@dudousxd/nestjs-agent-dashboard 0.9.1 → 0.10.1

package/dist/server/index.js

@@ -261,6 +261,56 @@ function clearSessionCookie(context) {
   appendSetCookie(context.response, cookie);
 }
 __name(clearSessionCookie, "clearSessionCookie");
+var inFlightRevalidations = /* @__PURE__ */ new Map();
+function revalidationKey(session) {
+  return `${session.sub}:${session.iat}`;
+}
+__name(revalidationKey, "revalidationKey");
+function getOrStartRevalidation(auth, session, user) {
+  const hook = auth.revalidate;
+  if (!hook) return Promise.resolve(true);
+  const key = revalidationKey(session);
+  const inFlight = inFlightRevalidations.get(key);
+  if (inFlight) return inFlight;
+  const outcome = (async () => {
+    try {
+      return await hook(user);
+    } catch {
+      return false;
+    }
+  })().finally(() => {
+    inFlightRevalidations.delete(key);
+  });
+  inFlightRevalidations.set(key, outcome);
+  return outcome;
+}
+__name(getOrStartRevalidation, "getOrStartRevalidation");
+async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
+  if (now - session.iat <= auth.ttlMs / 2) return true;
+  const user = {
+    id: session.sub,
+    ...session.name !== void 0 ? {
+      name: session.name
+    } : {},
+    roles: session.roles
+  };
+  const allowed = await getOrStartRevalidation(auth, session, user);
+  if (!allowed) {
+    clearSessionCookie({
+      request,
+      response
+    });
+    return false;
+  }
+  issueSessionCookie(user, {
+    auth,
+    request,
+    response,
+    now
+  });
+  return true;
+}
+__name(maybeRenewSession, "maybeRenewSession");
 
 // src/server/auth/dashboard-auth.guard.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -288,14 +338,16 @@ var DashboardAuthGuard = class {
   constructor(auth) {
     this.auth = auth;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = this.verifyRequestSession(request);
     if (!session) throw new UnauthorizedException();
     attachSession(request, session);
-    this.maybeRenew(http.getResponse(), request, session);
+    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
+      throw new UnauthorizedException();
+    }
     return true;
   }
   verifyRequestSession(request) {
@@ -307,28 +359,6 @@ var DashboardAuthGuard = class {
       secret: auth.secret
     });
   }
-  /**
-  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
-  * response, so an active user never gets logged out mid-session.
-  */
-  maybeRenew(response, request, session) {
-    const auth = this.auth;
-    if (!auth) return;
-    const now = Date.now();
-    if (now - session.iat <= auth.ttlMs / 2) return;
-    issueSessionCookie({
-      id: session.sub,
-      ...session.name !== void 0 ? {
-        name: session.name
-      } : {},
-      roles: session.roles
-    }, {
-      auth,
-      request,
-      response,
-      now
-    });
-  }
 };
 DashboardAuthGuard = _ts_decorate([
   Injectable(),
@@ -1117,24 +1147,21 @@ AgentApiController = _ts_decorate3([
 ], AgentApiController);
 
 // src/server/agent-dashboard-auth.controller.ts
-import { Body as Body2, Controller as Controller2, Get as Get2, Header, Inject as Inject4, Logger, NotFoundException, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res } from "@nestjs/common";
+import { Body as Body2, Controller as Controller2, Get as Get2, Header, HttpCode as HttpCode2, Inject as Inject4, Logger, NotFoundException, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
 
 // src/server/auth/login-page.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 __name(escapeHtml, "escapeHtml");
-function renderLoginPage(options) {
-  const action = escapeHtml(options.actionUrl);
-  const returnTo = escapeHtml(options.returnTo);
-  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
+function pageShell(content, title) {
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex, nofollow" />
-<title>Sign in \u2014 AI Gateway</title>
+<title>${title}</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -1165,6 +1192,13 @@ function renderLoginPage(options) {
     font-weight: 600;
     color: #34d399;
   }
+  h1 {
+    margin: 0 0 12px;
+    font-size: 16px;
+    font-weight: 600;
+    color: #f4f4f5;
+  }
+  p { margin: 0 0 16px; color: #a1a1aa; }
   form { display: flex; flex-direction: column; gap: 16px; }
   label { display: flex; flex-direction: column; gap: 6px; }
   .field-label {
@@ -1203,7 +1237,17 @@ function renderLoginPage(options) {
 </head>
 <body>
   <div class="card">
-    <p class="brand">AI Gateway</p>
+    ${content}
+  </div>
+</body>
+</html>`;
+}
+__name(pageShell, "pageShell");
+function renderLoginPage(options) {
+  const action = escapeHtml(options.actionUrl);
+  const returnTo = escapeHtml(options.returnTo);
+  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
+  return pageShell(`<p class="brand">AI Gateway</p>
     <form method="post" action="${action}">
       <input type="hidden" name="returnTo" value="${returnTo}" />
       <label>
@@ -1216,12 +1260,15 @@ function renderLoginPage(options) {
       </label>
       ${errorBanner}
       <button type="submit">Sign in</button>
-    </form>
-  </div>
-</body>
-</html>`;
+    </form>`, "Sign in \u2014 AI Gateway");
 }
 __name(renderLoginPage, "renderLoginPage");
+function renderSessionRequiredPage() {
+  return pageShell(`<p class="brand">AI Gateway</p>
+    <h1>Open this console from your application</h1>
+    <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>`, "Sign in \u2014 AI Gateway");
+}
+__name(renderSessionRequiredPage, "renderSessionRequiredPage");
 
 // src/server/auth/sanitize-return-to.ts
 function sanitizeReturnTo(basePath, returnTo) {
@@ -1267,14 +1314,15 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   auth;
   basePath;
   logger = new Logger(_AgentDashboardAuthController.name);
-  /** Warn once (not per request) so a broken hook can't be used to flood the logs. */
-  warnedLoginHookThrow = false;
+  /** Warn once PER HOOK KIND (not per request) so a broken hook can't be used to flood the logs. */
+  warnedHooks = /* @__PURE__ */ new Set();
   constructor(auth, basePath) {
     this.auth = auth;
     this.basePath = basePath;
   }
   loginPage(req, res, returnToQuery, error) {
-    this.requireAuth();
+    const auth = this.requireAuth();
+    if (!auth.modes.includes("login")) throw new NotFoundException();
     const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
     if (this.currentSession(req)) {
       res.status(302);
@@ -1289,6 +1337,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   }
   async login(body, req, res) {
     const auth = this.requireAuth();
+    if (!auth.modes.includes("login")) throw new NotFoundException();
     const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
     const username = body?.username;
     const password = body?.password;
@@ -1296,7 +1345,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
       this.redirectToLoginError(res, returnTo);
       return "";
     }
-    const user = await this.runLoginHook(auth, username.trim(), isString(password) ? password : "");
+    const user = await this.runHook("login", () => auth.login?.(username.trim(), isString(password) ? password : "") ?? null);
     if (!user) {
       this.redirectToLoginError(res, returnTo);
       return "";
@@ -1316,9 +1365,30 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
       response: res
     });
     res.status(302);
-    res.setHeader("Location", `${this.basePath}/auth/login`);
+    res.setHeader("Location", this.auth && !this.auth.modes.includes("login") ? `${this.basePath}/auth/session-required` : `${this.basePath}/auth/login`);
     return "";
   }
+  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
+  // request and returns the session user, or `null` to deny. No credential reaches this library.
+  async session(request, response) {
+    const auth = this.requireAuth();
+    if (!auth.modes.includes("session")) throw new NotFoundException();
+    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
+    if (!user) throw new UnauthorizedException2();
+    issueSessionCookie(user, {
+      auth,
+      request,
+      response
+    });
+  }
+  // Mode-A-only landing: the host mints the session, so there is nothing to submit here. Serves
+  // as the redirect target `DashboardAuthPageGuard` bounces to instead of `/auth/login`, which
+  // 404s under Mode A (see `loginPage` above).
+  sessionRequiredPage() {
+    const auth = this.requireAuth();
+    if (auth.modes.includes("login")) throw new NotFoundException();
+    return renderSessionRequiredPage();
+  }
   /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
   redirectToLoginError(res, returnTo) {
     res.status(303);
@@ -1334,17 +1404,17 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
     }) !== null;
   }
   /**
-  * Run the host's `login` hook defensively: a throw (sync or async) is treated as a denial
-  * (`null`) and warn-logged ONCE, so a buggy/unreachable hook never 500s the endpoint into a
-  * stack-trace leak nor floods the logs.
+  * Run a host hook (`login` or `session`) defensively: a throw (sync or async) is treated as a
+  * denial (`null`) and warn-logged ONCE PER KIND, so a buggy/unreachable hook never 500s the
+  * endpoint into a stack-trace leak nor floods the logs on repeated bad attempts.
   */
-  async runLoginHook(auth, username, password) {
+  async runHook(kind, run) {
     try {
-      return await auth.login(username, password) ?? null;
+      return await run() ?? null;
     } catch (error) {
-      if (!this.warnedLoginHookThrow) {
-        this.warnedLoginHookThrow = true;
-        this.logger.warn(`AgentDashboardModule dashboardAuth login hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
+      if (!this.warnedHooks.has(kind)) {
+        this.warnedHooks.add(kind);
+        this.logger.warn(`AgentDashboardModule dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
       }
       return null;
     }
@@ -1401,6 +1471,28 @@ _ts_decorate4([
   ]),
   _ts_metadata4("design:returntype", String)
 ], AgentDashboardAuthController.prototype, "logout", null);
+_ts_decorate4([
+  Post2("session"),
+  HttpCode2(204),
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], AgentDashboardAuthController.prototype, "session", null);
+_ts_decorate4([
+  Get2("session-required"),
+  Header("Content-Type", "text/html; charset=utf-8"),
+  Header("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", String)
+], AgentDashboardAuthController.prototype, "sessionRequiredPage", null);
 AgentDashboardAuthController = _ts_decorate4([
   Controller2("auth"),
   _ts_param4(0, Optional4()),
@@ -1513,19 +1605,39 @@ var DashboardAuthPageGuard = class {
     this.auth = auth;
     this.basePath = basePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = this.verifyRequestSession(request);
-    if (!session) {
-      const returnTo = readOriginalUrl(request);
-      throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
-    }
+    if (!session) this.deny(auth, request);
     attachSession(request, session);
-    this.maybeRenew(http.getResponse(), request, session);
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      this.deny(auth, request);
+    }
     return true;
   }
+  /**
+  * No valid session: bounce the browser navigation onward. Under Mode B (`login` configured)
+  * that's the built-in login screen, carrying `returnTo` back to the page that was requested.
+  * Under Mode-A-only there is no login screen to redirect to — the host mints the session
+  * itself — so this instead serves the instruction page rather than redirecting into a 404.
+  * Pulled out of `canActivate` so both the "no session at all" and the "revalidate revoked a
+  * renewable session" paths reuse the exact same mode-aware deny logic.
+  *
+  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
+  * return narrows the field within that method only — TS doesn't carry it across a method call —
+  * so the caller passes the already-narrowed value instead of this method re-deriving (or
+  * asserting away) the nullability.
+  */
+  deny(auth, request) {
+    if (!auth.modes.includes("login")) {
+      throw new DashboardAuthRedirect(`${this.basePath}/auth/session-required`);
+    }
+    const returnTo = readOriginalUrl(request);
+    throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
+  }
   verifyRequestSession(request) {
     const auth = this.auth;
     if (!auth) return null;
@@ -1535,28 +1647,6 @@ var DashboardAuthPageGuard = class {
       secret: auth.secret
     });
   }
-  /**
-  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
-  * response, so an active user never gets logged out mid-session.
-  */
-  maybeRenew(response, request, session) {
-    const auth = this.auth;
-    if (!auth) return;
-    const now = Date.now();
-    if (now - session.iat <= auth.ttlMs / 2) return;
-    issueSessionCookie({
-      id: session.sub,
-      ...session.name !== void 0 ? {
-        name: session.name
-      } : {},
-      roles: session.roles
-    }, {
-      auth,
-      request,
-      response,
-      now
-    });
-  }
 };
 DashboardAuthPageGuard = _ts_decorate6([
   Injectable4(),
@@ -1715,13 +1805,38 @@ function resolveDashboardAuth(options) {
   if (typeof options.secret !== "string" || options.secret === "") {
     throw new Error("AgentDashboardModule dashboardAuth: `secret` is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
   }
-  if (typeof options.login !== "function") {
-    throw new Error("AgentDashboardModule dashboardAuth: `login` is required (validates submitted credentials for the built-in login screen). Failing closed.");
+  const modes = [];
+  if (options.session !== void 0) {
+    if (typeof options.session !== "function") {
+      throw new Error("AgentDashboardModule dashboardAuth: `session` must be a function.");
+    }
+    modes.push("session");
+  }
+  if (options.login !== void 0) {
+    if (typeof options.login !== "function") {
+      throw new Error("AgentDashboardModule dashboardAuth: `login` must be a function.");
+    }
+    modes.push("login");
+  }
+  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
+    throw new Error("AgentDashboardModule dashboardAuth: `revalidate` must be a function.");
+  }
+  if (modes.length === 0) {
+    throw new Error("AgentDashboardModule dashboardAuth: at least one of `session` (the host mints the session from its own auth) or `login` (the built-in login screen) is required \u2014 otherwise the cookie can never be minted. Failing closed.");
   }
   return {
     secret: options.secret,
     ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    login: options.login
+    modes,
+    ...options.session !== void 0 ? {
+      session: options.session
+    } : {},
+    ...options.login !== void 0 ? {
+      login: options.login
+    } : {},
+    ...options.revalidate !== void 0 ? {
+      revalidate: options.revalidate
+    } : {}
   };
 }
 __name(resolveDashboardAuth, "resolveDashboardAuth");