@cratis/arc 22.45.0 → 22.47.0

package/dist/cjs/identity/IdentityProvider.d.ts

@@ -7,14 +7,23 @@ export declare class IdentityProvider extends IIdentityProvider {
     static httpHeadersCallback: GetHttpHeaders | undefined;
     static apiBasePath: string;
     static origin: string;
+    private static cachedResult;
+    private static hasWarnedAboutLegacyCookie;
+    private static legacyCookie;
     static setHttpHeadersCallback(callback: GetHttpHeaders): void;
     static setApiBasePath(apiBasePath: string): void;
     static setOrigin(origin: string): void;
     static getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
     getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
     static refresh<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
-    private static notSet;
-    private static getCookie;
+    static clearCache(): void;
     static clearIdentityCookie(): void;
+    private static expireLegacyCookie;
+    private static readLegacyCookie;
+    private static fetchAndCache;
+    private static fetchResult;
+    private static fromLegacyCookie;
+    private static toIdentity;
+    private static notSet;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/cjs/identity/IdentityProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../identity/IdentityProvider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQtD,qBAAa,gBAAiB,SAAQ,iBAAiB;IAEnD,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAsB;IAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,GAAG,SAAS,CAAC;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAM;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAM3B,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE5D;IAMD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE/C;IAMD,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAErC;IAQD,OAAa,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAmBpH;IAGK,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAE7G;IAED,OAAa,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CA4BjH;IAED,OAAO,CAAC,MAAM,CAAC,MAAM;IAYrB,OAAO,CAAC,MAAM,CAAC,SAAS;IAiBxB,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAGjC;CACJ"}
+{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../identity/IdentityProvider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBtD,qBAAa,gBAAiB,SAAQ,iBAAiB;IAOnD,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAsB;IAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,GAAG,SAAS,CAAC;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAM;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAE3B,OAAO,CAAC,MAAM,CAAC,YAAY,CAA0D;IACrF,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAS;IAClD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAqB;IAMhD,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE5D;IAMD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAM/C;IAMD,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMrC;IAWD,OAAa,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAMpH;IAGK,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAE7G;IAOD,OAAa,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAQjH;IAMD,MAAM,CAAC,UAAU,IAAI,IAAI,CAIxB;IAMD,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAEjC;IAED,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAKjC,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAM/B,OAAO,CAAC,MAAM,CAAC,aAAa;mBAkBP,WAAW;IA0BhC,OAAO,CAAC,MAAM,CAAC,gBAAgB;IA0B/B,OAAO,CAAC,MAAM,CAAC,UAAU;IAiBzB,OAAO,CAAC,MAAM,CAAC,MAAM;CAWxB"}

package/dist/cjs/identity/IdentityProvider.js

@@ -10,11 +10,26 @@ var joinPaths = require('../joinPaths.js');
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 /**
  * Represents an implementation of {@link IIdentityProvider}.
+ *
+ * The identity comes from the `/.cratis/me` endpoint, which derives it from the authenticated request. The
+ * result is kept in memory for the page, so repeated calls to {@link IdentityProvider.getCurrent} do not each go to
+ * the server; {@link IdentityProvider.refresh} always asks the server again.
+ *
+ * Only when the server has no `/.cratis/me` endpoint (it answers 404) does it fall back to the readable
+ * `.cratis-identity` cookie earlier versions relied on, and it warns when it does. That fallback is for the transition
+ * and will be removed.
 */ class IdentityProvider extends IIdentityProvider.IIdentityProvider {
-    static CookieName = '.cratis-identity';
+    /**
+     * The name of the identity cookie earlier versions of Arc wrote and read.
+     * @deprecated The identity comes from the `/.cratis/me` endpoint. The cookie is only read when that endpoint does
+     * not exist, and that fallback will be removed.
+     */ static CookieName = '.cratis-identity';
     static httpHeadersCallback;
     static apiBasePath = '';
     static origin = '';
+    static cachedResult;
+    static hasWarnedAboutLegacyCookie = false;
+    static legacyCookie;
     /**
      * Sets the HTTP headers callback.
      * @param callback Callback to set.
@@ -25,44 +40,92 @@ var joinPaths = require('../joinPaths.js');
      * Sets the API base path.
      * @param apiBasePath API base path to set.
      */ static setApiBasePath(apiBasePath) {
+        if (IdentityProvider.apiBasePath !== apiBasePath) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.apiBasePath = apiBasePath;
     }
     /**
      * Sets the origin.
      * @param origin Origin to set.
      */ static setOrigin(origin) {
+        if (IdentityProvider.origin !== origin) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.origin = origin;
     }
     /**
      * Gets the current identity by optionally specifying the details type.
      * @param type Optional constructor for the details type to enable type-safe deserialization.
      * @returns The current identity as {@link IIdentity}.
-     * @remarks The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
+     * @remarks The identity is fetched from `/.cratis/me` the first time and kept in memory until
+     * {@link IdentityProvider.refresh} or {@link IdentityProvider.clearCache} is called. An identity that could not be
+     * resolved is not kept, so the next call asks the server again.
+     * The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
      */ static async getCurrent(type) {
-        const cookie = this.getCookie();
-        if (cookie.length == 2) {
-            const json = atob(cookie[1]);
-            const result = JSON.parse(json);
-            const details = deserializeIdentityDetails.deserializeIdentityDetails(type, result.details);
-            return {
-                id: result.id,
-                name: result.name,
-                roles: result.roles || [],
-                details: details,
-                isSet: true,
-                isInRole: (role)=>(result.roles || []).includes(role),
-                refresh: ()=>IdentityProvider.refresh(type)
-            };
-        } else {
-            const identity = await this.refresh(type);
-            return identity;
+        if (!IdentityProvider.cachedResult) {
+            IdentityProvider.fetchAndCache();
         }
+        const result = await IdentityProvider.cachedResult;
+        return IdentityProvider.toIdentity(result, type);
     }
     /** @inheritdoc */ async getCurrent(type) {
         return IdentityProvider.getCurrent(type);
     }
-    static async refresh(type) {
-        IdentityProvider.clearIdentityCookie();
+    /**
+     * Fetches the current identity from `/.cratis/me`, replacing what is kept in memory.
+     * @param type Optional constructor for the details type to enable type-safe deserialization.
+     * @returns The current identity as {@link IIdentity}.
+     */ static async refresh(type) {
+        // Earlier backends resolve the cookie before consulting the current credentials. Retain it during the
+        // request for a possible 404 transition fallback, but do not send it with an explicit refresh request.
+        IdentityProvider.legacyCookie = IdentityProvider.readLegacyCookie() ?? IdentityProvider.legacyCookie;
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.expireLegacyCookie();
+        const result = await IdentityProvider.fetchAndCache();
+        return IdentityProvider.toIdentity(result, type);
+    }
+    /**
+     * Forgets the identity kept in memory, so the next {@link IdentityProvider.getCurrent} asks the server again.
+     * It also expires a readable `.cratis-identity` cookie left by an earlier version. Call this when the user logs out.
+     */ static clearCache() {
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.legacyCookie = undefined;
+        IdentityProvider.expireLegacyCookie();
+    }
+    /**
+     * Forgets the identity kept in memory.
+     * @deprecated Arc no longer keeps the identity in a cookie. Use {@link IdentityProvider.clearCache} instead.
+     */ static clearIdentityCookie() {
+        IdentityProvider.clearCache();
+    }
+    static expireLegacyCookie() {
+        if (typeof document === 'undefined') return;
+        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+    }
+    static readLegacyCookie() {
+        if (typeof document === 'undefined') return undefined;
+        const prefix = `${IdentityProvider.CookieName}=`;
+        return document.cookie.split(';').map((_)=>_.trim()).find((_)=>_.startsWith(prefix));
+    }
+    static fetchAndCache() {
+        const pending = IdentityProvider.fetchResult();
+        IdentityProvider.cachedResult = pending;
+        // Only a resolved identity is worth keeping: an unset one, or a failed request, has to be asked for
+        // again - otherwise a page that loaded before sign-in would never see the user who signed in.
+        const forget = ()=>{
+            if (IdentityProvider.cachedResult === pending) {
+                IdentityProvider.cachedResult = undefined;
+            }
+        };
+        pending.then((result)=>{
+            if (!result) forget();
+        }, forget);
+        return pending;
+    }
+    static async fetchResult() {
         const origin = IdentityProvider.origin || Globals.Globals.origin || '';
         const apiBasePath = IdentityProvider.apiBasePath || Globals.Globals.apiBasePath || '';
         const route = joinPaths.joinPaths(apiBasePath, '/.cratis/me');
@@ -71,10 +134,43 @@ var joinPaths = require('../joinPaths.js');
             method: 'GET',
             headers: IdentityProvider.httpHeadersCallback?.() ?? {}
         });
+        // No identity endpoint at all - an application that has not mapped one, or one whose identity comes from a
+        // proxy in front of it. Anything else, a 401 or 403 above all, is the server's answer and a cookie the
+        // browser holds must never overrule it.
+        if (response.status === 404) {
+            return IdentityProvider.fromLegacyCookie();
+        }
+        IdentityProvider.legacyCookie = undefined;
         if (!response.ok) {
+            return undefined;
+        }
+        return await response.json();
+    }
+    static fromLegacyCookie() {
+        if (typeof document === 'undefined') return undefined;
+        // A proxy may issue a newer cookie on the response. Prefer it over the one expired before the request.
+        const responseCookie = IdentityProvider.readLegacyCookie();
+        const cookie = responseCookie ?? IdentityProvider.legacyCookie;
+        if (!cookie) return undefined;
+        IdentityProvider.legacyCookie = cookie;
+        try {
+            const result = JSON.parse(atob(decodeURIComponent(cookie.substring(`${IdentityProvider.CookieName}=`.length))));
+            // The proxy may not reissue its cookie while its own authorization record remains valid. Restore the
+            // transition fallback after a 404 so it also survives a reload, without changing a response cookie.
+            if (!responseCookie) document.cookie = `${cookie};path=/;samesite=lax${location.protocol === 'https:' ? ';secure' : ''}`;
+            if (!IdentityProvider.hasWarnedAboutLegacyCookie) {
+                IdentityProvider.hasWarnedAboutLegacyCookie = true;
+                console.warn(`The server has no '/.cratis/me' endpoint, so the identity was read from the '${IdentityProvider.CookieName}' cookie. ` + 'That cookie is not protected and the fallback will be removed in a future major version. ' + 'Expose /.cratis/me to the frontend: https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/identity/migrating-from-the-identity-cookie.md');
+            }
+            return result;
+        } catch  {
+            return undefined;
+        }
+    }
+    static toIdentity(result, type) {
+        if (!result) {
             return IdentityProvider.notSet(type);
         }
-        const result = await response.json();
         const details = deserializeIdentityDetails.deserializeIdentityDetails(type, result.details);
         return {
             id: result.id,
@@ -97,28 +193,6 @@ var joinPaths = require('../joinPaths.js');
             refresh: ()=>IdentityProvider.refresh(type)
         };
     }
-    static getCookie() {
-        if (typeof document === 'undefined') return [];
-        const decoded = decodeURIComponent(document.cookie);
-        const cookies = decoded.split(';').map((_)=>_.trim());
-        const cookie = cookies.find((_)=>_.indexOf(`${IdentityProvider.CookieName}=`) == 0);
-        if (cookie) {
-            const keyValue = cookie.split('=');
-            return [
-                keyValue[0].trim(),
-                keyValue[1].trim()
-            ];
-        }
-        return [];
-    }
-    /**
-     * Clears the identity cookie used by Arc to cache the current identity.
-     * Call this when the user logs out to ensure subsequent requests and WebSocket
-     * connections do not carry stale credentials.
-     */ static clearIdentityCookie() {
-        if (typeof document === 'undefined') return;
-        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT`;
-    }
 }
 
 exports.IdentityProvider = IdentityProvider;

package/dist/cjs/identity/IdentityProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.js","sources":["../../../identity/IdentityProvider.ts"],"sourcesContent":["// Copyright (c) Cratis. All rights reserved.\n// Licensed under the MIT license. See LICENSE file in the project root for full license information.\n\nimport { Constructor } from '@cratis/fundamentals';\nimport { IIdentityProvider } from './IIdentityProvider.js';\nimport { IIdentity } from './IIdentity.js';\nimport { IdentityProviderResult } from './IdentityProviderResult.js';\nimport { deserializeIdentityDetails } from './deserializeIdentityDetails.js';\nimport { GetHttpHeaders } from '../GetHttpHeaders.js';\nimport { Globals } from '../Globals.js';\nimport { UrlHelpers } from '../UrlHelpers.js';\nimport { joinPaths } from '../joinPaths.js';\n\n/**\n * Represents an implementation of {@link IIdentityProvider}.\n*/\nexport class IdentityProvider extends IIdentityProvider {\n\n    static readonly CookieName = '.cratis-identity';\n    static httpHeadersCallback: GetHttpHeaders | undefined;\n    static apiBasePath: string = '';\n    static origin: string = '';\n\n    /**\n     * Sets the HTTP headers callback.\n     * @param callback Callback to set.\n     */\n    static setHttpHeadersCallback(callback: GetHttpHeaders): void {\n        IdentityProvider.httpHeadersCallback = callback;\n    }\n\n    /**\n     * Sets the API base path.\n     * @param apiBasePath API base path to set.\n     */\n    static setApiBasePath(apiBasePath: string): void {\n        IdentityProvider.apiBasePath = apiBasePath;\n    }\n\n    /**\n     * Sets the origin.\n     * @param origin Origin to set.\n     */\n    static setOrigin(origin: string): void {\n        IdentityProvider.origin = origin;\n    }\n\n    /**\n     * Gets the current identity by optionally specifying the details type.\n     * @param type Optional constructor for the details type to enable type-safe deserialization.\n     * @returns The current identity as {@link IIdentity}.\n     * @remarks The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().\n     */\n    static async getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        const cookie = this.getCookie();\n        if (cookie.length == 2) {\n            const json = atob(cookie[1]);\n            const result = JSON.parse(json) as IdentityProviderResult;\n            const details = deserializeIdentityDetails(type, result.details);\n            return {\n                id: result.id,\n                name: result.name,\n                roles: result.roles || [],\n                details: details as TDetails,\n                isSet: true,\n                isInRole: (role: string) => (result.roles || []).includes(role),\n                refresh: () => IdentityProvider.refresh(type)\n            } as IIdentity<TDetails>;\n        } else {\n            const identity = await this.refresh<TDetails>(type);\n            return identity;\n        }\n    }\n\n    /** @inheritdoc */\n    async getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        return IdentityProvider.getCurrent<TDetails>(type);\n    }\n\n    static async refresh<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        IdentityProvider.clearIdentityCookie();\n        const origin = IdentityProvider.origin || Globals.origin || '';\n        const apiBasePath = IdentityProvider.apiBasePath || Globals.apiBasePath || '';\n        const route = joinPaths(apiBasePath, '/.cratis/me');\n        const url = UrlHelpers.createUrlFrom(origin, apiBasePath, route);\n        const response = await fetch(\n            url, {\n            method: 'GET',\n            headers: IdentityProvider.httpHeadersCallback?.() ?? {}\n        });\n\n        if (!response.ok) {\n            return IdentityProvider.notSet(type);\n        }\n\n        const result = await response.json() as IdentityProviderResult;\n        const details = deserializeIdentityDetails(type, result.details);\n\n        return {\n            id: result.id,\n            name: result.name,\n            roles: result.roles || [],\n            details: details as TDetails,\n            isSet: true,\n            isInRole: (role: string) => (result.roles || []).includes(role),\n            refresh: () => IdentityProvider.refresh(type)\n        };\n    }\n\n    private static notSet<TDetails extends object = object>(type?: Constructor<TDetails>): IIdentity<TDetails> {\n        return {\n            id: '',\n            name: '',\n            roles: [],\n            details: {} as TDetails,\n            isSet: false,\n            isInRole: () => false,\n            refresh: () => IdentityProvider.refresh(type)\n        };\n    }\n\n    private static getCookie() {\n        if (typeof document === 'undefined') return [];\n        const decoded = decodeURIComponent(document.cookie);\n        const cookies = decoded.split(';').map(_ => _.trim());\n        const cookie = cookies.find(_ => _.indexOf(`${IdentityProvider.CookieName}=`) == 0);\n        if (cookie) {\n            const keyValue = cookie.split('=');\n            return [keyValue[0].trim(), keyValue[1].trim()];\n        }\n        return [];\n    }\n\n    /**\n     * Clears the identity cookie used by Arc to cache the current identity.\n     * Call this when the user logs out to ensure subsequent requests and WebSocket\n     * connections do not carry stale credentials.\n     */\n    static clearIdentityCookie(): void {\n        if (typeof document === 'undefined') return;\n        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n    }\n}\n"],"names":["IdentityProvider","IIdentityProvider","CookieName","httpHeadersCallback","apiBasePath","origin","setHttpHeadersCallback","callback","setApiBasePath","setOrigin","getCurrent","type","cookie","getCookie","length","json","atob","result","JSON","parse","details","deserializeIdentityDetails","id","name","roles","isSet","isInRole","role","includes","refresh","identity","clearIdentityCookie","Globals","route","joinPaths","url","UrlHelpers","createUrlFrom","response","fetch","method","headers","ok","notSet","document","decoded","decodeURIComponent","cookies","split","map","_","trim","find","indexOf","keyValue"],"mappings":";;;;;;;;AAAA;AACA;AAYA;;AAEA,GACO,MAAMA,gBAAAA,SAAyBC,mCAAAA,CAAAA;AAElC,IAAA,OAAgBC,aAAa,kBAAA;AAC7B,IAAA,OAAOC,mBAAAA;AACP,IAAA,OAAOC,cAAsB,EAAA;AAC7B,IAAA,OAAOC,SAAiB,EAAA;AAExB;;;QAIA,OAAOC,sBAAAA,CAAuBC,QAAwB,EAAQ;AAC1DP,QAAAA,gBAAAA,CAAiBG,mBAAmB,GAAGI,QAAAA;AAC3C,IAAA;AAEA;;;QAIA,OAAOC,cAAAA,CAAeJ,WAAmB,EAAQ;AAC7CJ,QAAAA,gBAAAA,CAAiBI,WAAW,GAAGA,WAAAA;AACnC,IAAA;AAEA;;;QAIA,OAAOK,SAAAA,CAAUJ,MAAc,EAAQ;AACnCL,QAAAA,gBAAAA,CAAiBK,MAAM,GAAGA,MAAAA;AAC9B,IAAA;AAEA;;;;;QAMA,aAAaK,UAAAA,CAA6CC,IAA4B,EAAgC;QAClH,MAAMC,MAAAA,GAAS,IAAI,CAACC,SAAS,EAAA;QAC7B,IAAID,MAAAA,CAAOE,MAAM,IAAI,CAAA,EAAG;AACpB,YAAA,MAAMC,IAAAA,GAAOC,IAAAA,CAAKJ,MAAM,CAAC,CAAA,CAAE,CAAA;YAC3B,MAAMK,MAAAA,GAASC,IAAAA,CAAKC,KAAK,CAACJ,IAAAA,CAAAA;AAC1B,YAAA,MAAMK,OAAAA,GAAUC,qDAAAA,CAA2BV,IAAAA,EAAMM,MAAAA,CAAOG,OAAO,CAAA;YAC/D,OAAO;AACHE,gBAAAA,EAAAA,EAAIL,OAAOK,EAAE;AACbC,gBAAAA,IAAAA,EAAMN,OAAOM,IAAI;gBACjBC,KAAAA,EAAOP,MAAAA,CAAOO,KAAK,IAAI,EAAE;gBACzBJ,OAAAA,EAASA,OAAAA;gBACTK,KAAAA,EAAO,IAAA;gBACPC,QAAAA,EAAU,CAACC,IAAAA,GAAkBV,CAAAA,MAAAA,CAAOO,KAAK,IAAI,EAAC,EAAGI,QAAQ,CAACD,IAAAA,CAAAA;gBAC1DE,OAAAA,EAAS,IAAM7B,gBAAAA,CAAiB6B,OAAO,CAAClB,IAAAA;AAC5C,aAAA;QACJ,CAAA,MAAO;AACH,YAAA,MAAMmB,QAAAA,GAAW,MAAM,IAAI,CAACD,OAAO,CAAWlB,IAAAA,CAAAA;YAC9C,OAAOmB,QAAAA;AACX,QAAA;AACJ,IAAA;AAEA,uBACA,MAAMpB,UAAAA,CAA6CC,IAA4B,EAAgC;QAC3G,OAAOX,gBAAAA,CAAiBU,UAAU,CAAWC,IAAAA,CAAAA;AACjD,IAAA;IAEA,aAAakB,OAAAA,CAA0ClB,IAA4B,EAAgC;AAC/GX,QAAAA,gBAAAA,CAAiB+B,mBAAmB,EAAA;AACpC,QAAA,MAAM1B,SAASL,gBAAAA,CAAiBK,MAAM,IAAI2B,eAAAA,CAAQ3B,MAAM,IAAI,EAAA;AAC5D,QAAA,MAAMD,cAAcJ,gBAAAA,CAAiBI,WAAW,IAAI4B,eAAAA,CAAQ5B,WAAW,IAAI,EAAA;QAC3E,MAAM6B,KAAAA,GAAQC,oBAAU9B,WAAAA,EAAa,aAAA,CAAA;AACrC,QAAA,MAAM+B,GAAAA,GAAMC,qBAAAA,CAAWC,aAAa,CAAChC,QAAQD,WAAAA,EAAa6B,KAAAA,CAAAA;QAC1D,MAAMK,QAAAA,GAAW,MAAMC,KAAAA,CACnBJ,GAAAA,EAAK;YACLK,MAAAA,EAAQ,KAAA;YACRC,OAAAA,EAASzC,gBAAAA,CAAiBG,mBAAmB,IAAA,IAAQ;AACzD,SAAA,CAAA;QAEA,IAAI,CAACmC,QAAAA,CAASI,EAAE,EAAE;YACd,OAAO1C,gBAAAA,CAAiB2C,MAAM,CAAChC,IAAAA,CAAAA;AACnC,QAAA;QAEA,MAAMM,MAAAA,GAAS,MAAMqB,QAAAA,CAASvB,IAAI,EAAA;AAClC,QAAA,MAAMK,OAAAA,GAAUC,qDAAAA,CAA2BV,IAAAA,EAAMM,MAAAA,CAAOG,OAAO,CAAA;QAE/D,OAAO;AACHE,YAAAA,EAAAA,EAAIL,OAAOK,EAAE;AACbC,YAAAA,IAAAA,EAAMN,OAAOM,IAAI;YACjBC,KAAAA,EAAOP,MAAAA,CAAOO,KAAK,IAAI,EAAE;YACzBJ,OAAAA,EAASA,OAAAA;YACTK,KAAAA,EAAO,IAAA;YACPC,QAAAA,EAAU,CAACC,IAAAA,GAAkBV,CAAAA,MAAAA,CAAOO,KAAK,IAAI,EAAC,EAAGI,QAAQ,CAACD,IAAAA,CAAAA;YAC1DE,OAAAA,EAAS,IAAM7B,gBAAAA,CAAiB6B,OAAO,CAAClB,IAAAA;AAC5C,SAAA;AACJ,IAAA;IAEA,OAAegC,MAAAA,CAAyChC,IAA4B,EAAuB;QACvG,OAAO;YACHW,EAAAA,EAAI,EAAA;YACJC,IAAAA,EAAM,EAAA;AACNC,YAAAA,KAAAA,EAAO,EAAE;AACTJ,YAAAA,OAAAA,EAAS,EAAC;YACVK,KAAAA,EAAO,KAAA;AACPC,YAAAA,QAAAA,EAAU,IAAM,KAAA;YAChBG,OAAAA,EAAS,IAAM7B,gBAAAA,CAAiB6B,OAAO,CAAClB,IAAAA;AAC5C,SAAA;AACJ,IAAA;AAEA,IAAA,OAAeE,SAAAA,GAAY;AACvB,QAAA,IAAI,OAAO+B,QAAAA,KAAa,WAAA,EAAa,OAAO,EAAE;QAC9C,MAAMC,OAAAA,GAAUC,kBAAAA,CAAmBF,QAAAA,CAAShC,MAAM,CAAA;QAClD,MAAMmC,OAAAA,GAAUF,OAAAA,CAAQG,KAAK,CAAC,GAAA,CAAA,CAAKC,GAAG,CAACC,CAAAA,CAAAA,GAAKA,CAAAA,CAAEC,IAAI,EAAA,CAAA;AAClD,QAAA,MAAMvC,MAAAA,GAASmC,OAAAA,CAAQK,IAAI,CAACF,CAAAA,CAAAA,GAAKA,CAAAA,CAAEG,OAAO,CAAC,GAAGrD,gBAAAA,CAAiBE,UAAU,CAAC,CAAC,CAAC,CAAA,IAAK,CAAA,CAAA;AACjF,QAAA,IAAIU,MAAAA,EAAQ;YACR,MAAM0C,QAAAA,GAAW1C,MAAAA,CAAOoC,KAAK,CAAC,GAAA,CAAA;YAC9B,OAAO;gBAACM,QAAQ,CAAC,CAAA,CAAE,CAACH,IAAI,EAAA;gBAAIG,QAAQ,CAAC,CAAA,CAAE,CAACH,IAAI;AAAG,aAAA;AACnD,QAAA;AACA,QAAA,OAAO,EAAE;AACb,IAAA;AAEA;;;;AAIC,QACD,OAAOpB,mBAAAA,GAA4B;QAC/B,IAAI,OAAOa,aAAa,WAAA,EAAa;AACrCA,QAAAA,QAAAA,CAAShC,MAAM,GAAG,CAAA,EAAGZ,iBAAiBE,UAAU,CAAC,uCAAuC,CAAC;AAC7F,IAAA;AACJ;;"}
+{"version":3,"file":"IdentityProvider.js","sources":["../../../identity/IdentityProvider.ts"],"sourcesContent":["// Copyright (c) Cratis. All rights reserved.\n// Licensed under the MIT license. See LICENSE file in the project root for full license information.\n\nimport { Constructor } from '@cratis/fundamentals';\nimport { IIdentityProvider } from './IIdentityProvider.js';\nimport { IIdentity } from './IIdentity.js';\nimport { IdentityProviderResult } from './IdentityProviderResult.js';\nimport { deserializeIdentityDetails } from './deserializeIdentityDetails.js';\nimport { GetHttpHeaders } from '../GetHttpHeaders.js';\nimport { Globals } from '../Globals.js';\nimport { UrlHelpers } from '../UrlHelpers.js';\nimport { joinPaths } from '../joinPaths.js';\n\n/**\n * Represents an implementation of {@link IIdentityProvider}.\n *\n * The identity comes from the `/.cratis/me` endpoint, which derives it from the authenticated request. The\n * result is kept in memory for the page, so repeated calls to {@link IdentityProvider.getCurrent} do not each go to\n * the server; {@link IdentityProvider.refresh} always asks the server again.\n *\n * Only when the server has no `/.cratis/me` endpoint (it answers 404) does it fall back to the readable\n * `.cratis-identity` cookie earlier versions relied on, and it warns when it does. That fallback is for the transition\n * and will be removed.\n*/\nexport class IdentityProvider extends IIdentityProvider {\n\n    /**\n     * The name of the identity cookie earlier versions of Arc wrote and read.\n     * @deprecated The identity comes from the `/.cratis/me` endpoint. The cookie is only read when that endpoint does\n     * not exist, and that fallback will be removed.\n     */\n    static readonly CookieName = '.cratis-identity';\n    static httpHeadersCallback: GetHttpHeaders | undefined;\n    static apiBasePath: string = '';\n    static origin: string = '';\n\n    private static cachedResult: Promise<IdentityProviderResult | undefined> | undefined;\n    private static hasWarnedAboutLegacyCookie = false;\n    private static legacyCookie: string | undefined;\n\n    /**\n     * Sets the HTTP headers callback.\n     * @param callback Callback to set.\n     */\n    static setHttpHeadersCallback(callback: GetHttpHeaders): void {\n        IdentityProvider.httpHeadersCallback = callback;\n    }\n\n    /**\n     * Sets the API base path.\n     * @param apiBasePath API base path to set.\n     */\n    static setApiBasePath(apiBasePath: string): void {\n        if (IdentityProvider.apiBasePath !== apiBasePath) {\n            IdentityProvider.cachedResult = undefined;\n            IdentityProvider.legacyCookie = undefined;\n        }\n        IdentityProvider.apiBasePath = apiBasePath;\n    }\n\n    /**\n     * Sets the origin.\n     * @param origin Origin to set.\n     */\n    static setOrigin(origin: string): void {\n        if (IdentityProvider.origin !== origin) {\n            IdentityProvider.cachedResult = undefined;\n            IdentityProvider.legacyCookie = undefined;\n        }\n        IdentityProvider.origin = origin;\n    }\n\n    /**\n     * Gets the current identity by optionally specifying the details type.\n     * @param type Optional constructor for the details type to enable type-safe deserialization.\n     * @returns The current identity as {@link IIdentity}.\n     * @remarks The identity is fetched from `/.cratis/me` the first time and kept in memory until\n     * {@link IdentityProvider.refresh} or {@link IdentityProvider.clearCache} is called. An identity that could not be\n     * resolved is not kept, so the next call asks the server again.\n     * The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().\n     */\n    static async getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        if (!IdentityProvider.cachedResult) {\n            IdentityProvider.fetchAndCache();\n        }\n        const result = await IdentityProvider.cachedResult;\n        return IdentityProvider.toIdentity(result, type);\n    }\n\n    /** @inheritdoc */\n    async getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        return IdentityProvider.getCurrent<TDetails>(type);\n    }\n\n    /**\n     * Fetches the current identity from `/.cratis/me`, replacing what is kept in memory.\n     * @param type Optional constructor for the details type to enable type-safe deserialization.\n     * @returns The current identity as {@link IIdentity}.\n     */\n    static async refresh<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {\n        // Earlier backends resolve the cookie before consulting the current credentials. Retain it during the\n        // request for a possible 404 transition fallback, but do not send it with an explicit refresh request.\n        IdentityProvider.legacyCookie = IdentityProvider.readLegacyCookie() ?? IdentityProvider.legacyCookie;\n        IdentityProvider.cachedResult = undefined;\n        IdentityProvider.expireLegacyCookie();\n        const result = await IdentityProvider.fetchAndCache();\n        return IdentityProvider.toIdentity(result, type);\n    }\n\n    /**\n     * Forgets the identity kept in memory, so the next {@link IdentityProvider.getCurrent} asks the server again.\n     * It also expires a readable `.cratis-identity` cookie left by an earlier version. Call this when the user logs out.\n     */\n    static clearCache(): void {\n        IdentityProvider.cachedResult = undefined;\n        IdentityProvider.legacyCookie = undefined;\n        IdentityProvider.expireLegacyCookie();\n    }\n\n    /**\n     * Forgets the identity kept in memory.\n     * @deprecated Arc no longer keeps the identity in a cookie. Use {@link IdentityProvider.clearCache} instead.\n     */\n    static clearIdentityCookie(): void {\n        IdentityProvider.clearCache();\n    }\n\n    private static expireLegacyCookie(): void {\n        if (typeof document === 'undefined') return;\n        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;\n    }\n\n    private static readLegacyCookie(): string | undefined {\n        if (typeof document === 'undefined') return undefined;\n        const prefix = `${IdentityProvider.CookieName}=`;\n        return document.cookie.split(';').map(_ => _.trim()).find(_ => _.startsWith(prefix));\n    }\n\n    private static fetchAndCache(): Promise<IdentityProviderResult | undefined> {\n        const pending = IdentityProvider.fetchResult();\n        IdentityProvider.cachedResult = pending;\n\n        // Only a resolved identity is worth keeping: an unset one, or a failed request, has to be asked for\n        // again - otherwise a page that loaded before sign-in would never see the user who signed in.\n        const forget = () => {\n            if (IdentityProvider.cachedResult === pending) {\n                IdentityProvider.cachedResult = undefined;\n            }\n        };\n        pending.then(result => {\n            if (!result) forget();\n        }, forget);\n\n        return pending;\n    }\n\n    private static async fetchResult(): Promise<IdentityProviderResult | undefined> {\n        const origin = IdentityProvider.origin || Globals.origin || '';\n        const apiBasePath = IdentityProvider.apiBasePath || Globals.apiBasePath || '';\n        const route = joinPaths(apiBasePath, '/.cratis/me');\n        const url = UrlHelpers.createUrlFrom(origin, apiBasePath, route);\n        const response = await fetch(\n            url, {\n            method: 'GET',\n            headers: IdentityProvider.httpHeadersCallback?.() ?? {}\n        });\n\n        // No identity endpoint at all - an application that has not mapped one, or one whose identity comes from a\n        // proxy in front of it. Anything else, a 401 or 403 above all, is the server's answer and a cookie the\n        // browser holds must never overrule it.\n        if (response.status === 404) {\n            return IdentityProvider.fromLegacyCookie();\n        }\n\n        IdentityProvider.legacyCookie = undefined;\n        if (!response.ok) {\n            return undefined;\n        }\n\n        return await response.json() as IdentityProviderResult;\n    }\n\n    private static fromLegacyCookie(): IdentityProviderResult | undefined {\n        if (typeof document === 'undefined') return undefined;\n        // A proxy may issue a newer cookie on the response. Prefer it over the one expired before the request.\n        const responseCookie = IdentityProvider.readLegacyCookie();\n        const cookie = responseCookie ?? IdentityProvider.legacyCookie;\n        if (!cookie) return undefined;\n        IdentityProvider.legacyCookie = cookie;\n\n        try {\n            const result = JSON.parse(atob(decodeURIComponent(cookie.substring(`${IdentityProvider.CookieName}=`.length)))) as IdentityProviderResult;\n            // The proxy may not reissue its cookie while its own authorization record remains valid. Restore the\n            // transition fallback after a 404 so it also survives a reload, without changing a response cookie.\n            if (!responseCookie) document.cookie = `${cookie};path=/;samesite=lax${location.protocol === 'https:' ? ';secure' : ''}`;\n            if (!IdentityProvider.hasWarnedAboutLegacyCookie) {\n                IdentityProvider.hasWarnedAboutLegacyCookie = true;\n                console.warn(\n                    `The server has no '/.cratis/me' endpoint, so the identity was read from the '${IdentityProvider.CookieName}' cookie. ` +\n                    'That cookie is not protected and the fallback will be removed in a future major version. ' +\n                    'Expose /.cratis/me to the frontend: https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/identity/migrating-from-the-identity-cookie.md');\n            }\n            return result;\n        } catch {\n            return undefined;\n        }\n    }\n\n    private static toIdentity<TDetails extends object = object>(result: IdentityProviderResult | undefined, type?: Constructor<TDetails>): IIdentity<TDetails> {\n        if (!result) {\n            return IdentityProvider.notSet(type);\n        }\n\n        const details = deserializeIdentityDetails(type, result.details);\n        return {\n            id: result.id,\n            name: result.name,\n            roles: result.roles || [],\n            details: details as TDetails,\n            isSet: true,\n            isInRole: (role: string) => (result.roles || []).includes(role),\n            refresh: () => IdentityProvider.refresh(type)\n        };\n    }\n\n    private static notSet<TDetails extends object = object>(type?: Constructor<TDetails>): IIdentity<TDetails> {\n        return {\n            id: '',\n            name: '',\n            roles: [],\n            details: {} as TDetails,\n            isSet: false,\n            isInRole: () => false,\n            refresh: () => IdentityProvider.refresh(type)\n        };\n    }\n}\n"],"names":["IdentityProvider","IIdentityProvider","CookieName","httpHeadersCallback","apiBasePath","origin","cachedResult","hasWarnedAboutLegacyCookie","legacyCookie","setHttpHeadersCallback","callback","setApiBasePath","undefined","setOrigin","getCurrent","type","fetchAndCache","result","toIdentity","refresh","readLegacyCookie","expireLegacyCookie","clearCache","clearIdentityCookie","document","cookie","prefix","split","map","_","trim","find","startsWith","pending","fetchResult","forget","then","Globals","route","joinPaths","url","UrlHelpers","createUrlFrom","response","fetch","method","headers","status","fromLegacyCookie","ok","json","responseCookie","JSON","parse","atob","decodeURIComponent","substring","length","location","protocol","console","warn","notSet","details","deserializeIdentityDetails","id","name","roles","isSet","isInRole","role","includes"],"mappings":";;;;;;;;AAAA;AACA;AAYA;;;;;;;;;;AAUA,GACO,MAAMA,gBAAAA,SAAyBC,mCAAAA,CAAAA;AAElC;;;;QAKA,OAAgBC,aAAa,kBAAA;AAC7B,IAAA,OAAOC,mBAAAA;AACP,IAAA,OAAOC,cAAsB,EAAA;AAC7B,IAAA,OAAOC,SAAiB,EAAA;AAExB,IAAA,OAAeC,YAAAA;AACf,IAAA,OAAeC,6BAA6B,KAAA;AAC5C,IAAA,OAAeC,YAAAA;AAEf;;;QAIA,OAAOC,sBAAAA,CAAuBC,QAAwB,EAAQ;AAC1DV,QAAAA,gBAAAA,CAAiBG,mBAAmB,GAAGO,QAAAA;AAC3C,IAAA;AAEA;;;QAIA,OAAOC,cAAAA,CAAeP,WAAmB,EAAQ;QAC7C,IAAIJ,gBAAAA,CAAiBI,WAAW,KAAKA,WAAAA,EAAa;AAC9CJ,YAAAA,gBAAAA,CAAiBM,YAAY,GAAGM,SAAAA;AAChCZ,YAAAA,gBAAAA,CAAiBQ,YAAY,GAAGI,SAAAA;AACpC,QAAA;AACAZ,QAAAA,gBAAAA,CAAiBI,WAAW,GAAGA,WAAAA;AACnC,IAAA;AAEA;;;QAIA,OAAOS,SAAAA,CAAUR,MAAc,EAAQ;QACnC,IAAIL,gBAAAA,CAAiBK,MAAM,KAAKA,MAAAA,EAAQ;AACpCL,YAAAA,gBAAAA,CAAiBM,YAAY,GAAGM,SAAAA;AAChCZ,YAAAA,gBAAAA,CAAiBQ,YAAY,GAAGI,SAAAA;AACpC,QAAA;AACAZ,QAAAA,gBAAAA,CAAiBK,MAAM,GAAGA,MAAAA;AAC9B,IAAA;AAEA;;;;;;;;QASA,aAAaS,UAAAA,CAA6CC,IAA4B,EAAgC;QAClH,IAAI,CAACf,gBAAAA,CAAiBM,YAAY,EAAE;AAChCN,YAAAA,gBAAAA,CAAiBgB,aAAa,EAAA;AAClC,QAAA;QACA,MAAMC,MAAAA,GAAS,MAAMjB,gBAAAA,CAAiBM,YAAY;QAClD,OAAON,gBAAAA,CAAiBkB,UAAU,CAACD,MAAAA,EAAQF,IAAAA,CAAAA;AAC/C,IAAA;AAEA,uBACA,MAAMD,UAAAA,CAA6CC,IAA4B,EAAgC;QAC3G,OAAOf,gBAAAA,CAAiBc,UAAU,CAAWC,IAAAA,CAAAA;AACjD,IAAA;AAEA;;;;QAKA,aAAaI,OAAAA,CAA0CJ,IAA4B,EAAgC;;;AAG/Gf,QAAAA,gBAAAA,CAAiBQ,YAAY,GAAGR,gBAAAA,CAAiBoB,gBAAgB,EAAA,IAAMpB,iBAAiBQ,YAAY;AACpGR,QAAAA,gBAAAA,CAAiBM,YAAY,GAAGM,SAAAA;AAChCZ,QAAAA,gBAAAA,CAAiBqB,kBAAkB,EAAA;QACnC,MAAMJ,MAAAA,GAAS,MAAMjB,gBAAAA,CAAiBgB,aAAa,EAAA;QACnD,OAAOhB,gBAAAA,CAAiBkB,UAAU,CAACD,MAAAA,EAAQF,IAAAA,CAAAA;AAC/C,IAAA;AAEA;;;AAGC,QACD,OAAOO,UAAAA,GAAmB;AACtBtB,QAAAA,gBAAAA,CAAiBM,YAAY,GAAGM,SAAAA;AAChCZ,QAAAA,gBAAAA,CAAiBQ,YAAY,GAAGI,SAAAA;AAChCZ,QAAAA,gBAAAA,CAAiBqB,kBAAkB,EAAA;AACvC,IAAA;AAEA;;;AAGC,QACD,OAAOE,mBAAAA,GAA4B;AAC/BvB,QAAAA,gBAAAA,CAAiBsB,UAAU,EAAA;AAC/B,IAAA;AAEA,IAAA,OAAeD,kBAAAA,GAA2B;QACtC,IAAI,OAAOG,aAAa,WAAA,EAAa;AACrCA,QAAAA,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGzB,iBAAiBE,UAAU,CAAC,8CAA8C,CAAC;AACpG,IAAA;AAEA,IAAA,OAAekB,gBAAAA,GAAuC;QAClD,IAAI,OAAOI,QAAAA,KAAa,WAAA,EAAa,OAAOZ,SAAAA;AAC5C,QAAA,MAAMc,SAAS,CAAA,EAAG1B,gBAAAA,CAAiBE,UAAU,CAAC,CAAC,CAAC;AAChD,QAAA,OAAOsB,SAASC,MAAM,CAACE,KAAK,CAAC,GAAA,CAAA,CAAKC,GAAG,CAACC,CAAAA,IAAKA,CAAAA,CAAEC,IAAI,IAAIC,IAAI,CAACF,CAAAA,CAAAA,GAAKA,CAAAA,CAAEG,UAAU,CAACN,MAAAA,CAAAA,CAAAA;AAChF,IAAA;AAEA,IAAA,OAAeV,aAAAA,GAA6D;QACxE,MAAMiB,OAAAA,GAAUjC,iBAAiBkC,WAAW,EAAA;AAC5ClC,QAAAA,gBAAAA,CAAiBM,YAAY,GAAG2B,OAAAA;;;AAIhC,QAAA,MAAME,MAAAA,GAAS,IAAA;YACX,IAAInC,gBAAAA,CAAiBM,YAAY,KAAK2B,OAAAA,EAAS;AAC3CjC,gBAAAA,gBAAAA,CAAiBM,YAAY,GAAGM,SAAAA;AACpC,YAAA;AACJ,QAAA,CAAA;QACAqB,OAAAA,CAAQG,IAAI,CAACnB,CAAAA,MAAAA,GAAAA;AACT,YAAA,IAAI,CAACA,MAAAA,EAAQkB,MAAAA,EAAAA;QACjB,CAAA,EAAGA,MAAAA,CAAAA;QAEH,OAAOF,OAAAA;AACX,IAAA;AAEA,IAAA,aAAqBC,WAAAA,GAA2D;AAC5E,QAAA,MAAM7B,SAASL,gBAAAA,CAAiBK,MAAM,IAAIgC,eAAAA,CAAQhC,MAAM,IAAI,EAAA;AAC5D,QAAA,MAAMD,cAAcJ,gBAAAA,CAAiBI,WAAW,IAAIiC,eAAAA,CAAQjC,WAAW,IAAI,EAAA;QAC3E,MAAMkC,KAAAA,GAAQC,oBAAUnC,WAAAA,EAAa,aAAA,CAAA;AACrC,QAAA,MAAMoC,GAAAA,GAAMC,qBAAAA,CAAWC,aAAa,CAACrC,QAAQD,WAAAA,EAAakC,KAAAA,CAAAA;QAC1D,MAAMK,QAAAA,GAAW,MAAMC,KAAAA,CACnBJ,GAAAA,EAAK;YACLK,MAAAA,EAAQ,KAAA;YACRC,OAAAA,EAAS9C,gBAAAA,CAAiBG,mBAAmB,IAAA,IAAQ;AACzD,SAAA,CAAA;;;;QAKA,IAAIwC,QAAAA,CAASI,MAAM,KAAK,GAAA,EAAK;AACzB,YAAA,OAAO/C,iBAAiBgD,gBAAgB,EAAA;AAC5C,QAAA;AAEAhD,QAAAA,gBAAAA,CAAiBQ,YAAY,GAAGI,SAAAA;QAChC,IAAI,CAAC+B,QAAAA,CAASM,EAAE,EAAE;YACd,OAAOrC,SAAAA;AACX,QAAA;QAEA,OAAO,MAAM+B,SAASO,IAAI,EAAA;AAC9B,IAAA;AAEA,IAAA,OAAeF,gBAAAA,GAAuD;QAClE,IAAI,OAAOxB,QAAAA,KAAa,WAAA,EAAa,OAAOZ,SAAAA;;QAE5C,MAAMuC,cAAAA,GAAiBnD,iBAAiBoB,gBAAgB,EAAA;QACxD,MAAMK,MAAAA,GAAS0B,cAAAA,IAAkBnD,gBAAAA,CAAiBQ,YAAY;QAC9D,IAAI,CAACiB,QAAQ,OAAOb,SAAAA;AACpBZ,QAAAA,gBAAAA,CAAiBQ,YAAY,GAAGiB,MAAAA;QAEhC,IAAI;AACA,YAAA,MAAMR,SAASmC,IAAAA,CAAKC,KAAK,CAACC,IAAAA,CAAKC,mBAAmB9B,MAAAA,CAAO+B,SAAS,CAAC,CAAA,EAAGxD,iBAAiBE,UAAU,CAAC,CAAC,CAAC,CAACuD,MAAM,CAAA,CAAA,CAAA,CAAA;;;AAG3G,YAAA,IAAI,CAACN,cAAAA,EAAgB3B,QAAAA,CAASC,MAAM,GAAG,CAAA,EAAGA,MAAAA,CAAO,oBAAoB,EAAEiC,QAAAA,CAASC,QAAQ,KAAK,QAAA,GAAW,YAAY,EAAA,CAAA,CAAI;YACxH,IAAI,CAAC3D,gBAAAA,CAAiBO,0BAA0B,EAAE;AAC9CP,gBAAAA,gBAAAA,CAAiBO,0BAA0B,GAAG,IAAA;gBAC9CqD,OAAAA,CAAQC,IAAI,CACR,CAAC,6EAA6E,EAAE7D,gBAAAA,CAAiBE,UAAU,CAAC,UAAU,CAAC,GACvH,2FAAA,GACA,yJAAA,CAAA;AACR,YAAA;YACA,OAAOe,MAAAA;AACX,QAAA,CAAA,CAAE,OAAM;YACJ,OAAOL,SAAAA;AACX,QAAA;AACJ,IAAA;AAEA,IAAA,OAAeM,UAAAA,CAA6CD,MAA0C,EAAEF,IAA4B,EAAuB;AACvJ,QAAA,IAAI,CAACE,MAAAA,EAAQ;YACT,OAAOjB,gBAAAA,CAAiB8D,MAAM,CAAC/C,IAAAA,CAAAA;AACnC,QAAA;AAEA,QAAA,MAAMgD,OAAAA,GAAUC,qDAAAA,CAA2BjD,IAAAA,EAAME,MAAAA,CAAO8C,OAAO,CAAA;QAC/D,OAAO;AACHE,YAAAA,EAAAA,EAAIhD,OAAOgD,EAAE;AACbC,YAAAA,IAAAA,EAAMjD,OAAOiD,IAAI;YACjBC,KAAAA,EAAOlD,MAAAA,CAAOkD,KAAK,IAAI,EAAE;YACzBJ,OAAAA,EAASA,OAAAA;YACTK,KAAAA,EAAO,IAAA;YACPC,QAAAA,EAAU,CAACC,IAAAA,GAAkBrD,CAAAA,MAAAA,CAAOkD,KAAK,IAAI,EAAC,EAAGI,QAAQ,CAACD,IAAAA,CAAAA;YAC1DnD,OAAAA,EAAS,IAAMnB,gBAAAA,CAAiBmB,OAAO,CAACJ,IAAAA;AAC5C,SAAA;AACJ,IAAA;IAEA,OAAe+C,MAAAA,CAAyC/C,IAA4B,EAAuB;QACvG,OAAO;YACHkD,EAAAA,EAAI,EAAA;YACJC,IAAAA,EAAM,EAAA;AACNC,YAAAA,KAAAA,EAAO,EAAE;AACTJ,YAAAA,OAAAA,EAAS,EAAC;YACVK,KAAAA,EAAO,KAAA;AACPC,YAAAA,QAAAA,EAAU,IAAM,KAAA;YAChBlD,OAAAA,EAAS,IAAMnB,gBAAAA,CAAiBmB,OAAO,CAACJ,IAAAA;AAC5C,SAAA;AACJ,IAAA;AACJ;;"}

package/dist/cjs/identity/deserializeIdentityDetails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deserializeIdentityDetails.d.ts","sourceRoot":"","sources":["../../../identity/deserializeIdentityDetails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAA0B,MAAM,sBAAsB,CAAC;AAmD3E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAwBnG"}
+{"version":3,"file":"deserializeIdentityDetails.d.ts","sourceRoot":"","sources":["../../../identity/deserializeIdentityDetails.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAA0B,MAAM,sBAAsB,CAAC;AAkD3E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAwBnG"}

package/dist/cjs/identity/deserializeIdentityDetails.js

@@ -30,8 +30,7 @@ var fundamentals = require('@cratis/fundamentals');
  * would otherwise crash or silently destroy the payload.
  * @param {Constructor | undefined} type The details type to deserialize into, or `undefined` to leave
  * the payload untouched.
- * @param {unknown} details The raw details payload - parsed JSON from the identity cookie or the
- * `/.cratis/me` endpoint.
+ * @param {unknown} details The raw details payload - parsed JSON from the `/.cratis/me` endpoint.
  * @returns {unknown} The deserialized instance, or `details` unchanged when deserializing it would be
  * unsafe, pointless, or has already been done.
  * @remarks

package/dist/cjs/identity/deserializeIdentityDetails.js.map

@@ -1 +1 @@
-{"version":3,"file":"deserializeIdentityDetails.js","sources":["../../../identity/deserializeIdentityDetails.ts"],"sourcesContent":["// Copyright (c) Cratis. All rights reserved.\n// Licensed under the MIT license. See LICENSE file in the project root for full license information.\n\nimport { Constructor, Fields, JsonSerializer } from '@cratis/fundamentals';\n\n/*\n * ⚠️ deserializeIdentityDetails is exported deliberately, unlike deserializeQueryModel in\n * ../queries/deserializeQueryModel.ts.\n *\n * JsonSerializer's converter registry is module state, and a consumer package can easily resolve a\n * different physical copy of @cratis/fundamentals than this one - which is why deserializeQueryModel\n * stays package-private. Identity details are different: @cratis/arc.react's useIdentity() needs to\n * apply the exact same deserialization as this package's own IdentityProvider, for a payload that may\n * already be flowing through this package's IdentityProvider/IIdentity. Exporting the function itself\n * - rather than having @cratis/arc.react re-implement the same logic against its own copy of\n * @cratis/fundamentals - guarantees every identity details value is deserialized through this one\n * physical JsonSerializer/Fields, regardless of which package's copy of @cratis/fundamentals the\n * caller resolved.\n */\n\n/**\n * Determines whether a details type is a JavaScript primitive wrapper rather than a real,\n * `@field`-decorated model.\n * @param {Constructor} type The details type to check.\n * @returns {boolean} True when the type is a primitive wrapper.\n */\nfunction isPrimitiveDetailsType(type: Constructor): boolean {\n    return type === String || type === Number || type === Boolean;\n}\n\n/**\n * Deserializes identity details into their strongly-typed shape, guarding every way that doing so\n * would otherwise crash or silently destroy the payload.\n * @param {Constructor | undefined} type The details type to deserialize into, or `undefined` to leave\n * the payload untouched.\n * @param {unknown} details The raw details payload - parsed JSON from the identity cookie or the\n * `/.cratis/me` endpoint.\n * @returns {unknown} The deserialized instance, or `details` unchanged when deserializing it would be\n * unsafe, pointless, or has already been done.\n * @remarks\n * {@link JsonSerializer.deserializeFromInstance} assumes a well-formed object and a target type\n * carrying `@field` metadata - neither is guaranteed here:\n * - No type means there is nothing to deserialize into.\n * - A `null`/`undefined`/non-object payload would make `deserializeFromInstance`'s internal\n *   `instance[field.name]` lookup throw.\n * - A payload that is already an instance of the target type has already been deserialized -\n *   deserializing it again is destructive, not merely wasteful: it can throw on a nested temporal\n *   value and double-wraps a concept (`{ value: { value: '...' } }`).\n * - `Object` and the primitive wrapper types (`String`, `Number`, `Boolean`) are not real,\n *   `@field`-decorated models; deserializing into them would discard the payload.\n * - A type with no `@field`-decorated members deserializes to an empty instance, silently discarding\n *   the payload. That is worse than leaving the payload alone, so this warns and passes it through\n *   instead - preserving data beats a hard crash for anyone upgrading with an undecorated type.\n */\nexport function deserializeIdentityDetails(type: Constructor | undefined, details: unknown): unknown {\n    if (!type || type === Object || isPrimitiveDetailsType(type)) {\n        return details;\n    }\n\n    if (details === null || details === undefined || typeof details !== 'object') {\n        return details;\n    }\n\n    if (details instanceof type) {\n        return details;\n    }\n\n    const fields = Fields.getFieldsForType(type);\n    if (fields.length === 0) {\n        console.warn(\n            `Identity details type '${type.name}' has no @field-decorated members. Deserializing into ` +\n            'it would discard the payload and return an empty instance, so the raw payload is being ' +\n            'passed through instead. Add @field decorators for every property that should be ' +\n            'populated, or omit the details type to receive the raw payload as-is.');\n        return details;\n    }\n\n    return JsonSerializer.deserializeFromInstance(type as Constructor<object>, details);\n}\n"],"names":["isPrimitiveDetailsType","type","String","Number","Boolean","deserializeIdentityDetails","details","Object","undefined","fields","Fields","getFieldsForType","length","console","warn","name","JsonSerializer","deserializeFromInstance"],"mappings":";;;;AAAA;AACA;AAIA;;;;;;;;;;;;;;;;;;IAqBA,SAASA,uBAAuBC,IAAiB,EAAA;AAC7C,IAAA,OAAOA,IAAAA,KAASC,MAAAA,IAAUD,IAAAA,KAASE,MAAAA,IAAUF,IAAAA,KAASG,OAAAA;AAC1D;AAEA;;;;;;;;;;;;;;;;;;;;;;;AAuBC,IACM,SAASC,0BAAAA,CAA2BJ,IAA6B,EAAEK,OAAgB,EAAA;AACtF,IAAA,IAAI,CAACL,IAAAA,IAAQA,IAAAA,KAASM,MAAAA,IAAUP,uBAAuBC,IAAAA,CAAAA,EAAO;QAC1D,OAAOK,OAAAA;AACX,IAAA;AAEA,IAAA,IAAIA,YAAY,IAAA,IAAQA,OAAAA,KAAYE,SAAAA,IAAa,OAAOF,YAAY,QAAA,EAAU;QAC1E,OAAOA,OAAAA;AACX,IAAA;AAEA,IAAA,IAAIA,mBAAmBL,IAAAA,EAAM;QACzB,OAAOK,OAAAA;AACX,IAAA;IAEA,MAAMG,MAAAA,GAASC,mBAAAA,CAAOC,gBAAgB,CAACV,IAAAA,CAAAA;IACvC,IAAIQ,MAAAA,CAAOG,MAAM,KAAK,CAAA,EAAG;AACrBC,QAAAA,OAAAA,CAAQC,IAAI,CACR,CAAC,uBAAuB,EAAEb,IAAAA,CAAKc,IAAI,CAAC,sDAAsD,CAAC,GAC3F,yFAAA,GACA,kFAAA,GACA,uEAAA,CAAA;QACJ,OAAOT,OAAAA;AACX,IAAA;IAEA,OAAOU,2BAAAA,CAAeC,uBAAuB,CAAChB,IAAAA,EAA6BK,OAAAA,CAAAA;AAC/E;;"}
+{"version":3,"file":"deserializeIdentityDetails.js","sources":["../../../identity/deserializeIdentityDetails.ts"],"sourcesContent":["// Copyright (c) Cratis. All rights reserved.\n// Licensed under the MIT license. See LICENSE file in the project root for full license information.\n\nimport { Constructor, Fields, JsonSerializer } from '@cratis/fundamentals';\n\n/*\n * ⚠️ deserializeIdentityDetails is exported deliberately, unlike deserializeQueryModel in\n * ../queries/deserializeQueryModel.ts.\n *\n * JsonSerializer's converter registry is module state, and a consumer package can easily resolve a\n * different physical copy of @cratis/fundamentals than this one - which is why deserializeQueryModel\n * stays package-private. Identity details are different: @cratis/arc.react's useIdentity() needs to\n * apply the exact same deserialization as this package's own IdentityProvider, for a payload that may\n * already be flowing through this package's IdentityProvider/IIdentity. Exporting the function itself\n * - rather than having @cratis/arc.react re-implement the same logic against its own copy of\n * @cratis/fundamentals - guarantees every identity details value is deserialized through this one\n * physical JsonSerializer/Fields, regardless of which package's copy of @cratis/fundamentals the\n * caller resolved.\n */\n\n/**\n * Determines whether a details type is a JavaScript primitive wrapper rather than a real,\n * `@field`-decorated model.\n * @param {Constructor} type The details type to check.\n * @returns {boolean} True when the type is a primitive wrapper.\n */\nfunction isPrimitiveDetailsType(type: Constructor): boolean {\n    return type === String || type === Number || type === Boolean;\n}\n\n/**\n * Deserializes identity details into their strongly-typed shape, guarding every way that doing so\n * would otherwise crash or silently destroy the payload.\n * @param {Constructor | undefined} type The details type to deserialize into, or `undefined` to leave\n * the payload untouched.\n * @param {unknown} details The raw details payload - parsed JSON from the `/.cratis/me` endpoint.\n * @returns {unknown} The deserialized instance, or `details` unchanged when deserializing it would be\n * unsafe, pointless, or has already been done.\n * @remarks\n * {@link JsonSerializer.deserializeFromInstance} assumes a well-formed object and a target type\n * carrying `@field` metadata - neither is guaranteed here:\n * - No type means there is nothing to deserialize into.\n * - A `null`/`undefined`/non-object payload would make `deserializeFromInstance`'s internal\n *   `instance[field.name]` lookup throw.\n * - A payload that is already an instance of the target type has already been deserialized -\n *   deserializing it again is destructive, not merely wasteful: it can throw on a nested temporal\n *   value and double-wraps a concept (`{ value: { value: '...' } }`).\n * - `Object` and the primitive wrapper types (`String`, `Number`, `Boolean`) are not real,\n *   `@field`-decorated models; deserializing into them would discard the payload.\n * - A type with no `@field`-decorated members deserializes to an empty instance, silently discarding\n *   the payload. That is worse than leaving the payload alone, so this warns and passes it through\n *   instead - preserving data beats a hard crash for anyone upgrading with an undecorated type.\n */\nexport function deserializeIdentityDetails(type: Constructor | undefined, details: unknown): unknown {\n    if (!type || type === Object || isPrimitiveDetailsType(type)) {\n        return details;\n    }\n\n    if (details === null || details === undefined || typeof details !== 'object') {\n        return details;\n    }\n\n    if (details instanceof type) {\n        return details;\n    }\n\n    const fields = Fields.getFieldsForType(type);\n    if (fields.length === 0) {\n        console.warn(\n            `Identity details type '${type.name}' has no @field-decorated members. Deserializing into ` +\n            'it would discard the payload and return an empty instance, so the raw payload is being ' +\n            'passed through instead. Add @field decorators for every property that should be ' +\n            'populated, or omit the details type to receive the raw payload as-is.');\n        return details;\n    }\n\n    return JsonSerializer.deserializeFromInstance(type as Constructor<object>, details);\n}\n"],"names":["isPrimitiveDetailsType","type","String","Number","Boolean","deserializeIdentityDetails","details","Object","undefined","fields","Fields","getFieldsForType","length","console","warn","name","JsonSerializer","deserializeFromInstance"],"mappings":";;;;AAAA;AACA;AAIA;;;;;;;;;;;;;;;;;;IAqBA,SAASA,uBAAuBC,IAAiB,EAAA;AAC7C,IAAA,OAAOA,IAAAA,KAASC,MAAAA,IAAUD,IAAAA,KAASE,MAAAA,IAAUF,IAAAA,KAASG,OAAAA;AAC1D;AAEA;;;;;;;;;;;;;;;;;;;;;;AAsBC,IACM,SAASC,0BAAAA,CAA2BJ,IAA6B,EAAEK,OAAgB,EAAA;AACtF,IAAA,IAAI,CAACL,IAAAA,IAAQA,IAAAA,KAASM,MAAAA,IAAUP,uBAAuBC,IAAAA,CAAAA,EAAO;QAC1D,OAAOK,OAAAA;AACX,IAAA;AAEA,IAAA,IAAIA,YAAY,IAAA,IAAQA,OAAAA,KAAYE,SAAAA,IAAa,OAAOF,YAAY,QAAA,EAAU;QAC1E,OAAOA,OAAAA;AACX,IAAA;AAEA,IAAA,IAAIA,mBAAmBL,IAAAA,EAAM;QACzB,OAAOK,OAAAA;AACX,IAAA;IAEA,MAAMG,MAAAA,GAASC,mBAAAA,CAAOC,gBAAgB,CAACV,IAAAA,CAAAA;IACvC,IAAIQ,MAAAA,CAAOG,MAAM,KAAK,CAAA,EAAG;AACrBC,QAAAA,OAAAA,CAAQC,IAAI,CACR,CAAC,uBAAuB,EAAEb,IAAAA,CAAKc,IAAI,CAAC,sDAAsD,CAAC,GAC3F,yFAAA,GACA,kFAAA,GACA,uEAAA,CAAA;QACJ,OAAOT,OAAAA;AACX,IAAA;IAEA,OAAOU,2BAAAA,CAAeC,uBAAuB,CAAChB,IAAAA,EAA6BK,OAAAA,CAAAA;AAC/E;;"}

package/dist/esm/identity/IdentityProvider.d.ts

@@ -7,14 +7,23 @@ export declare class IdentityProvider extends IIdentityProvider {
     static httpHeadersCallback: GetHttpHeaders | undefined;
     static apiBasePath: string;
     static origin: string;
+    private static cachedResult;
+    private static hasWarnedAboutLegacyCookie;
+    private static legacyCookie;
     static setHttpHeadersCallback(callback: GetHttpHeaders): void;
     static setApiBasePath(apiBasePath: string): void;
     static setOrigin(origin: string): void;
     static getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
     getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
     static refresh<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>>;
-    private static notSet;
-    private static getCookie;
+    static clearCache(): void;
     static clearIdentityCookie(): void;
+    private static expireLegacyCookie;
+    private static readLegacyCookie;
+    private static fetchAndCache;
+    private static fetchResult;
+    private static fromLegacyCookie;
+    private static toIdentity;
+    private static notSet;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/esm/identity/IdentityProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../identity/IdentityProvider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQtD,qBAAa,gBAAiB,SAAQ,iBAAiB;IAEnD,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAsB;IAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,GAAG,SAAS,CAAC;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAM;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAM3B,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE5D;IAMD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAE/C;IAMD,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAErC;IAQD,OAAa,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAmBpH;IAGK,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAE7G;IAED,OAAa,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CA4BjH;IAED,OAAO,CAAC,MAAM,CAAC,MAAM;IAYrB,OAAO,CAAC,MAAM,CAAC,SAAS;IAiBxB,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAGjC;CACJ"}
+{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../identity/IdentityProvider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBtD,qBAAa,gBAAiB,SAAQ,iBAAiB;IAOnD,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAsB;IAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,GAAG,SAAS,CAAC;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAM;IAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAE3B,OAAO,CAAC,MAAM,CAAC,YAAY,CAA0D;IACrF,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAS;IAClD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAqB;IAMhD,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE5D;IAMD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAM/C;IAMD,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMrC;IAWD,OAAa,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAMpH;IAGK,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAE7G;IAOD,OAAa,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAQjH;IAMD,MAAM,CAAC,UAAU,IAAI,IAAI,CAIxB;IAMD,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAEjC;IAED,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAKjC,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAM/B,OAAO,CAAC,MAAM,CAAC,aAAa;mBAkBP,WAAW;IA0BhC,OAAO,CAAC,MAAM,CAAC,gBAAgB;IA0B/B,OAAO,CAAC,MAAM,CAAC,UAAU;IAiBzB,OAAO,CAAC,MAAM,CAAC,MAAM;CAWxB"}

package/dist/esm/identity/IdentityProvider.js

@@ -8,11 +8,26 @@ import { joinPaths } from '../joinPaths.js';
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 /**
  * Represents an implementation of {@link IIdentityProvider}.
+ *
+ * The identity comes from the `/.cratis/me` endpoint, which derives it from the authenticated request. The
+ * result is kept in memory for the page, so repeated calls to {@link IdentityProvider.getCurrent} do not each go to
+ * the server; {@link IdentityProvider.refresh} always asks the server again.
+ *
+ * Only when the server has no `/.cratis/me` endpoint (it answers 404) does it fall back to the readable
+ * `.cratis-identity` cookie earlier versions relied on, and it warns when it does. That fallback is for the transition
+ * and will be removed.
 */ class IdentityProvider extends IIdentityProvider {
-    static CookieName = '.cratis-identity';
+    /**
+     * The name of the identity cookie earlier versions of Arc wrote and read.
+     * @deprecated The identity comes from the `/.cratis/me` endpoint. The cookie is only read when that endpoint does
+     * not exist, and that fallback will be removed.
+     */ static CookieName = '.cratis-identity';
     static httpHeadersCallback;
     static apiBasePath = '';
     static origin = '';
+    static cachedResult;
+    static hasWarnedAboutLegacyCookie = false;
+    static legacyCookie;
     /**
      * Sets the HTTP headers callback.
      * @param callback Callback to set.
@@ -23,44 +38,92 @@ import { joinPaths } from '../joinPaths.js';
      * Sets the API base path.
      * @param apiBasePath API base path to set.
      */ static setApiBasePath(apiBasePath) {
+        if (IdentityProvider.apiBasePath !== apiBasePath) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.apiBasePath = apiBasePath;
     }
     /**
      * Sets the origin.
      * @param origin Origin to set.
      */ static setOrigin(origin) {
+        if (IdentityProvider.origin !== origin) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.origin = origin;
     }
     /**
      * Gets the current identity by optionally specifying the details type.
      * @param type Optional constructor for the details type to enable type-safe deserialization.
      * @returns The current identity as {@link IIdentity}.
-     * @remarks The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
+     * @remarks The identity is fetched from `/.cratis/me` the first time and kept in memory until
+     * {@link IdentityProvider.refresh} or {@link IdentityProvider.clearCache} is called. An identity that could not be
+     * resolved is not kept, so the next call asks the server again.
+     * The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
      */ static async getCurrent(type) {
-        const cookie = this.getCookie();
-        if (cookie.length == 2) {
-            const json = atob(cookie[1]);
-            const result = JSON.parse(json);
-            const details = deserializeIdentityDetails(type, result.details);
-            return {
-                id: result.id,
-                name: result.name,
-                roles: result.roles || [],
-                details: details,
-                isSet: true,
-                isInRole: (role)=>(result.roles || []).includes(role),
-                refresh: ()=>IdentityProvider.refresh(type)
-            };
-        } else {
-            const identity = await this.refresh(type);
-            return identity;
+        if (!IdentityProvider.cachedResult) {
+            IdentityProvider.fetchAndCache();
         }
+        const result = await IdentityProvider.cachedResult;
+        return IdentityProvider.toIdentity(result, type);
     }
     /** @inheritdoc */ async getCurrent(type) {
         return IdentityProvider.getCurrent(type);
     }
-    static async refresh(type) {
-        IdentityProvider.clearIdentityCookie();
+    /**
+     * Fetches the current identity from `/.cratis/me`, replacing what is kept in memory.
+     * @param type Optional constructor for the details type to enable type-safe deserialization.
+     * @returns The current identity as {@link IIdentity}.
+     */ static async refresh(type) {
+        // Earlier backends resolve the cookie before consulting the current credentials. Retain it during the
+        // request for a possible 404 transition fallback, but do not send it with an explicit refresh request.
+        IdentityProvider.legacyCookie = IdentityProvider.readLegacyCookie() ?? IdentityProvider.legacyCookie;
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.expireLegacyCookie();
+        const result = await IdentityProvider.fetchAndCache();
+        return IdentityProvider.toIdentity(result, type);
+    }
+    /**
+     * Forgets the identity kept in memory, so the next {@link IdentityProvider.getCurrent} asks the server again.
+     * It also expires a readable `.cratis-identity` cookie left by an earlier version. Call this when the user logs out.
+     */ static clearCache() {
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.legacyCookie = undefined;
+        IdentityProvider.expireLegacyCookie();
+    }
+    /**
+     * Forgets the identity kept in memory.
+     * @deprecated Arc no longer keeps the identity in a cookie. Use {@link IdentityProvider.clearCache} instead.
+     */ static clearIdentityCookie() {
+        IdentityProvider.clearCache();
+    }
+    static expireLegacyCookie() {
+        if (typeof document === 'undefined') return;
+        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+    }
+    static readLegacyCookie() {
+        if (typeof document === 'undefined') return undefined;
+        const prefix = `${IdentityProvider.CookieName}=`;
+        return document.cookie.split(';').map((_)=>_.trim()).find((_)=>_.startsWith(prefix));
+    }
+    static fetchAndCache() {
+        const pending = IdentityProvider.fetchResult();
+        IdentityProvider.cachedResult = pending;
+        // Only a resolved identity is worth keeping: an unset one, or a failed request, has to be asked for
+        // again - otherwise a page that loaded before sign-in would never see the user who signed in.
+        const forget = ()=>{
+            if (IdentityProvider.cachedResult === pending) {
+                IdentityProvider.cachedResult = undefined;
+            }
+        };
+        pending.then((result)=>{
+            if (!result) forget();
+        }, forget);
+        return pending;
+    }
+    static async fetchResult() {
         const origin = IdentityProvider.origin || Globals.origin || '';
         const apiBasePath = IdentityProvider.apiBasePath || Globals.apiBasePath || '';
         const route = joinPaths(apiBasePath, '/.cratis/me');
@@ -69,10 +132,43 @@ import { joinPaths } from '../joinPaths.js';
             method: 'GET',
             headers: IdentityProvider.httpHeadersCallback?.() ?? {}
         });
+        // No identity endpoint at all - an application that has not mapped one, or one whose identity comes from a
+        // proxy in front of it. Anything else, a 401 or 403 above all, is the server's answer and a cookie the
+        // browser holds must never overrule it.
+        if (response.status === 404) {
+            return IdentityProvider.fromLegacyCookie();
+        }
+        IdentityProvider.legacyCookie = undefined;
         if (!response.ok) {
+            return undefined;
+        }
+        return await response.json();
+    }
+    static fromLegacyCookie() {
+        if (typeof document === 'undefined') return undefined;
+        // A proxy may issue a newer cookie on the response. Prefer it over the one expired before the request.
+        const responseCookie = IdentityProvider.readLegacyCookie();
+        const cookie = responseCookie ?? IdentityProvider.legacyCookie;
+        if (!cookie) return undefined;
+        IdentityProvider.legacyCookie = cookie;
+        try {
+            const result = JSON.parse(atob(decodeURIComponent(cookie.substring(`${IdentityProvider.CookieName}=`.length))));
+            // The proxy may not reissue its cookie while its own authorization record remains valid. Restore the
+            // transition fallback after a 404 so it also survives a reload, without changing a response cookie.
+            if (!responseCookie) document.cookie = `${cookie};path=/;samesite=lax${location.protocol === 'https:' ? ';secure' : ''}`;
+            if (!IdentityProvider.hasWarnedAboutLegacyCookie) {
+                IdentityProvider.hasWarnedAboutLegacyCookie = true;
+                console.warn(`The server has no '/.cratis/me' endpoint, so the identity was read from the '${IdentityProvider.CookieName}' cookie. ` + 'That cookie is not protected and the fallback will be removed in a future major version. ' + 'Expose /.cratis/me to the frontend: https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/identity/migrating-from-the-identity-cookie.md');
+            }
+            return result;
+        } catch  {
+            return undefined;
+        }
+    }
+    static toIdentity(result, type) {
+        if (!result) {
             return IdentityProvider.notSet(type);
         }
-        const result = await response.json();
         const details = deserializeIdentityDetails(type, result.details);
         return {
             id: result.id,
@@ -95,28 +191,6 @@ import { joinPaths } from '../joinPaths.js';
             refresh: ()=>IdentityProvider.refresh(type)
         };
     }
-    static getCookie() {
-        if (typeof document === 'undefined') return [];
-        const decoded = decodeURIComponent(document.cookie);
-        const cookies = decoded.split(';').map((_)=>_.trim());
-        const cookie = cookies.find((_)=>_.indexOf(`${IdentityProvider.CookieName}=`) == 0);
-        if (cookie) {
-            const keyValue = cookie.split('=');
-            return [
-                keyValue[0].trim(),
-                keyValue[1].trim()
-            ];
-        }
-        return [];
-    }
-    /**
-     * Clears the identity cookie used by Arc to cache the current identity.
-     * Call this when the user logs out to ensure subsequent requests and WebSocket
-     * connections do not carry stale credentials.
-     */ static clearIdentityCookie() {
-        if (typeof document === 'undefined') return;
-        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT`;
-    }
 }
 
 export { IdentityProvider };