@entropy-softworks/ui 2026.8.34 → 2026.8.36

package/src/services/auth.service.ts

@@ -273,18 +273,54 @@ class AuthService {
     }
   }
 
+  /**
+   * The signed-in user, from local state if it is there and from the server if
+   * it is not.
+   *
+   * The server fallback is the whole point. On web `loadPersistedUser` returns
+   * a module-level variable, which is null in every freshly loaded document —
+   * so this used to answer "nobody" on each page load and refresh while the
+   * session cookie was perfectly valid. `useAuth.checkAuth` reads that as a
+   * session it cannot resolve and calls `logout()`, which POSTs
+   * `/auth/logout` and destroys the session server-side. The user is signed
+   * out by the act of loading the page.
+   *
+   * Observed on Access on 2026-08-22: the portal and the admin console are
+   * separate SPAs on one origin, so every navigation between them is a fresh
+   * document and therefore a guaranteed logout — which presents as an infinite
+   * sign-in loop. Its audit log recorded the logouts nobody asked for.
+   *
+   * Native was affected too, if less visibly: `isAuthenticated` there is
+   * satisfied by a token in SecureStore, so a token that outlived its cached
+   * user record produced the same spurious logout.
+   *
+   * It does NOT route through `isAuthenticated`. That method's web branch falls
+   * back to calling this one, so going the other way would recurse until the
+   * stack gave out on exactly the signed-out path this is meant to make cheap.
+   */
   static async getCurrentUser(): Promise<User | null> {
-    return loadPersistedUser();
+    const persisted = await loadPersistedUser();
+    if (persisted) {
+      return persisted;
+    }
+    return AuthService.fetchMe(false);
   }
 
-  static async refreshUserData(): Promise<User | null> {
+  /**
+   * `GET /auth/me`, persisting whatever comes back.
+   *
+   * `logoutOn401` is a parameter rather than a fixed behaviour because the two
+   * callers need opposite things from the same request. A *refresh* of a
+   * session believed live that returns 401 means the session died and local
+   * state should be cleared. A *lookup* that returns 401 means there was no
+   * session to begin with — the ordinary state of a signed-out visitor — and
+   * tearing down on that would fire a logout on every anonymous page load.
+   */
+  private static async fetchMe(logoutOn401: boolean): Promise<User | null> {
     try {
-      if (!(await this.isAuthenticated())) {
-        return null;
-      }
       const response = await apiFetch("/auth/me", { method: "GET" });
       if (!response.ok) {
-        if (response.status === 401) {
+        if (logoutOn401 && response.status === 401) {
           await this.logout();
         }
         return null;
@@ -297,6 +333,13 @@ class AuthService {
     }
   }
 
+  static async refreshUserData(): Promise<User | null> {
+    if (!(await this.isAuthenticated())) {
+      return null;
+    }
+    return AuthService.fetchMe(true);
+  }
+
   /**
    * Web: HttpOnly cookies aren't readable from JS. We use the
    * presence of the (non-HttpOnly) `csrf_token` cookie — set by the
@@ -339,7 +382,14 @@ class AuthService {
   static async changePassword(
     currentPassword: string,
     newPassword: string,
-    reWrappedKey?: { symmetric_key_enc: string; pbkdf2_salt: string }
+    reWrappedKey?: {
+      symmetric_key_enc: string;
+      kdf: string;
+      kdf_salt: string;
+      kdf_iterations: number;
+      kdf_memory_kib?: number;
+      kdf_lanes?: number;
+    }
   ): Promise<void> {
     const body: Record<string, unknown> = {
       current_password: currentPassword.normalize("NFC"),
@@ -347,7 +397,11 @@ class AuthService {
     };
     if (reWrappedKey) {
       body.symmetric_key_enc = reWrappedKey.symmetric_key_enc;
-      body.pbkdf2_salt = reWrappedKey.pbkdf2_salt;
+      body.kdf = reWrappedKey.kdf;
+      body.kdf_salt = reWrappedKey.kdf_salt;
+      body.kdf_iterations = reWrappedKey.kdf_iterations;
+      body.kdf_memory_kib = reWrappedKey.kdf_memory_kib;
+      body.kdf_lanes = reWrappedKey.kdf_lanes;
     }
     const response = await apiFetch("/auth/password", {
       method: "PUT",