@ctrl-spc/cs 0.7.14 → 0.7.16

package/dist/supabase.js

@@ -1,12 +1,43 @@
 import { createClient } from '@supabase/supabase-js';
 import { SUPABASE_URL, SUPABASE_KEY } from './env.js';
-import { readSession, writeSession, getMachineIdentity } from './config.js';
+import { readSessionRecord, writeSession, rotateSession, rejectSession, getMachineIdentity } from './config.js';
 export class NotLoggedIn extends Error {
     constructor(message = 'Not logged in. Run `cs login` first.') {
         super(message);
         this.name = 'NotLoggedIn';
     }
 }
+/** A rejected credential is different from a request that never reached Auth. */
+export function confirmedSessionRejection(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const value = error;
+    return [
+        'refresh_token_not_found', 'refresh_token_already_used', 'session_not_found',
+        'session_expired', 'user_not_found', 'invalid_credentials',
+    ].includes(value.code ?? value.error_code ?? '');
+}
+const sessionWriters = new WeakMap();
+const invalidateClients = new WeakMap();
+const clientChecks = new WeakMap();
+export function assertClientSession(client) { clientChecks.get(client)?.(); }
+export function clientSessionCurrent(client) {
+    try {
+        assertClientSession(client);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Dispose the sole refresh writer before replacing it or abandoning startup. */
+export async function disposeClient(client) {
+    invalidateClients.get(client)?.();
+    invalidateClients.delete(client);
+    sessionWriters.get(client)?.unsubscribe();
+    sessionWriters.delete(client);
+    await client.auth.stopAutoRefresh();
+}
 /**
  * Sign in with email + password and persist the session to disk (shared with
  * the terminal CLI via session.json). Used by the companion GUI's sign-in form,
@@ -14,6 +45,7 @@ export class NotLoggedIn extends Error {
  * Supabase happens here, server-side, not in the browser.
  */
 export async function signIn(email, password) {
+    const expectedGeneration = readSessionRecord()?.generation ?? null;
     const client = createClient(SUPABASE_URL, SUPABASE_KEY, {
         auth: { persistSession: false, autoRefreshToken: false },
         global: { fetch: retryingFetch },
@@ -23,7 +55,7 @@ export async function signIn(email, password) {
         throw new Error(error.message);
     if (!data.session || !data.user?.email)
         throw new Error('Sign-in did not return a session.');
-    writeSession({ access_token: data.session.access_token, refresh_token: data.session.refresh_token });
+    await writeSession({ access_token: data.session.access_token, refresh_token: data.session.refresh_token }, data.user.id, expectedGeneration);
     getMachineIdentity(); // ensure a stable machine id exists post sign-in
     return { email: data.user.email };
 }
@@ -33,24 +65,45 @@ export async function signIn(email, password) {
  * error responses pass straight through so callers see the status.
  */
 const RETRY_DELAYS_MS = [250, 1000, 3000];
-const retryingFetch = async (input, init) => {
-    let lastErr;
-    for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
-        try {
-            return await fetch(input, init);
-        }
-        catch (err) {
-            if (!(err instanceof TypeError))
-                throw err;
-            lastErr = err;
-            const delay = RETRY_DELAYS_MS[attempt];
-            if (delay === undefined)
-                break;
-            await new Promise((r) => setTimeout(r, delay));
+function sessionFetch(check = () => { }) {
+    return async (input, init) => {
+        const supplied = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+        const deadline = AbortSignal.timeout(20_000);
+        const signal = supplied ? AbortSignal.any([supplied, deadline]) : deadline;
+        let lastErr;
+        for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+            check();
+            try {
+                return await fetch(input, { ...init, signal });
+            }
+            catch (err) {
+                if (signal.aborted)
+                    throw err;
+                if (!(err instanceof TypeError))
+                    throw err;
+                lastErr = err;
+                const delay = RETRY_DELAYS_MS[attempt];
+                if (delay === undefined)
+                    break;
+                await new Promise((r) => setTimeout(r, delay));
+            }
         }
-    }
-    throw lastErr;
-};
+        throw lastErr;
+    };
+}
+const retryingFetch = sessionFetch();
+/** Candidate credentials are verified without granting them ownership of storage. */
+export async function acceptLogin(session) {
+    const expectedGeneration = readSessionRecord()?.generation ?? null;
+    const client = createClient(SUPABASE_URL, SUPABASE_KEY, {
+        auth: { persistSession: false, autoRefreshToken: false }, global: { fetch: retryingFetch },
+    });
+    const { data, error } = await client.auth.getUser(session.access_token);
+    if (error || !data.user?.email)
+        throw new Error('Sign-in could not be verified.', { cause: error });
+    await writeSession(session, data.user.id, expectedGeneration);
+    return data.user.email;
+}
 /**
  * Authenticated client built from the stored session.
  *
@@ -63,8 +116,14 @@ const retryingFetch = async (input, init) => {
  * refresh token, for a caller that shares session.json with another process:
  * two processes refreshing the same token family revoke it for both.
  */
+const renewingGenerations = new Map();
+export function sessionRenewing() {
+    const generation = readSessionRecord()?.generation;
+    return !!generation && (renewingGenerations.get(generation) ?? 0) > 0;
+}
 export async function getClient({ refreshing = true } = {}) {
-    const stored = readSession();
+    const record = readSessionRecord();
+    const stored = record?.state === 'signed-in' ? record.tokens : null;
     // The refreshing path still requires both, exactly as today. The
     // non-refreshing one is never handed a refresh token, so it must not demand
     // one: requiring it would refuse a session this client can legitimately use.
@@ -72,6 +131,53 @@ export async function getClient({ refreshing = true } = {}) {
         throw new NotLoggedIn();
     if (refreshing && !stored?.refresh_token)
         throw new NotLoggedIn();
+    const generation = record.generation;
+    const accountId = record.accountId;
+    let invalidated = false;
+    let persistenceError;
+    const check = () => {
+        if (persistenceError)
+            throw new Error('Rotated sign-in could not be saved. Work is suspended.', { cause: persistenceError });
+        const current = readSessionRecord();
+        if (invalidated || current?.state !== 'signed-in' || current.generation !== generation
+            || (accountId !== null && current.accountId !== accountId))
+            throw new NotLoggedIn('This connection no longer owns the local sign-in.');
+    };
+    const guardedFetch = async (input, init) => {
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+        const renewing = refreshing && url.startsWith(`${SUPABASE_URL}/auth/v1/token`);
+        if (renewing)
+            renewingGenerations.set(generation, (renewingGenerations.get(generation) ?? 0) + 1);
+        try {
+            const response = await sessionFetch(check)(input, init);
+            if (refreshing && url.startsWith(`${SUPABASE_URL}/auth/v1/token`) && !response.ok) {
+                let failure;
+                try {
+                    failure = await response.clone().json();
+                }
+                catch { /* Invalid responses are unknown, never rejection. */ }
+                if (confirmedSessionRejection(failure)) {
+                    invalidated = true;
+                    try {
+                        await rejectSession(generation);
+                    }
+                    catch (error) {
+                        persistenceError = error;
+                    }
+                }
+            }
+            return response;
+        }
+        finally {
+            if (renewing) {
+                const remaining = (renewingGenerations.get(generation) ?? 1) - 1;
+                if (remaining)
+                    renewingGenerations.set(generation, remaining);
+                else
+                    renewingGenerations.delete(generation);
+            }
+        }
+    };
     /* ═══ NOT REFRESHING MEANS NEVER HANDED THE REFRESH TOKEN. ═══ Not merely
        `autoRefreshToken: false`: auth-js refreshes inside `setSession` whenever
        the access token has already expired, regardless of that flag
@@ -85,31 +191,61 @@ export async function getClient({ refreshing = true } = {}) {
     if (!refreshing) {
         if (accessTokenExpired(stored.access_token))
             throw new NotLoggedIn();
-        return createClient(SUPABASE_URL, SUPABASE_KEY, {
+        const passive = createClient(SUPABASE_URL, SUPABASE_KEY, {
             auth: { persistSession: false, autoRefreshToken: false },
-            global: { fetch: retryingFetch, headers: { Authorization: `Bearer ${stored.access_token}` } },
+            global: { fetch: guardedFetch, headers: { Authorization: `Bearer ${stored.access_token}` } },
         });
+        clientChecks.set(passive, check);
+        invalidateClients.set(passive, () => { invalidated = true; });
+        return passive;
     }
     const client = createClient(SUPABASE_URL, SUPABASE_KEY, {
         auth: { persistSession: false, autoRefreshToken: true },
-        global: { fetch: retryingFetch },
+        global: { fetch: guardedFetch },
     });
-    client.auth.onAuthStateChange((_event, session) => {
-        // Update-only: a token refresh must never recreate session.json after
-        // `cs logout` deleted it, or the logged-out machine would re-authorize
-        // itself up to an hour later.
-        if (session && readSession()) {
-            writeSession({ access_token: session.access_token, refresh_token: session.refresh_token });
-        }
-    });
-    const { data, error } = await client.auth.setSession({
-        access_token: stored.access_token,
-        refresh_token: stored.refresh_token,
+    clientChecks.set(client, check);
+    invalidateClients.set(client, () => { invalidated = true; });
+    let persistence = Promise.resolve();
+    const writer = client.auth.onAuthStateChange((event, session) => {
+        // Never await storage/SDK operations inside the SDK's own auth lock.
+        if (event === 'SIGNED_OUT')
+            invalidated = true;
+        if (!session && event !== 'SIGNED_OUT')
+            return;
+        persistence = persistence.then(async () => {
+            if (event === 'SIGNED_OUT') {
+                await rejectSession(generation);
+                return;
+            }
+            if (session && !invalidated) {
+                await rotateSession(generation, { access_token: session.access_token, refresh_token: session.refresh_token }, session.user.id);
+            }
+        }).catch(error => { persistenceError = error; });
     });
-    if (error || !data.session) {
-        throw new NotLoggedIn(`Stored session is invalid or expired (${error?.message ?? 'no session'}). Run \`cs login\` again.`);
+    sessionWriters.set(client, writer.data.subscription);
+    try {
+        const { data, error } = await client.auth.setSession({
+            access_token: stored.access_token,
+            refresh_token: stored.refresh_token,
+        });
+        if (error) {
+            if (confirmedSessionRejection(error)) {
+                invalidated = true;
+                await rejectSession(generation);
+                throw new NotLoggedIn('Stored sign-in was rejected. Run `cs login` again.');
+            }
+            throw new Error(`Cloud sign-in could not be checked: ${error.message}`, { cause: error });
+        }
+        if (!data.session)
+            throw new Error('Cloud sign-in did not return a session. Try again when the connection is available.');
+        await persistence;
+        check();
+        return client;
+    }
+    catch (error) {
+        await disposeClient(client);
+        throw error;
     }
-    return client;
 }
 /** Whether a stored access token's own `exp` claim has already passed. A token
  *  this process cannot parse is treated as unusable rather than trusted: the