@ethlete/query 6.0.0-next.42 → 6.0.0-next.44

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @ethlete/query
 
+## 6.0.0-next.44
+
+### Patch Changes
+
+- [#3077](https://github.com/ethlete-io/ethdk/pull/3077) [`8c2cb3a`](https://github.com/ethlete-io/ethdk/commit/8c2cb3a7b8a311363255d66b0f3c07fcfc4f6bdb) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: `onRefreshFailure` and the `logout()` it triggers now run outside the reactive context of the effect that detects the failure. A consumer reacting to the session ending could otherwise throw `NG0602` instead of handling the logout.
+
+- [`f7d6bb1`](https://github.com/ethlete-io/ethdk/commit/f7d6bb12a799b680ce72c90cbdcfd96ae3ea2fc0) Thanks [@TomTomB](https://github.com/TomTomB)! - A secure query now waits for the token refresh instead of sending an access token that is already expired, so a session seeded by SSO no longer costs a `401` and a retry.
+
+## 6.0.0-next.43
+
+### Patch Changes
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`48488fb`](https://github.com/ethlete-io/ethdk/commit/48488fbdc0d61bafe5e8117844e5efa2c31c330a) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: a rejected cookie auto-login now ends the session through `onRefreshFailure` with `sessionEndCause()` `'expired'`, and `setTokens()` supersedes an auto-login still in flight so its late `401` no longer overwrites the seeded session.
+
+- [`a533863`](https://github.com/ethlete-io/ethdk/commit/a533863ce73cbb9e3454b6016be39487aa965c7a) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: a session that ends as expired is dropped from the auth vault, so a tab seeded with it no longer meets the same dead token on every reload.
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`1d38e7e`](https://github.com/ethlete-io/ethdk/commit/1d38e7e0a025769f065d8ca7d506cb75ad89139a) Thanks [@github-actions](https://github.com/apps/github-actions)! - `et update` moves the `@ethlete/*` packages to a newer version, runs the codemods those versions
+  declare in their own `migrations.json`, and reports what needs a decision or an agent.
+
+- [#3075](https://github.com/ethlete-io/ethdk/pull/3075) [`f9fbd3a`](https://github.com/ethlete-io/ethdk/commit/f9fbd3a6959a99af7c6de60d7ceaf2781e8a58d2) Thanks [@github-actions](https://github.com/apps/github-actions)! - Re-export types explicitly with `export type` so the barrels type-check under `isolatedModules`.
+
 ## 6.0.0-next.42
 
 ### Minor Changes

package/fesm2022/ethlete-query.mjs

@@ -1,7 +1,7 @@
 import * as i0 from '@angular/core';
 import { inject, Injector, effect, DestroyRef, InjectionToken, EnvironmentInjector, ElementRef, ErrorHandler, createEnvironmentInjector, untracked, signal, linkedSignal, computed, runInInjectionContext, isDevMode, PLATFORM_ID, resource, DOCUMENT, VERSION, makeEnvironmentProviders, provideEnvironmentInitializer, ApplicationRef, assertInInjectionContext, ChangeDetectorRef, ViewContainerRef, TemplateRef, Input, Directive, input, Pipe, ViewEncapsulation, Component, NgZone } from '@angular/core';
 import { UrlTree, Router, RedirectCommand, ActivatedRoute } from '@angular/router';
-import { Observable, defer, from, filter, Subject, Subscription, throwError, of, timer, switchMap, tap, retry, catchError, EMPTY as EMPTY$1, take, takeUntil, finalize, mergeMap, toArray, map, merge, takeWhile, firstValueFrom, race, concatMap, fromEvent, throttleTime, interval, startWith, pairwise, BehaviorSubject, combineLatest, ReplaySubject, shareReplay, skip, withLatestFrom, debounceTime } from 'rxjs';
+import { Observable, defer, from, filter, Subject, Subscription, throwError, of, timer, switchMap, tap, retry, catchError, EMPTY as EMPTY$1, take, takeUntil, finalize, mergeMap, toArray, map, race, NEVER, merge, takeWhile, firstValueFrom, concatMap, fromEvent, throttleTime, interval, startWith, pairwise, BehaviorSubject, combineLatest, ReplaySubject, shareReplay, skip, withLatestFrom, debounceTime } from 'rxjs';
 import { defineStaticProvider, RuntimeError, clamp, randomId, defineRootProvider, isObject, injectUnsavedChangesCoordinator, injectRoute, getCookie, deleteCookie, setCookie, CORE_VERSION, createDestroy, computedTillTruthy, defineProvider, toProvideFn, toInjectFn, nextFrame, injectQueryParams, injectQueryParamChanges, clone, equal, ET_PROPERTY_REMOVED, previousSignalValue } from '@ethlete/core';
 import { HttpClient, HttpEventType, HttpErrorResponse, HttpResponse, HttpHeaders, HttpStatusCode } from '@angular/common/http';
 import { toObservable, takeUntilDestroyed, toSignal } from '@angular/core/rxjs-interop';
@@ -4389,6 +4389,12 @@ const createQueryClient = (options) => defineRootProvider(() => {
 });
 
 const AUTH_HEADER = 'Authorization';
+/**
+ * How long a request waits for the refresh of an expired access token before it sends the expired one
+ * anyway. Nothing guarantees the refresh arrives - the refresh token can be spent, and the request can
+ * fail or never come back - and a request that 401s and retries beats one that never goes out.
+ */
+const EXPIRED_TOKEN_WAIT_MS = 5000;
 const createSecureExecuteFactory = (options) => {
     const executeState = setupQueryExecuteState();
     const circularChecker = circularQueryDependencyChecker();
@@ -4479,16 +4485,25 @@ const createSecureExecuteFactory = (options) => {
     // Calling `authAndExec` purely because the auth query is "done" therefore races
     // the token and can run while it is still null. Gate on the token signal instead:
     // execute immediately if it is already available, otherwise wait for it.
+    //
+    // A token that is present but already expired is no better than a missing one: it can only earn a
+    // 401, and the refresh that answers that 401 is the one already in flight (a token seed hands over
+    // an expired access token, and the refresh query's schedule fires on it at once). Waiting for it
+    // spends one round trip instead of two.
     const authAndExecWhenTokenReady = (executeArgs) => {
-        if (options.authProvider.accessToken()) {
+        const tokenAtWait = options.authProvider.accessToken();
+        if (tokenAtWait && !options.authProvider.isAccessTokenExpired()) {
             authAndExec(executeArgs);
             return;
         }
+        // The query is on its way out, not idle - without this a consumer renders an empty state for as
+        // long as the wait lasts.
+        options.state.loading.set({ executeTime: Date.now(), progress: null });
         tokenWaitSubscription.unsubscribe();
-        tokenWaitSubscription = toObservable(options.authProvider.accessToken, {
+        tokenWaitSubscription = race(toObservable(options.authProvider.accessToken, {
             injector: options.deps.injector,
-        })
-            .pipe(filter(Boolean), take(1), tap(() => authAndExec(executeArgs)))
+        }).pipe(filter((token) => !!token && token !== tokenAtWait)), tokenAtWait ? timer(EXPIRED_TOKEN_WAIT_MS) : NEVER)
+            .pipe(take(1), tap(() => authAndExec(executeArgs)))
             .subscribe();
     };
     const exec = (executeArgs) => {
@@ -5279,6 +5294,10 @@ const createBearerAuthProviderImpl = (config) => {
     // executionState (e.g. `{ type: 'login', state: 'success' }`) via setupBearerQueryRegistry's
     // execute(), so that internal path calls applyTokens directly to avoid stomping it with this.
     const setTokens = (access, refresh) => {
+        // A seed supersedes what is in flight, the way a logout does: the tokens are here, so a cookie
+        // auto-login or a refresh still out with an older token can only report a failure that no longer
+        // means anything - or apply the pair it comes back with over this one.
+        invalidateTokenIssuingExecutions();
         applyTokens(access, refresh);
         executionState.set({ type: 'tokenSeed', state: 'success' });
     };
@@ -5327,6 +5346,7 @@ const createBearerAuthProviderImpl = (config) => {
         sessionEndCause: sessionEndCause.asReadonly(),
         isTabLocalSession: isTabLocalSession.asReadonly(),
     });
+    let readAccessTokenExpiry = null;
     const querySetupContext = {
         name: config.name,
         accessToken,
@@ -5339,8 +5359,12 @@ const createBearerAuthProviderImpl = (config) => {
         logout,
         afterTokenRefresh$,
         queries: queries,
+        latestExecutedQuery: latestExecutedQuery.asReadonly(),
         executionState: executionState.asReadonly(),
         hasTokenIssuingExecutionInFlight,
+        reportAccessTokenExpiry: (isExpired) => {
+            readAccessTokenExpiry = isExpired;
+        },
     };
     for (const builder of config.queries) {
         builder.setup?.(querySetupContext);
@@ -5391,6 +5415,7 @@ const createBearerAuthProviderImpl = (config) => {
         refreshToken: refreshToken.asReadonly(),
         bearerData,
         isAuthenticated,
+        isAccessTokenExpired: () => readAccessTokenExpiry?.() ?? false,
         latestExecutedQuery: latestExecutedQuery.asReadonly(),
         latestNonInternalQuery: latestNonInternalQuery.asReadonly(),
         executionState: executionState.asReadonly(),
@@ -5746,6 +5771,24 @@ const withRefreshQuery = (key, config) => {
             const remainingMs = msUntilAccessTokenIsStale();
             return remainingMs !== null && remainingMs <= 0;
         };
+        /**
+         * Whether the access token this tab holds is already past its expiry, so sending it can only earn
+         * a 401. Unlike {@link isAccessTokenStale} this has no grace period: a token with seconds of life
+         * left is still worth sending.
+         */
+        const isAccessTokenExpired = () => {
+            const token = context.accessToken();
+            if (!token)
+                return false;
+            const expiresAt = tokenExpiresAt(token);
+            return expiresAt !== null && expiresAt <= Date.now();
+        };
+        // Only reported when an expired token actually gets refreshed. With `refreshIfExpired: false` the
+        // application asked for the request to go out and fail, so a secure query must not wait for a
+        // refresh that never comes.
+        if (refreshIfExpired) {
+            context.reportAccessTokenExpiry(isAccessTokenExpired);
+        }
         /**
          * The scheduled refresh, re-armed for as long as it keeps declining to spend the refresh token.
          * Without the re-arm a single declined attempt strands the session on a token nothing renews until
@@ -5804,9 +5847,23 @@ const withRefreshQuery = (key, config) => {
             });
         effect(() => {
             const state = context.executionState();
-            if (state?.type !== 'tokenRefresh' || state.state !== 'error')
+            if (state?.state !== 'error')
                 return;
-            onRefreshFailure({ error: state.error, logout: () => context.logout('expired') });
+            // `withPersistentAuth` spends the cookie's refresh token through this very query, and that
+            // execution reports as `autoLogin` rather than as `tokenRefresh`. Judged by its type alone it
+            // would end nothing: the tab keeps a rejected cookie's error state for good, `sessionEndCause`
+            // never says `expired`, and an app gated on either never leaves its startup screen. The token
+            // check keeps a session another tab handed over mid-request out of it - that session is not
+            // this restore's to end.
+            const isRejectedRestore = state.type === 'autoLogin' &&
+                untracked(context.latestExecutedQuery)?.key === key &&
+                !untracked(context.accessToken);
+            if (state.type !== 'tokenRefresh' && !isRejectedRestore)
+                return;
+            // `logout` tears down every secure cache entry and emits on `events$`, so a consumer that reacts
+            // to a session ending runs inside this effect. Angular refuses `effect()` from a reactive context,
+            // so a listener that creates a query would throw NG0602 instead of handling the logout.
+            untracked(() => onRefreshFailure({ error: state.error, logout: () => context.logout('expired') }));
         });
         // Auto-retry on 401: Listen to repository events and trigger refresh on 401 errors
         const autoRetryOn401 = config.autoRetryOn401 ?? true;
@@ -8099,9 +8156,12 @@ const trackQueryDevtoolsAuthProvider = (registration) => {
     const stop = effect(() => {
         const accessToken = handle.accessToken();
         const refreshToken = handle.refreshToken();
+        const endCause = handle.sessionEndCause();
         untracked(() => {
             if (accessToken && refreshToken)
                 remember({ provider: name, accessToken, refreshToken });
+            else if (endCause === 'expired')
+                forgetExpired(name);
             else
                 forgetActive(name);
         });
@@ -8212,6 +8272,26 @@ const forgetActive = (provider) => {
     persist();
     syncPill();
 };
+/**
+ * Drops the session a provider was on because it expired, tokens and all - unlike every other way a
+ * session ends, this pair is spent. Keeping it offers a switch back that can only fail, and a tab-local
+ * seed would re-apply it on every reload, so the tab meets the same dead token until someone clears the
+ * storage by hand.
+ */
+const forgetExpired = (provider) => {
+    const sessionId = active()[provider] ?? null;
+    const { [provider]: _dropped, ...seeds } = readSeeds();
+    writeSeeds(seeds);
+    if (!sessionId)
+        return;
+    store.update((current) => ({
+        ...current,
+        sessions: current.sessions.filter((session) => session.id !== sessionId),
+    }));
+    setActive(provider, null);
+    persist();
+    syncPill();
+};
 /** The sessions offered for one provider, which are the ones this backend issued. */
 const queryDevtoolsAuthSessionsFor = (provider) => {
     const scope = scopeOf();
@@ -9582,7 +9662,7 @@ const armQueryDevtoolsOverrideTransfer = (recorder, ops) => {
 
 // Generated from package.json by tools/scripts/generate-version.js - do not edit.
 /** The version of `@ethlete/query` this build was cut from. */
-const QUERY_VERSION = '6.0.0-next.42';
+const QUERY_VERSION = '6.0.0-next.44';
 
 /** How deep a schema is expanded before a nested branch is given up on. */
 const MAX_DEPTH = 12;