@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.1

package/dist/core/webSessionIdentity.js

@@ -0,0 +1,496 @@
+/**
+ * The session-backed identity source: boots a site from `GET /auth/session`
+ * and follows the server's answer. It keeps no record of past sessions, and
+ * the remembered provider login is an opaque port, so no provider leaks in.
+ */
+import { z } from 'zod';
+import { createWebSession, deleteWebSession, readWebSession } from './webSession.js';
+const read = { type: 'read' };
+const signOutLocally = { type: 'sign_out_locally' };
+function signOutDifferentLogin(session, rememberedUserId) {
+    return rememberedUserId !== null && rememberedUserId !== session.user.id
+        ? [signOutLocally]
+        : [];
+}
+function settleSignedIn(session, rememberedUserId, outcome) {
+    return {
+        state: { phase: 'signed_in', session },
+        effects: [
+            ...signOutDifferentLogin(session, rememberedUserId),
+            { type: 'report', outcome }
+        ]
+    };
+}
+function settleSignedOut(outcome) {
+    return {
+        state: { phase: 'signed_out', outcome },
+        effects: [
+            ...(outcome === 'revoked' ? [signOutLocally] : []),
+            { type: 'report', outcome }
+        ]
+    };
+}
+function waitToRetry(failures) {
+    return {
+        state: { phase: 'retry_wait', failures },
+        effects: [{ type: 'schedule_retry', failures }]
+    };
+}
+function isNoLiveSession(failure) {
+    return failure.code === 'NO_SESSION' || failure.code === 'SESSION_EXPIRED';
+}
+function applyReadAnswered(failures, result, rememberedUserId) {
+    if (result.status === 'ok') {
+        return settleSignedIn(result.session, rememberedUserId, 'signed_in');
+    }
+    if (result.retryable)
+        return waitToRetry(failures + 1);
+    if (result.code === 'SESSION_REVOKED')
+        return settleSignedOut('revoked');
+    if (!isNoLiveSession(result))
+        return settleSignedOut('signed_out');
+    if (rememberedUserId === null)
+        return settleSignedOut('signed_out');
+    return {
+        state: { phase: 'restoring', failures },
+        effects: [{ type: 'restore', expectedUserId: rememberedUserId }]
+    };
+}
+function applyRestoreAnswered(failures, result, rememberedUserId) {
+    if (result.status === 'ok') {
+        return settleSignedIn(result.session, rememberedUserId, 'restored');
+    }
+    if (result.retryable)
+        return waitToRetry(failures + 1);
+    if (result.code === 'SESSION_REVOKED')
+        return settleSignedOut('revoked');
+    return settleSignedOut('restore_failed');
+}
+function leaveAccount(outcome, effects = []) {
+    return {
+        state: { phase: 'signed_out', outcome },
+        effects: [
+            ...effects,
+            { type: 'account_changed', change: { reason: 'signed_out', outcome } }
+        ]
+    };
+}
+function replaceSession(held, session, effects = []) {
+    const state = { phase: 'signed_in', session };
+    if (session.user.id === held.user.id)
+        return { state, effects: [] };
+    return {
+        state,
+        effects: [
+            ...effects,
+            { type: 'account_changed', change: { reason: 'user_changed', session } }
+        ]
+    };
+}
+/** A read never signs out on doubt: only revoked or no live session does. */
+function observeWhileSignedIn(state, result, rememberedUserId, restored, ownRead) {
+    if (result.status === 'ok') {
+        return replaceSession(state.session, result.session, signOutDifferentLogin(result.session, rememberedUserId));
+    }
+    if (result.retryable)
+        return { state, effects: [] };
+    if (result.code === 'SESSION_REVOKED') {
+        return leaveAccount('revoked', ownRead
+            ? [signOutLocally, { type: 'report_signed_out_remotely' }]
+            : [signOutLocally]);
+    }
+    if (restored)
+        return leaveAccount('restore_failed');
+    if (!isNoLiveSession(result))
+        return { state, effects: [] };
+    if (rememberedUserId === null)
+        return leaveAccount('signed_out');
+    return {
+        state,
+        effects: [{ type: 'restore', expectedUserId: rememberedUserId }]
+    };
+}
+function transitionSignedIn(state, event) {
+    switch (event.type) {
+        case 'session_observed':
+            return observeWhileSignedIn(state, event.result, event.rememberedUserId, false, event.from === 'this_tab');
+        case 'restore_answered':
+            return observeWhileSignedIn(state, event.result, event.rememberedUserId, true, true);
+        case 'session_created':
+            return replaceSession(state.session, event.session);
+        case 'proof_missing':
+            return leaveAccount('restore_failed');
+        case 'sign_out_requested':
+            return leaveAccount('signed_out', [signOutLocally]);
+        default:
+            return { state, effects: [] };
+    }
+}
+function transitionRestoring(state, event) {
+    switch (event.type) {
+        case 'restore_answered':
+            return applyRestoreAnswered(state.failures, event.result, event.rememberedUserId);
+        case 'proof_missing':
+            return settleSignedOut('restore_failed');
+        case 'proof_errored':
+        case 'login_errored':
+            return waitToRetry(state.failures + 1);
+        default:
+            return { state, effects: [] };
+    }
+}
+function transitionBoot(state, event) {
+    switch (state.phase) {
+        case 'reading':
+            if (event.type === 'login_errored')
+                return waitToRetry(state.failures + 1);
+            return event.type === 'read_answered'
+                ? applyReadAnswered(state.failures, event.result, event.rememberedUserId)
+                : { state, effects: [] };
+        case 'retry_wait':
+            return event.type === 'retry_due'
+                ? { state: { ...state, phase: 'reading' }, effects: [read] }
+                : { state, effects: [] };
+        case 'restoring':
+            return transitionRestoring(state, event);
+        default:
+            return { state, effects: [] };
+    }
+}
+function transitionSettling(state, event) {
+    switch (event.type) {
+        case 'session_observed': {
+            const { result } = event;
+            const adoptable = state.phase === 'retry_wait' ||
+                (state.phase === 'signed_out' && event.from === 'sibling_sign_in');
+            if (result.status !== 'ok' || !adoptable)
+                return { state, effects: [] };
+            return {
+                state: { phase: 'signed_in', session: result.session },
+                effects: signOutDifferentLogin(result.session, event.rememberedUserId)
+            };
+        }
+        case 'session_created':
+            return {
+                state: { phase: 'signed_in', session: event.session },
+                effects: []
+            };
+        case 'sign_out_requested':
+            return state.phase === 'signed_out'
+                ? { state, effects: [] }
+                : {
+                    state: { phase: 'signed_out', outcome: 'signed_out' },
+                    effects: [signOutLocally]
+                };
+        default:
+            return transitionBoot(state, event);
+    }
+}
+/** Pure: an event that means nothing in the current phase changes nothing. */
+export function transitionWebSessionIdentity(state, event) {
+    switch (state.phase) {
+        case 'idle':
+            return event.type === 'boot'
+                ? { state: { phase: 'reading', failures: 0 }, effects: [read] }
+                : { state, effects: [] };
+        case 'api_key':
+            return { state, effects: [] };
+        case 'signed_in':
+            return transitionSignedIn(state, event);
+        default:
+            return transitionSettling(state, event);
+    }
+}
+const HEARTBEAT_KEY = '@comfyorg/account-core web-session heartbeat';
+const HEARTBEAT_INTERVAL_MS = 10 * 60 * 1000;
+const zSharedResult = z.discriminatedUnion('status', [
+    z.object({
+        status: z.literal('ok'),
+        session: z.object({
+            user: z.object({
+                id: z.string(),
+                email: z.string(),
+                name: z.string().optional(),
+                emailVerified: z.boolean(),
+                signInProvider: z.string().optional()
+            }),
+            csrfToken: z.string(),
+            expiresAt: z.number(),
+            absoluteExpiresAt: z.number()
+        })
+    }),
+    z.object({
+        status: z.literal('error'),
+        code: z.literal('SESSION_REVOKED'),
+        retryable: z.literal(false)
+    })
+]);
+/**
+ * Every tab of a site reads the same host-only cookie, so a sibling's answer
+ * is this tab's own session observed elsewhere; that is what makes adopting
+ * it safe. A per-tab session scope would break this assumption.
+ */
+const zSharedMessage = z.object({
+    from: z.enum(['heartbeat', 'sign_in', 'sign_out']),
+    result: zSharedResult
+});
+const revoked = {
+    status: 'error',
+    code: 'SESSION_REVOKED',
+    retryable: false
+};
+const scheduleWithTimer = (run, delayMs) => {
+    const timer = setTimeout(run, delayMs);
+    return () => clearTimeout(timer);
+};
+function reportLocalSignOutFailure(error) {
+    console.warn('webSessionIdentity: local sign-out failed', error);
+}
+function createApiKeyIdentity() {
+    const state = { phase: 'api_key' };
+    return {
+        getState: () => state,
+        subscribe: (listener) => {
+            listener(state);
+            return () => undefined;
+        },
+        boot: () => undefined,
+        signedIn: async () => ({
+            status: 'error',
+            code: 'SESSION_REQUEST_REFUSED',
+            retryable: false
+        }),
+        signOut: async () => ({ status: 'ok' }),
+        getEpoch: () => 0,
+        dispose: () => undefined
+    };
+}
+function createAccountIdentity(options, login) {
+    const schedule = options.schedule ?? scheduleWithTimer;
+    const retryBaseMs = options.retryBaseMs ?? 1000;
+    const retryMaxMs = options.retryMaxMs ?? 60_000;
+    const heartbeat = options.heartbeat;
+    const listeners = new Set();
+    let state = { phase: 'idle' };
+    let epoch = 0;
+    let signOuts = 0;
+    let signIns = 0;
+    let liveSignIn = 0;
+    let cancelRetry;
+    let cancelBeat;
+    let releaseLeadership;
+    let stopWatching = [];
+    function dispatch(event) {
+        const next = transitionWebSessionIdentity(state, event);
+        const changed = next.state !== state;
+        state = next.state;
+        next.effects.forEach(run);
+        if (changed)
+            listeners.forEach((listener) => listener(state));
+        syncLeadership();
+    }
+    function publish(from, result) {
+        heartbeat?.crossTab?.publishCredential(HEARTBEAT_KEY, { from, result });
+    }
+    async function answer(started, answered, request) {
+        const result = await request();
+        const remembered = await login.currentUserId().then((value) => ({ value }), () => undefined);
+        if (started !== epoch)
+            return;
+        // A failed lookup matters only without a live session to adopt: with one,
+        // it can skip nothing but the different-user sign-out.
+        if (remembered === undefined && result.status !== 'ok') {
+            return dispatch({ type: 'login_errored' });
+        }
+        dispatch({
+            ...answered,
+            result,
+            rememberedUserId: remembered?.value ?? null
+        });
+    }
+    function beat() {
+        const started = epoch;
+        const observed = { type: 'session_observed', from: 'this_tab' };
+        void answer(started, observed, async () => {
+            const result = await readWebSession(options.session);
+            const shared = result.status === 'ok' || result.code === 'SESSION_REVOKED';
+            if (shared && started === epoch)
+                publish('heartbeat', result);
+            return result;
+        });
+    }
+    function invalidatePendingSignIns() {
+        signOuts += 1;
+        liveSignIn = 0;
+    }
+    function adopt(message) {
+        const parsed = zSharedMessage.safeParse(message);
+        if (!parsed.success)
+            return;
+        const { from, result } = parsed.data;
+        if (from === 'sign_out')
+            invalidatePendingSignIns();
+        const observed = {
+            type: 'session_observed',
+            from: `sibling_${from}`
+        };
+        void answer(epoch, observed, async () => result);
+    }
+    function wantsBeat() {
+        return (stopWatching.length > 0 &&
+            state.phase === 'signed_in' &&
+            heartbeat?.visibility.isVisible() === true);
+    }
+    function armBeat() {
+        cancelBeat = schedule(() => {
+            beat();
+            armBeat();
+        }, heartbeat?.intervalMs ?? HEARTBEAT_INTERVAL_MS);
+    }
+    function lead() {
+        if (wantsBeat() && cancelBeat === undefined)
+            armBeat();
+    }
+    function syncLeadership() {
+        const wanted = wantsBeat();
+        if (wanted && releaseLeadership === undefined) {
+            const port = heartbeat?.crossTab;
+            if (port) {
+                releaseLeadership = port.requestLeadership(HEARTBEAT_KEY, lead);
+            }
+            else {
+                releaseLeadership = () => undefined;
+                lead();
+            }
+        }
+        else if (!wanted && releaseLeadership !== undefined) {
+            releaseLeadership();
+            releaseLeadership = undefined;
+            cancelBeat?.();
+            cancelBeat = undefined;
+        }
+    }
+    function watch() {
+        if (heartbeat === undefined)
+            return;
+        const { visibility, crossTab } = heartbeat;
+        stopWatching = [
+            visibility.onChange((visible) => {
+                if (visible && state.phase === 'signed_in')
+                    beat();
+                syncLeadership();
+            }),
+            ...(crossTab ? [crossTab.onCredential(HEARTBEAT_KEY, adopt)] : [])
+        ];
+    }
+    async function restore(started, expectedUserId) {
+        const proof = await login.getProof().then((value) => ({ value }), () => undefined);
+        if (started !== epoch)
+            return;
+        if (proof === undefined)
+            return dispatch({ type: 'proof_errored' });
+        const { value } = proof;
+        if (value === null)
+            return dispatch({ type: 'proof_missing' });
+        await answer(started, { type: 'restore_answered' }, () => createWebSession(options.session, async () => value, { expectedUserId }));
+    }
+    function run(effect) {
+        switch (effect.type) {
+            case 'read':
+                void answer(epoch, { type: 'read_answered' }, () => readWebSession(options.session));
+                return;
+            case 'restore':
+                void restore(epoch, effect.expectedUserId);
+                return;
+            case 'schedule_retry':
+                cancelRetry = schedule(() => {
+                    cancelRetry = undefined;
+                    dispatch({ type: 'retry_due' });
+                }, Math.min(retryBaseMs * 2 ** (effect.failures - 1), retryMaxMs));
+                return;
+            case 'sign_out_locally':
+                login.signOutLocally().catch(reportLocalSignOutFailure);
+                return;
+            default:
+                notify(effect);
+        }
+    }
+    function notify(effect) {
+        switch (effect.type) {
+            case 'report':
+                options.onBootstrap?.({
+                    outcome: effect.outcome,
+                    origin: options.origin
+                });
+                return;
+            case 'account_changed':
+                epoch += 1;
+                options.onAccountChanged?.({ ...effect.change, epoch });
+                return;
+            case 'report_signed_out_remotely':
+                options.onSignedOutRemotely?.({ origin: options.origin });
+        }
+    }
+    function stopHeartbeat() {
+        stopWatching.forEach((stop) => stop());
+        stopWatching = [];
+        syncLeadership();
+    }
+    return {
+        getState: () => state,
+        subscribe: (listener) => {
+            listeners.add(listener);
+            listener(state);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        boot: () => {
+            if (state.phase !== 'idle')
+                return;
+            watch();
+            dispatch({ type: 'boot' });
+        },
+        signedIn: async (getProof) => {
+            const signOutsAtStart = signOuts;
+            const signIn = ++signIns;
+            const result = await createWebSession(options.session, getProof);
+            if (result.status !== 'ok')
+                return result;
+            if (signOuts !== signOutsAtStart) {
+                // A later sign-in owns the cookie now; deleting would end its session.
+                if (liveSignIn > signIn)
+                    return revoked;
+                const cleanup = await deleteWebSession(options.session);
+                return cleanup.status === 'ok' ? revoked : cleanup;
+            }
+            liveSignIn = signIn;
+            dispatch({ type: 'session_created', session: result.session });
+            publish('sign_in', result);
+            return result;
+        },
+        signOut: async () => {
+            invalidatePendingSignIns();
+            dispatch({ type: 'sign_out_requested' });
+            const result = await deleteWebSession(options.session);
+            if (result.status === 'ok')
+                publish('sign_out', revoked);
+            return result;
+        },
+        getEpoch: () => epoch,
+        dispose: () => {
+            epoch += 1;
+            cancelRetry?.();
+            cancelRetry = undefined;
+            stopHeartbeat();
+            state = { phase: 'idle' };
+            listeners.forEach((listener) => listener(state));
+        }
+    };
+}
+/** Inert until `boot()`: constructing it sends no request and arms no timer. */
+export function createWebSessionIdentity(options) {
+    return options.principal.kind === 'api_key'
+        ? createApiKeyIdentity()
+        : createAccountIdentity(options, options.principal.rememberedLogin);
+}

package/dist/firebase/configSource.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Cloud configuration read at runtime from the Cloud app's own
+ * `/api/features`, instead of values every host used to bake in at build
+ * time: the Firebase options, the Stripe publishable key, and the PostHog
+ * project and disabled events. Framework-free and dependency-free — it
+ * returns plain data and never imports the Firebase, Stripe or PostHog SDKs,
+ * so a caller decides if and when to use any of them.
+ *
+ * `fetchCloudFeatures` fetches the document once and reads every field from
+ * it; `fetchFirebaseConfig` and `fetchStripePublishableKey` are single-field
+ * conveniences built on top of it for a caller that only wants one. A host
+ * that wants both still calls `fetchCloudFeatures` directly — calling both
+ * conveniences would cost a second round trip.
+ */
+/** The subset of Firebase's own `FirebaseOptions` shape this fetch produces. */
+export interface RuntimeFirebaseOptions {
+    readonly apiKey: string;
+    readonly authDomain: string;
+    readonly projectId: string;
+    readonly appId: string;
+    readonly databaseURL?: string;
+    readonly storageBucket?: string;
+    readonly messagingSenderId?: string;
+    readonly measurementId?: string;
+}
+export interface CloudFeatures {
+    readonly firebaseConfig?: RuntimeFirebaseOptions;
+    /** Absent when the backend has no key configured, not an empty string. */
+    readonly stripePublishableKey?: string;
+    /** Present only for a literal `true` `web_session_probe`; see `../core/webSessionFlag.ts`. */
+    readonly webSessionProbe?: true;
+    /** The Cloud app's own PostHog project, so every Comfy surface reports into one. */
+    readonly posthogProjectToken?: string;
+    readonly posthogApiHost?: string;
+    /** Event names the backend has switched off for product analytics. */
+    readonly telemetryDisabledEvents?: readonly string[];
+}
+export interface FetchFirebaseConfigOptions {
+    readonly fetchImpl?: typeof fetch;
+    readonly timeoutMs?: number;
+}
+/**
+ * Fetches the Cloud app's `/api/features` once and reads the Firebase
+ * options (`firebase_config`), the Stripe publishable key
+ * (`stripe_publishable_key`) and the PostHog settings (`posthog_project_token`,
+ * `posthog_api_host`, `telemetry_disabled_events`) from it. A field is absent
+ * when the response omits it, is malformed, or the fetch itself fails — this
+ * never throws.
+ */
+export declare function fetchCloudFeatures(cloudBaseUrl: string, options?: FetchFirebaseConfigOptions): Promise<CloudFeatures>;
+/** Single-field convenience over `fetchCloudFeatures`; see the module comment before pairing it with another single-field call. */
+export declare function fetchFirebaseConfig(cloudBaseUrl: string, options?: FetchFirebaseConfigOptions): Promise<RuntimeFirebaseOptions | undefined>;
+/** Single-field convenience over `fetchCloudFeatures`; see the module comment before pairing it with another single-field call. */
+export declare function fetchStripePublishableKey(cloudBaseUrl: string, options?: FetchFirebaseConfigOptions): Promise<string | undefined>;

package/dist/firebase/configSource.js

@@ -0,0 +1,111 @@
+/**
+ * Cloud configuration read at runtime from the Cloud app's own
+ * `/api/features`, instead of values every host used to bake in at build
+ * time: the Firebase options, the Stripe publishable key, and the PostHog
+ * project and disabled events. Framework-free and dependency-free — it
+ * returns plain data and never imports the Firebase, Stripe or PostHog SDKs,
+ * so a caller decides if and when to use any of them.
+ *
+ * `fetchCloudFeatures` fetches the document once and reads every field from
+ * it; `fetchFirebaseConfig` and `fetchStripePublishableKey` are single-field
+ * conveniences built on top of it for a caller that only wants one. A host
+ * that wants both still calls `fetchCloudFeatures` directly — calling both
+ * conveniences would cost a second round trip.
+ */
+const DEFAULT_TIMEOUT_MS = 5000;
+function readString(source, key) {
+    const value = source[key];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/** Same required-field rule as the build-time reader: everything Firebase Auth needs is required, the rest carried through when present. */
+function parseFirebaseConfig(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const source = value;
+    const apiKey = readString(source, 'apiKey');
+    const authDomain = readString(source, 'authDomain');
+    const projectId = readString(source, 'projectId');
+    const appId = readString(source, 'appId');
+    if (!apiKey || !authDomain || !projectId || !appId)
+        return undefined;
+    return {
+        apiKey,
+        authDomain,
+        projectId,
+        appId,
+        databaseURL: readString(source, 'databaseURL'),
+        storageBucket: readString(source, 'storageBucket'),
+        messagingSenderId: readString(source, 'messagingSenderId'),
+        measurementId: readString(source, 'measurementId')
+    };
+}
+/** A non-string or empty value is treated the same as an absent field. */
+function parseStripePublishableKey(value) {
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function parseStringList(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : undefined;
+}
+/**
+ * Fetches `/api/features` from the given Cloud origin, an unauthenticated,
+ * cross-origin-readable endpoint. Resolves `undefined` on any problem — a
+ * non-OK response, an unparseable or non-object body, a network failure, or
+ * a fetch that outruns `timeoutMs` — so a caller can always fall back
+ * without branching on why the fetch failed.
+ */
+async function fetchFeaturesDocument(cloudBaseUrl, options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(`${cloudBaseUrl}/api/features`, {
+            signal: controller.signal
+        });
+        if (!response.ok)
+            return undefined;
+        const body = await response.json();
+        return typeof body === 'object' && body !== null
+            ? body
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Fetches the Cloud app's `/api/features` once and reads the Firebase
+ * options (`firebase_config`), the Stripe publishable key
+ * (`stripe_publishable_key`) and the PostHog settings (`posthog_project_token`,
+ * `posthog_api_host`, `telemetry_disabled_events`) from it. A field is absent
+ * when the response omits it, is malformed, or the fetch itself fails — this
+ * never throws.
+ */
+export async function fetchCloudFeatures(cloudBaseUrl, options = {}) {
+    const body = await fetchFeaturesDocument(cloudBaseUrl, options);
+    if (!body)
+        return {};
+    return {
+        firebaseConfig: parseFirebaseConfig(body.firebase_config),
+        stripePublishableKey: parseStripePublishableKey(body.stripe_publishable_key),
+        posthogProjectToken: readString(body, 'posthog_project_token'),
+        posthogApiHost: readString(body, 'posthog_api_host'),
+        telemetryDisabledEvents: parseStringList(body.telemetry_disabled_events),
+        ...(body.web_session_probe === true ? { webSessionProbe: true } : {})
+    };
+}
+/** Single-field convenience over `fetchCloudFeatures`; see the module comment before pairing it with another single-field call. */
+export async function fetchFirebaseConfig(cloudBaseUrl, options = {}) {
+    const features = await fetchCloudFeatures(cloudBaseUrl, options);
+    return features.firebaseConfig;
+}
+/** Single-field convenience over `fetchCloudFeatures`; see the module comment before pairing it with another single-field call. */
+export async function fetchStripePublishableKey(cloudBaseUrl, options = {}) {
+    const features = await fetchCloudFeatures(cloudBaseUrl, options);
+    return features.stripePublishableKey;
+}