@drax/identity-vue 3.67.0 → 3.69.0

package/README.md

@@ -58,7 +58,7 @@ Integration contracts:
   null-to-null logout. Legacy stores without the field use the initial null epoch.
   Late returned refresh credentials are revoked best-effort.
 - Transient refresh/profile errors retain recoverable credentials; rejected
-  credentials (HTTP 401/403, including common-front wrapped errors) clear auth.
+  credentials (HTTP 401/403/498, including common-front wrapped errors) clear auth.
   Logout clears local state immediately, with best-effort server revocation even
   when the feature has subsequently been disabled. Offline revocation cannot be
   guaranteed; the backend expiration/revocation policy remains authoritative.
@@ -72,6 +72,155 @@ Focused tests:
 npm exec --workspace @drax/identity-vue -- vitest run test/auth-session.spec.ts test/auth-session.integration.spec.ts test/components/__tests__/IdentityLogin.spec.ts
 ```
 
+## Expired sessions and external login migration
+
+Session maintenance runs even with remember-me disabled or without a refresh token.
+Expired/malformed access tokens without renewal are cleared together with the profile,
+refresh credentials, persisted state and shared authorization headers. With remember-me
+disabled, a live access token remains usable, but legacy refresh credentials are discarded.
+`AuthStore.isAuth` checks local JWT validity, not mere token presence. This check is not
+signature verification: the backend remains authoritative.
+
+Store token/clear actions synchronize both shared clients. `syncAuthHeaders()` never
+installs an expired/malformed JWT; transient refresh errors preserve recoverable tokens
+in storage, remove expired authorization from the clients and reject the authenticated
+REST preflight before fetch. There is no navigation or automatic request replay.
+Removing a header directly is only a transport operation and intentionally does **not**
+clear the store: use session/store actions for credential changes. Direct `$patch` is
+not a session API; normal request maintenance re-reads persisted state.
+
+External login should use the public workflow:
+
+```ts
+useAuth().loginWithSession(
+  operation: (rememberMe: boolean) => Promise<ILoginResponse>,
+  rememberMe = false,
+): Promise<void>
+```
+
+`ILoginResponse` is the existing exported type from `@drax/identity-front`:
+`{accessToken: string, refreshToken?: string, refreshExpiresAt?: string}`.
+The workflow clears the previous credentials/profile, captures the operation epoch,
+then calls `operation` with the effective frontend flag + explicit opt-in. It confirms
+the session, synchronizes headers and loads the profile using the same path as standard
+login. Failures reject the promise; only navigate after successful completion.
+Discarded or unwanted refresh credentials are revoked best-effort. A profile failure
+clears the current attempted login; offline revocation cannot be guaranteed.
+
+**Start the entire async exchange inside the callback.** Passing a promise started
+before the workflow, or awaiting the response then calling `loginWithToken`, cannot
+protect against logout/new login while that request is pending. Legacy
+`loginWithToken(string)` remains available for access-token-only callers; it does not
+accept or persist refresh credentials.
+
+Example consumer component (the consumer's Google integration supplies
+`obtainGoogleCredential`; no Google SDK is added to Drax):
+
+```vue
+<script setup lang="ts">
+import {ref} from 'vue'
+import {useRouter} from 'vue-router'
+import {HttpRestClientFactory} from '@drax/common-front'
+import type {ILoginResponse} from '@drax/identity-front'
+import {IdentityRememberMe, useAuth} from '@drax/identity-vue'
+import {obtainGoogleCredential} from './googleCredential'
+
+const rememberMe = ref(false)
+const loading = ref(false)
+const {loginWithSession} = useAuth()
+const router = useRouter()
+
+async function loginGoogle() {
+  loading.value = true
+  try {
+    await loginWithSession(async effectiveRememberMe => {
+      const credential = await obtainGoogleCredential()
+      return await HttpRestClientFactory.getInstance().post('/api/google/login', {
+        credential, rememberMe: effectiveRememberMe,
+      }, {removeHeaders: ['Authorization']}) as ILoginResponse
+    }, rememberMe.value)
+    await router.push('/') // Adapt to the consumer's authorized destination.
+  } catch {
+    // Show the consumer's localized error; never log credentials or headers.
+  } finally {
+    loading.value = false
+  }
+}
+</script>
+
+<template>
+  <IdentityRememberMe v-model="rememberMe" />
+  <v-btn :loading="loading" :disabled="loading" @click="loginGoogle">Google</v-btn>
+</template>
+```
+
+This checkbox starts unchecked and hides itself when the feature is disabled. It is
+independent from the private checkbox inside `IdentityLogin`; an external button must
+supply its own explicit opt-in. The callback receives a snapshot, not a later checkbox
+value. Do not write tokens to Pinia/localStorage or manipulate Authorization manually.
+
+Use `removeHeaders: ['Authorization']` on the external exchange: it excludes stale
+bearer credentials and skips Drax session preflight for that request, without mutating
+global headers or disabling browser CORS preflight. There is no second refresh/retry
+mechanism. The backend must verify the external identity before issuing any Drax
+session; see `identity-back/docs/remember-me.md`.
+
+Consumer changes:
+
+- **GoogleProvider:** add `removeHeaders: ['Authorization']` to the login POST and
+  remove redundant `setHttpClientToken` calls and return the full `ILoginResponse`.
+  Invoke that provider inside `loginWithSession(effectiveRememberMe =>
+  provider.login(credential, effectiveRememberMe), rememberMe)`; obtain the credential
+  inside the callback too if that step is asynchronous. Do not start the request first.
+- **LoginPage:** delete the workaround that checks invalid access tokens and calls
+  `logout()`. Session cleanup belongs to maintenance, not a page (logout also navigates).
+- **Bootstrap:** retain `app.use(pinia); await setupAuthSession(); app.use(router)`;
+  install Pinia's persisted-state plugin before these calls. No extra cleanup needed.
+- **Router:** retain the existing `await refreshAuthSession()` plus catch and cancel
+  protected navigation while `!isAuthenticated() && isRememberMeEnabled() &&
+  authStore.refreshToken`. Do not convert transient failures into logout or redirects.
+- **Backend external route:** replace the Google-specific middleware wrapper with
+  the supported Fastify route option `{config: {identityJwt: 'ignore'}}` on the POST
+  route. Keep its external credential verifier and normal authorization checks.
+  A public route with optional JWT authentication still rejects a supplied invalid
+  Bearer; only this explicit option ignores it. See identity-back's
+  `docs/jwt-route-policy.md`.
+
+The two local workarounds can therefore be removed after upgrading compatible packages
+and declaring the external route policy. Google SDK/signature verification itself is
+consumer-owned; Drax tests use a deterministic external verifier, not Google's service.
+REST request-time maintenance requires the shared client's optional `setBeforeRequest`;
+GraphQL and custom clients without that hook do not get automatic preflight renewal.
+
+### External remember-me rollout and security
+
+This change requires new releases of **`@drax/identity-back` and
+`@drax/identity-vue`**. No new type or runtime changes are needed in identity-front,
+identity-share or common-front for this extension, but consumers must retain compatible
+remember-me APIs and the shared REST preflight (avoid duplicate singleton packages).
+No publication/version is implied by this source change. Deploy the compatible backend
+and its verified external endpoint first, then update/rebuild the frontend coherently.
+The user must log in again and explicitly check the option; existing ordinary sessions
+are not upgraded.
+
+Keep `DRAX_REMEMBER_ME_ENABLED=true`, optional
+`DRAX_REFRESH_TOKEN_TTL_SECONDS=2592000` on the backend and
+`VITE_DRAX_REMEMBER_ME_ENABLED=true` at frontend build time. Refresh has an absolute
+TTL, uses the user's **currently assigned database tenant**, and does not extend JWT
+lifetime. A tenant selected with switchTenant must be selected again after renewal.
+
+Storage contains sensitive credentials in **localStorage**, not HttpOnly cookies.
+Use HTTPS and XSS protections. Web Locks coordinates refresh across tabs when available;
+without it, single-flight is per tab only. Disabling the backend flag blocks new
+remembered sessions/refresh; disabling the frontend flag prevents opt-in and maintenance
+strips legacy local refresh credentials. Neither flag revokes already-issued JWTs or
+all server refresh records. Re-enabling can make unexpired, non-revoked refresh tokens
+usable again. Logout revokes the latest known Drax refresh token best-effort.
+
+Drax refresh tokens renew **Drax sessions only**. They are not Google's OAuth refresh
+or access tokens and do not grant Gmail/Calendar access or offline Google API consent.
+Keep Google API authorization and its token storage separate.
+
 ## Registro con creación de tenant (opcional, REST)
 
 En el **backend**:

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.67.0",
+  "version": "3.69.0",
   "type": "module",
   "main": "./src/index.ts",
   "module": "./src/index.ts",
@@ -18,12 +18,12 @@
     "format": "prettier --write src/"
   },
   "dependencies": {
-    "@drax/common-front": "^3.65.0",
-    "@drax/common-vue": "^3.65.0",
+    "@drax/common-front": "^3.68.0",
+    "@drax/common-vue": "^3.68.0",
     "@drax/crud-front": "^3.58.0",
     "@drax/crud-share": "^3.65.0",
-    "@drax/crud-vue": "^3.66.0",
-    "@drax/identity-front": "^3.67.0",
+    "@drax/crud-vue": "^3.68.0",
+    "@drax/identity-front": "^3.68.0",
     "@drax/identity-share": "^3.67.0"
   },
   "peerDependencies": {
@@ -49,5 +49,5 @@
     "vue-tsc": "^3.2.4",
     "vuetify": "^3.11.8"
   },
-  "gitHead": "ffe6431614727caa3940fcb03da690d50c5032db"
+  "gitHead": "4358ebd6e083a11924349ef5bb07a20cafccbabe"
 }

package/src/composables/setupAuthSession.ts

@@ -1,5 +1,5 @@
-import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
-import {AuthSystemFactory} from '@drax/identity-front'
+import {HttpRestClientFactory} from '@drax/common-front'
+import {AuthHelper, AuthSystemFactory} from '@drax/identity-front'
 import {useAuthStore} from '../stores/AuthStore'
 
 export const isRememberMeEnabled = () => import.meta.env.VITE_DRAX_REMEMBER_ME_ENABLED === 'true'
@@ -12,11 +12,7 @@ const revisions = new WeakMap<AuthStore, number>()
 export const authSessionRevision = (store = useAuthStore()) => revisions.get(store) ?? 0
 
 export function syncAuthHeaders(store = useAuthStore()) {
-    const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
-    for (const client of clients) {
-        if (store.accessToken) client.addHeader('Authorization', `Bearer ${store.accessToken}`)
-        else client.removeHeader('Authorization')
-    }
+    store.syncAuthHeaders()
 }
 
 export function clearAuthSession(store = useAuthStore()) {
@@ -28,7 +24,7 @@ export function clearAuthSession(store = useAuthStore()) {
 export function isRejectedCredential(error: unknown): boolean {
     const e = error as {statusCode?: number, status?: number, response?: {status?: number}, cause?: unknown, error?: unknown}
     const status = e?.statusCode ?? e?.status ?? e?.response?.status
-    return status === 401 || status === 403 ||
+    return status === 401 || status === 403 || status === 498 ||
         (!!e?.error && e.error !== error && isRejectedCredential(e.error)) ||
         (!!e?.cause && e.cause !== error && isRejectedCredential(e.cause))
 }
@@ -76,11 +72,7 @@ export function isCurrentAuthSession(store: AuthStore, token: string | null, ver
 }
 
 function needsRefresh(token: string | null) {
-    try {
-        const payload = (token?.split('.')[1] ?? '').replace(/-/g, '+').replace(/_/g, '/')
-        const {exp} = JSON.parse(atob(payload))
-        return typeof exp !== 'number' || exp * 1000 <= Date.now() + 30_000
-    } catch { return true }
+    return !AuthHelper.isJWTValid(token ?? '', 30)
 }
 
 async function withSessionLock(action: () => Promise<void>) {
@@ -115,12 +107,25 @@ async function fetchSessionUser(store: AuthStore) {
 }
 
 export function refreshAuthSession(store = useAuthStore()): Promise<void> {
-    if (!isRememberMeEnabled()) return Promise.resolve()
+
     const running = flights.get(store)
     if (running) return running
     const flight = withSessionLock(async () => {
         rereadSession(store)
-        if (!store.refreshToken) return
+        const valid = AuthHelper.isJWTValid(store.accessToken ?? '')
+        if (!isRememberMeEnabled() || !store.refreshToken) {
+            if (!valid) {
+                if (store.accessToken || store.refreshToken || store.refreshExpiresAt || store.authUser) clearAuthSession(store)
+                else syncAuthHeaders(store)
+            } else {
+                // Disabling remember-me must not invalidate an otherwise live ordinary JWT.
+                if (!isRememberMeEnabled() && (store.refreshToken || store.refreshExpiresAt)) {
+                    store.setAccessToken(store.accessToken!)
+                }
+                syncAuthHeaders(store)
+            }
+            return
+        }
         if (!needsRefresh(store.accessToken)) {
             if (!store.authUser) await fetchSessionUser(store)
             return

package/src/composables/useAuth.ts

@@ -1,6 +1,6 @@
 import {useAuthStore} from "../stores/AuthStore";
 import {AuthHelper, AuthSystemFactory} from "@drax/identity-front";
-import type {AuthSystem} from "@drax/identity-front";
+import type {AuthSystem, ILoginResponse} from "@drax/identity-front";
 import {useRouter} from 'vue-router'
 import {authSessionRevision, clearAuthSession, isCurrentAuthOperation, isCurrentAuthSession, isRememberMeEnabled, rereadSession, revokeSessionToken, syncAuthHeaders} from './setupAuthSession'
 
@@ -11,14 +11,13 @@ export function useAuth() {
 
     const authSystem: AuthSystem = AuthSystemFactory.getInstance()
 
-    const login = async (username: string, password: string, rememberMe = false) => {
+    /** Start the external credential exchange inside operation so logout/new login can cancel its result. */
+    const loginWithSession = async (operation: (rememberMe: boolean) => Promise<ILoginResponse>, rememberMe = false) => {
         clearAuthSession(authStore)
         const revision = authSessionRevision(authStore)
         const version = authStore.sessionVersion
         const remembered = isRememberMeEnabled() && rememberMe
-        const result = remembered
-            ? await authSystem.login(username, password, true)
-            : await authSystem.login(username, password)
+        const result = await operation(remembered)
         if (authSessionRevision(authStore) !== revision || !isCurrentAuthOperation(authStore, version)) {
             syncAuthHeaders(authStore)
             if (result.refreshToken) await revokeSessionToken(result.refreshToken).catch(() => {})
@@ -26,6 +25,8 @@ export function useAuth() {
         }
         if (remembered) authStore.setSession(result)
         else authStore.setAccessToken(result.accessToken)
+        // A server returning refresh credentials without opt-in must not leave an orphan session.
+        if (!remembered && result.refreshToken) void revokeSessionToken(result.refreshToken).catch(() => {})
         syncAuthHeaders(authStore)
         try {
             await fetchAuthUser()
@@ -35,11 +36,18 @@ export function useAuth() {
                 const token = authStore.refreshToken
                 clearAuthSession(authStore)
                 if (token) await revokeSessionToken(token).catch(() => {})
+            } else if (result.refreshToken) {
+                await revokeSessionToken(result.refreshToken).catch(() => {})
             }
             throw error
         }
     }
 
+    const login = async (username: string, password: string, rememberMe = false) => {
+        await loginWithSession(remembered => remembered
+            ? authSystem.login(username, password, true)
+            : authSystem.login(username, password), rememberMe)
+    }
 
     const switchTenant = async (tenantId: string) => {
         const {accessToken} = await authSystem.switchTenant(tenantId)
@@ -150,7 +158,7 @@ export function useAuth() {
     }
 
     return {
-        login, logout, loginWithToken,
+        login, logout, loginWithToken, loginWithSession,
         tokenIsValid, hasPermission,
         isAuthenticated, fetchAuthUser,
         changeOwnPassword, changeAvatar, passwordPolicy,

package/src/stores/AuthStore.ts

@@ -4,6 +4,7 @@ import type {IAuthFullUser} from "@drax/identity-front";
 //@ts-ignore
 import type from 'pinia-plugin-persistedstate'
 import {AuthHelper} from "@drax/identity-front";
+import {HttpClientFactory, HttpRestClientFactory} from '@drax/common-front'
 
 export const useAuthStore = defineStore('AuthStore', {
   state: () => ({
@@ -15,8 +16,7 @@ export const useAuthStore = defineStore('AuthStore', {
   }),
   getters:{
     isAuth: (state): boolean => {
-      //TODO verify token
-      return !!state.accessToken
+      return !!state.accessToken && AuthHelper.isJWTValid(state.accessToken)
     },
     hasPermission: (state) => (permission:string) => {
       return state.authUser && state.authUser.role && state.authUser.role.permissions ? state.authUser.role.permissions.includes(permission) : false
@@ -26,6 +26,16 @@ export const useAuthStore = defineStore('AuthStore', {
     },
   },
   actions:{
+    syncAuthHeaders(){
+      const clients = new Set([HttpClientFactory.getInstance(), HttpRestClientFactory.getInstance()])
+      for (const client of clients) {
+        for (const header of Object.keys(client.baseHeaders ?? {})) {
+          if (header.toLowerCase() === 'authorization' && header !== 'Authorization') client.removeHeader(header)
+        }
+        if (this.accessToken && AuthHelper.isJWTValid(this.accessToken)) client.addHeader('Authorization', `Bearer ${this.accessToken}`)
+        else client.removeHeader('Authorization')
+      }
+    },
     persistSession(){
       // Persist synchronously so another tab holding the refresh lock sees rotation immediately.
       try {
@@ -35,6 +45,7 @@ export const useAuthStore = defineStore('AuthStore', {
     setAccessToken(accessToken:string){
       this.$patch({accessToken, refreshToken: null, refreshExpiresAt: null})
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setSession(session: {accessToken: string, refreshToken?: string, refreshExpiresAt?: string}){
       this.$patch({
@@ -43,6 +54,7 @@ export const useAuthStore = defineStore('AuthStore', {
         refreshExpiresAt: session.refreshExpiresAt ?? null,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     },
     setAuthUser(authUser:IAuthFullUser){
       this.authUser = authUser
@@ -55,6 +67,7 @@ export const useAuthStore = defineStore('AuthStore', {
         sessionVersion: globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`,
       })
       this.persistSession()
+      this.syncAuthHeaders()
     }
   },