@dlwiest/ts-tonal-client 0.5.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.cjs +20 -9
  2. package/dist/index.esm.js +20 -9
  3. package/package.json +1 -1
package/dist/index.cjs CHANGED
@@ -77,43 +77,54 @@ class AuthManager {
77
77
  this.tokenExpiresAt = this.getTokenExpiresAt(tokenData.id_token, expiresInDeadline);
78
78
  return this.idToken;
79
79
  }
80
+ // `expiresInDeadline` may be NaN: OAuthTokenResponse declares `expires_in` as required,
81
+ // but that same interface declared `refresh_token` required until Auth0 was observed
82
+ // omitting it, so the field is not trustworthy. A NaN deadline must never reach
83
+ // `tokenExpiresAt` -- `isTokenValid()` compares against it and would return false
84
+ // forever, refreshing on every single call.
80
85
  getTokenExpiresAt(idToken, expiresInDeadline) {
86
+ const expiresInUsable = Number.isFinite(expiresInDeadline);
87
+ // Neither source usable: a short finite window beats NaN, which would spin the
88
+ // refresh grant on every request and invite Auth0 rate limiting.
89
+ const noInfoFallback = expiresInUsable ? expiresInDeadline : Date.now() + 10 * 60 * 1000;
81
90
  try {
82
91
  if (!idToken) {
83
- return expiresInDeadline;
92
+ return noInfoFallback;
84
93
  }
85
94
  const segments = idToken.split('.');
86
95
  if (segments.length !== 3) {
87
- return expiresInDeadline;
96
+ return noInfoFallback;
88
97
  }
89
98
  const payloadSegment = segments[1];
90
99
  if (!/^[A-Za-z0-9_-]+$/.test(payloadSegment)) {
91
- return expiresInDeadline;
100
+ return noInfoFallback;
92
101
  }
93
102
  const payloadBuffer = Buffer.from(payloadSegment, 'base64url');
94
103
  if (payloadBuffer.toString('base64url') !== payloadSegment) {
95
- return expiresInDeadline;
104
+ return noInfoFallback;
96
105
  }
97
106
  const payload = JSON.parse(payloadBuffer.toString('utf8'));
98
107
  if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
99
- return expiresInDeadline;
108
+ return noInfoFallback;
100
109
  }
101
110
  const exp = 'exp' in payload ? payload.exp : undefined;
102
111
  if (typeof exp !== 'number' || !Number.isFinite(exp) || exp <= 0) {
103
- return expiresInDeadline;
112
+ return noInfoFallback;
104
113
  }
105
114
  const expDeadline = exp * 1000;
106
115
  // ID tokens are hour-lived; ten years rejects nonsensical dates without affecting real tokens.
107
116
  const latestReasonableExpiry = Date.now() + 10 * 365 * 24 * 60 * 60 * 1000;
108
117
  if (!Number.isFinite(expDeadline) || expDeadline > latestReasonableExpiry) {
109
- return expiresInDeadline;
118
+ return noInfoFallback;
110
119
  }
111
120
  // Auth0's expires_in (measured at 24h) describes the access token, while
112
121
  // we send the ID token (measured at 10h), so its own exp must cap the deadline.
113
- return Math.min(expDeadline, expiresInDeadline);
122
+ // When expires_in is unusable the exp claim stands alone rather than being
123
+ // discarded by Math.min(valid, NaN) === NaN.
124
+ return expiresInUsable ? Math.min(expDeadline, expiresInDeadline) : expDeadline;
114
125
  }
115
126
  catch {
116
- return expiresInDeadline;
127
+ return noInfoFallback;
117
128
  }
118
129
  }
119
130
  invalidateToken() {
package/dist/index.esm.js CHANGED
@@ -73,43 +73,54 @@ class AuthManager {
73
73
  this.tokenExpiresAt = this.getTokenExpiresAt(tokenData.id_token, expiresInDeadline);
74
74
  return this.idToken;
75
75
  }
76
+ // `expiresInDeadline` may be NaN: OAuthTokenResponse declares `expires_in` as required,
77
+ // but that same interface declared `refresh_token` required until Auth0 was observed
78
+ // omitting it, so the field is not trustworthy. A NaN deadline must never reach
79
+ // `tokenExpiresAt` -- `isTokenValid()` compares against it and would return false
80
+ // forever, refreshing on every single call.
76
81
  getTokenExpiresAt(idToken, expiresInDeadline) {
82
+ const expiresInUsable = Number.isFinite(expiresInDeadline);
83
+ // Neither source usable: a short finite window beats NaN, which would spin the
84
+ // refresh grant on every request and invite Auth0 rate limiting.
85
+ const noInfoFallback = expiresInUsable ? expiresInDeadline : Date.now() + 10 * 60 * 1000;
77
86
  try {
78
87
  if (!idToken) {
79
- return expiresInDeadline;
88
+ return noInfoFallback;
80
89
  }
81
90
  const segments = idToken.split('.');
82
91
  if (segments.length !== 3) {
83
- return expiresInDeadline;
92
+ return noInfoFallback;
84
93
  }
85
94
  const payloadSegment = segments[1];
86
95
  if (!/^[A-Za-z0-9_-]+$/.test(payloadSegment)) {
87
- return expiresInDeadline;
96
+ return noInfoFallback;
88
97
  }
89
98
  const payloadBuffer = Buffer.from(payloadSegment, 'base64url');
90
99
  if (payloadBuffer.toString('base64url') !== payloadSegment) {
91
- return expiresInDeadline;
100
+ return noInfoFallback;
92
101
  }
93
102
  const payload = JSON.parse(payloadBuffer.toString('utf8'));
94
103
  if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
95
- return expiresInDeadline;
104
+ return noInfoFallback;
96
105
  }
97
106
  const exp = 'exp' in payload ? payload.exp : undefined;
98
107
  if (typeof exp !== 'number' || !Number.isFinite(exp) || exp <= 0) {
99
- return expiresInDeadline;
108
+ return noInfoFallback;
100
109
  }
101
110
  const expDeadline = exp * 1000;
102
111
  // ID tokens are hour-lived; ten years rejects nonsensical dates without affecting real tokens.
103
112
  const latestReasonableExpiry = Date.now() + 10 * 365 * 24 * 60 * 60 * 1000;
104
113
  if (!Number.isFinite(expDeadline) || expDeadline > latestReasonableExpiry) {
105
- return expiresInDeadline;
114
+ return noInfoFallback;
106
115
  }
107
116
  // Auth0's expires_in (measured at 24h) describes the access token, while
108
117
  // we send the ID token (measured at 10h), so its own exp must cap the deadline.
109
- return Math.min(expDeadline, expiresInDeadline);
118
+ // When expires_in is unusable the exp claim stands alone rather than being
119
+ // discarded by Math.min(valid, NaN) === NaN.
120
+ return expiresInUsable ? Math.min(expDeadline, expiresInDeadline) : expDeadline;
110
121
  }
111
122
  catch {
112
- return expiresInDeadline;
123
+ return noInfoFallback;
113
124
  }
114
125
  }
115
126
  invalidateToken() {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@dlwiest/ts-tonal-client",
3
- "version": "0.5.0",
3
+ "version": "0.5.1",
4
4
  "description": "TypeScript client for Tonal API",
5
5
  "main": "dist/index.cjs",
6
6
  "module": "dist/index.esm.js",