@ethlete/query 6.0.0-next.42 → 6.0.0-next.43

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @ethlete/query
 
+## 6.0.0-next.43
+
+### Patch Changes
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`48488fb`](https://github.com/ethlete-io/ethdk/commit/48488fbdc0d61bafe5e8117844e5efa2c31c330a) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: a rejected cookie auto-login now ends the session through `onRefreshFailure` with `sessionEndCause()` `'expired'`, and `setTokens()` supersedes an auto-login still in flight so its late `401` no longer overwrites the seeded session.
+
+- [`a533863`](https://github.com/ethlete-io/ethdk/commit/a533863ce73cbb9e3454b6016be39487aa965c7a) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: a session that ends as expired is dropped from the auth vault, so a tab seeded with it no longer meets the same dead token on every reload.
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`1d38e7e`](https://github.com/ethlete-io/ethdk/commit/1d38e7e0a025769f065d8ca7d506cb75ad89139a) Thanks [@github-actions](https://github.com/apps/github-actions)! - `et update` moves the `@ethlete/*` packages to a newer version, runs the codemods those versions
+  declare in their own `migrations.json`, and reports what needs a decision or an agent.
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`f9fbd3a`](https://github.com/ethlete-io/ethdk/commit/f9fbd3a6959a99af7c6de60d7ceaf2781e8a58d2) Thanks [@github-actions](https://github.com/apps/github-actions)! - Re-export types explicitly with `export type` so the barrels type-check under `isolatedModules`.
+
 ## 6.0.0-next.42
 
 ### Minor Changes

package/fesm2022/ethlete-query.mjs

@@ -5279,6 +5279,10 @@ const createBearerAuthProviderImpl = (config) => {
     // executionState (e.g. `{ type: 'login', state: 'success' }`) via setupBearerQueryRegistry's
     // execute(), so that internal path calls applyTokens directly to avoid stomping it with this.
     const setTokens = (access, refresh) => {
+        // A seed supersedes what is in flight, the way a logout does: the tokens are here, so a cookie
+        // auto-login or a refresh still out with an older token can only report a failure that no longer
+        // means anything - or apply the pair it comes back with over this one.
+        invalidateTokenIssuingExecutions();
         applyTokens(access, refresh);
         executionState.set({ type: 'tokenSeed', state: 'success' });
     };
@@ -5339,6 +5343,7 @@ const createBearerAuthProviderImpl = (config) => {
         logout,
         afterTokenRefresh$,
         queries: queries,
+        latestExecutedQuery: latestExecutedQuery.asReadonly(),
         executionState: executionState.asReadonly(),
         hasTokenIssuingExecutionInFlight,
     };
@@ -5804,7 +5809,18 @@ const withRefreshQuery = (key, config) => {
             });
         effect(() => {
             const state = context.executionState();
-            if (state?.type !== 'tokenRefresh' || state.state !== 'error')
+            if (state?.state !== 'error')
+                return;
+            // `withPersistentAuth` spends the cookie's refresh token through this very query, and that
+            // execution reports as `autoLogin` rather than as `tokenRefresh`. Judged by its type alone it
+            // would end nothing: the tab keeps a rejected cookie's error state for good, `sessionEndCause`
+            // never says `expired`, and an app gated on either never leaves its startup screen. The token
+            // check keeps a session another tab handed over mid-request out of it - that session is not
+            // this restore's to end.
+            const isRejectedRestore = state.type === 'autoLogin' &&
+                untracked(context.latestExecutedQuery)?.key === key &&
+                !untracked(context.accessToken);
+            if (state.type !== 'tokenRefresh' && !isRejectedRestore)
                 return;
             onRefreshFailure({ error: state.error, logout: () => context.logout('expired') });
         });
@@ -8099,9 +8115,12 @@ const trackQueryDevtoolsAuthProvider = (registration) => {
     const stop = effect(() => {
         const accessToken = handle.accessToken();
         const refreshToken = handle.refreshToken();
+        const endCause = handle.sessionEndCause();
         untracked(() => {
             if (accessToken && refreshToken)
                 remember({ provider: name, accessToken, refreshToken });
+            else if (endCause === 'expired')
+                forgetExpired(name);
             else
                 forgetActive(name);
         });
@@ -8212,6 +8231,26 @@ const forgetActive = (provider) => {
     persist();
     syncPill();
 };
+/**
+ * Drops the session a provider was on because it expired, tokens and all - unlike every other way a
+ * session ends, this pair is spent. Keeping it offers a switch back that can only fail, and a tab-local
+ * seed would re-apply it on every reload, so the tab meets the same dead token until someone clears the
+ * storage by hand.
+ */
+const forgetExpired = (provider) => {
+    const sessionId = active()[provider] ?? null;
+    const { [provider]: _dropped, ...seeds } = readSeeds();
+    writeSeeds(seeds);
+    if (!sessionId)
+        return;
+    store.update((current) => ({
+        ...current,
+        sessions: current.sessions.filter((session) => session.id !== sessionId),
+    }));
+    setActive(provider, null);
+    persist();
+    syncPill();
+};
 /** The sessions offered for one provider, which are the ones this backend issued. */
 const queryDevtoolsAuthSessionsFor = (provider) => {
     const scope = scopeOf();
@@ -9582,7 +9621,7 @@ const armQueryDevtoolsOverrideTransfer = (recorder, ops) => {
 
 // Generated from package.json by tools/scripts/generate-version.js - do not edit.
 /** The version of `@ethlete/query` this build was cut from. */
-const QUERY_VERSION = '6.0.0-next.42';
+const QUERY_VERSION = '6.0.0-next.43';
 
 /** How deep a schema is expanded before a nested branch is given up on. */
 const MAX_DEPTH = 12;