@drax/identity-vue 3.67.0 → 3.68.0

package/README.md

@@ -58,7 +58,7 @@ Integration contracts:
   null-to-null logout. Legacy stores without the field use the initial null epoch.
   Late returned refresh credentials are revoked best-effort.
 - Transient refresh/profile errors retain recoverable credentials; rejected
-  credentials (HTTP 401/403, including common-front wrapped errors) clear auth.
+  credentials (HTTP 401/403/498, including common-front wrapped errors) clear auth.
   Logout clears local state immediately, with best-effort server revocation even
   when the feature has subsequently been disabled. Offline revocation cannot be
   guaranteed; the backend expiration/revocation policy remains authoritative.
@@ -72,6 +72,66 @@ Focused tests:
 npm exec --workspace @drax/identity-vue -- vitest run test/auth-session.spec.ts test/auth-session.integration.spec.ts test/components/__tests__/IdentityLogin.spec.ts
 ```
 
+## Expired sessions and external login migration
+
+Session maintenance runs even with remember-me disabled or without a refresh token.
+Expired/malformed access tokens without renewal are cleared together with the profile,
+refresh credentials, persisted state and shared authorization headers. With remember-me
+disabled, a live access token remains usable, but legacy refresh credentials are discarded.
+`AuthStore.isAuth` checks local JWT validity, not mere token presence. This check is not
+signature verification: the backend remains authoritative.
+
+Store token/clear actions synchronize both shared clients. `syncAuthHeaders()` never
+installs an expired/malformed JWT; transient refresh errors preserve recoverable tokens
+in storage, remove expired authorization from the clients and reject the authenticated
+REST preflight before fetch. There is no navigation or automatic request replay.
+Removing a header directly is only a transport operation and intentionally does **not**
+clear the store: use session/store actions for credential changes. Direct `$patch` is
+not a session API; normal request maintenance re-reads persisted state.
+
+External providers must mark the credential exchange as independent using the existing
+HTTP option, even if the old Drax session is recoverable:
+
+```ts
+const response = await this.httpClient.post('/api/google/login', {credential}, {
+  timeout: 120000,
+  removeHeaders: ['Authorization'],
+})
+await loginWithToken(response.accessToken)
+```
+
+Do not remove/restore global headers or set the returned token manually before
+`loginWithToken`. The request option excludes Authorization case-insensitively and
+skips the session preflight without changing shared state. Its 401 is the external
+credential's rejection, not a reason to clear the existing Drax session. No global
+response interceptor performs logout. This does not disable browser CORS preflight.
+
+Consumer changes:
+
+- **GoogleProvider:** add `removeHeaders: ['Authorization']` to the login POST and
+  remove the redundant `setHttpClientToken(response.accessToken)` call; keep
+  `await loginWithToken(response.accessToken)` after a successful exchange. See
+  Zuite's `src/modules/base/providers/GoogleProvider.ts`.
+- **LoginPage:** delete the workaround that checks invalid access tokens and calls
+  `logout()`. Session cleanup belongs to maintenance, not a page (logout also navigates).
+- **Bootstrap:** retain `app.use(pinia); await setupAuthSession(); app.use(router)`;
+  install Pinia's persisted-state plugin before these calls. No extra cleanup needed.
+- **Router:** retain the existing `await refreshAuthSession()` plus catch and cancel
+  protected navigation while `!isAuthenticated() && isRememberMeEnabled() &&
+  authStore.refreshToken`. Do not convert transient failures into logout or redirects.
+- **Backend external route:** replace the Google-specific middleware wrapper with
+  the supported Fastify route option `{config: {identityJwt: 'ignore'}}` on the POST
+  route. Keep its external credential verifier and normal authorization checks.
+  A public route with optional JWT authentication still rejects a supplied invalid
+  Bearer; only this explicit option ignores it. See identity-back's
+  `docs/jwt-route-policy.md`.
+
+The two local workarounds can therefore be removed after upgrading compatible packages
+and declaring the external route policy. Google SDK/signature verification itself is
+consumer-owned; Drax tests use a deterministic external verifier, not Google's service.
+REST request-time maintenance requires the shared client's optional `setBeforeRequest`;
+GraphQL and custom clients without that hook do not get automatic preflight renewal.
+
 ## Registro con creación de tenant (opcional, REST)
 
 En el **backend**:

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.67.0",
+  "version": "3.68.0",
   "type": "module",
   "main": "./src/index.ts",
   "module": "./src/index.ts",
@@ -18,12 +18,12 @@
     "format": "prettier --write src/"
   },
   "dependencies": {
-    "@drax/common-front": "^3.65.0",
-    "@drax/common-vue": "^3.65.0",
+    "@drax/common-front": "^3.68.0",
+    "@drax/common-vue": "^3.68.0",
     "@drax/crud-front": "^3.58.0",
     "@drax/crud-share": "^3.65.0",
-    "@drax/crud-vue": "^3.66.0",
-    "@drax/identity-front": "^3.67.0",
+    "@drax/crud-vue": "^3.68.0",
+    "@drax/identity-front": "^3.68.0",
     "@drax/identity-share": "^3.67.0"
   },
   "peerDependencies": {
@@ -49,5 +49,5 @@
     "vue-tsc": "^3.2.4",
     "vuetify": "^3.11.8"
   },
-  "gitHead": "ffe6431614727caa3940fcb03da690d50c5032db"
+  "gitHead": "c8300dd678d4048416da13f9065d6749e715c3bf"
 }

package/src/composables/setupAuthSession.ts

@@ -1,5 +1,5 @@
-import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
-import {AuthSystemFactory} from '@drax/identity-front'
+import {HttpRestClientFactory} from '@drax/common-front'
+import {AuthHelper, AuthSystemFactory} from '@drax/identity-front'
 import {useAuthStore} from '../stores/AuthStore'
 
 export const isRememberMeEnabled = () => import.meta.env.VITE_DRAX_REMEMBER_ME_ENABLED === 'true'
@@ -12,11 +12,7 @@ const revisions = new WeakMap<AuthStore, number>()
 export const authSessionRevision = (store = useAuthStore()) => revisions.get(store) ?? 0
 
 export function syncAuthHeaders(store = useAuthStore()) {
-    const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
-    for (const client of clients) {
-        if (store.accessToken) client.addHeader('Authorization', `Bearer ${store.accessToken}`)
-        else client.removeHeader('Authorization')
-    }
+    store.syncAuthHeaders()
 }
 
 export function clearAuthSession(store = useAuthStore()) {
@@ -28,7 +24,7 @@ export function clearAuthSession(store = useAuthStore()) {
 export function isRejectedCredential(error: unknown): boolean {
     const e = error as {statusCode?: number, status?: number, response?: {status?: number}, cause?: unknown, error?: unknown}
     const status = e?.statusCode ?? e?.status ?? e?.response?.status
-    return status === 401 || status === 403 ||
+    return status === 401 || status === 403 || status === 498 ||
         (!!e?.error && e.error !== error && isRejectedCredential(e.error)) ||
         (!!e?.cause && e.cause !== error && isRejectedCredential(e.cause))
 }
@@ -76,11 +72,7 @@ export function isCurrentAuthSession(store: AuthStore, token: string | null, ver
 }
 
 function needsRefresh(token: string | null) {
-    try {
-        const payload = (token?.split('.')[1] ?? '').replace(/-/g, '+').replace(/_/g, '/')
-        const {exp} = JSON.parse(atob(payload))
-        return typeof exp !== 'number' || exp * 1000 <= Date.now() + 30_000
-    } catch { return true }
+    return !AuthHelper.isJWTValid(token ?? '', 30)
 }
 
 async function withSessionLock(action: () => Promise<void>) {
@@ -115,12 +107,25 @@ async function fetchSessionUser(store: AuthStore) {
 }
 
 export function refreshAuthSession(store = useAuthStore()): Promise<void> {
-    if (!isRememberMeEnabled()) return Promise.resolve()
+
     const running = flights.get(store)
     if (running) return running
     const flight = withSessionLock(async () => {
         rereadSession(store)
-        if (!store.refreshToken) return
+        const valid = AuthHelper.isJWTValid(store.accessToken ?? '')
+        if (!isRememberMeEnabled() || !store.refreshToken) {
+            if (!valid) {
+                if (store.accessToken || store.refreshToken || store.refreshExpiresAt || store.authUser) clearAuthSession(store)
+                else syncAuthHeaders(store)
+            } else {
+                // Disabling remember-me must not invalidate an otherwise live ordinary JWT.
+                if (!isRememberMeEnabled() && (store.refreshToken || store.refreshExpiresAt)) {
+                    store.setAccessToken(store.accessToken!)
+                }
+                syncAuthHeaders(store)
+            }
+            return
+        }
         if (!needsRefresh(store.accessToken)) {
             if (!store.authUser) await fetchSessionUser(store)
             return

package/src/stores/AuthStore.ts

@@ -4,6 +4,7 @@ import type {IAuthFullUser} from "@drax/identity-front";
 //@ts-ignore
 import type from 'pinia-plugin-persistedstate'
 import {AuthHelper} from "@drax/identity-front";
+import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
 
 export const useAuthStore = defineStore('AuthStore', {
   state: () => ({
@@ -15,8 +16,7 @@ export const useAuthStore = defineStore('AuthStore', {
   }),
   getters:{
     isAuth: (state): boolean => {
-      //TODO verify token
-      return !!state.accessToken
+      return !!state.accessToken && AuthHelper.isJWTValid(state.accessToken)
     },
     hasPermission: (state) => (permission:string) => {
       return state.authUser && state.authUser.role && state.authUser.role.permissions ? state.authUser.role.permissions.includes(permission) : false
@@ -26,6 +26,16 @@ export const useAuthStore = defineStore('AuthStore', {
     },
   },
   actions:{
+    syncAuthHeaders(){
+      const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
+      for (const client of clients) {
+        for (const header of Object.keys(client.baseHeaders ?? {})) {
+          if (header.toLowerCase() === 'authorization' && header !== 'Authorization') client.removeHeader(header)
+        }
+        if (this.accessToken && AuthHelper.isJWTValid(this.accessToken)) client.addHeader('Authorization', `Bearer ${this.accessToken}`)
+        else client.removeHeader('Authorization')
+      }
+    },
     persistSession(){
       // Persist synchronously so another tab holding the refresh lock sees rotation immediately.
       try {
@@ -35,6 +45,7 @@ export const useAuthStore = defineStore('AuthStore', {
     setAccessToken(accessToken:string){
       this.$patch({accessToken, refreshToken: null, refreshExpiresAt: null})
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setSession(session: {accessToken: string, refreshToken?: string, refreshExpiresAt?: string}){
       this.$patch({
@@ -43,6 +54,7 @@ export const useAuthStore = defineStore('AuthStore', {
         refreshExpiresAt: session.refreshExpiresAt ?? null,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setAuthUser(authUser:IAuthFullUser){
       this.authUser = authUser
@@ -55,6 +67,7 @@ export const useAuthStore = defineStore('AuthStore', {
         sessionVersion: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     }
   },