@dudousxd/nestjs-durable-dashboard 0.37.0 → 0.37.1

package/dist/server/index.d.cts

@@ -18,9 +18,11 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` per
- * session, so a DB round-trip here is cheap. Return `false` to revoke (the cookie is cleared and
- * the request denied). Distinct from `session`: that hook reads the host's auth off a fresh
- * request, which a console XHR does not carry — this one receives the already-minted session.
+ * session, so a DB round-trip here is cheap — this holds even under concurrent traffic: N parallel
+ * requests carrying the same past-half-life cookie share ONE call (see `revalidateOnce` in
+ * `session-cookie-io.ts`), not N. Return `false` to revoke (the cookie is cleared and the request
+ * denied). Distinct from `session`: that hook reads the host's auth off a fresh request, which a
+ * console XHR does not carry — this one receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
 type AuthMode = 'session' | 'login';
@@ -418,6 +420,13 @@ declare class DurableApiSessionGuard implements CanActivate {
     private readonly auth;
     constructor(auth: ResolvedDashboardAuth | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+     * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+     * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+     * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+     */
+    private unauthorized;
 }
 
 /** DI token carrying the UI mount base (e.g. `/durable`). */

package/dist/server/index.d.ts

@@ -18,9 +18,11 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` per
- * session, so a DB round-trip here is cheap. Return `false` to revoke (the cookie is cleared and
- * the request denied). Distinct from `session`: that hook reads the host's auth off a fresh
- * request, which a console XHR does not carry — this one receives the already-minted session.
+ * session, so a DB round-trip here is cheap — this holds even under concurrent traffic: N parallel
+ * requests carrying the same past-half-life cookie share ONE call (see `revalidateOnce` in
+ * `session-cookie-io.ts`), not N. Return `false` to revoke (the cookie is cleared and the request
+ * denied). Distinct from `session`: that hook reads the host's auth off a fresh request, which a
+ * console XHR does not carry — this one receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
 type AuthMode = 'session' | 'login';
@@ -418,6 +420,13 @@ declare class DurableApiSessionGuard implements CanActivate {
     private readonly auth;
     constructor(auth: ResolvedDashboardAuth | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+     * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+     * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+     * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+     */
+    private unauthorized;
 }
 
 /** DI token carrying the UI mount base (e.g. `/durable`). */

package/dist/server/index.js

@@ -1014,6 +1014,20 @@ function readSessionFromRequest(auth, request) {
   });
 }
 __name(readSessionFromRequest, "readSessionFromRequest");
+var inFlightRevalidations = /* @__PURE__ */ new Map();
+function revalidateOnce(auth, user) {
+  const revalidate = auth.revalidate;
+  if (!revalidate) return Promise.resolve(true);
+  const key = `${auth.secret}:${user.id}`;
+  const inFlight = inFlightRevalidations.get(key);
+  if (inFlight) return inFlight;
+  const call = Promise.resolve().then(() => revalidate(user)).catch(() => false).finally(() => {
+    inFlightRevalidations.delete(key);
+  });
+  inFlightRevalidations.set(key, call);
+  return call;
+}
+__name(revalidateOnce, "revalidateOnce");
 async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
   if (now - session.iat <= auth.ttlMs / 2) return true;
   const user = {
@@ -1023,20 +1037,13 @@ async function maybeRenewSession(auth, session, request, response, now = Date.no
     } : {},
     roles: session.roles
   };
-  if (auth.revalidate) {
-    let allowed;
-    try {
-      allowed = await auth.revalidate(user);
-    } catch {
-      allowed = false;
-    }
-    if (!allowed) {
-      clearSessionCookie({
-        request,
-        response
-      });
-      return false;
-    }
+  const allowed = await revalidateOnce(auth, user);
+  if (!allowed) {
+    clearSessionCookie({
+      request,
+      response
+    });
+    return false;
   }
   issueSessionCookie(user, {
     auth,
@@ -1260,7 +1267,7 @@ var DurableAuthController = class _DurableAuthController {
   // the developer-controlled `basePath`.
   loginPage() {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException3();
+    if (!auth.modes.includes("login")) throw new NotFoundException3();
     return renderLoginPage(this.basePath);
   }
   // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
@@ -1269,7 +1276,7 @@ var DurableAuthController = class _DurableAuthController {
   // (unknown user, wrong password, throwing hook) — no user-enumeration.
   async login(body, request, response) {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException3();
+    if (!auth.modes.includes("login")) throw new NotFoundException3();
     if (!isString(body?.username) || !isString(body?.password)) {
       throw new BadRequestException("Body must include string `username` and `password`.");
     }
@@ -1292,7 +1299,7 @@ var DurableAuthController = class _DurableAuthController {
   // guard decides, and no credential ever reaches this library.
   async session(request, response) {
     const auth = this.requireAuth();
-    if (!auth.session) throw new NotFoundException3();
+    if (!auth.modes.includes("session")) throw new NotFoundException3();
     const user = await this.runHook("session", () => auth.session?.(request) ?? null);
     if (!user) throw new UnauthorizedException();
     issueSessionCookie(user, {
@@ -1310,7 +1317,7 @@ var DurableAuthController = class _DurableAuthController {
       request,
       response
     });
-    redirectRaw(response, this.auth?.login ? `${this.basePath}/login` : this.basePath);
+    redirectRaw(response, this.auth?.modes.includes("login") ? `${this.basePath}/login` : this.basePath);
   }
   requireAuth() {
     if (!this.auth) throw new NotFoundException3();
@@ -1453,7 +1460,7 @@ var DurableUiSessionGuard = class {
   * asserting away) the nullability.
   */
   denyUnauthenticated(auth, request) {
-    if (!auth.login) throw new DashboardSessionRequiredException(this.basePath);
+    if (!auth.modes.includes("login")) throw new DashboardSessionRequiredException(this.basePath);
     const returnTo = encodeURIComponent(originalRequestUrl(request));
     throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
   }
@@ -1478,15 +1485,29 @@ var DurableApiSessionGuard = class {
   }
   async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
-    const session = readSessionFromRequest(this.auth, request);
-    if (!session) throw new UnauthorizedException2();
-    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
-      throw new UnauthorizedException2();
+    const session = readSessionFromRequest(auth, request);
+    if (!session) throw this.unauthorized(auth);
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      throw this.unauthorized(auth);
     }
     return true;
   }
+  /**
+  * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+  * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+  * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+  * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+  */
+  unauthorized(auth) {
+    return new UnauthorizedException2({
+      auth: {
+        modes: auth.modes
+      }
+    });
+  }
 };
 DurableApiSessionGuard = _ts_decorate7([
   Injectable2(),