@franzzemen/brokenstock-shell 0.4.3 → 0.4.4

package/fesm2022/franzzemen-brokenstock-shell.mjs

@@ -2,7 +2,7 @@ import * as i0 from '@angular/core';
 import { InjectionToken, makeEnvironmentProviders, signal, computed, Injectable, inject, input, Directive, isDevMode, effect, untracked, HostListener, ViewChild, ViewEncapsulation, ChangeDetectionStrategy, Component, NgZone, viewChild, afterNextRender } from '@angular/core';
 import * as i2$1 from '@angular/router';
 import { Router, RouterLink, RouterLinkActive, ActivatedRoute, RouterOutlet } from '@angular/router';
-import { HttpHeader, BEARER_TOKEN_REGEX, USERNAME_REGEX, PASSWORD_REGEX } from '@franzzemen/utility';
+import { BEARER_TOKEN_REGEX, HttpHeader, USERNAME_REGEX, PASSWORD_REGEX } from '@franzzemen/utility';
 import { validateCredentials } from '@franzzemen/identity';
 import { HttpClient } from '@angular/common/http';
 import { catchError, from, switchMap, throwError, firstValueFrom } from 'rxjs';
@@ -41,6 +41,18 @@ const SHELL_AUTH_URLS = new InjectionToken('SHELL_AUTH_URLS');
  */
 const SHELL_COMMANDS = new InjectionToken('SHELL_COMMANDS');
 const SHELL_POST_LOGIN_ROUTE = new InjectionToken('SHELL_POST_LOGIN_ROUTE');
+/**
+ * Whether this app shares one session across every window of the browser
+ * (multiple-windows PRD D2/D7).
+ *
+ * ⚠ OFF unless an app opts in, and only `broken-stock` does. Turning it on puts
+ * the sign-in token in browser storage, where any script on the origin can read
+ * it and it persists on disk. The admin apps send their renewal cookie
+ * cross-site and can change other people's data, which makes that a materially
+ * different exposure — extending this to them is a separate decision, not a
+ * default.
+ */
+const SHELL_SHARED_SESSION = new InjectionToken('SHELL_SHARED_SESSION');
 
 function provideShellConfig(config) {
     return makeEnvironmentProviders([
@@ -48,6 +60,7 @@ function provideShellConfig(config) {
         { provide: SHELL_MENU_ITEMS, useValue: config.menuItems },
         { provide: SHELL_AUTH_URLS, useValue: config.authUrls },
         { provide: SHELL_COMMANDS, useValue: config.commands ?? [] },
+        { provide: SHELL_SHARED_SESSION, useValue: config.sharedSession ?? false },
     ]);
 }
 
@@ -76,7 +89,214 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImpor
             args: [{ providedIn: 'root' }]
         }] });
 
+/*
+Created by Franz Zemen 2026-08-29
+License Type: UNLICENSED
+
+The sign-in token's home in browser storage (multiple-windows PRD D2).
+
+WHY THIS IS ITS OWN FILE, AND WHY IT DOES NOT USE `LocalStorageService`.
+That service swallows a failed write on purpose — losing a remembered pane width
+must never break the screen that was trying to remember it. That policy is
+exactly wrong here. A silently dropped token write is a silently lost session:
+the window keeps working on the token it holds in memory, every other window
+never learns it, and the failure surfaces minutes later somewhere else entirely.
+So this writes directly and THROWS.
+
+READS ARE THE SOURCE OF TRUTH, NOT A CACHE. `AuthenticationService.auth` reads
+through to this on every access rather than keeping a copy. That is the whole
+reason the design works with several windows open: the tape socket asks for the
+token on a sixty-second heartbeat and a window that is frozen or backgrounded may
+never receive a queued `storage` event, so a copy refreshed by an event is only
+as fresh as the last event delivered. Reading through removes the question.
+
+⚠ NOT under the `bs.pref.` namespace. `LocalStorageService` wipes that namespace
+wholesale, and a preference wipe must never sign the user out.
+*/
+/** Deliberately outside `bs.pref.` — see the header. */
+const SESSION_TOKEN_KEY = 'bs.auth.token';
+class SessionTokenStore {
+    /** False during prerendering, where there is no `window` at all. */
+    #available = typeof window !== 'undefined' && !!window.localStorage;
+    get available() {
+        return this.#available;
+    }
+    /**
+     * The stored token, or undefined.
+     *
+     * A stored value that is not a well-formed bearer is treated as absent and
+     * removed. It cannot be authenticated with, and leaving it there would make
+     * every later read fail the same way with nothing to explain it.
+     */
+    read() {
+        if (!this.#available)
+            return undefined;
+        let raw;
+        try {
+            raw = window.localStorage.getItem(SESSION_TOKEN_KEY);
+        }
+        catch {
+            // Storage disabled by the browser. Not recoverable here, and not fatal —
+            // the caller falls back to its in-memory token and this window works
+            // alone, which is exactly today's behaviour.
+            return undefined;
+        }
+        if (!raw)
+            return undefined;
+        if (!BEARER_TOKEN_REGEX.test(raw)) {
+            this.clear();
+            return undefined;
+        }
+        return raw;
+    }
+    /**
+     * Stores the token. THROWS on failure — see the header.
+     *
+     * @throws if the value is not a bearer token, or the write does not stick.
+     */
+    write(token) {
+        if (!this.#available)
+            return;
+        if (!BEARER_TOKEN_REGEX.test(token)) {
+            throw new Error('SessionTokenStore.write refused a value that is not a bearer token');
+        }
+        try {
+            window.localStorage.setItem(SESSION_TOKEN_KEY, token);
+        }
+        catch (error) {
+            throw new Error(`Could not store the session token: ${String(error)}`);
+        }
+    }
+    clear() {
+        if (!this.#available)
+            return;
+        try {
+            window.localStorage.removeItem(SESSION_TOKEN_KEY);
+        }
+        catch {
+            // Nothing useful to do. The in-memory state is cleared by the caller
+            // regardless, so this window is signed out either way.
+        }
+    }
+    /**
+     * Calls back when ANOTHER window changes the token.
+     *
+     * `storage` does not fire in the window that made the change, which is
+     * correct — that window is the one doing it and has already acted.
+     *
+     * ⚠ `event.key === null` is what `localStorage.clear()` produces, and it means
+     * everything went, this key included. Treating it as "not our key" is how a
+     * whole-storage clear silently fails to sign the user out.
+     */
+    onExternalChange(handler) {
+        if (!this.#available)
+            return () => undefined;
+        const listener = (event) => {
+            if (event.key !== null && event.key !== SESSION_TOKEN_KEY)
+                return;
+            handler(this.read());
+        };
+        window.addEventListener('storage', listener);
+        return () => window.removeEventListener('storage', listener);
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionTokenStore, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionTokenStore, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: SessionTokenStore, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+
+/*
+Created by Franz Zemen 2026-08-29
+License Type: UNLICENSED
+
+Run something in exactly one window (multiple-windows PRD D5).
+
+THE PROBLEM. Several windows share one session. When the token expires they all
+notice at once and all try to renew. The server serialises renewal correctly and
+REFUSES the losers, so without coordination every window but one is signed out —
+and it happens every token lifetime, several times a day.
+
+WHY `ifAvailable` RATHER THAN WAITING ON THE LOCK. A waiter blocks on a peer it
+cannot supervise. If the window holding the lock is frozen, backgrounded or its
+request hangs, the waiters wait forever — screens simply stop updating, with
+nothing logged and nothing on screen. `ifAvailable` refuses immediately instead,
+which turns "wait on a peer" into "wait for a value to appear, with my own
+bound". A bound you own is a bound you can honour.
+
+⚠ A lock held by a DESTROYED document is released by the browser, so closing a
+window is safe. A merely frozen document is NOT destroyed — which is why every
+path here is bounded regardless.
+
+⚠ `navigator.locks` needs a secure context and is absent in some. Absent means
+fall back to running uncoordinated — today's behaviour — never throw. A missing
+API must not be the reason nobody can sign in.
+*/
+const LOCKS_AVAILABLE = typeof navigator !== 'undefined'
+    && typeof navigator.locks?.request === 'function';
+/**
+ * Runs `work` if this window can take the lock right now.
+ *
+ * Returns `{ran: false}` when another window holds it — the caller decides what
+ * to do instead, which is the point: only the caller knows whether waiting for
+ * the peer's result or proceeding alone is correct.
+ *
+ * When `navigator.locks` is unavailable the work RUNS, uncoordinated. That is a
+ * deliberate degradation to today's behaviour rather than a refusal.
+ */
+async function runExclusive(name, work) {
+    if (!LOCKS_AVAILABLE) {
+        console.warn(`[shell] navigator.locks unavailable; "${name}" runs without cross-window coordination`);
+        return { ran: true, value: await work() };
+    }
+    let outcome = { ran: false };
+    await navigator.locks.request(name, { ifAvailable: true }, async (lock) => {
+        if (!lock)
+            return;
+        outcome = { ran: true, value: await work() };
+    });
+    return outcome;
+}
+/**
+ * Polls `read` until it returns something other than `unchanged`, or the bound
+ * elapses.
+ *
+ * Polling rather than listening for `storage` on purpose: the event does not
+ * fire in a window that is frozen at the moment it is dispatched, and this is
+ * the path that recovers such a window. A poll asks the question again.
+ *
+ * Resolves `undefined` on timeout — "the peer did not deliver", which is a
+ * legitimate answer the caller must handle, not an error.
+ */
+async function awaitChange(read, unchanged, timeoutMs, pollMs = 100) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const current = read();
+        if (current !== unchanged)
+            return current;
+        if (Date.now() >= deadline)
+            return undefined;
+        await new Promise(resolve => setTimeout(resolve, pollMs));
+    }
+}
+
+/** Name of the cross-window renewal lock (PRD D5). */
+const RENEWAL_LOCK = 'brokenstock.session.renew';
+/** How long a window waits for the renewing window to publish a token (PRD D5). */
+const PEER_RENEWAL_WAIT_MS = 10_000;
+/** How long the renewal request itself may take before it is abandoned (PRD D5). */
+const RENEWAL_TIMEOUT_MS = 15_000;
 class AuthenticationService {
+    #refreshing;
+    #auth;
+    #httpClient;
+    #thinkingService;
+    #router;
+    #authUrls;
+    #store;
+    /** Off by default: an app opts in to sharing its session across windows (PRD D7). */
+    #sharedSession;
     constructor() {
         this.authenticated = signal(false, /* @ts-ignore */
         ...(ngDevMode ? [{ debugName: "authenticated" }] : /* istanbul ignore next */ []));
@@ -94,16 +314,65 @@ class AuthenticationService {
         this.#thinkingService = inject(ThinkingService);
         this.#router = inject(Router);
         this.#authUrls = inject(SHELL_AUTH_URLS);
+        this.#store = inject(SessionTokenStore);
+        /** Off by default: an app opts in to sharing its session across windows (PRD D7). */
+        this.#sharedSession = inject(SHELL_SHARED_SESSION, { optional: true }) ?? false;
+        if (!this.#sharedSession)
+            return;
+        // Adopt a token this browser already holds. This runs during construction,
+        // and `authGuard` injecting this service IS the first read of `authenticated`
+        // — a field initializer completes before `inject()` returns — so the guard
+        // sees the restored state without becoming asynchronous (PRD D4).
+        //
+        // The token may well be expired. That is not this constructor's problem: the
+        // first request 401s and the interceptor renews and retries, which is the
+        // path that already works today.
+        const stored = this.#store.read();
+        if (stored) {
+            this.#auth = stored;
+            this.authenticated.set(true);
+        }
+        // Another window signing out must sign this one out too (PRD D6). A token
+        // that merely CHANGED needs no action here — `auth` reads through, so the
+        // next caller gets the new value without anyone copying it.
+        this.#store.onExternalChange(token => {
+            if (!token && this.authenticated())
+                this.#clearSession();
+        });
     }
-    #refreshing;
-    #auth;
-    #httpClient;
-    #thinkingService;
-    #router;
-    #authUrls;
+    /**
+     * The bearer for outbound calls.
+     *
+     * READ-THROUGH, not a cached copy, whenever the session is shared across
+     * windows (PRD D2/D10). A copy is only as fresh as the last `storage` event
+     * delivered, and the consumer that matters most is outside the request path:
+     * the market-tape socket re-presents this token on a sixty-second heartbeat,
+     * and the server closes the socket with a code the client does NOT retry if it
+     * is stale. A window that was frozen when the event fired would lose its live
+     * prices permanently. Reading through removes the question of which window
+     * holds which token.
+     */
     get auth() {
+        if (this.#sharedSession) {
+            const stored = this.#store.read();
+            if (stored)
+                return stored;
+        }
         return this.#auth;
     }
+    /**
+     * Adopts a freshly issued token: in memory, and in shared storage so every
+     * other window of this browser sees it on their next read.
+     *
+     * A failed write THROWS out of here rather than being absorbed — see
+     * `SessionTokenStore`. A session the other windows cannot see is the failure
+     * this whole design exists to prevent.
+     */
+    #adoptToken(token) {
+        this.#auth = token;
+        if (this.#sharedSession)
+            this.#store.write(token);
+    }
     // Legacy hasRole/hasAnyRole removed (legacy-authz-teardown): sessions carry no
     // roles, and every gate moved to hasFeature (commerce) with the BE enforcing the
     // security axis.
@@ -129,6 +398,23 @@ class AuthenticationService {
         this.conflictSessions.set(undefined);
         this.pendingCredentials.set(undefined);
     }
+    /**
+     * The session is gone and cannot be recovered — renewal failed permanently,
+     * or another window signed out.
+     *
+     * ⚠ THIS EXISTS BECAUSE THERE ARE TWO SIGN-OUT PATHS AND ONLY ONE USED TO
+     * CLEAR THE TOKEN. `logout()` went through `#clearSession()`; the 401
+     * interceptor set the signals and navigated but left `#auth` alone. Harmless
+     * while the token lived only in memory and died with the tab — but once it is
+     * in storage, a dead token left behind means every later window marks itself
+     * signed in, passes the guard, renders, 401s and bounces to the login screen.
+     * The reload fix would have become "the app flashes, then throws me out",
+     * which is harder to diagnose than the behaviour it replaced.
+     */
+    sessionLost() {
+        this.#thinkingService.reset();
+        this.#clearSession();
+    }
     logout() {
         const subscription = this.#httpClient
             .get(this.#authUrls.logout, {
@@ -180,7 +466,7 @@ class AuthenticationService {
                             reject('Unable to login');
                             return;
                         }
-                        this.#auth = auth;
+                        this.#adoptToken(auth);
                         this.authenticated.set(true);
                         this.pendingCredentials.set(undefined);
                         resolve();
@@ -214,15 +500,81 @@ class AuthenticationService {
             });
         });
     }
+    /**
+     * Renews the session, coordinating with the other windows of this browser.
+     *
+     * WHY COORDINATION IS REQUIRED, NOT AN OPTIMISATION. Every window shares one
+     * session, so they all find the token expired at the same moment and all try
+     * to renew. The server serialises rotation on the session row and REFUSES the
+     * losers — so uncoordinated, every window but one is signed out, every token
+     * lifetime, several times a day.
+     *
+     * The lock is taken with `ifAvailable`, so a window that does not get it is
+     * told so immediately and then waits for the WINNER'S RESULT with a bound of
+     * its own, rather than blocking on a peer it cannot supervise. A frozen
+     * window holding the lock would otherwise stop every other window forever,
+     * with nothing on screen and nothing logged.
+     */
     async #doRefresh() {
+        if (!this.#sharedSession)
+            return this.#renew();
+        // Captured BEFORE asking for the lock: it is what "did someone else renew
+        // while I waited?" is measured against.
+        const before = this.#store.read();
+        const outcome = await runExclusive(RENEWAL_LOCK, () => this.#renewOrAdopt(before));
+        if (outcome.ran)
+            return outcome.value;
+        // Another window is renewing. Wait for its token to appear.
+        const published = await awaitChange(() => this.#store.read(), before, PEER_RENEWAL_WAIT_MS);
+        if (published) {
+            this.#auth = published;
+            return true;
+        }
+        // Either the winner cleared the token (its renewal failed permanently), or
+        // it never delivered inside the bound. Re-read to tell those apart: an
+        // absent token is a definite answer and must not be retried, whereas a
+        // still-unchanged one means the winner is gone and this window should try.
+        if (before && !this.#store.read())
+            return false;
+        return this.#renewOrAdopt(before);
+    }
+    /**
+     * The three-way rule, applied once this window holds the lock (PRD D5).
+     *
+     * Stated precisely because "retry with a token different from the one you
+     * failed with" is not well defined: the in-window single-flight already
+     * collapses requests that were sent with different tokens.
+     */
+    async #renewOrAdopt(before) {
+        const current = this.#store.read();
+        // Gone: whoever held the lock before us renewed and then failed permanently,
+        // or signed out. Retrying would present nothing and 401 again.
+        if (before && !current)
+            return false;
+        // Someone renewed while we queued. Adopt their work; do not rotate again —
+        // a second rotation would invalidate the token every other window just took.
+        if (current && current !== before) {
+            this.#auth = current;
+            return true;
+        }
+        return this.#renew();
+    }
+    /**
+     * The renewal request itself.
+     *
+     * ⚠ THE TIMEOUT IS LOAD-BEARING. Without it a hung request holds the
+     * cross-window lock indefinitely and every other window waits behind it.
+     */
+    async #renew() {
         try {
             const response = await fetch(this.#authUrls.refresh, {
                 method: 'POST',
                 headers: {
-                    [HttpHeader.Authorization]: this.#auth,
+                    [HttpHeader.Authorization]: this.auth,
                     [HttpHeader.AppContext]: 'brokenstock',
                 },
                 credentials: 'include',
+                signal: AbortSignal.timeout(RENEWAL_TIMEOUT_MS),
             });
             if (!response.ok)
                 return false;
@@ -230,20 +582,33 @@ class AuthenticationService {
             if (!auth || !BEARER_TOKEN_REGEX.test(auth))
                 return false;
             const body = await response.json();
-            this.#auth = auth;
-            this.userSession.set(body.session);
+            this.#adoptToken(auth);
+            // The raw token is stripped exactly as `login()` strips it. `/refresh`
+            // returns `{session: {token}}`, and assigning that straight through put
+            // the bearer into a PUBLIC signal — a second copy of the credential in a
+            // place nothing needs it, which contradicts the care taken everywhere
+            // else about where this token may live.
+            const session = { ...(body.session ?? {}) };
+            delete session.token;
+            this.userSession.set(session);
             return true;
         }
         catch {
+            // Includes the abort. A timed-out renewal is a failed renewal.
             return false;
         }
     }
+    /**
+     * THE ONE PLACE a session ends. Both sign-out paths route through here so the
+     * stored token cannot outlive the session it belongs to — see `sessionLost`.
+     */
     #clearSession() {
         this.authenticated.set(false);
         this.userSession.set(undefined);
         this.conflictSessions.set(undefined);
         this.pendingCredentials.set(undefined);
         this.#auth = 'Bearer ..';
+        this.#store.clear();
         this.#router.navigate(['/login']).catch(console.error);
     }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: AuthenticationService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
@@ -252,7 +617,7 @@ class AuthenticationService {
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImport: i0, type: AuthenticationService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
-        }] });
+        }], ctorParameters: () => [] });
 
 const authGuard = (_route, state) => {
     const authService = inject(AuthenticationService);
@@ -277,9 +642,7 @@ const guestGuard = () => {
 
 const authInterceptor = (req, next) => {
     const authService = inject(AuthenticationService);
-    const thinkingService = inject(ThinkingService);
     const authUrls = inject(SHELL_AUTH_URLS);
-    const router = inject(Router);
     return next(req).pipe(catchError((error) => {
         const isRefreshOrLogin = req.url === authUrls.refresh || req.url === authUrls.login;
         if (error.status === 401 && !isRefreshOrLogin) {
@@ -290,16 +653,13 @@ const authInterceptor = (req, next) => {
                     });
                     return next(retryReq);
                 }
-                thinkingService.reset();
-                authService.authenticated.set(false);
-                authService.userSession.set(undefined);
-                router.navigate(['/login']);
+                // `sessionLost()` and not the three lines that used to be here: it
+                // also clears the STORED token. Leaving a dead token behind makes
+                // every later window sign itself in, render, 401 and bounce.
+                authService.sessionLost();
                 return throwError(() => error);
             }), catchError(() => {
-                thinkingService.reset();
-                authService.authenticated.set(false);
-                authService.userSession.set(undefined);
-                router.navigate(['/login']);
+                authService.sessionLost();
                 return throwError(() => error);
             }));
         }
@@ -2805,5 +3165,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.2", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AuthenticationService, CLEAR_USAGE, CommandRegistryService, CommandService, CommandTerminal, ConfirmDialog, FAQ_CONTENT_LOADER, FAQ_DEV_EDITOR, FAQ_DEV_MODE, FAQ_DEV_WORKSPACE_ROOT, FAQ_PUBLIC_PUBLISHER, FAQ_PUBLIC_SITE_BASE_URL, FaqAuthoringPanel, FaqHistoryService, FaqMarkdownRendererService, FaqModal, FaqService, HELP_USAGE, HttpFaqContentLoader, KeyboardShortcutService, Login, MainContent, PublicFaqIndex, PublicFaqPage, PublicFaqToc, RegexValidatorDirective, SHELL_APP_NAME, SHELL_AUTH_URLS, SHELL_COMMANDS, SHELL_MENU_ITEMS, SHELL_POST_LOGIN_ROUTE, Shell, SideMenu, StatusBar, TerminalFocusService, TerminalVisibilityService, ThemeService, ThinkingService, audienceAllowed, authGuard, authInterceptor, buildFallbackChain, guestGuard, provideShellConfig, tokenize };
+export { AuthenticationService, CLEAR_USAGE, CommandRegistryService, CommandService, CommandTerminal, ConfirmDialog, FAQ_CONTENT_LOADER, FAQ_DEV_EDITOR, FAQ_DEV_MODE, FAQ_DEV_WORKSPACE_ROOT, FAQ_PUBLIC_PUBLISHER, FAQ_PUBLIC_SITE_BASE_URL, FaqAuthoringPanel, FaqHistoryService, FaqMarkdownRendererService, FaqModal, FaqService, HELP_USAGE, HttpFaqContentLoader, KeyboardShortcutService, Login, MainContent, PublicFaqIndex, PublicFaqPage, PublicFaqToc, RegexValidatorDirective, SESSION_TOKEN_KEY, SHELL_APP_NAME, SHELL_AUTH_URLS, SHELL_COMMANDS, SHELL_MENU_ITEMS, SHELL_POST_LOGIN_ROUTE, SHELL_SHARED_SESSION, SessionTokenStore, Shell, SideMenu, StatusBar, TerminalFocusService, TerminalVisibilityService, ThemeService, ThinkingService, audienceAllowed, authGuard, authInterceptor, buildFallbackChain, guestGuard, provideShellConfig, tokenize };
 //# sourceMappingURL=franzzemen-brokenstock-shell.mjs.map