@dudousxd/nestjs-durable-dashboard 0.36.0 → 0.37.0

package/dist/server/index.js

@@ -543,28 +543,51 @@ function resolveDashboardAuth(options) {
   if (typeof options.secret !== "string" || options.secret === "") {
     throw new Error("DurableDashboardModule: dashboardAuth.secret is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
   }
-  if (typeof options.login !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.login is required (a login hook).");
+  const modes = [];
+  if (options.session !== void 0) {
+    if (typeof options.session !== "function") {
+      throw new Error("DurableDashboardModule: dashboardAuth.session must be a function.");
+    }
+    modes.push("session");
+  }
+  if (options.login !== void 0) {
+    if (typeof options.login !== "function") {
+      throw new Error("DurableDashboardModule: dashboardAuth.login must be a function.");
+    }
+    modes.push("login");
+  }
+  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
+    throw new Error("DurableDashboardModule: dashboardAuth.revalidate must be a function.");
+  }
+  if (modes.length === 0) {
+    throw new Error("DurableDashboardModule: dashboardAuth needs at least one of `session` or `login` (otherwise the cookie can never be minted). Failing closed.");
   }
   return {
     secret: options.secret,
     ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    login: options.login
+    modes,
+    ...options.session !== void 0 ? {
+      session: options.session
+    } : {},
+    ...options.login !== void 0 ? {
+      login: options.login
+    } : {},
+    ...options.revalidate !== void 0 ? {
+      revalidate: options.revalidate
+    } : {}
   };
 }
 __name(resolveDashboardAuth, "resolveDashboardAuth");
 
 // src/server/auth/login-page.ts
-function renderLoginPage(basePath) {
-  const loginAction = `${basePath}/login`;
-  const defaultReturnTo = basePath;
+function page(content, title = "Durable") {
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex, nofollow" />
-<title>Sign in \u2014 Durable</title>
+<title>${title}</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -595,6 +618,13 @@ function renderLoginPage(basePath) {
     font-weight: 600;
     color: #34d399;
   }
+  h1 {
+    margin: 0 0 12px;
+    font-size: 16px;
+    font-weight: 600;
+    color: #f4f4f5;
+  }
+  p { margin: 0 0 16px; color: #a1a1aa; }
   form { display: flex; flex-direction: column; gap: 16px; }
   label { display: flex; flex-direction: column; gap: 6px; }
   .field-label {
@@ -619,7 +649,7 @@ function renderLoginPage(basePath) {
     font-size: 12px;
     color: #fb7185;
   }
-  button {
+  button, .button {
     margin-top: 8px;
     border-radius: 4px;
     border: 1px solid rgb(52 211 153 / 0.4);
@@ -632,14 +662,27 @@ function renderLoginPage(basePath) {
     text-transform: uppercase;
     letter-spacing: 0.05em;
     cursor: pointer;
+    display: inline-block;
+    text-align: center;
+    text-decoration: none;
+    box-sizing: border-box;
   }
-  button:hover:not(:disabled) { background: rgb(52 211 153 / 0.2); }
+  button:hover:not(:disabled), .button:hover { background: rgb(52 211 153 / 0.2); }
   button:disabled { opacity: 0.6; cursor: default; }
 </style>
 </head>
 <body>
   <div class="card">
-    <p class="brand">Durable</p>
+    ${content}
+  </div>
+</body>
+</html>`;
+}
+__name(page, "page");
+function renderLoginPage(basePath) {
+  const loginAction = `${basePath}/login`;
+  const defaultReturnTo = basePath;
+  return page(`<p class="brand">Durable</p>
     <form id="login-form" autocomplete="on">
       <label>
         <span class="field-label">Username</span>
@@ -652,7 +695,6 @@ function renderLoginPage(basePath) {
       <p id="error" role="alert">Invalid username or password.</p>
       <button id="submit" type="submit">Sign in</button>
     </form>
-  </div>
 <script>
 (function () {
   var LOGIN_ACTION = ${JSON.stringify(loginAction)};
@@ -699,11 +741,15 @@ function renderLoginPage(basePath) {
       });
   });
 })();
-</script>
-</body>
-</html>`;
+</script>`, "Sign in \u2014 Durable");
 }
 __name(renderLoginPage, "renderLoginPage");
+function renderSessionRequiredPage(basePath) {
+  return page(`<h1>Open this console from your application</h1>
+     <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>
+     <a class="button" href="${basePath}">Retry</a>`);
+}
+__name(renderSessionRequiredPage, "renderSessionRequiredPage");
 
 // src/server/auth/request.ts
 function isRecord(value) {
@@ -804,6 +850,15 @@ function redirectRaw(response, location, status = 302) {
   raw.end();
 }
 __name(redirectRaw, "redirectRaw");
+function writeHtmlRaw(response, html, status = 200) {
+  const raw = resolveRedirectResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("content-type", "text/html; charset=utf-8");
+  raw.setHeader("cache-control", "no-store, must-revalidate");
+  raw.end(html);
+}
+__name(writeHtmlRaw, "writeHtmlRaw");
 
 // src/server/auth/cookie-header.ts
 function parseCookieHeader(header) {
@@ -959,21 +1014,37 @@ function readSessionFromRequest(auth, request) {
   });
 }
 __name(readSessionFromRequest, "readSessionFromRequest");
-function maybeRenewSession(auth, session, request, response) {
-  const now = Date.now();
-  if (now - session.iat <= auth.ttlMs / 2) return;
-  issueSessionCookie({
+async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
+  if (now - session.iat <= auth.ttlMs / 2) return true;
+  const user = {
     id: session.sub,
     ...session.name !== void 0 ? {
       name: session.name
     } : {},
     roles: session.roles
-  }, {
+  };
+  if (auth.revalidate) {
+    let allowed;
+    try {
+      allowed = await auth.revalidate(user);
+    } catch {
+      allowed = false;
+    }
+    if (!allowed) {
+      clearSessionCookie({
+        request,
+        response
+      });
+      return false;
+    }
+  }
+  issueSessionCookie(user, {
     auth,
     request,
     response,
     now
   });
+  return true;
 }
 __name(maybeRenewSession, "maybeRenewSession");
 
@@ -1016,7 +1087,8 @@ DashboardLoginRedirectFilter = _ts_decorate3([
   Catch(DashboardLoginRedirectException)
 ], DashboardLoginRedirectFilter);
 
-// src/server/durable-ui.controller.ts
+// src/server/auth/session-required.exception.ts
+import { Catch as Catch2, HttpException as HttpException2, HttpStatus as HttpStatus2 } from "@nestjs/common";
 function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1024,6 +1096,38 @@ function _ts_decorate4(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate4, "_ts_decorate");
+var DashboardSessionRequiredException = class extends HttpException2 {
+  static {
+    __name(this, "DashboardSessionRequiredException");
+  }
+  basePath;
+  constructor(basePath) {
+    super({
+      basePath
+    }, HttpStatus2.UNAUTHORIZED), this.basePath = basePath;
+  }
+};
+var DashboardSessionRequiredFilter = class {
+  static {
+    __name(this, "DashboardSessionRequiredFilter");
+  }
+  catch(exception, host) {
+    const response = host.switchToHttp().getResponse();
+    writeHtmlRaw(response, renderSessionRequiredPage(exception.basePath), HttpStatus2.UNAUTHORIZED);
+  }
+};
+DashboardSessionRequiredFilter = _ts_decorate4([
+  Catch2(DashboardSessionRequiredException)
+], DashboardSessionRequiredFilter);
+
+// src/server/durable-ui.controller.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
 function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1086,7 +1190,7 @@ var DurableUiController = class {
     });
   }
 };
-_ts_decorate4([
+_ts_decorate5([
   Get2(),
   Header2("Content-Type", "text/html; charset=utf-8"),
   Header2("Cache-Control", "no-store, must-revalidate"),
@@ -1094,7 +1198,7 @@ _ts_decorate4([
   _ts_metadata3("design:paramtypes", []),
   _ts_metadata3("design:returntype", String)
 ], DurableUiController.prototype, "index", null);
-_ts_decorate4([
+_ts_decorate5([
   Get2("assets/:file"),
   Header2("Cache-Control", "public, max-age=31536000, immutable"),
   _ts_param3(0, Param2("file")),
@@ -1104,8 +1208,8 @@ _ts_decorate4([
   ]),
   _ts_metadata3("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], DurableUiController.prototype, "asset", null);
-DurableUiController = _ts_decorate4([
-  UseFilters(DashboardLoginRedirectFilter),
+DurableUiController = _ts_decorate5([
+  UseFilters(DashboardLoginRedirectFilter, DashboardSessionRequiredFilter),
   Controller2(),
   _ts_param3(0, Inject2(DASHBOARD_BASE_PATH)),
   _ts_param3(1, Inject2(DASHBOARD_API_PATH)),
@@ -1117,13 +1221,13 @@ DurableUiController = _ts_decorate4([
 ], DurableUiController);
 
 // src/server/durable-auth.controller.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1145,8 +1249,8 @@ var DurableAuthController = class _DurableAuthController {
   auth;
   basePath;
   logger = new Logger(_DurableAuthController.name);
-  /** Warn once so a throwing `login` hook doesn't spam logs on every failed attempt. */
-  warnedOnHookThrow = false;
+  /** Warn once per hook kind so a throwing hook doesn't spam logs on every failed attempt. */
+  warnedHooks = /* @__PURE__ */ new Set();
   constructor(auth, basePath) {
     this.auth = auth;
     this.basePath = basePath;
@@ -1155,7 +1259,8 @@ var DurableAuthController = class _DurableAuthController {
   // `login-page.ts`), so this response never varies per request and needs no templating beyond
   // the developer-controlled `basePath`.
   loginPage() {
-    if (!this.auth) throw new NotFoundException3();
+    const auth = this.requireAuth();
+    if (!auth.login) throw new NotFoundException3();
     return renderLoginPage(this.basePath);
   }
   // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
@@ -1164,10 +1269,12 @@ var DurableAuthController = class _DurableAuthController {
   // (unknown user, wrong password, throwing hook) — no user-enumeration.
   async login(body, request, response) {
     const auth = this.requireAuth();
+    if (!auth.login) throw new NotFoundException3();
     if (!isString(body?.username) || !isString(body?.password)) {
       throw new BadRequestException("Body must include string `username` and `password`.");
     }
-    const user = await this.runLoginHook(auth, body.username, body.password);
+    const { username, password } = body;
+    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
     if (!user) throw new UnauthorizedException({
       message: "Invalid username or password."
     });
@@ -1180,6 +1287,20 @@ var DurableAuthController = class _DurableAuthController {
       redirectTo: sanitizeReturnTo(body.returnTo, this.basePath)
     };
   }
+  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
+  // request and returns the session user, or `null` to deny. This is the SSO path — the host's own
+  // guard decides, and no credential ever reaches this library.
+  async session(request, response) {
+    const auth = this.requireAuth();
+    if (!auth.session) throw new NotFoundException3();
+    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
+    if (!user) throw new UnauthorizedException();
+    issueSessionCookie(user, {
+      auth,
+      request,
+      response
+    });
+  }
   // Plain `GET` (not `POST`): logging out only ever destroys the CALLER's own session, so it's
   // safe/idempotent from the caller's perspective — a simple `<a href>` (no JS, no CSRF token)
   // works. Non-passthrough `@Res()`: this handler owns the response outright (clears the cookie,
@@ -1189,30 +1310,30 @@ var DurableAuthController = class _DurableAuthController {
       request,
       response
     });
-    redirectRaw(response, `${this.basePath}/login`);
+    redirectRaw(response, this.auth?.login ? `${this.basePath}/login` : this.basePath);
   }
   requireAuth() {
     if (!this.auth) throw new NotFoundException3();
     return this.auth;
   }
   /**
-  * Run the host's `login` hook defensively: a throw is treated as a denial (uniform failure) and
-  * warn-logged once, so a buggy hook never 500s the endpoint into a stack-trace leak nor floods
-  * the logs on repeated bad attempts.
+  * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
+  * failure) and warn-logged once PER KIND, so a buggy hook never 500s the endpoint into a
+  * stack-trace leak nor floods the logs on repeated bad attempts.
   */
-  async runLoginHook(auth, username, password) {
+  async runHook(kind, run) {
     try {
-      return await auth.login(username, password) ?? null;
+      return await run() ?? null;
     } catch (error) {
-      if (!this.warnedOnHookThrow) {
-        this.warnedOnHookThrow = true;
-        this.logger.warn(`dashboardAuth login hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
+      if (!this.warnedHooks.has(kind)) {
+        this.warnedHooks.add(kind);
+        this.logger.warn(`dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
       }
       return null;
     }
   }
 };
-_ts_decorate5([
+_ts_decorate6([
   Get3("login"),
   Header3("Content-Type", "text/html; charset=utf-8"),
   Header3("Cache-Control", "no-store, must-revalidate"),
@@ -1220,7 +1341,7 @@ _ts_decorate5([
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", String)
 ], DurableAuthController.prototype, "loginPage", null);
-_ts_decorate5([
+_ts_decorate6([
   Post2("login"),
   HttpCode(200),
   _ts_param4(0, Body2()),
@@ -1236,7 +1357,21 @@ _ts_decorate5([
   ]),
   _ts_metadata4("design:returntype", Promise)
 ], DurableAuthController.prototype, "login", null);
-_ts_decorate5([
+_ts_decorate6([
+  Post2("session"),
+  HttpCode(204),
+  _ts_param4(0, Req()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableAuthController.prototype, "session", null);
+_ts_decorate6([
   Get3("logout"),
   _ts_param4(0, Req()),
   _ts_param4(1, Res()),
@@ -1247,7 +1382,7 @@ _ts_decorate5([
   ]),
   _ts_metadata4("design:returntype", void 0)
 ], DurableAuthController.prototype, "logout", null);
-DurableAuthController = _ts_decorate5([
+DurableAuthController = _ts_decorate6([
   Controller3(),
   _ts_param4(0, Optional2()),
   _ts_param4(0, Inject3(DASHBOARD_AUTH)),
@@ -1266,13 +1401,13 @@ import { RouterModule } from "@nestjs/core";
 
 // src/server/durable-session.guard.ts
 import { Inject as Inject4, Injectable as Injectable2, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate7, "_ts_decorate");
 function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1293,20 +1428,37 @@ var DurableUiSessionGuard = class {
     this.auth = auth;
     this.basePath = basePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
-    const session = readSessionFromRequest(this.auth, request);
+    const session = readSessionFromRequest(auth, request);
     if (!session) {
-      const returnTo = encodeURIComponent(originalRequestUrl(request));
-      throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
+      this.denyUnauthenticated(auth, request);
+    }
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      this.denyUnauthenticated(auth, request);
     }
-    maybeRenewSession(this.auth, session, request, http.getResponse());
     return true;
   }
+  /**
+  * A revoked session (the host's `revalidate` hook says no) is denied exactly like an absent
+  * one — by design, there is nothing left to distinguish "never had a session" from "had one,
+  * then lost it" once the cookie is cleared, so both get the same Mode-aware treatment.
+  *
+  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
+  * return narrows the field within that method only — TS doesn't carry it across a method call
+  * — so callers pass the already-narrowed value instead of this method re-deriving (or
+  * asserting away) the nullability.
+  */
+  denyUnauthenticated(auth, request) {
+    if (!auth.login) throw new DashboardSessionRequiredException(this.basePath);
+    const returnTo = encodeURIComponent(originalRequestUrl(request));
+    throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
+  }
 };
-DurableUiSessionGuard = _ts_decorate6([
+DurableUiSessionGuard = _ts_decorate7([
   Injectable2(),
   _ts_param5(0, Inject4(DASHBOARD_AUTH)),
   _ts_param5(1, Inject4(DASHBOARD_BASE_PATH)),
@@ -1324,17 +1476,19 @@ var DurableApiSessionGuard = class {
   constructor(auth) {
     this.auth = auth;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = readSessionFromRequest(this.auth, request);
     if (!session) throw new UnauthorizedException2();
-    maybeRenewSession(this.auth, session, request, http.getResponse());
+    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
+      throw new UnauthorizedException2();
+    }
     return true;
   }
 };
-DurableApiSessionGuard = _ts_decorate6([
+DurableApiSessionGuard = _ts_decorate7([
   Injectable2(),
   _ts_param5(0, Inject4(DASHBOARD_AUTH)),
   _ts_metadata5("design:type", Function),
@@ -1344,13 +1498,13 @@ DurableApiSessionGuard = _ts_decorate6([
 ], DurableApiSessionGuard);
 
 // src/server/durable-dashboard.module.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 var GUARDS_METADATA = "__guards__";
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -1392,7 +1546,7 @@ var DurableApiModule = class _DurableApiModule {
     };
   }
 };
-DurableApiModule = _ts_decorate7([
+DurableApiModule = _ts_decorate8([
   Module({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
@@ -1478,7 +1632,7 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate7([
+DurableDashboardModule = _ts_decorate8([
   Module({})
 ], DurableDashboardModule);
 export {