@dudousxd/nestjs-agent-dashboard 0.10.0 → 0.10.1

package/dist/server/index.d.cts

@@ -203,14 +203,15 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` PER
- * COOKIE GENERATION, per in-flight request — the gate is on the inbound cookie's `iat`, so every
- * request still carrying a not-yet-renewed cookie invokes this hook, not just the first: a page
- * load that fires N parallel API calls can trigger up to N calls before the refreshed cookie lands
- * on the client. Bounded and cheap for typical console traffic, but not a per-session-lifetime
- * cap — a slow or expensive check should debounce/cache on its own. Return `false` to revoke (the
- * cookie is cleared and the request denied). Distinct from `session`: that hook reads the host's
- * auth off a fresh request, which a console XHR does not carry — this one receives the
- * already-minted session.
+ * COOKIE GENERATION — the gate is on the inbound cookie's `iat`, so every request still carrying a
+ * not-yet-renewed cookie would, on its own, invoke this hook again; `maybeRenewSession` de-dupes
+ * concurrent calls for the same session (`sub` + `iat`) into a single in-flight call, so a page
+ * load that fires N parallel API calls still costs exactly ONE host round-trip, not N. Still not a
+ * per-session-lifetime cap — this can run again every `ttl/2` as the session keeps sliding, so a
+ * slow or expensive check should still debounce/cache across renewal windows on its own. Return
+ * `false` to revoke (the cookie is cleared and the request denied). Distinct from `session`: that
+ * hook reads the host's auth off a fresh request, which a console XHR does not carry — this one
+ * receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
 /** Which `dashboardAuth` hook(s) a resolved config was given — see `resolveDashboardAuth`. */
@@ -289,9 +290,10 @@ interface LoginFormBody {
  * hook decides — or Mode B (`login`), a dependency-free, server-rendered login form (GET/POST) —
  * the bundled React SPA in this package is a built Vite artifact with no auth-aware UI of its own,
  * so gating the actual page navigation needs a self-contained flow that doesn't touch it. Each
- * mode's routes 404 when that mode isn't configured (`auth.session`/`auth.login` absent), and
- * every route 404s outright when `dashboardAuth` is unconfigured (`DASHBOARD_AUTH` resolves to
- * `null`) — no dangling login page when the feature is off.
+ * mode's routes 404 when that mode isn't listed in `auth.modes` — the single source of truth for
+ * which mode(s) are configured, not hook-presence truthiness — and every route 404s outright when
+ * `dashboardAuth` is unconfigured (`DASHBOARD_AUTH` resolves to `null`) — no dangling login page
+ * when the feature is off.
  */
 declare class AgentDashboardAuthController {
     private readonly auth;

package/dist/server/index.d.ts

@@ -203,14 +203,15 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` PER
- * COOKIE GENERATION, per in-flight request — the gate is on the inbound cookie's `iat`, so every
- * request still carrying a not-yet-renewed cookie invokes this hook, not just the first: a page
- * load that fires N parallel API calls can trigger up to N calls before the refreshed cookie lands
- * on the client. Bounded and cheap for typical console traffic, but not a per-session-lifetime
- * cap — a slow or expensive check should debounce/cache on its own. Return `false` to revoke (the
- * cookie is cleared and the request denied). Distinct from `session`: that hook reads the host's
- * auth off a fresh request, which a console XHR does not carry — this one receives the
- * already-minted session.
+ * COOKIE GENERATION — the gate is on the inbound cookie's `iat`, so every request still carrying a
+ * not-yet-renewed cookie would, on its own, invoke this hook again; `maybeRenewSession` de-dupes
+ * concurrent calls for the same session (`sub` + `iat`) into a single in-flight call, so a page
+ * load that fires N parallel API calls still costs exactly ONE host round-trip, not N. Still not a
+ * per-session-lifetime cap — this can run again every `ttl/2` as the session keeps sliding, so a
+ * slow or expensive check should still debounce/cache across renewal windows on its own. Return
+ * `false` to revoke (the cookie is cleared and the request denied). Distinct from `session`: that
+ * hook reads the host's auth off a fresh request, which a console XHR does not carry — this one
+ * receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
 /** Which `dashboardAuth` hook(s) a resolved config was given — see `resolveDashboardAuth`. */
@@ -289,9 +290,10 @@ interface LoginFormBody {
  * hook decides — or Mode B (`login`), a dependency-free, server-rendered login form (GET/POST) —
  * the bundled React SPA in this package is a built Vite artifact with no auth-aware UI of its own,
  * so gating the actual page navigation needs a self-contained flow that doesn't touch it. Each
- * mode's routes 404 when that mode isn't configured (`auth.session`/`auth.login` absent), and
- * every route 404s outright when `dashboardAuth` is unconfigured (`DASHBOARD_AUTH` resolves to
- * `null`) — no dangling login page when the feature is off.
+ * mode's routes 404 when that mode isn't listed in `auth.modes` — the single source of truth for
+ * which mode(s) are configured, not hook-presence truthiness — and every route 404s outright when
+ * `dashboardAuth` is unconfigured (`DASHBOARD_AUTH` resolves to `null`) — no dangling login page
+ * when the feature is off.
  */
 declare class AgentDashboardAuthController {
     private readonly auth;

package/dist/server/index.js

@@ -261,6 +261,30 @@ function clearSessionCookie(context) {
   appendSetCookie(context.response, cookie);
 }
 __name(clearSessionCookie, "clearSessionCookie");
+var inFlightRevalidations = /* @__PURE__ */ new Map();
+function revalidationKey(session) {
+  return `${session.sub}:${session.iat}`;
+}
+__name(revalidationKey, "revalidationKey");
+function getOrStartRevalidation(auth, session, user) {
+  const hook = auth.revalidate;
+  if (!hook) return Promise.resolve(true);
+  const key = revalidationKey(session);
+  const inFlight = inFlightRevalidations.get(key);
+  if (inFlight) return inFlight;
+  const outcome = (async () => {
+    try {
+      return await hook(user);
+    } catch {
+      return false;
+    }
+  })().finally(() => {
+    inFlightRevalidations.delete(key);
+  });
+  inFlightRevalidations.set(key, outcome);
+  return outcome;
+}
+__name(getOrStartRevalidation, "getOrStartRevalidation");
 async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
   if (now - session.iat <= auth.ttlMs / 2) return true;
   const user = {
@@ -270,20 +294,13 @@ async function maybeRenewSession(auth, session, request, response, now = Date.no
     } : {},
     roles: session.roles
   };
-  if (auth.revalidate) {
-    let allowed;
-    try {
-      allowed = await auth.revalidate(user);
-    } catch {
-      allowed = false;
-    }
-    if (!allowed) {
-      clearSessionCookie({
-        request,
-        response
-      });
-      return false;
-    }
+  const allowed = await getOrStartRevalidation(auth, session, user);
+  if (!allowed) {
+    clearSessionCookie({
+      request,
+      response
+    });
+    return false;
   }
   issueSessionCookie(user, {
     auth,
@@ -1305,7 +1322,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   }
   loginPage(req, res, returnToQuery, error) {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException();
+    if (!auth.modes.includes("login")) throw new NotFoundException();
     const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
     if (this.currentSession(req)) {
       res.status(302);
@@ -1320,7 +1337,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   }
   async login(body, req, res) {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException();
+    if (!auth.modes.includes("login")) throw new NotFoundException();
     const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
     const username = body?.username;
     const password = body?.password;
@@ -1348,14 +1365,14 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
       response: res
     });
     res.status(302);
-    res.setHeader("Location", this.auth && !this.auth.login ? `${this.basePath}/auth/session-required` : `${this.basePath}/auth/login`);
+    res.setHeader("Location", this.auth && !this.auth.modes.includes("login") ? `${this.basePath}/auth/session-required` : `${this.basePath}/auth/login`);
     return "";
   }
   // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
   // request and returns the session user, or `null` to deny. No credential reaches this library.
   async session(request, response) {
     const auth = this.requireAuth();
-    if (!auth.session) throw new NotFoundException();
+    if (!auth.modes.includes("session")) throw new NotFoundException();
     const user = await this.runHook("session", () => auth.session?.(request) ?? null);
     if (!user) throw new UnauthorizedException2();
     issueSessionCookie(user, {
@@ -1369,7 +1386,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   // 404s under Mode A (see `loginPage` above).
   sessionRequiredPage() {
     const auth = this.requireAuth();
-    if (auth.login) throw new NotFoundException();
+    if (auth.modes.includes("login")) throw new NotFoundException();
     return renderSessionRequiredPage();
   }
   /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
@@ -1615,7 +1632,7 @@ var DashboardAuthPageGuard = class {
   * asserting away) the nullability.
   */
   deny(auth, request) {
-    if (!auth.login) {
+    if (!auth.modes.includes("login")) {
       throw new DashboardAuthRedirect(`${this.basePath}/auth/session-required`);
     }
     const returnTo = readOriginalUrl(request);