@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.2

package/dist/core/sessionTokenMint.js

@@ -0,0 +1,222 @@
+/**
+ * Workspace tokens for services that cannot read the session cookie. The
+ * session mints one at `POST /auth/token` on first use, and each token is
+ * reused per (session user, workspace) until it nears expiry. Failures come
+ * back as web-session codes; nothing here retries or signs out.
+ */
+import { zErrorResponse, zExchangeTokenResponse } from '@comfyorg/ingest-types/zod';
+import { isCredentialFresh } from './credentialCache.js';
+import { COMFY_CLIENT } from './requestAuth.js';
+import { timedSignal } from './requestTimeout.js';
+export class SessionTokenError extends Error {
+    failure;
+    constructor(failure) {
+        super(`Workspace token mint failed: ${failure.code}`);
+        this.failure = failure;
+        this.name = 'SessionTokenError';
+    }
+}
+export const DEFAULT_REFRESH_BUFFER_MS = 60_000;
+const MAX_RETRY_AFTER_MS = 10 * 60 * 1000;
+const STATUS_RULES = {
+    401: {
+        byServerCode: {
+            session_expired: 'SESSION_EXPIRED',
+            session_revoked: 'SESSION_REVOKED',
+            TOKEN_REVOKED: 'SESSION_REVOKED'
+        },
+        fallback: 'NO_SESSION'
+    },
+    403: {
+        byServerCode: {
+            csrf_invalid: 'CSRF_STALE',
+            workspace_access_denied: 'WORKSPACE_ACCESS_DENIED'
+        },
+        fallback: 'SESSION_REQUEST_REFUSED'
+    },
+    /** The workspace is unknown, deleted, or not the user's: one remedy. */
+    404: {
+        byServerCode: { NOT_FOUND: 'WORKSPACE_ACCESS_DENIED' },
+        fallback: 'SESSION_REQUEST_REFUSED'
+    }
+};
+const zServerCode = zErrorResponse.pick({ code: true });
+function failure(code, httpStatus, serverCode) {
+    return {
+        status: 'error',
+        code,
+        retryable: code === 'SESSION_UNAVAILABLE',
+        ...(httpStatus === undefined ? {} : { httpStatus }),
+        ...(serverCode === undefined ? {} : { serverCode })
+    };
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Retry-After is delay-seconds or an HTTP-date; either is capped. */
+function retryAfterMs(value, nowMs) {
+    if (value === null)
+        return undefined;
+    const seconds = Number(value);
+    const delayMs = Number.isFinite(seconds)
+        ? seconds * 1000
+        : Date.parse(value) - nowMs;
+    return delayMs > 0 ? Math.min(delayMs, MAX_RETRY_AFTER_MS) : undefined;
+}
+function rateLimited(response, nowMs) {
+    const limited = failure('SESSION_UNAVAILABLE', response.status);
+    const waitMs = retryAfterMs(response.headers.get('Retry-After'), nowMs);
+    return waitMs === undefined ? limited : { ...limited, retryAfterMs: waitMs };
+}
+function codeFor(status, serverCode) {
+    const rule = STATUS_RULES[status];
+    if (rule === undefined)
+        return 'SESSION_REQUEST_REFUSED';
+    return rule.byServerCode[serverCode ?? ''] ?? rule.fallback;
+}
+function classifyFailure(response, body, nowMs) {
+    const { status } = response;
+    if (status === 429)
+        return rateLimited(response, nowMs);
+    if (status >= 500)
+        return failure('SESSION_UNAVAILABLE', status);
+    const parsed = zServerCode.safeParse(body);
+    const serverCode = parsed.success ? parsed.data.code : undefined;
+    return failure(codeFor(status, serverCode), status, serverCode);
+}
+export function createSessionTokenMint({ apiBaseUrl, fetchImpl, getSession, now = Date.now, refreshBufferMs = DEFAULT_REFRESH_BUFFER_MS, timeoutMs }) {
+    const tokenUrl = `${apiBaseUrl.replace(/\/+$/, '')}/auth/token`;
+    /** Keyed by workspace; every entry belongs to `cacheOwner`. */
+    const cache = new Map();
+    const inFlight = new Map();
+    let cacheOwner;
+    /** Bumped on every owner change, so an older owner's answer never lands. */
+    let ownerGeneration = 0;
+    let rateLimit;
+    function adoptOwner(userId) {
+        if (cacheOwner === userId)
+            return;
+        cacheOwner = userId;
+        ownerGeneration += 1;
+        cache.clear();
+        inFlight.clear();
+        rateLimit = undefined;
+    }
+    async function request(session, workspaceId) {
+        const { signal, release } = timedSignal(undefined, timeoutMs);
+        try {
+            const response = await fetchImpl(tokenUrl, {
+                method: 'POST',
+                credentials: 'include',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Comfy-Client': COMFY_CLIENT,
+                    'X-CSRF-Token': session.csrfToken,
+                    ...(workspaceId === undefined
+                        ? {}
+                        : { 'X-Comfy-Workspace-ID': workspaceId })
+                },
+                body: JSON.stringify(workspaceId === undefined ? {} : { workspace_id: workspaceId }),
+                signal
+            });
+            const body = await readJson(response);
+            if (signal?.aborted)
+                return failure('SESSION_UNAVAILABLE');
+            return response.ok
+                ? credentialFrom(session, response.status, body)
+                : classifyFailure(response, body, now());
+        }
+        catch {
+            return failure('SESSION_UNAVAILABLE');
+        }
+        finally {
+            release();
+        }
+    }
+    function credentialFrom(session, status, body) {
+        const parsed = zExchangeTokenResponse.safeParse(body);
+        const expiresAt = parsed.success
+            ? Date.parse(parsed.data.expires_at)
+            : Number.NaN;
+        if (!parsed.success || parsed.data.token === '' || !(expiresAt > now())) {
+            return failure('SESSION_UNAVAILABLE', status);
+        }
+        return {
+            status: 'ok',
+            credential: {
+                token: parsed.data.token,
+                expiresAt: Math.min(expiresAt, session.expiresAt),
+                uid: session.user.id,
+                workspace: parsed.data.workspace,
+                role: parsed.data.role,
+                permissions: parsed.data.permissions
+            }
+        };
+    }
+    function commit(workspaceId, generation, result) {
+        if (generation !== ownerGeneration)
+            return;
+        if (result.status === 'ok') {
+            cache.set(workspaceId, result.credential);
+            return;
+        }
+        if (result.httpStatus === 401)
+            cache.clear();
+        if (result.retryAfterMs !== undefined) {
+            rateLimit = { until: now() + result.retryAfterMs, failure: result };
+        }
+    }
+    async function mint(workspaceId) {
+        const session = getSession();
+        adoptOwner(session?.user.id);
+        if (session === undefined)
+            return failure('NO_SESSION');
+        const userId = session.user.id;
+        // The cache is checked before the backoff on purpose: a caller already
+        // holding a fresh token is still served while new mints wait.
+        const cached = cache.get(workspaceId);
+        if (cached && isCredentialFresh(cached, now(), refreshBufferMs)) {
+            return { status: 'ok', credential: cached };
+        }
+        if (rateLimit && now() < rateLimit.until) {
+            return rateLimit.failure;
+        }
+        const joined = inFlight.get(workspaceId);
+        if (joined)
+            return joined;
+        const generation = ownerGeneration;
+        const running = request(session, workspaceId).then((result) => {
+            if (inFlight.get(workspaceId) === running)
+                inFlight.delete(workspaceId);
+            const current = getSession();
+            if (current === undefined)
+                return failure('NO_SESSION');
+            if (current.user.id !== userId)
+                return failure('IDENTITY_CHANGED');
+            commit(workspaceId, generation, result);
+            return result;
+        });
+        inFlight.set(workspaceId, running);
+        return running;
+    }
+    function remint(workspaceId) {
+        if (!inFlight.has(workspaceId))
+            cache.delete(workspaceId);
+        return mint(workspaceId);
+    }
+    return {
+        mint,
+        remint,
+        async getWorkspaceToken(workspaceId) {
+            const result = await mint(workspaceId);
+            if (result.status === 'ok')
+                return result.credential.token;
+            throw new SessionTokenError(result);
+        }
+    };
+}

package/dist/core/webSession.d.ts

@@ -0,0 +1,27 @@
+import type { WebSessionCommandResult, WebSessionResult } from './sessionContracts.js';
+export type { WebSession, WebSessionCommandResult, WebSessionErrorCode, WebSessionFailure, WebSessionResult, WebSessionUser } from './sessionContracts.js';
+export interface WebSessionOptions {
+    /** Ingest API root, e.g. `https://cloud.comfy.org/api`. */
+    readonly apiBaseUrl: string;
+    readonly fetchImpl: typeof fetch;
+    readonly signal?: AbortSignal;
+    /** Caps each request, body included; a timeout is `SESSION_UNAVAILABLE`. Default: none. */
+    readonly timeoutMs?: number;
+}
+export declare function readWebSession(options: WebSessionOptions, { expectedUserId }?: {
+    readonly expectedUserId?: string;
+}): Promise<WebSessionResult>;
+/**
+ * Creates the session, then reads it back for the user and CSRF token. A
+ * failure to produce the proof is the provider's error and propagates.
+ */
+export declare function createWebSession(options: WebSessionOptions, getIdentityProof: () => Promise<string>, { expectedUserId }?: {
+    readonly expectedUserId?: string;
+}): Promise<WebSessionResult>;
+/** Sends no CSRF token: sign-out must work against a dead session. */
+export declare function deleteWebSession(options: WebSessionOptions): Promise<WebSessionCommandResult>;
+/**
+ * Signs the user out of every device. Only a body the contract recognises is
+ * ok: the caller tells the user every device is signed out on that answer.
+ */
+export declare function revokeAllWebSessions(options: WebSessionOptions, csrfToken: string, getIdentityProof: () => Promise<string>): Promise<WebSessionCommandResult>;

package/dist/core/webSession.js

@@ -0,0 +1,144 @@
+/**
+ * Client for the shared web session on ingest (`/api/auth/session*`). It only
+ * sends and classifies: retries, boot rules, and sign-out belong to callers.
+ * Identity proof is an opaque string from the caller, so no provider leaks in.
+ */
+import { zCreateSessionResponse, zDeleteSessionResponse, zErrorResponse, zGetSessionResponse, zRevokeAllSessionsResponse } from '@comfyorg/ingest-types/zod';
+import { timedSignal } from './requestTimeout.js';
+const UNAUTHORIZED_CODES = {
+    no_session: 'NO_SESSION',
+    session_expired: 'SESSION_EXPIRED',
+    session_revoked: 'SESSION_REVOKED',
+    TOKEN_REVOKED: 'SESSION_REVOKED'
+};
+const FORBIDDEN_CODES = {
+    csrf_invalid: 'CSRF_STALE',
+    workspace_access_denied: 'WORKSPACE_ACCESS_DENIED'
+};
+function failure(code, httpStatus, serverCode) {
+    return {
+        status: 'error',
+        code,
+        retryable: code === 'SESSION_UNAVAILABLE',
+        ...(httpStatus === undefined ? {} : { httpStatus }),
+        ...(serverCode === undefined ? {} : { serverCode })
+    };
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+function classifyFailure(status, body) {
+    if (status === 429 || status >= 500) {
+        return failure('SESSION_UNAVAILABLE', status);
+    }
+    const parsed = zErrorResponse.safeParse(body);
+    if (!parsed.success)
+        return failure('SESSION_REQUEST_REFUSED', status);
+    const serverCode = parsed.data.code;
+    const byServerCode = status === 401
+        ? (UNAUTHORIZED_CODES[serverCode] ?? 'NO_SESSION')
+        : status === 403
+            ? (FORBIDDEN_CODES[serverCode] ?? 'SESSION_REQUEST_REFUSED')
+            : 'SESSION_REQUEST_REFUSED';
+    return failure(byServerCode, status, serverCode);
+}
+async function send(options, path, init) {
+    const { signal, release } = timedSignal(options.signal, options.timeoutMs);
+    try {
+        const response = await options.fetchImpl(`${options.apiBaseUrl.replace(/\/+$/, '')}${path}`, { ...init, credentials: 'include', signal });
+        const body = await readJson(response);
+        if (signal?.aborted)
+            return failure('SESSION_UNAVAILABLE');
+        const { status } = response;
+        return response.ok ? { status, body } : classifyFailure(status, body);
+    }
+    catch {
+        return failure('SESSION_UNAVAILABLE');
+    }
+    finally {
+        release();
+    }
+}
+export async function readWebSession(options, { expectedUserId } = {}) {
+    const sent = await send(options, '/auth/session', {
+        method: 'GET',
+        cache: 'no-store'
+    });
+    if ('code' in sent)
+        return sent;
+    const { status } = sent;
+    const parsed = zGetSessionResponse.safeParse(sent.body);
+    if (!parsed.success)
+        return failure('SESSION_UNAVAILABLE', status);
+    const { user, csrf_token, expires_at, absolute_expires_at } = parsed.data;
+    if (expectedUserId !== undefined && user.id !== expectedUserId) {
+        return failure('IDENTITY_CHANGED', status);
+    }
+    return {
+        status: 'ok',
+        session: {
+            user: {
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                emailVerified: user.email_verified,
+                signInProvider: user.sign_in_provider
+            },
+            csrfToken: csrf_token,
+            expiresAt: Date.parse(expires_at),
+            absoluteExpiresAt: Date.parse(absolute_expires_at)
+        }
+    };
+}
+/**
+ * Creates the session, then reads it back for the user and CSRF token. A
+ * failure to produce the proof is the provider's error and propagates.
+ */
+export async function createWebSession(options, getIdentityProof, { expectedUserId } = {}) {
+    const proof = await getIdentityProof();
+    const sent = await send(options, '/auth/session', {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${proof}` }
+    });
+    if ('code' in sent)
+        return sent;
+    const parsed = zCreateSessionResponse.safeParse(sent.body);
+    if (!parsed.success || !parsed.data.success) {
+        return failure('SESSION_UNAVAILABLE', sent.status);
+    }
+    return readWebSession(options, { expectedUserId });
+}
+/** Sends no CSRF token: sign-out must work against a dead session. */
+export async function deleteWebSession(options) {
+    const sent = await send(options, '/auth/session', { method: 'DELETE' });
+    if ('code' in sent)
+        return sent;
+    const parsed = zDeleteSessionResponse.safeParse(sent.body);
+    if (!parsed.success || !parsed.data.success) {
+        return failure('SESSION_UNAVAILABLE', sent.status);
+    }
+    return { status: 'ok' };
+}
+/**
+ * Signs the user out of every device. Only a body the contract recognises is
+ * ok: the caller tells the user every device is signed out on that answer.
+ */
+export async function revokeAllWebSessions(options, csrfToken, getIdentityProof) {
+    const proof = await getIdentityProof();
+    const sent = await send(options, '/auth/sessions/revoke-all', {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${proof}`, 'X-CSRF-Token': csrfToken }
+    });
+    if ('code' in sent)
+        return sent;
+    const parsed = zRevokeAllSessionsResponse.safeParse(sent.body);
+    if (!parsed.success) {
+        return failure('SESSION_UNAVAILABLE', sent.status);
+    }
+    return { status: 'ok' };
+}

package/dist/core/webSessionFlag.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `unified_web_session` for a site with no sign-in of its own to ask with.
+ * The anonymous `/api/features` document's global `web_session_probe` only
+ * decides whether to ask; the answer is the credentialed read's
+ * `unified_web_session` (cloud#10689). Every failure is `false`.
+ */
+export interface FeaturesReadOptions {
+    /** Cloud origin, e.g. `https://cloud.comfy.org`. */
+    readonly cloudBaseUrl: string;
+    readonly fetchImpl: typeof fetch;
+    readonly timeoutMs?: number;
+}
+export interface UnifiedWebSessionOptions extends FeaturesReadOptions {
+    /** Settles the anonymous document's `web_session_probe`. */
+    readonly probe: () => Promise<boolean>;
+}
+/** A plain anonymous GET: no cookie, no custom header, so no CORS preflight. */
+export declare function readWebSessionProbe(options: FeaturesReadOptions): Promise<boolean>;
+export declare function resolveUnifiedWebSession({ probe, ...options }: UnifiedWebSessionOptions): Promise<boolean>;

package/dist/core/webSessionFlag.js

@@ -0,0 +1,61 @@
+/**
+ * `unified_web_session` for a site with no sign-in of its own to ask with.
+ * The anonymous `/api/features` document's global `web_session_probe` only
+ * decides whether to ask; the answer is the credentialed read's
+ * `unified_web_session` (cloud#10689). Every failure is `false`.
+ */
+const DEFAULT_TIMEOUT_MS = 5000;
+function readsLiteralTrue(body, key) {
+    return (typeof body === 'object' && body !== null && Reflect.get(body, key) === true);
+}
+async function readFeatures({ cloudBaseUrl, fetchImpl, timeoutMs = DEFAULT_TIMEOUT_MS }, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(`${cloudBaseUrl}/api/features`, {
+            ...init,
+            signal: controller.signal
+        });
+        return response.ok ? await response.json() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/** A plain anonymous GET: no cookie, no custom header, so no CORS preflight. */
+export async function readWebSessionProbe(options) {
+    return readsLiteralTrue(await readFeatures(options, { credentials: 'omit' }), 'web_session_probe');
+}
+async function probeIsOn(probe) {
+    try {
+        return await probe();
+    }
+    catch {
+        return false;
+    }
+}
+async function loadClientHeader() {
+    try {
+        const { COMFY_CLIENT } = await import('./requestAuth.js');
+        return COMFY_CLIENT;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function resolveUnifiedWebSession({ probe, ...options }) {
+    if (!(await probeIsOn(probe)))
+        return false;
+    const client = await loadClientHeader();
+    if (client === undefined)
+        return false;
+    const body = await readFeatures(options, {
+        credentials: 'include',
+        cache: 'no-store',
+        headers: { 'X-Comfy-Client': client }
+    });
+    return readsLiteralTrue(body, 'unified_web_session');
+}