@ethora/chat-component 26.6.6 → 26.7.1

package/dist/main.d.ts

@@ -14,3 +14,5 @@ export { applyTypography, clearTypography } from './helpers/applyTypography';
 export { useTypography } from './hooks/useTypography';
 export type { TypographyConfig, FontFaceSource, } from './types/models/config.model';
 export { ChatInputTestIds, MessageBubbleTestIds, RoomListTestIds, AuthTestIds, } from './testIds';
+export { refreshAuthTokens, refreshAuthTokensQuietly, RefreshFatalError, isRefreshFatalError, } from './networking/authRefresh';
+export type { RefreshErrorCode, RefreshResult, RefreshOptions, } from './networking/authRefresh';

package/dist/main.js

@@ -1,22 +1,26 @@
-import { m as e, R as o, C as t, M as p, n as r, X as u, o as n, p as d, q as h, t as i, v as y, w as I, x as T, y as g, z as l, D as C, E as c, F as m } from "./main-Doq70DIE.js";
+import { m as a, R as r, C as t, M as o, n as h, o as p, X as u, p as n, q as i, t as d, v as l, w as y, x as I, y as T, z as f, D as R, E as g, F as C, G as c, I as m, J as A, K as v } from "./main-JguHZ6Rn.js";
 export {
-  e as AuthTestIds,
-  o as Chat,
+  a as AuthTestIds,
+  r as Chat,
   t as ChatInputTestIds,
-  p as MessageBubbleTestIds,
-  r as RoomListTestIds,
+  o as MessageBubbleTestIds,
+  h as RefreshFatalError,
+  p as RoomListTestIds,
   u as XmppProvider,
   n as applyTypography,
-  d as clearTypography,
-  h as handleQRChatId,
-  i as logoutService,
-  y as resendMessage,
-  I as useInAppNotifications,
-  T as useIsUserOnline,
-  g as usePushNotifications,
-  l as useQRCodeChat,
-  C as useRoomPresence,
-  c as useTypography,
-  m as useUnread
+  i as clearTypography,
+  d as handleQRChatId,
+  l as isRefreshFatalError,
+  y as logoutService,
+  I as refreshAuthTokens,
+  T as refreshAuthTokensQuietly,
+  f as resendMessage,
+  R as useInAppNotifications,
+  g as useIsUserOnline,
+  C as usePushNotifications,
+  c as useQRCodeChat,
+  m as useRoomPresence,
+  A as useTypography,
+  v as useUnread
 };
 //# sourceMappingURL=main.js.map

package/dist/networking/apiClient.d.ts

@@ -1,12 +1,20 @@
+import { RefreshResult } from './authRefresh';
 declare const http: import('axios').AxiosInstance;
 declare let appToken: string;
 export declare function setBaseURL(newBaseURL?: string, customAppToken?: string): void;
-export declare function refresh(): Promise<{
-    data: {
-        refreshToken: string;
-        token: string;
-        fileToken?: string;
-    };
-}>;
+/**
+ * @deprecated Import `refreshAuthTokens` from `./authRefresh` instead.
+ *
+ * Kept as a thin forwarder so existing call sites keep working while
+ * they migrate. Declared as a function (not `const refresh =
+ * refreshAuthTokens`) on purpose: this module and `authRefresh` import
+ * each other, and a const would capture the binding before the other
+ * module finished evaluating.
+ *
+ * Behaviour change vs. the old implementation: it no longer dispatches
+ * `logout()` on every failure. Only a fatal verdict from the backend
+ * ends the session - see the interceptor below.
+ */
+export declare function refresh(): Promise<RefreshResult>;
 export default http;
 export { appToken };

package/dist/networking/authRefresh.d.ts

@@ -0,0 +1,108 @@
+import { User } from '../types/types';
+/**
+ * THE single refresh-token rotation point for the SDK.
+ *
+ * The backend now runs refresh-token ROTATION with REUSE DETECTION:
+ * every successful `/v1/users/login/refresh` burns the presented
+ * refresh token and issues a new one. Presenting an already-rotated
+ * token is indistinguishable, server-side, from a stolen token - so it
+ * is treated as theft and (once the backend leaves monitor mode and
+ * enables enforcing mode) kills the whole token family.
+ *
+ * That puts three hard obligations on the client:
+ *
+ *   1. Persist the NEW refreshToken from every response, immediately,
+ *      before any other logic can throw and drop it on the floor.
+ *   2. Never rotate concurrently - including ACROSS TABS. Two parallel
+ *      refreshes both start from the same token; the loser presents a
+ *      burned one and looks like an attacker. Hence Web Locks below,
+ *      plus a same-tab in-flight promise.
+ *   3. Route EVERY refresh path through here. One "side" refresh
+ *      elsewhere (service worker, poller, host app) breaks the scheme
+ *      for everyone.
+ *
+ * The subtle part is (2): serialising the requests is NOT enough. A tab
+ * that waited on the lock still holds the token it read before waiting,
+ * which the winner has since burned. The token must be RE-READ from
+ * cross-tab storage inside the lock - see `performRefresh`.
+ *
+ * Callers must also stop treating 401 as "log out". Two of the four
+ * refresh error codes are race signals, not auth failures - see
+ * `RefreshErrorCode` below and `RefreshFatalError`.
+ */
+export type RefreshErrorCode = 'REFRESH_IN_PROGRESS' | 'REFRESH_TOKEN_ALREADY_ROTATED' | 'REFRESH_TOKEN_REUSE_DETECTED' | 'REFRESH_TOKEN_NOT_FOUND';
+export interface RefreshResult {
+    token: string;
+    refreshToken: string;
+    fileToken?: string;
+    xmppPassword?: string;
+}
+/**
+ * Thrown when the session is genuinely dead and the caller must do a
+ * hard logout (clear storage, drop XMPP, send the user to login).
+ *
+ * Anything else this module rejects with - network errors, 5xx, an
+ * unrecognised 401 - is NOT fatal and must NOT trigger a logout.
+ */
+export declare class RefreshFatalError extends Error {
+    code: RefreshErrorCode;
+    constructor(code: RefreshErrorCode, message?: string);
+}
+export declare const isRefreshFatalError: (error: unknown) => error is RefreshFatalError;
+/**
+ * All four codes come back as HTTP 401, so the status alone tells us
+ * nothing - the code in the body is the only signal.
+ *
+ * TODO(backend-confirm): the exact location of `code` in the payload is
+ * not documented yet. Until it is, probe every shape the API uses
+ * elsewhere and take the first hit. Once confirmed, collapse this to
+ * the single real path.
+ */
+export declare const parseRefreshErrorCode: (error: unknown) => RefreshErrorCode | null;
+/**
+ * Is there anything left to rotate?
+ *
+ * Callers used to answer this by reading the redux copy, which is wrong
+ * in exactly the case that matters: `scrubSensitiveChatStateTransform`
+ * (roomStore/index.ts) blanks token/refreshToken before redux-persist
+ * writes them, so a freshly rehydrated second tab holds an EMPTY
+ * refresh token while the real one sits in `ETHORA_USER_SESSION`. Every
+ * such gate therefore has to go through storage first, same as the
+ * rotation itself.
+ */
+export declare const hasRotatableSession: () => boolean;
+export interface RefreshOptions {
+    /**
+     * Rotate THIS token instead of the one in the store/storage.
+     *
+     * Only for bootstrap, where the session being restored isn't in the
+     * store yet (a host-supplied `userLogin.user`, a persisted record).
+     * Everywhere else, omitting it is the correct and safer choice: the
+     * module then always presents the newest token it knows about.
+     */
+    refreshToken?: string;
+}
+/**
+ * Rotate the tokens. Concurrent callers in this tab share ONE request;
+ * concurrent tabs are serialised by the Web Lock. This is the lock the
+ * new backend scheme requires.
+ *
+ * Rejects with `RefreshFatalError` when the session is dead (caller
+ * should hard-logout) and with a plain error otherwise (caller should
+ * surface the failure and leave the session alone).
+ */
+export declare function refreshAuthTokens(options?: RefreshOptions): Promise<RefreshResult>;
+/**
+ * Fire-and-forget variant for call sites that only want "make sure the
+ * tokens are fresh" and have no meaningful error handling - chat
+ * bootstrap, XMPP reconnect. Never rejects.
+ */
+export declare function refreshAuthTokensQuietly(): Promise<RefreshResult | null>;
+export declare function startCrossTabTokenSync(): () => void;
+type CredentialLike = Partial<Pick<User, 'xmppUsername' | 'refreshToken' | 'token'>> | null | undefined;
+export declare function markCurrentSessionDead(): void;
+export declare function isSessionDead(candidate: CredentialLike): boolean;
+export declare function clearDeadSessionLatch(): void;
+/** Test seam: drops any shared in-flight promise between cases. */
+export declare function __resetAuthRefreshStateForTests(): void;
+export {};

package/dist/networking/xmppClient.d.ts

@@ -2,6 +2,10 @@ import { Client } from '@xmpp/client';
 import { Iso639_1Codes, XmppClientInterface, xmppSettingsInterface, IMessage } from '../types/types';
 import { AllRoomPresenceSummary } from './xmpp/allRoomPresences.xmpp';
 type HistorySource = 'active' | 'send_ack' | 'background' | 'default';
+export type XmppCredentialsProvider = () => Promise<{
+    username: string;
+    password: string;
+}>;
 export declare class XmppClient implements XmppClientInterface {
     client: Client;
     devServer: string | undefined;
@@ -81,6 +85,51 @@ export declare class XmppClient implements XmppClientInterface {
     private pausedDueToOfflineCap;
     private authFailureDetected;
     private intentionalLogout;
+    /**
+     * Ported from the RN client (bug #17). The XMPP password now expires
+     * after an hour, so a SASL `not-authorized` is no longer a dead end -
+     * it is the normal, expected end of a credential's life.
+     *
+     * Note the shape of the failure, confirmed with the backend: an
+     * ALREADY-ESTABLISHED connection is NOT dropped when its password
+     * expires - authentication happens once, at SASL bind. So a tab that
+     * simply stays open keeps working indefinitely, and the expiry only
+     * bites on the next (re)connect: a network blip, a laptop waking from
+     * sleep, a server restart. That makes it rare, intermittent and easy
+     * to misdiagnose - and before this hook it was permanent, because the
+     * client latched `authFailureDetected` and refused to reconnect for
+     * the rest of the page's life. Only a reload brought the chat back.
+     */
+    private credentialsProvider;
+    private credentialsRefreshInFlight;
+    /**
+     * Bounded so a genuinely dead session (revoked account, wrong host)
+     * can't spin refresh -> reconnect -> auth-fail forever. Reset on every
+     * successful 'online'.
+     */
+    private authRecoveryAttempts;
+    private maxAuthRecoveryAttempts;
+    /**
+     * Inject (or replace) the callback used to fetch fresh XMPP
+     * credentials after a SASL `not-authorized`. The provider refreshes
+     * whatever upstream credential is needed (the REST session, which now
+     * re-issues the hourly XMPP password) and returns username+password.
+     */
+    setCredentialsProvider(provider: XmppCredentialsProvider | null): void;
+    updateCredentials(username: string, password: string): void;
+    /**
+     * Single-flight wrapper around the provider. Several reconnect paths
+     * (error handler, watchdog, visibility) can fire at once; they share
+     * one request and update the credentials exactly once.
+     */
+    private refreshCredentialsOnce;
+    /**
+     * A SASL failure used to be terminal here. With an hourly XMPP
+     * password it is routine, so try to re-mint credentials and come back
+     * instead of latching the connection off for the rest of the page's
+     * life. Returns true when a retry was started.
+     */
+    private recoverFromAuthFailure;
     private isTerminalAuthFailure;
     constructor(username: string, password: string, xmppSettings?: xmppSettingsInterface);
     initializeClient(): Promise<void>;

package/dist/roomStore/chatSettingsSlice.d.ts

@@ -37,6 +37,7 @@ export declare const setUser: import('@reduxjs/toolkit').ActionCreatorWithOption
     token: string;
     refreshToken: string;
     fileToken?: string;
+    xmppPassword?: string;
 }, "chatSettingStore/refreshTokens">, logout: import('@reduxjs/toolkit').ActionCreatorWithoutPayload<"chatSettingStore/logout">, setActiveModal: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<string, "chatSettingStore/setActiveModal">, setDeleteModal: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<DeleteModal, "chatSettingStore/setDeleteModal">, setSelectedUser: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<IUser, "chatSettingStore/setSelectedUser">, updateUser: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<{
     updates: Partial<User>;
 }, "chatSettingStore/updateUser">, setActiveFile: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<ModalFile, "chatSettingStore/setActiveFile">, setLangSource: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<Iso639_1Codes, "chatSettingStore/setLangSource">, setTranslateSendEnabled: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<boolean, "chatSettingStore/setTranslateSendEnabled">, setTranslateMode: import('@reduxjs/toolkit').ActionCreatorWithOptionalPayload<"auto" | "manual", "chatSettingStore/setTranslateMode">;

package/dist/types/models/config.model.d.ts

@@ -201,10 +201,25 @@ export interface IConfig {
     defaultRooms?: ConfigRoom[];
     refreshTokens?: {
         enabled: boolean;
+        /**
+         * Host-owned rotation. When set, the SDK calls this INSTEAD of
+         * `/v1/users/login/refresh` - always, including during bootstrap -
+         * and never rotates the Ethora refresh token itself. Serialised
+         * through the same lock (and the same Web Lock) as the built-in path.
+         *
+         * Return `refreshToken` whenever the host's flow actually rotates an
+         * Ethora refresh token: the backend now treats a re-presented one as
+         * theft, so omitting it leaves a burned token in storage that ends
+         * the session the next time it is used. It stays optional because
+         * some hosts re-mint an access token from a different authority
+         * (SuperTokens, an owner-session endpoint) and hold no Ethora
+         * refresh token at all.
+         */
         refreshFunction?: () => Promise<{
             accessToken: string;
             refreshToken?: string;
             fileToken?: string;
+            xmppPassword?: string;
         } | null>;
     };
     backgroundChat?: {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const ETHORA_CHAT_COMPONENT_VERSION = "26.6.1";
+export declare const ETHORA_CHAT_COMPONENT_VERSION = "26.06.04";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethora/chat-component",
-  "version": "26.6.6",
+  "version": "26.7.1",
   "type": "module",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",

package/dist/networking/helpers/refreshChecker.d.ts

@@ -1 +0,0 @@
-export declare const refreshHelper: (isEnabled: boolean, refreshFunc: any, logoutClb: any) => void;