@finos/legend-application 16.0.105 → 16.0.107

package/lib/components/LegendTokenSync.d.ts

@@ -16,6 +16,11 @@
 /**
  * Must be rendered inside an `<AuthProvider>` and an
  * `<ApplicationStoreProvider>`.
+ *
+ * Keeps the in-memory token and cookie in sync with the OIDC provider
+ * and proactively renews the access token before it expires so that
+ * long-running sessions (e.g. Legend marketplace AI chat, query execution) never send
+ * stale credentials.
  */
 export declare const LegendTokenSync: (props: {
     children: React.ReactNode;

package/lib/components/LegendTokenSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LegendTokenSync.d.ts","sourceRoot":"","sources":["../../src/components/LegendTokenSync.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B,KAAG,KAAK,CAAC,YAgCT,CAAC"}
+{"version":3,"file":"LegendTokenSync.d.ts","sourceRoot":"","sources":["../../src/components/LegendTokenSync.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO;IACrC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B,KAAG,KAAK,CAAC,YA2DT,CAAC"}

package/lib/components/LegendTokenSync.js

@@ -14,7 +14,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { useEffect } from 'react';
+import { useEffect, useCallback } from 'react';
 import { useAuth } from 'react-oidc-context';
 import { LogEvent } from '@finos/legend-shared';
 import { useApplicationStore } from './ApplicationStoreProvider.js';
@@ -22,12 +22,26 @@ import { APPLICATION_EVENT } from '../__lib__/LegendApplicationEvent.js';
 /**
  * Must be rendered inside an `<AuthProvider>` and an
  * `<ApplicationStoreProvider>`.
+ *
+ * Keeps the in-memory token and cookie in sync with the OIDC provider
+ * and proactively renews the access token before it expires so that
+ * long-running sessions (e.g. Legend marketplace AI chat, query execution) never send
+ * stale credentials.
  */
 export const LegendTokenSync = (props) => {
     const auth = useAuth();
     const applicationStore = useApplicationStore();
     const token = auth.user?.access_token;
     const expiresAt = auth.user?.expires_at;
+    const attemptSilentRenew = useCallback(async () => {
+        try {
+            await auth.signinSilent();
+        }
+        catch {
+            applicationStore.logService.warn(LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED), 'OIDC silent renewal failed — clearing token');
+            applicationStore.setAccessToken(undefined);
+        }
+    }, [auth, applicationStore]);
     // Sync token into ApplicationStore whenever it changes (including
     // after a successful automatic silent renewal).  When the auth object
     // contains an `expires_at` timestamp we derive `max-age` so the
@@ -38,15 +52,26 @@ export const LegendTokenSync = (props) => {
             : undefined;
         applicationStore.setAccessToken(token ?? undefined, maxAge);
     }, [applicationStore, token, expiresAt]);
+    useEffect(() => {
+        const removeExpiring = auth.events.addAccessTokenExpiring(() => {
+            applicationStore.logService.info(LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED), 'OIDC access token expiring soon — attempting silent renewal');
+            attemptSilentRenew().catch(() => {
+                /* handled inside attemptSilentRenew */
+            });
+        });
+        return removeExpiring;
+    }, [auth.events, applicationStore, attemptSilentRenew]);
     // If the token fully expires (automatic renewal failed or was never
-    // attempted) clear the stale token immediately.
+    // attempted) make one last renewal attempt before giving up.
     useEffect(() => {
         const removeExpired = auth.events.addAccessTokenExpired(() => {
-            applicationStore.logService.warn(LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED), 'OIDC access token expired — clearing token');
-            applicationStore.setAccessToken(undefined);
+            applicationStore.logService.warn(LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED), 'OIDC access token expired — attempting silent renewal');
+            attemptSilentRenew().catch(() => {
+                /* handled inside attemptSilentRenew */
+            });
         });
         return removeExpired;
-    }, [auth.events, applicationStore]);
+    }, [auth.events, applicationStore, attemptSilentRenew]);
     return _jsx(_Fragment, { children: props.children });
 };
 //# sourceMappingURL=LegendTokenSync.js.map

package/lib/components/LegendTokenSync.js.map

@@ -1 +1 @@
-{"version":3,"file":"LegendTokenSync.js","sourceRoot":"","sources":["../../src/components/LegendTokenSync.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAE/B,EAAsB,EAAE;IACvB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;IAExC,kEAAkE;IAClE,sEAAsE;IACtE,gEAAgE;IAChE,wDAAwD;IACxD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,gBAAgB,CAAC,cAAc,CAAC,KAAK,IAAI,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAEzC,oEAAoE;IACpE,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE;YAC3D,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAC9B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAChD,4CAA4C,CAC7C,CAAC;YACF,gBAAgB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEpC,OAAO,4BAAG,KAAK,CAAC,QAAQ,GAAI,CAAC;AAC/B,CAAC,CAAC"}
+{"version":3,"file":"LegendTokenSync.js","sourceRoot":"","sources":["../../src/components/LegendTokenSync.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAE/B,EAAsB,EAAE;IACvB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;IAExC,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAC9B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAChD,6CAA6C,CAC9C,CAAC;YACF,gBAAgB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE7B,kEAAkE;IAClE,sEAAsE;IACtE,gEAAgE;IAChE,wDAAwD;IACxD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,gBAAgB,CAAC,cAAc,CAAC,KAAK,IAAI,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAEzC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE;YAC7D,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAC9B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAChD,6DAA6D,CAC9D,CAAC;YACF,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9B,uCAAuC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAExD,oEAAoE;IACpE,6DAA6D;IAC7D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE;YAC3D,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAC9B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAChD,uDAAuD,CACxD,CAAC;YACF,kBAAkB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9B,uCAAuC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAExD,OAAO,4BAAG,KAAK,CAAC,QAAQ,GAAI,CAAC;AAC/B,CAAC,CAAC"}

package/lib/index.css

@@ -1,4 +1,4 @@
-/** @license @finos/legend-application v16.0.105
+/** @license @finos/legend-application v16.0.107
  * Copyright (c) 2020-present, Goldman Sachs
  *
  * Licensed under the Apache License, Version 2.0 (the "License");

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@finos/legend-application",
-    "version": "16.0.105",
+    "version": "16.0.107",
     "description": "Legend application core",
     "keywords": [
         "legend",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finos/legend-application",
-  "version": "16.0.105",
+  "version": "16.0.107",
   "description": "Legend application core",
   "keywords": [
     "legend",
@@ -45,9 +45,9 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@finos/legend-art": "7.1.147",
-    "@finos/legend-shared": "11.0.24",
-    "@finos/legend-storage": "3.0.145",
+    "@finos/legend-art": "7.1.148",
+    "@finos/legend-shared": "11.0.25",
+    "@finos/legend-storage": "3.0.146",
     "@types/react": "19.0.10",
     "@types/react-dom": "19.0.4",
     "@types/react-router-dom": "5.3.3",

package/src/components/LegendTokenSync.tsx

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import { useEffect } from 'react';
+import { useEffect, useCallback } from 'react';
 import { useAuth } from 'react-oidc-context';
 import { LogEvent } from '@finos/legend-shared';
 import { useApplicationStore } from './ApplicationStoreProvider.js';
@@ -23,6 +23,11 @@ import { APPLICATION_EVENT } from '../__lib__/LegendApplicationEvent.js';
 /**
  * Must be rendered inside an `<AuthProvider>` and an
  * `<ApplicationStoreProvider>`.
+ *
+ * Keeps the in-memory token and cookie in sync with the OIDC provider
+ * and proactively renews the access token before it expires so that
+ * long-running sessions (e.g. Legend marketplace AI chat, query execution) never send
+ * stale credentials.
  */
 export const LegendTokenSync = (props: {
   children: React.ReactNode;
@@ -32,6 +37,18 @@ export const LegendTokenSync = (props: {
   const token = auth.user?.access_token;
   const expiresAt = auth.user?.expires_at;
 
+  const attemptSilentRenew = useCallback(async () => {
+    try {
+      await auth.signinSilent();
+    } catch {
+      applicationStore.logService.warn(
+        LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED),
+        'OIDC silent renewal failed — clearing token',
+      );
+      applicationStore.setAccessToken(undefined);
+    }
+  }, [auth, applicationStore]);
+
   // Sync token into ApplicationStore whenever it changes (including
   // after a successful automatic silent renewal).  When the auth object
   // contains an `expires_at` timestamp we derive `max-age` so the
@@ -44,18 +61,33 @@ export const LegendTokenSync = (props: {
     applicationStore.setAccessToken(token ?? undefined, maxAge);
   }, [applicationStore, token, expiresAt]);
 
+  useEffect(() => {
+    const removeExpiring = auth.events.addAccessTokenExpiring(() => {
+      applicationStore.logService.info(
+        LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED),
+        'OIDC access token expiring soon — attempting silent renewal',
+      );
+      attemptSilentRenew().catch(() => {
+        /* handled inside attemptSilentRenew */
+      });
+    });
+    return removeExpiring;
+  }, [auth.events, applicationStore, attemptSilentRenew]);
+
   // If the token fully expires (automatic renewal failed or was never
-  // attempted) clear the stale token immediately.
+  // attempted) make one last renewal attempt before giving up.
   useEffect(() => {
     const removeExpired = auth.events.addAccessTokenExpired(() => {
       applicationStore.logService.warn(
         LogEvent.create(APPLICATION_EVENT.TOKEN_EXPIRED),
-        'OIDC access token expired — clearing token',
+        'OIDC access token expired — attempting silent renewal',
       );
-      applicationStore.setAccessToken(undefined);
+      attemptSilentRenew().catch(() => {
+        /* handled inside attemptSilentRenew */
+      });
     });
     return removeExpired;
-  }, [auth.events, applicationStore]);
+  }, [auth.events, applicationStore, attemptSilentRenew]);
 
   return <>{props.children}</>;
 };