@efa-one/sdk 1.16.1 → 1.18.0

package/README.md

@@ -61,6 +61,24 @@ import { initI18n, registerAppInfo, DevHeader } from '@efa-one/sdk/frontend';
 registerAppInfo({ appName: 'efa-chat', version: __APP_VERSION__ });
 ```
 
+```tsx
+// Frontend — receive the login token from the kernel (inside a mount effect)
+import { subscribeConvergeAuth } from '@efa-one/sdk/frontend';
+
+useEffect(() => subscribeConvergeAuth({
+  onAuth: async ({ token, serviceKey, theme, language }) => {
+    try { await exchange(token, serviceKey); return true; } catch { return false; }
+  },
+  onTimeout: () => setError('No login received from the platform — reload the page.'),
+}), []);
+```
+
+The app asks for the token itself (`CONVERGE_AUTH_REQUEST`) as soon as its listener
+is attached and repeats the request with backoff. Waiting passively for the kernel's
+push is not enough: the push goes out in a fixed window after the tile opens, and an
+app that needs longer to mount (cold cache, slow connection) would miss it and spin
+forever.
+
 ```tsx
 // Frontend — a fully-featured list in a few lines
 import { DataTable, type ColumnDef } from '@efa-one/sdk/frontend/ui';
@@ -144,6 +162,19 @@ run under it. Dependabot is configured to never propose a TypeScript major.
 
 SemVer. Consuming apps pull new versions with `npm update @efa-one/sdk`.
 
+**Kernel compatibility — 1.17.0 needs an up-to-date kernel.** Since 1.17.0 the
+`app_session` cookie is bound to the kernel session and `requireAuth` checks it
+live via the kernel endpoint `GET /api/internal/sessions/:jti/status`. Against a
+kernel without that endpoint, every authenticated request fails closed with
+`503 Session service unavailable`. Roll out the kernel first, then apps on 1.17.
+Sessions issued by an older SDK are rejected once (401) and renewed on the next
+iframe load.
+
+**1.18.0 — auth handshake on request.** `subscribeConvergeAuth` sends
+`CONVERGE_AUTH_REQUEST` to the kernel. It works against any kernel: an older kernel
+ignores the request and its fixed-window push reaches the app as before; a current
+kernel answers the request directly. No rollout order.
+
 ## License
 
 [Apache-2.0](./LICENSE) — permissive with a patent grant, so customers and partners

package/backend/auth.d.ts

@@ -9,6 +9,7 @@ export interface JwtPayload {
     iat: number;
     exp: number;
     forcePasswordChange?: boolean;
+    jti?: string;
 }
 export interface SessionPayload {
     sub: string;
@@ -17,6 +18,8 @@ export interface SessionPayload {
     email: string | null;
     language?: string;
     tenant: string;
+    kernelJti?: string;
+    kernelIat?: number;
 }
 export interface AuthRequest extends Request {
     user?: SessionPayload;

package/backend/auth.js

@@ -14,8 +14,11 @@ exports.createExchangeRouter = createExchangeRouter;
 const express_1 = require("express");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const permissionClient_1 = require("./permissionClient");
+const sessionStatusClient_1 = require("./sessionStatusClient");
 const JWT_ISSUER = 'converge';
 const JWT_AUDIENCE = 'converge';
+const KERNEL_JTI_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+const KERNEL_SUB_RE = /^[A-Za-z0-9._:@-]{1,128}$/;
 function getPlatformPublicKey() {
     const s = process.env.JWT_PUBLIC_KEY;
     if (!s)
@@ -31,14 +34,14 @@ function getSessionSecret() {
 function getCookieName() {
     return process.env.APP_SESSION_COOKIE_NAME || 'app_session';
 }
-function setSessionCookie(res, token) {
+function setSessionCookie(res, token, maxAgeMs) {
     const secure = process.env.COOKIE_SECURE
         ? ['1', 'true', 'yes', 'on'].includes(process.env.COOKIE_SECURE.toLowerCase())
         : process.env.NODE_ENV === 'production';
     res.cookie(getCookieName(), token, {
         httpOnly: true,
         sameSite: 'lax',
-        maxAge: 8 * 60 * 60 * 1000,
+        maxAge: maxAgeMs,
         secure,
         path: '/',
     });
@@ -49,14 +52,36 @@ function requireAuth(req, res, next) {
         res.status(401).json({ error: 'Not authenticated' });
         return;
     }
+    let payload;
     try {
-        const payload = jsonwebtoken_1.default.verify(token, getSessionSecret(), { algorithms: ['HS256'] });
-        req.user = payload;
-        next();
+        payload = jsonwebtoken_1.default.verify(token, getSessionSecret(), { algorithms: ['HS256'] });
     }
     catch {
         res.status(401).json({ error: 'Session invalid or expired' });
+        return;
+    }
+    const { kernelJti, kernelIat, exp } = payload;
+    if (typeof kernelJti !== 'string' || !kernelJti || typeof kernelIat !== 'number' || typeof exp !== 'number') {
+        res.status(401).json({ error: 'Session invalid or expired' });
+        return;
     }
+    const verified = payload;
+    (0, sessionStatusClient_1.getSessionStatus)({
+        convergeId: verified.convergeId,
+        jti: kernelJti,
+        iat: kernelIat,
+        exp,
+    }).then((status) => {
+        if (!status.active) {
+            res.status(401).json({ error: 'Session revoked' });
+            return;
+        }
+        req.user = verified;
+        next();
+    }, (err) => {
+        console.error(JSON.stringify({ level: 'error', msg: 'requireAuth: session status lookup failed', err: String(err) }));
+        res.status(503).json({ error: 'Session service unavailable' });
+    });
 }
 function requireAdmin(req, res, next) {
     requireAuth(req, res, () => {
@@ -177,6 +202,17 @@ function createExchangeRouter(pool) {
             res.status(401).json({ error: 'Invalid or expired platform token' });
             return;
         }
+        if (typeof convergePayload.jti !== 'string' || !KERNEL_JTI_RE.test(convergePayload.jti) ||
+            typeof convergePayload.sub !== 'string' || !KERNEL_SUB_RE.test(convergePayload.sub) ||
+            !Number.isInteger(convergePayload.iat) || !Number.isInteger(convergePayload.exp)) {
+            res.status(401).json({ error: 'Invalid or expired platform token' });
+            return;
+        }
+        const remainingSec = convergePayload.exp - Math.floor(Date.now() / 1000);
+        if (remainingSec <= 0) {
+            res.status(401).json({ error: 'Invalid or expired platform token' });
+            return;
+        }
         try {
             const { rows } = await pool.query(`INSERT INTO app_users (converge_id, email, name, last_seen_at)
          VALUES ($1, $2, $3, NOW())
@@ -197,9 +233,11 @@ function createExchangeRouter(pool) {
                 email: convergePayload.email ?? null,
                 language: convergePayload.language,
                 tenant: convergePayload.tenant,
+                kernelJti: convergePayload.jti,
+                kernelIat: convergePayload.iat,
             };
-            const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: '8h' });
-            setSessionCookie(res, sessionToken);
+            const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: remainingSec });
+            setSessionCookie(res, sessionToken, remainingSec * 1000);
             res.json({
                 user: {
                     id: appUser.id,

package/backend/index.d.ts

@@ -6,6 +6,7 @@ export * from './mail';
 export * from './notifications';
 export * from './permissions';
 export * from './permissionClient';
+export * from './sessionStatusClient';
 export * from './permissionCheck';
 export * from './customPermissions';
 export * from './serviceClient';

package/backend/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./mail"), exports);
 __exportStar(require("./notifications"), exports);
 __exportStar(require("./permissions"), exports);
 __exportStar(require("./permissionClient"), exports);
+__exportStar(require("./sessionStatusClient"), exports);
 __exportStar(require("./permissionCheck"), exports);
 __exportStar(require("./customPermissions"), exports);
 __exportStar(require("./serviceClient"), exports);

package/backend/sessionStatusClient.d.ts

@@ -0,0 +1,14 @@
+export type SessionInactiveReason = 'server_restarted' | 'session_revoked';
+export interface SessionStatus {
+    active: boolean;
+    reason?: SessionInactiveReason;
+}
+export interface SessionRef {
+    convergeId: string;
+    jti: string;
+    iat: number;
+    exp: number;
+}
+export declare function getSessionStatus(ref: SessionRef): Promise<SessionStatus>;
+export declare function clearSessionStatusCache(): void;
+export declare function sessionStatusCacheSize(): number;

package/frontend/ipc.d.ts

@@ -24,3 +24,22 @@ export declare function navigateToApp(serviceKey: string, options?: {
     path?: string;
 }): void;
 export declare function notifyRouteChange(path: string): void;
+export declare const CONVERGE_AUTH = "CONVERGE_AUTH";
+export declare const CONVERGE_AUTH_REQUEST = "CONVERGE_AUTH_REQUEST";
+export interface ConvergeAuthMessage<TTheme = unknown> {
+    type: typeof CONVERGE_AUTH;
+    token: string;
+    serviceKey?: string;
+    language?: string;
+    theme?: TTheme;
+    embed?: boolean;
+}
+export interface SubscribeConvergeAuthOptions<TTheme = unknown> {
+    onAuth: (message: ConvergeAuthMessage<TTheme>) => Promise<boolean>;
+    onTimeout?: () => void;
+    requestDelaysMs?: readonly number[];
+    timeoutMs?: number;
+}
+export declare const DEFAULT_AUTH_REQUEST_DELAYS_MS: readonly number[];
+export declare const DEFAULT_AUTH_TIMEOUT_MS = 15000;
+export declare function subscribeConvergeAuth<TTheme = unknown>(options: SubscribeConvergeAuthOptions<TTheme>): () => void;

package/frontend/ipc.js

@@ -59,3 +59,82 @@ export function notifyRouteChange(path) {
         return;
     window.parent.postMessage({ type: 'CONVERGE_ROUTE_CHANGED', path }, getParentOrigin());
 }
+export const CONVERGE_AUTH = 'CONVERGE_AUTH';
+export const CONVERGE_AUTH_REQUEST = 'CONVERGE_AUTH_REQUEST';
+export const DEFAULT_AUTH_REQUEST_DELAYS_MS = [0, 500, 1000, 2000, 4000, 8000];
+export const DEFAULT_AUTH_TIMEOUT_MS = 15000;
+function isAuthMessage(data) {
+    const d = data;
+    return !!d && d.type === CONVERGE_AUTH && typeof d.token === 'string' && d.token !== '';
+}
+export function subscribeConvergeAuth(options) {
+    if (!isEmbedded())
+        return () => { };
+    const delays = options.requestDelaysMs ?? DEFAULT_AUTH_REQUEST_DELAYS_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+    let active = true;
+    let received = false;
+    let authenticated = false;
+    let inFlight = false;
+    let queued = null;
+    const timers = [];
+    const clearTimers = () => {
+        timers.forEach((t) => clearTimeout(t));
+        timers.length = 0;
+    };
+    const start = (message) => {
+        inFlight = true;
+        options.onAuth(message).then((ok) => finish(ok), () => finish(false));
+    };
+    const finish = (ok) => {
+        inFlight = false;
+        if (!active)
+            return;
+        if (ok) {
+            authenticated = true;
+            queued = null;
+            clearTimers();
+            return;
+        }
+        const next = queued;
+        queued = null;
+        if (next)
+            start(next);
+    };
+    const handler = (event) => {
+        if (!isFromPlatformParent(event))
+            return;
+        if (!isAuthMessage(event.data))
+            return;
+        received = true;
+        if (authenticated)
+            return;
+        const message = event.data;
+        if (inFlight) {
+            queued = message;
+            return;
+        }
+        start(message);
+    };
+    const request = () => {
+        if (!active || received)
+            return;
+        window.parent.postMessage({ type: CONVERGE_AUTH_REQUEST }, getParentOrigin());
+    };
+    window.addEventListener('message', handler);
+    for (const ms of delays) {
+        if (ms <= 0)
+            request();
+        else
+            timers.push(setTimeout(request, ms));
+    }
+    timers.push(setTimeout(() => {
+        if (active && !received)
+            options.onTimeout?.();
+    }, timeoutMs));
+    return () => {
+        active = false;
+        clearTimers();
+        window.removeEventListener('message', handler);
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efa-one/sdk",
-  "version": "1.16.1",
+  "version": "1.18.0",
   "description": "Offizielles SDK für efa-one-Apps: Auth/Session, Service-Discovery, Gateway-Client, Audit/Reporting/Mail/Notifications, Permission- und Capability-Registrierung sowie das Frontend-IPC-/i18n-Toolkit.",
   "license": "Apache-2.0",
   "type": "commonjs",