@dudousxd/nestjs-durable-dashboard 0.36.0 → 0.37.1

package/dist/server/index.cjs

@@ -552,7 +552,7 @@ DurableApiController = _ts_decorate2([
 ], DurableApiController);
 
 // src/server/durable-auth.controller.ts
-var import_common5 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 
 // src/server/auth/dashboard-auth-config.ts
 var DASHBOARD_AUTH = Symbol("DASHBOARD_AUTH");
@@ -577,28 +577,51 @@ function resolveDashboardAuth(options) {
   if (typeof options.secret !== "string" || options.secret === "") {
     throw new Error("DurableDashboardModule: dashboardAuth.secret is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
   }
-  if (typeof options.login !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.login is required (a login hook).");
+  const modes = [];
+  if (options.session !== void 0) {
+    if (typeof options.session !== "function") {
+      throw new Error("DurableDashboardModule: dashboardAuth.session must be a function.");
+    }
+    modes.push("session");
+  }
+  if (options.login !== void 0) {
+    if (typeof options.login !== "function") {
+      throw new Error("DurableDashboardModule: dashboardAuth.login must be a function.");
+    }
+    modes.push("login");
+  }
+  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
+    throw new Error("DurableDashboardModule: dashboardAuth.revalidate must be a function.");
+  }
+  if (modes.length === 0) {
+    throw new Error("DurableDashboardModule: dashboardAuth needs at least one of `session` or `login` (otherwise the cookie can never be minted). Failing closed.");
   }
   return {
     secret: options.secret,
     ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    login: options.login
+    modes,
+    ...options.session !== void 0 ? {
+      session: options.session
+    } : {},
+    ...options.login !== void 0 ? {
+      login: options.login
+    } : {},
+    ...options.revalidate !== void 0 ? {
+      revalidate: options.revalidate
+    } : {}
   };
 }
 __name(resolveDashboardAuth, "resolveDashboardAuth");
 
 // src/server/auth/login-page.ts
-function renderLoginPage(basePath) {
-  const loginAction = `${basePath}/login`;
-  const defaultReturnTo = basePath;
+function page(content, title = "Durable") {
   return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex, nofollow" />
-<title>Sign in \u2014 Durable</title>
+<title>${title}</title>
 <style>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
@@ -629,6 +652,13 @@ function renderLoginPage(basePath) {
     font-weight: 600;
     color: #34d399;
   }
+  h1 {
+    margin: 0 0 12px;
+    font-size: 16px;
+    font-weight: 600;
+    color: #f4f4f5;
+  }
+  p { margin: 0 0 16px; color: #a1a1aa; }
   form { display: flex; flex-direction: column; gap: 16px; }
   label { display: flex; flex-direction: column; gap: 6px; }
   .field-label {
@@ -653,7 +683,7 @@ function renderLoginPage(basePath) {
     font-size: 12px;
     color: #fb7185;
   }
-  button {
+  button, .button {
     margin-top: 8px;
     border-radius: 4px;
     border: 1px solid rgb(52 211 153 / 0.4);
@@ -666,14 +696,27 @@ function renderLoginPage(basePath) {
     text-transform: uppercase;
     letter-spacing: 0.05em;
     cursor: pointer;
+    display: inline-block;
+    text-align: center;
+    text-decoration: none;
+    box-sizing: border-box;
   }
-  button:hover:not(:disabled) { background: rgb(52 211 153 / 0.2); }
+  button:hover:not(:disabled), .button:hover { background: rgb(52 211 153 / 0.2); }
   button:disabled { opacity: 0.6; cursor: default; }
 </style>
 </head>
 <body>
   <div class="card">
-    <p class="brand">Durable</p>
+    ${content}
+  </div>
+</body>
+</html>`;
+}
+__name(page, "page");
+function renderLoginPage(basePath) {
+  const loginAction = `${basePath}/login`;
+  const defaultReturnTo = basePath;
+  return page(`<p class="brand">Durable</p>
     <form id="login-form" autocomplete="on">
       <label>
         <span class="field-label">Username</span>
@@ -686,7 +729,6 @@ function renderLoginPage(basePath) {
       <p id="error" role="alert">Invalid username or password.</p>
       <button id="submit" type="submit">Sign in</button>
     </form>
-  </div>
 <script>
 (function () {
   var LOGIN_ACTION = ${JSON.stringify(loginAction)};
@@ -733,11 +775,15 @@ function renderLoginPage(basePath) {
       });
   });
 })();
-</script>
-</body>
-</html>`;
+</script>`, "Sign in \u2014 Durable");
 }
 __name(renderLoginPage, "renderLoginPage");
+function renderSessionRequiredPage(basePath) {
+  return page(`<h1>Open this console from your application</h1>
+     <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>
+     <a class="button" href="${basePath}">Retry</a>`);
+}
+__name(renderSessionRequiredPage, "renderSessionRequiredPage");
 
 // src/server/auth/request.ts
 function isRecord(value) {
@@ -838,6 +884,15 @@ function redirectRaw(response, location, status = 302) {
   raw.end();
 }
 __name(redirectRaw, "redirectRaw");
+function writeHtmlRaw(response, html, status = 200) {
+  const raw = resolveRedirectResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("content-type", "text/html; charset=utf-8");
+  raw.setHeader("cache-control", "no-store, must-revalidate");
+  raw.end(html);
+}
+__name(writeHtmlRaw, "writeHtmlRaw");
 
 // src/server/auth/cookie-header.ts
 function parseCookieHeader(header) {
@@ -993,21 +1048,44 @@ function readSessionFromRequest(auth, request) {
   });
 }
 __name(readSessionFromRequest, "readSessionFromRequest");
-function maybeRenewSession(auth, session, request, response) {
-  const now = Date.now();
-  if (now - session.iat <= auth.ttlMs / 2) return;
-  issueSessionCookie({
+var inFlightRevalidations = /* @__PURE__ */ new Map();
+function revalidateOnce(auth, user) {
+  const revalidate = auth.revalidate;
+  if (!revalidate) return Promise.resolve(true);
+  const key = `${auth.secret}:${user.id}`;
+  const inFlight = inFlightRevalidations.get(key);
+  if (inFlight) return inFlight;
+  const call = Promise.resolve().then(() => revalidate(user)).catch(() => false).finally(() => {
+    inFlightRevalidations.delete(key);
+  });
+  inFlightRevalidations.set(key, call);
+  return call;
+}
+__name(revalidateOnce, "revalidateOnce");
+async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
+  if (now - session.iat <= auth.ttlMs / 2) return true;
+  const user = {
     id: session.sub,
     ...session.name !== void 0 ? {
       name: session.name
     } : {},
     roles: session.roles
-  }, {
+  };
+  const allowed = await revalidateOnce(auth, user);
+  if (!allowed) {
+    clearSessionCookie({
+      request,
+      response
+    });
+    return false;
+  }
+  issueSessionCookie(user, {
     auth,
     request,
     response,
     now
   });
+  return true;
 }
 __name(maybeRenewSession, "maybeRenewSession");
 
@@ -1015,7 +1093,7 @@ __name(maybeRenewSession, "maybeRenewSession");
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common4 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 
 // src/server/auth/login-redirect.exception.ts
 var import_common3 = require("@nestjs/common");
@@ -1050,7 +1128,8 @@ DashboardLoginRedirectFilter = _ts_decorate3([
   (0, import_common3.Catch)(DashboardLoginRedirectException)
 ], DashboardLoginRedirectFilter);
 
-// src/server/durable-ui.controller.ts
+// src/server/auth/session-required.exception.ts
+var import_common4 = require("@nestjs/common");
 function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1058,6 +1137,38 @@ function _ts_decorate4(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate4, "_ts_decorate");
+var DashboardSessionRequiredException = class extends import_common4.HttpException {
+  static {
+    __name(this, "DashboardSessionRequiredException");
+  }
+  basePath;
+  constructor(basePath) {
+    super({
+      basePath
+    }, import_common4.HttpStatus.UNAUTHORIZED), this.basePath = basePath;
+  }
+};
+var DashboardSessionRequiredFilter = class {
+  static {
+    __name(this, "DashboardSessionRequiredFilter");
+  }
+  catch(exception, host) {
+    const response = host.switchToHttp().getResponse();
+    writeHtmlRaw(response, renderSessionRequiredPage(exception.basePath), import_common4.HttpStatus.UNAUTHORIZED);
+  }
+};
+DashboardSessionRequiredFilter = _ts_decorate4([
+  (0, import_common4.Catch)(DashboardSessionRequiredException)
+], DashboardSessionRequiredFilter);
+
+// src/server/durable-ui.controller.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
 function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1100,7 +1211,7 @@ var DurableUiController = class {
   index() {
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common4.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common5.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__DURABLE_BASE__='${this.basePath}';window.__DURABLE_API__='${this.apiBasePath}';</script>`;
@@ -1108,41 +1219,41 @@ var DurableUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common4.NotFoundException();
+    if (safe !== file) throw new import_common5.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common4.NotFoundException();
+      throw new import_common5.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common4.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common5.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate4([
-  (0, import_common4.Get)(),
-  (0, import_common4.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common4.Header)("Cache-Control", "no-store, must-revalidate"),
+_ts_decorate5([
+  (0, import_common5.Get)(),
+  (0, import_common5.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common5.Header)("Cache-Control", "no-store, must-revalidate"),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", []),
   _ts_metadata3("design:returntype", String)
 ], DurableUiController.prototype, "index", null);
-_ts_decorate4([
-  (0, import_common4.Get)("assets/:file"),
-  (0, import_common4.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, (0, import_common4.Param)("file")),
+_ts_decorate5([
+  (0, import_common5.Get)("assets/:file"),
+  (0, import_common5.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param3(0, (0, import_common5.Param)("file")),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof import_common4.StreamableFile === "undefined" ? Object : import_common4.StreamableFile)
+  _ts_metadata3("design:returntype", typeof import_common5.StreamableFile === "undefined" ? Object : import_common5.StreamableFile)
 ], DurableUiController.prototype, "asset", null);
-DurableUiController = _ts_decorate4([
-  (0, import_common4.UseFilters)(DashboardLoginRedirectFilter),
-  (0, import_common4.Controller)(),
-  _ts_param3(0, (0, import_common4.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, (0, import_common4.Inject)(DASHBOARD_API_PATH)),
+DurableUiController = _ts_decorate5([
+  (0, import_common5.UseFilters)(DashboardLoginRedirectFilter, DashboardSessionRequiredFilter),
+  (0, import_common5.Controller)(),
+  _ts_param3(0, (0, import_common5.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param3(1, (0, import_common5.Inject)(DASHBOARD_API_PATH)),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     String,
@@ -1151,13 +1262,13 @@ DurableUiController = _ts_decorate4([
 ], DurableUiController);
 
 // src/server/durable-auth.controller.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1178,9 +1289,9 @@ var DurableAuthController = class _DurableAuthController {
   }
   auth;
   basePath;
-  logger = new import_common5.Logger(_DurableAuthController.name);
-  /** Warn once so a throwing `login` hook doesn't spam logs on every failed attempt. */
-  warnedOnHookThrow = false;
+  logger = new import_common6.Logger(_DurableAuthController.name);
+  /** Warn once per hook kind so a throwing hook doesn't spam logs on every failed attempt. */
+  warnedHooks = /* @__PURE__ */ new Set();
   constructor(auth, basePath) {
     this.auth = auth;
     this.basePath = basePath;
@@ -1189,7 +1300,8 @@ var DurableAuthController = class _DurableAuthController {
   // `login-page.ts`), so this response never varies per request and needs no templating beyond
   // the developer-controlled `basePath`.
   loginPage() {
-    if (!this.auth) throw new import_common5.NotFoundException();
+    const auth = this.requireAuth();
+    if (!auth.modes.includes("login")) throw new import_common6.NotFoundException();
     return renderLoginPage(this.basePath);
   }
   // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
@@ -1198,11 +1310,13 @@ var DurableAuthController = class _DurableAuthController {
   // (unknown user, wrong password, throwing hook) — no user-enumeration.
   async login(body, request, response) {
     const auth = this.requireAuth();
+    if (!auth.modes.includes("login")) throw new import_common6.NotFoundException();
     if (!isString(body?.username) || !isString(body?.password)) {
-      throw new import_common5.BadRequestException("Body must include string `username` and `password`.");
+      throw new import_common6.BadRequestException("Body must include string `username` and `password`.");
     }
-    const user = await this.runLoginHook(auth, body.username, body.password);
-    if (!user) throw new import_common5.UnauthorizedException({
+    const { username, password } = body;
+    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
+    if (!user) throw new import_common6.UnauthorizedException({
       message: "Invalid username or password."
     });
     issueSessionCookie(user, {
@@ -1214,6 +1328,20 @@ var DurableAuthController = class _DurableAuthController {
       redirectTo: sanitizeReturnTo(body.returnTo, this.basePath)
     };
   }
+  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
+  // request and returns the session user, or `null` to deny. This is the SSO path — the host's own
+  // guard decides, and no credential ever reaches this library.
+  async session(request, response) {
+    const auth = this.requireAuth();
+    if (!auth.modes.includes("session")) throw new import_common6.NotFoundException();
+    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
+    if (!user) throw new import_common6.UnauthorizedException();
+    issueSessionCookie(user, {
+      auth,
+      request,
+      response
+    });
+  }
   // Plain `GET` (not `POST`): logging out only ever destroys the CALLER's own session, so it's
   // safe/idempotent from the caller's perspective — a simple `<a href>` (no JS, no CSRF token)
   // works. Non-passthrough `@Res()`: this handler owns the response outright (clears the cookie,
@@ -1223,43 +1351,43 @@ var DurableAuthController = class _DurableAuthController {
       request,
       response
     });
-    redirectRaw(response, `${this.basePath}/login`);
+    redirectRaw(response, this.auth?.modes.includes("login") ? `${this.basePath}/login` : this.basePath);
   }
   requireAuth() {
-    if (!this.auth) throw new import_common5.NotFoundException();
+    if (!this.auth) throw new import_common6.NotFoundException();
     return this.auth;
   }
   /**
-  * Run the host's `login` hook defensively: a throw is treated as a denial (uniform failure) and
-  * warn-logged once, so a buggy hook never 500s the endpoint into a stack-trace leak nor floods
-  * the logs on repeated bad attempts.
+  * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
+  * failure) and warn-logged once PER KIND, so a buggy hook never 500s the endpoint into a
+  * stack-trace leak nor floods the logs on repeated bad attempts.
   */
-  async runLoginHook(auth, username, password) {
+  async runHook(kind, run) {
     try {
-      return await auth.login(username, password) ?? null;
+      return await run() ?? null;
     } catch (error) {
-      if (!this.warnedOnHookThrow) {
-        this.warnedOnHookThrow = true;
-        this.logger.warn(`dashboardAuth login hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
+      if (!this.warnedHooks.has(kind)) {
+        this.warnedHooks.add(kind);
+        this.logger.warn(`dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
       }
       return null;
     }
   }
 };
-_ts_decorate5([
-  (0, import_common5.Get)("login"),
-  (0, import_common5.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common5.Header)("Cache-Control", "no-store, must-revalidate"),
+_ts_decorate6([
+  (0, import_common6.Get)("login"),
+  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", String)
 ], DurableAuthController.prototype, "loginPage", null);
-_ts_decorate5([
-  (0, import_common5.Post)("login"),
-  (0, import_common5.HttpCode)(200),
-  _ts_param4(0, (0, import_common5.Body)()),
-  _ts_param4(1, (0, import_common5.Req)()),
-  _ts_param4(2, (0, import_common5.Res)({
+_ts_decorate6([
+  (0, import_common6.Post)("login"),
+  (0, import_common6.HttpCode)(200),
+  _ts_param4(0, (0, import_common6.Body)()),
+  _ts_param4(1, (0, import_common6.Req)()),
+  _ts_param4(2, (0, import_common6.Res)({
     passthrough: true
   })),
   _ts_metadata4("design:type", Function),
@@ -1270,10 +1398,24 @@ _ts_decorate5([
   ]),
   _ts_metadata4("design:returntype", Promise)
 ], DurableAuthController.prototype, "login", null);
-_ts_decorate5([
-  (0, import_common5.Get)("logout"),
-  _ts_param4(0, (0, import_common5.Req)()),
-  _ts_param4(1, (0, import_common5.Res)()),
+_ts_decorate6([
+  (0, import_common6.Post)("session"),
+  (0, import_common6.HttpCode)(204),
+  _ts_param4(0, (0, import_common6.Req)()),
+  _ts_param4(1, (0, import_common6.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableAuthController.prototype, "session", null);
+_ts_decorate6([
+  (0, import_common6.Get)("logout"),
+  _ts_param4(0, (0, import_common6.Req)()),
+  _ts_param4(1, (0, import_common6.Res)()),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", [
     Object,
@@ -1281,11 +1423,11 @@ _ts_decorate5([
   ]),
   _ts_metadata4("design:returntype", void 0)
 ], DurableAuthController.prototype, "logout", null);
-DurableAuthController = _ts_decorate5([
-  (0, import_common5.Controller)(),
-  _ts_param4(0, (0, import_common5.Optional)()),
-  _ts_param4(0, (0, import_common5.Inject)(DASHBOARD_AUTH)),
-  _ts_param4(1, (0, import_common5.Inject)(DASHBOARD_BASE_PATH)),
+DurableAuthController = _ts_decorate6([
+  (0, import_common6.Controller)(),
+  _ts_param4(0, (0, import_common6.Optional)()),
+  _ts_param4(0, (0, import_common6.Inject)(DASHBOARD_AUTH)),
+  _ts_param4(1, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", [
     Object,
@@ -1295,18 +1437,18 @@ DurableAuthController = _ts_decorate5([
 
 // src/server/durable-dashboard.module.ts
 var import_reflect_metadata = require("reflect-metadata");
-var import_common7 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
 // src/server/durable-session.guard.ts
-var import_common6 = require("@nestjs/common");
-function _ts_decorate6(decorators, target, key, desc) {
+var import_common7 = require("@nestjs/common");
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate7, "_ts_decorate");
 function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -1327,23 +1469,40 @@ var DurableUiSessionGuard = class {
     this.auth = auth;
     this.basePath = basePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
-    const session = readSessionFromRequest(this.auth, request);
+    const session = readSessionFromRequest(auth, request);
     if (!session) {
-      const returnTo = encodeURIComponent(originalRequestUrl(request));
-      throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
+      this.denyUnauthenticated(auth, request);
+    }
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      this.denyUnauthenticated(auth, request);
     }
-    maybeRenewSession(this.auth, session, request, http.getResponse());
     return true;
   }
+  /**
+  * A revoked session (the host's `revalidate` hook says no) is denied exactly like an absent
+  * one — by design, there is nothing left to distinguish "never had a session" from "had one,
+  * then lost it" once the cookie is cleared, so both get the same Mode-aware treatment.
+  *
+  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
+  * return narrows the field within that method only — TS doesn't carry it across a method call
+  * — so callers pass the already-narrowed value instead of this method re-deriving (or
+  * asserting away) the nullability.
+  */
+  denyUnauthenticated(auth, request) {
+    if (!auth.modes.includes("login")) throw new DashboardSessionRequiredException(this.basePath);
+    const returnTo = encodeURIComponent(originalRequestUrl(request));
+    throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
+  }
 };
-DurableUiSessionGuard = _ts_decorate6([
-  (0, import_common6.Injectable)(),
-  _ts_param5(0, (0, import_common6.Inject)(DASHBOARD_AUTH)),
-  _ts_param5(1, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
+DurableUiSessionGuard = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param5(0, (0, import_common7.Inject)(DASHBOARD_AUTH)),
+  _ts_param5(1, (0, import_common7.Inject)(DASHBOARD_BASE_PATH)),
   _ts_metadata5("design:type", Function),
   _ts_metadata5("design:paramtypes", [
     Object,
@@ -1358,19 +1517,35 @@ var DurableApiSessionGuard = class {
   constructor(auth) {
     this.auth = auth;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
-    const session = readSessionFromRequest(this.auth, request);
-    if (!session) throw new import_common6.UnauthorizedException();
-    maybeRenewSession(this.auth, session, request, http.getResponse());
+    const session = readSessionFromRequest(auth, request);
+    if (!session) throw this.unauthorized(auth);
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      throw this.unauthorized(auth);
+    }
     return true;
   }
+  /**
+  * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+  * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+  * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+  * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+  */
+  unauthorized(auth) {
+    return new import_common7.UnauthorizedException({
+      auth: {
+        modes: auth.modes
+      }
+    });
+  }
 };
-DurableApiSessionGuard = _ts_decorate6([
-  (0, import_common6.Injectable)(),
-  _ts_param5(0, (0, import_common6.Inject)(DASHBOARD_AUTH)),
+DurableApiSessionGuard = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param5(0, (0, import_common7.Inject)(DASHBOARD_AUTH)),
   _ts_metadata5("design:type", Function),
   _ts_metadata5("design:paramtypes", [
     Object
@@ -1378,13 +1553,13 @@ DurableApiSessionGuard = _ts_decorate6([
 ], DurableApiSessionGuard);
 
 // src/server/durable-dashboard.module.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 var GUARDS_METADATA = "__guards__";
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -1426,8 +1601,8 @@ var DurableApiModule = class _DurableApiModule {
     };
   }
 };
-DurableApiModule = _ts_decorate7([
-  (0, import_common7.Module)({})
+DurableApiModule = _ts_decorate8([
+  (0, import_common8.Module)({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
   static {
@@ -1512,8 +1687,8 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate7([
-  (0, import_common7.Module)({})
+DurableDashboardModule = _ts_decorate8([
+  (0, import_common8.Module)({})
 ], DurableDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {