session: WebSession;
+} | {
+    readonly phase: 'signed_out';
+    readonly outcome: SignedOutOutcome;
+};
+/** Only a sibling's sign-in is news to a tab that has signed out. */
+export type SessionObservedFrom = 'this_tab' | 'sibling_heartbeat' | 'sibling_sign_in' | 'sibling_sign_out';
+export type WebSessionIdentityEvent = {
+    readonly type: 'boot';
+} | {
+    readonly type: 'read_answered' | 'restore_answered';
+    readonly result: WebSessionResult;
+    readonly rememberedUserId: string | null;
+} | {
+    readonly type: 'proof_missing' | 'proof_errored' | 'login_errored';
+} | {
+    readonly type: 'retry_due';
+}
+/** A heartbeat answer, this tab's or one a sibling tab published. */
+ | {
+    readonly type: 'session_observed';
+    readonly from: SessionObservedFrom;
+    readonly result: WebSessionResult;
+    readonly rememberedUserId: string | null;
+} | {
+    readonly type: 'session_created';
+    readonly session: WebSession;
+} | {
+    readonly type: 'sign_out_requested';
+};
+export type WebSessionIdentityEffect = {
+    readonly type: 'read';
+} | {
+    readonly type: 'restore';
+    readonly expectedUserId: string;
+} | {
+    readonly type: 'schedule_retry';
+    readonly failures: number;
+} | {
+    readonly type: 'sign_out_locally';
+} | {
+    readonly type: 'report';
+    readonly outcome: WebSessionBootOutcome;
+} | {
+    readonly type: 'account_changed';
+    readonly change: WebSessionAccountChange;
+} | {
+    readonly type: 'report_signed_out_remotely';
+};
+export interface WebSessionIdentityTransition {
+    readonly state: WebSessionIdentityState;
+    readonly effects: readonly WebSessionIdentityEffect[];
+}
+/** Pure: an event that means nothing in the current phase changes nothing. */
+export declare function transitionWebSessionIdentity(state: WebSessionIdentityState, event: WebSessionIdentityEvent): WebSessionIdentityTransition;
+export type ScheduleRetry = (run: () => void, delayMs: number) => () => void;
+export interface VisibilityPort {
+    isVisible: () => boolean;
+    onChange: (listener: (visible: boolean) => void) => () => void;
+}
+export interface WebSessionHeartbeatOptions {
+    readonly visibility: VisibilityPort;
+    /** Without it every tab reads for itself. */
+    readonly crossTab?: CrossTabRefreshPort<WebSessionSharedMessage>;
+    readonly intervalMs?: number;
+}
+export interface WebSessionIdentityOptions {
+    readonly session: WebSessionOptions;
+    readonly principal: WebSessionPrincipal;
+    /** The site reporting the boot, e.g. `https://www.comfy.org`. */
+    readonly origin: string;
+    readonly onBootstrap?: (event: WebSessionBootstrapEvent) => void;
+    /** Telemetry for `session_signed_out_remotely`. */
+    readonly onSignedOutRemotely?: (event: {
+        readonly origin: string;
+    }) => void;
+    /** The host drops pending actions and user-scoped state here. */
+    readonly onAccountChanged?: (change: WebSessionAccountChange & {
+        readonly epoch: number;
+    }) => void;
+    readonly heartbeat?: WebSessionHeartbeatOptions;
+    readonly schedule?: ScheduleRetry;
+    readonly retryBaseMs?: number;
+    readonly retryMaxMs?: number;
+}
+export interface WebSessionIdentity {
+    getState: () => WebSessionIdentityState;
+    /** Delivers the current state at once, then every change. */
+    subscribe: (listener: (state: WebSessionIdentityState) => void) => () => void;
+    /** Starts the boot and the heartbeat; a no-op unless idle. */
+    boot: () => void;
+    /** Only after an interactive sign-in; a token refresh must never call it. */
+    signedIn: (getProof: () => Promise<string>) => Promise<WebSessionResult>;
+    signOut: () => Promise<WebSessionCommandResult>;
+    /** Changes with the account; an answer started under an older epoch is stale. */
+    getEpoch: () => number;
+    /** Cancels timers, ignores answers in flight, and returns to idle. */
+    dispose: () => void;
+}
+/**
+ * Every tab of a site reads the same host-only cookie, so a sibling's answer
+ * is this tab's own session observed elsewhere; that is what makes adopting
+ * it safe. A per-tab session scope would break this assumption.
+ */
+declare const zSharedMessage: z.ZodObject<{
+    from: z.ZodEnum<["heartbeat", "sign_in", "sign_out"]>;
+    result: z.ZodDiscriminatedUnion<"status", [z.ZodObject<{
+        status: z.ZodLiteral<"ok">;
+        session: z.ZodObject<{
+            user: z.ZodObject<{
+                id: z.ZodString;
+                email: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                emailVerified: z.ZodBoolean;
+                signInProvider: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            }, {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            }>;
+            csrfToken: z.ZodString;
+            expiresAt: z.ZodNumber;
+            absoluteExpiresAt: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        }, {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        status: "ok";
+        session: {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        };
+    }, {
+        status: "ok";
+        session: {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        };
+    }>, z.ZodObject<{
+        status: z.ZodLiteral<"error">;
+        code: z.ZodLiteral<"SESSION_REVOKED">;
+        retryable: z.ZodLiteral<false>;
+    }, "strip", z.ZodTypeAny, {
+        code: "SESSION_REVOKED";
+        status: "error";
+        retryable: false;
+    }, {
+        code: "SESSION_REVOKED";
+        status: "error";
+        retryable: false;
+    }>]>;
+}, "strip", z.ZodTypeAny, {
+    result: {
+        status: "ok";
+        session: {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        };
+    } | {
+        code: "SESSION_REVOKED";
+        status: "error";
+        retryable: false;
+    };
+    from: "heartbeat" | "sign_in" | "sign_out";
+}, {
+    result: {
+        status: "ok";
+        session: {
+            user: {
+                email: string;
+                id: string;
+                emailVerified: boolean;
+                name?: string | undefined;
+                signInProvider?: string | undefined;
+            };
+            expiresAt: number;
+            csrfToken: string;
+            absoluteExpiresAt: number;
+        };
+    } | {
+        code: "SESSION_REVOKED";
+        status: "error";
+        retryable: false;
+    };
+    from: "heartbeat" | "sign_in" | "sign_out";
+}>;
+type SharedFrom = z.infer<typeof zSharedMessage>['from'];
+/** What one tab of a site tells its siblings, and why. */
+export interface WebSessionSharedMessage {
+    readonly from: SharedFrom;
+    readonly result: WebSessionResult;
+}
+/** Inert until `boot()`: constructing it sends no request and arms no timer. */
+export declare function createWebSessionIdentity(options: WebSessionIdentityOptions): WebSessionIdentity;
+export {};