@dudousxd/nestjs-media-dashboard 0.8.0 → 0.10.0

package/dist/server/index.cjs

@@ -66,6 +66,9 @@ function resolveConsoleAuth(options) {
   if (modes.length === 0) {
     throw new Error("MediaDashboardModule: auth needs a `login` and/or `session` hook.");
   }
+  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
+    throw new Error("MediaDashboardModule: auth.unauthenticatedPage must be a function.");
+  }
   return {
     secret: options.secret,
     ttlMs: durationToMs(options.ttl),
@@ -75,6 +78,12 @@ function resolveConsoleAuth(options) {
     } : {},
     ...options.login ? {
       login: options.login
+    } : {},
+    ...options.revalidate ? {
+      revalidate: options.revalidate
+    } : {},
+    ...options.unauthenticatedPage ? {
+      unauthenticatedPage: options.unauthenticatedPage
     } : {}
   };
 }
@@ -221,6 +230,26 @@ function appendSetCookie(response, cookie) {
   ]);
 }
 __name(appendSetCookie, "appendSetCookie");
+function resolveEndableResponse(response) {
+  const isEndable = /* @__PURE__ */ __name((value) => isRawNodeResponse(value) && typeof value.end === "function", "isEndable");
+  if (isEndable(response)) return response;
+  if (isRecord2(response) && isEndable(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveEndableResponse, "resolveEndableResponse");
+function responseAlreadyWritten(response) {
+  return resolveEndableResponse(response)?.headersSent === true;
+}
+__name(responseAlreadyWritten, "responseAlreadyWritten");
+function sendHtml(response, status, html) {
+  const raw = resolveEndableResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("content-type", "text/html; charset=utf-8");
+  raw.setHeader("cache-control", "no-store, must-revalidate");
+  raw.end(html);
+}
+__name(sendHtml, "sendHtml");
 
 // src/server/auth/session-cookie.ts
 var import_node_crypto = require("crypto");
@@ -349,14 +378,16 @@ var MediaConsoleGuard = class {
     this.auth = auth;
     this.cookiePath = cookiePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = this.verifyRequestSession(request);
     if (!session) throw new import_common.UnauthorizedException();
     attachSession(request, session);
-    this.maybeRenew(http.getResponse(), request, session);
+    if (!await this.maybeRenew(http.getResponse(), request, session)) {
+      throw new import_common.UnauthorizedException();
+    }
     return true;
   }
   verifyRequestSession(request) {
@@ -368,26 +399,46 @@ var MediaConsoleGuard = class {
     });
   }
   /**
-  * Sliding renewal: when a valid cookie is past half its TTL, re-issue a fresh one so active users
-  * never get logged out mid-session. Appends a new Set-Cookie (preserving any others already set).
+  * Sliding renewal + revalidation: when a valid cookie is past half its TTL, re-issue a fresh one
+  * so active users never get logged out mid-session — but first let the host's `revalidate` hook
+  * re-check the user, so a deactivated or demoted operator loses access instead of riding a
+  * self-renewing cookie. Returns `false` when the session was revoked (cookie already cleared).
   */
-  maybeRenew(response, request, session) {
-    if (!this.auth) return;
+  async maybeRenew(response, request, session) {
+    if (!this.auth) return true;
     const now = Date.now();
-    if (now - session.iat <= this.auth.ttlMs / 2) return;
-    issueSessionCookie({
+    if (now - session.iat <= this.auth.ttlMs / 2) return true;
+    const user = {
       id: session.sub,
       ...session.name !== void 0 ? {
         name: session.name
       } : {},
       roles: session.roles
-    }, {
+    };
+    if (this.auth.revalidate) {
+      let allowed;
+      try {
+        allowed = await this.auth.revalidate(user);
+      } catch {
+        allowed = false;
+      }
+      if (!allowed) {
+        clearSessionCookie({
+          cookiePath: this.cookiePath ?? "/",
+          request,
+          response
+        });
+        return false;
+      }
+    }
+    issueSessionCookie(user, {
       auth: this.auth,
       cookiePath: this.cookiePath ?? "/",
       request,
       response,
       now
     });
+    return true;
   }
 };
 MediaConsoleGuard = _ts_decorate([
@@ -1458,8 +1509,14 @@ var MediaConsoleApiModule = class _MediaConsoleApiModule {
         // none — it's used as-is.
         ...(options.guards ?? []).filter(isGuardClass)
       ],
+      // MEDIA_CONSOLE_AUTH is exported (not just provided) because MediaDashboardUiController —
+      // hosted in MediaDashboardModule, which imports THIS module — reads it to decide whether to
+      // hand an unauthenticated navigation to the host's `unauthenticatedPage`. Exporting keeps the
+      // single `authProvider` instance shared; re-providing the same factory in both modules would
+      // run a `forRootAsync` host's `useAuth` twice.
       exports: [
-        MediaConsoleService
+        MediaConsoleService,
+        MEDIA_CONSOLE_AUTH
       ]
     };
   }
@@ -1504,27 +1561,77 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2",
   ".ico": "image/x-icon"
 };
-var MediaDashboardUiController = class {
+var MediaDashboardUiController = class _MediaDashboardUiController {
   static {
     __name(this, "MediaDashboardUiController");
   }
   basePath;
   apiBasePath;
+  auth;
   dir = spaDir();
-  constructor(basePath, apiBasePath) {
+  logger = new import_common7.Logger(_MediaDashboardUiController.name);
+  warned = false;
+  constructor(basePath, apiBasePath, auth = null) {
     this.basePath = basePath;
     this.apiBasePath = apiBasePath;
+    this.auth = auth;
   }
   // index.html references hash-named bundles, so it MUST NOT be cached (stale bundle = "stuck
-  // loading after a deploy"). The hashed assets below are immutable.
-  index() {
+  // loading after a deploy"). The hashed assets below are immutable. `sendHtml` sets both headers;
+  // they are no longer `@Header` decorators because this route is now non-passthrough (see below).
+  //
+  // Non-passthrough `@Res()` so a host's `auth.unauthenticatedPage` can OWN the response and serve
+  // its own page in place of the SPA. Without a hook this behaves exactly as before: the shell is
+  // served to everyone, and the SPA's own auth screen renders once its API calls come back 401.
+  async index(req, res) {
+    if (await this.serveUnauthenticatedPage(req, res)) return;
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
       throw new import_common7.NotFoundException("Console SPA is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__MEDIA_BASE__='${this.basePath}';window.__MEDIA_API__='${this.apiBasePath}';</script>`;
-    return html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html;
+    sendHtml(res, 200, html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html);
+  }
+  /**
+  * Hand the response to the host's `unauthenticatedPage` when this navigation has no valid session.
+  * Returns `true` when the host wrote a page (the caller must not also serve the SPA).
+  *
+  * Mode-A-only, deliberately: with `login` configured the SPA's own login form is the way in, so
+  * replacing the shell would lock a Mode B host out of its own console.
+  */
+  async serveUnauthenticatedPage(req, res) {
+    const auth = this.auth;
+    const hook = auth?.unauthenticatedPage;
+    if (!auth || !hook) return false;
+    if (auth.modes.includes("login")) return false;
+    if (this.hasValidSession(auth, req)) return false;
+    try {
+      await hook({
+        request: req,
+        response: res,
+        basePath: this.basePath
+      });
+      if (responseAlreadyWritten(res)) return true;
+      this.warnOnce("auth.unauthenticatedPage returned without writing a response; serving the console SPA instead. The hook must write AND end the response it is given.");
+    } catch (error) {
+      this.warnOnce(`auth.unauthenticatedPage threw; serving the console SPA instead. ${String(error)}`);
+      if (responseAlreadyWritten(res)) return true;
+    }
+    return false;
+  }
+  hasValidSession(auth, req) {
+    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return false;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    }) !== null;
+  }
+  /** Once per process, not once per request: a broken hook fires on every unauthenticated visit. */
+  warnOnce(message) {
+    if (this.warned) return;
+    this.warned = true;
+    this.logger.warn(message);
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
@@ -1542,11 +1649,14 @@ var MediaDashboardUiController = class {
 };
 _ts_decorate7([
   (0, import_common7.Get)(),
-  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common7.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param6(0, (0, import_common7.Req)()),
+  _ts_param6(1, (0, import_common7.Res)()),
   _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", String)
+  _ts_metadata6("design:paramtypes", [
+    Object,
+    Object
+  ]),
+  _ts_metadata6("design:returntype", Promise)
 ], MediaDashboardUiController.prototype, "index", null);
 _ts_decorate7([
   (0, import_common7.Get)("assets/:file"),
@@ -1562,10 +1672,13 @@ MediaDashboardUiController = _ts_decorate7([
   (0, import_common7.Controller)(),
   _ts_param6(0, (0, import_common7.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
   _ts_param6(1, (0, import_common7.Inject)(MEDIA_DASHBOARD_API_PATH)),
+  _ts_param6(2, (0, import_common7.Optional)()),
+  _ts_param6(2, (0, import_common7.Inject)(MEDIA_CONSOLE_AUTH)),
   _ts_metadata6("design:type", Function),
   _ts_metadata6("design:paramtypes", [
     String,
-    String
+    String,
+    Object
   ])
 ], MediaDashboardUiController);