@hexclave/js 1.0.49 → 1.0.52

package/dist/lib/hexclave-app/apps/implementations/redirect-loop-breaker.test.js

@@ -0,0 +1,91 @@
+let vitest = require("vitest");
+let __redirect_loop_breaker_js = require("./redirect-loop-breaker.js");
+//#region src/lib/hexclave-app/apps/implementations/redirect-loop-breaker.test.ts
+function createMockSessionStorage() {
+	const map = /* @__PURE__ */ new Map();
+	return {
+		getItem: (key) => map.get(key) ?? null,
+		setItem: (key, value) => {
+			map.set(key, value);
+		},
+		removeItem: (key) => {
+			map.delete(key);
+		}
+	};
+}
+const previousWindow = Reflect.get(globalThis, "window");
+const hadPreviousWindow = Reflect.has(globalThis, "window");
+function record(from, to) {
+	(0, __redirect_loop_breaker_js.recordRedirectAndThrowIfLoopDetected)({
+		currentUrl: new URL(from),
+		targetUrl: new URL(to)
+	});
+}
+(0, vitest.describe)("recordRedirectAndThrowIfLoopDetected", () => {
+	(0, vitest.beforeEach)(() => {
+		Reflect.set(globalThis, "window", { sessionStorage: createMockSessionStorage() });
+		vitest.vi.useFakeTimers();
+		vitest.vi.setSystemTime(/* @__PURE__ */ new Date("2026-01-01T00:00:00Z"));
+	});
+	(0, vitest.afterEach)(() => {
+		vitest.vi.useRealTimers();
+		if (hadPreviousWindow) Reflect.set(globalThis, "window", previousWindow);
+		else Reflect.deleteProperty(globalThis, "window");
+	});
+	(0, vitest.it)("allows distinct redirects in quick succession", () => {
+		for (let i = 0; i < 20; i++) record(`https://app.example.test/page-${i}`, `https://app.example.test/page-${i + 1}`);
+	});
+	(0, vitest.it)("throws once the same redirect repeats 5 times within the window", () => {
+		for (let i = 0; i < 4; i++) {
+			record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+			vitest.vi.advanceTimersByTime(1e3);
+		}
+		(0, vitest.expect)(() => {
+			record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		}).toThrowError(/Redirect loop detected/);
+	});
+	(0, vitest.it)("treats redirects that differ only in query params or hash as identical", () => {
+		for (let i = 0; i < 4; i++) record(`https://app.example.test/dashboard?code=code-${i}`, `https://hosted.example.test/handler/sign-in?state=state-${i}#frag-${i}`);
+		(0, vitest.expect)(() => {
+			record("https://app.example.test/dashboard?code=final", "https://hosted.example.test/handler/sign-in?state=final");
+		}).toThrowError(/Redirect loop detected/);
+	});
+	(0, vitest.it)("does not throw when the identical redirects are spread out beyond the window", () => {
+		for (let i = 0; i < 20; i++) {
+			record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+			vitest.vi.advanceTimersByTime(31e3);
+		}
+	});
+	(0, vitest.it)("allows the same redirect again after a loop was broken", () => {
+		for (let i = 0; i < 4; i++) record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		(0, vitest.expect)(() => {
+			record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		}).toThrowError(/Redirect loop detected/);
+		record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+	});
+	(0, vitest.it)("counts self-redirects (same origin and path) towards loops", () => {
+		for (let i = 0; i < 4; i++) record(`https://hosted.example.test/handler/sign-in?attempt=${i}`, "https://hosted.example.test/handler/sign-in");
+		(0, vitest.expect)(() => {
+			record("https://hosted.example.test/handler/sign-in?attempt=final", "https://hosted.example.test/handler/sign-in");
+		}).toThrowError(/Redirect loop detected/);
+	});
+	(0, vitest.it)("degrades to a no-op when sessionStorage is unavailable", () => {
+		Reflect.set(globalThis, "window", { get sessionStorage() {
+			throw new Error("Storage is disabled");
+		} });
+		for (let i = 0; i < 20; i++) record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+	});
+	(0, vitest.it)("recovers from corrupted breadcrumb storage", () => {
+		const storage = createMockSessionStorage();
+		storage.setItem("hexclave-redirect-loop-breadcrumbs", "{not json");
+		Reflect.set(globalThis, "window", { sessionStorage: storage });
+		record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		for (let i = 0; i < 3; i++) record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		(0, vitest.expect)(() => {
+			record("https://app.example.test/dashboard", "https://hosted.example.test/handler/sign-in");
+		}).toThrowError(/Redirect loop detected/);
+	});
+});
+//#endregion
+
+//# sourceMappingURL=redirect-loop-breaker.test.js.map

package/dist/lib/hexclave-app/apps/implementations/redirect-loop-breaker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-loop-breaker.test.js","names":[],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/redirect-loop-breaker.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { afterEach, beforeEach, describe, expect, it, vi } from \"vitest\";\nimport { recordRedirectAndThrowIfLoopDetected } from \"./redirect-loop-breaker\";\n\nfunction createMockSessionStorage() {\n  const map = new Map<string, string>();\n  return {\n    getItem: (key: string) => map.get(key) ?? null,\n    setItem: (key: string, value: string) => {\n      map.set(key, value);\n    },\n    removeItem: (key: string) => {\n      map.delete(key);\n    },\n  };\n}\n\nconst previousWindow = Reflect.get(globalThis, \"window\");\nconst hadPreviousWindow = Reflect.has(globalThis, \"window\");\n\nfunction record(from: string, to: string) {\n  recordRedirectAndThrowIfLoopDetected({\n    currentUrl: new URL(from),\n    targetUrl: new URL(to),\n  });\n}\n\ndescribe(\"recordRedirectAndThrowIfLoopDetected\", () => {\n  beforeEach(() => {\n    Reflect.set(globalThis, \"window\", { sessionStorage: createMockSessionStorage() });\n    vi.useFakeTimers();\n    vi.setSystemTime(new Date(\"2026-01-01T00:00:00Z\"));\n  });\n\n  afterEach(() => {\n    vi.useRealTimers();\n    if (hadPreviousWindow) {\n      Reflect.set(globalThis, \"window\", previousWindow);\n    } else {\n      Reflect.deleteProperty(globalThis, \"window\");\n    }\n  });\n\n  it(\"allows distinct redirects in quick succession\", () => {\n    for (let i = 0; i < 20; i++) {\n      record(`https://app.example.test/page-${i}`, `https://app.example.test/page-${i + 1}`);\n    }\n  });\n\n  it(\"throws once the same redirect repeats 5 times within the window\", () => {\n    for (let i = 0; i < 4; i++) {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n      vi.advanceTimersByTime(1000);\n    }\n    expect(() => {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }).toThrowError(/Redirect loop detected/);\n  });\n\n  it(\"treats redirects that differ only in query params or hash as identical\", () => {\n    // Real loops usually rotate nonce-style params (code, state, after_auth_return_to) each cycle.\n    for (let i = 0; i < 4; i++) {\n      record(\n        `https://app.example.test/dashboard?code=code-${i}`,\n        `https://hosted.example.test/handler/sign-in?state=state-${i}#frag-${i}`,\n      );\n    }\n    expect(() => {\n      record(\"https://app.example.test/dashboard?code=final\", \"https://hosted.example.test/handler/sign-in?state=final\");\n    }).toThrowError(/Redirect loop detected/);\n  });\n\n  it(\"does not throw when the identical redirects are spread out beyond the window\", () => {\n    for (let i = 0; i < 20; i++) {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n      vi.advanceTimersByTime(31_000);\n    }\n  });\n\n  it(\"allows the same redirect again after a loop was broken\", () => {\n    for (let i = 0; i < 4; i++) {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }\n    expect(() => {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }).toThrowError(/Redirect loop detected/);\n    // The breadcrumbs for the broken loop are dropped, so a manual retry isn't instantly blocked.\n    record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n  });\n\n  it(\"counts self-redirects (same origin and path) towards loops\", () => {\n    for (let i = 0; i < 4; i++) {\n      record(`https://hosted.example.test/handler/sign-in?attempt=${i}`, \"https://hosted.example.test/handler/sign-in\");\n    }\n    expect(() => {\n      record(\"https://hosted.example.test/handler/sign-in?attempt=final\", \"https://hosted.example.test/handler/sign-in\");\n    }).toThrowError(/Redirect loop detected/);\n  });\n\n  it(\"degrades to a no-op when sessionStorage is unavailable\", () => {\n    Reflect.set(globalThis, \"window\", {\n      get sessionStorage(): Storage {\n        throw new Error(\"Storage is disabled\");\n      },\n    });\n    for (let i = 0; i < 20; i++) {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }\n  });\n\n  it(\"recovers from corrupted breadcrumb storage\", () => {\n    const storage = createMockSessionStorage();\n    storage.setItem(\"hexclave-redirect-loop-breadcrumbs\", \"{not json\");\n    Reflect.set(globalThis, \"window\", { sessionStorage: storage });\n    record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    // After recovery, loop detection works again.\n    for (let i = 0; i < 3; i++) {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }\n    expect(() => {\n      record(\"https://app.example.test/dashboard\", \"https://hosted.example.test/handler/sign-in\");\n    }).toThrowError(/Redirect loop detected/);\n  });\n});\n"],"mappings":";;;AAOA,SAAS,2BAA2B;CAClC,MAAM,sBAAM,IAAI,IAAoB;CACpC,OAAO;EACL,UAAU,QAAgB,IAAI,IAAI,GAAG,KAAK;EAC1C,UAAU,KAAa,UAAkB;GACvC,IAAI,IAAI,KAAK,KAAK;EACpB;EACA,aAAa,QAAgB;GAC3B,IAAI,OAAO,GAAG;EAChB;CACF;AACF;AAEA,MAAM,iBAAiB,QAAQ,IAAI,YAAY,QAAQ;AACvD,MAAM,oBAAoB,QAAQ,IAAI,YAAY,QAAQ;AAE1D,SAAS,OAAO,MAAc,IAAY;CACxC,CAAA,GAAA,2BAAA,qCAAA,CAAqC;EACnC,YAAY,IAAI,IAAI,IAAI;EACxB,WAAW,IAAI,IAAI,EAAE;CACvB,CAAC;AACH;qBAES,8CAA8C;CACrD,CAAA,GAAA,OAAA,WAAA,OAAiB;EACf,QAAQ,IAAI,YAAY,UAAU,EAAE,gBAAgB,yBAAyB,EAAE,CAAC;EAChF,OAAA,GAAG,cAAc;EACjB,OAAA,GAAG,8BAAc,IAAI,KAAK,sBAAsB,CAAC;CACnD,CAAC;CAED,CAAA,GAAA,OAAA,UAAA,OAAgB;EACd,OAAA,GAAG,cAAc;EACjB,IAAI,mBACF,QAAQ,IAAI,YAAY,UAAU,cAAc;OAEhD,QAAQ,eAAe,YAAY,QAAQ;CAE/C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,uDAAuD;EACxD,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KACtB,OAAO,iCAAiC,KAAK,iCAAiC,IAAI,GAAG;CAEzF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,yEAAyE;EAC1E,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;GAC1B,OAAO,sCAAsC,6CAA6C;GAC1F,OAAA,GAAG,oBAAoB,GAAI;EAC7B;EACA,CAAA,GAAA,OAAA,OAAA,OAAa;GACX,OAAO,sCAAsC,6CAA6C;EAC5F,CAAC,CAAC,CAAC,aAAa,wBAAwB;CAC1C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,gFAAgF;EAEjF,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,OACE,gDAAgD,KAChD,2DAA2D,EAAE,QAAQ,GACvE;EAEF,CAAA,GAAA,OAAA,OAAA,OAAa;GACX,OAAO,iDAAiD,yDAAyD;EACnH,CAAC,CAAC,CAAC,aAAa,wBAAwB;CAC1C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,sFAAsF;EACvF,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,OAAO,sCAAsC,6CAA6C;GAC1F,OAAA,GAAG,oBAAoB,IAAM;EAC/B;CACF,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,gEAAgE;EACjE,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,OAAO,sCAAsC,6CAA6C;EAE5F,CAAA,GAAA,OAAA,OAAA,OAAa;GACX,OAAO,sCAAsC,6CAA6C;EAC5F,CAAC,CAAC,CAAC,aAAa,wBAAwB;EAExC,OAAO,sCAAsC,6CAA6C;CAC5F,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oEAAoE;EACrE,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,OAAO,uDAAuD,KAAK,6CAA6C;EAElH,CAAA,GAAA,OAAA,OAAA,OAAa;GACX,OAAO,6DAA6D,6CAA6C;EACnH,CAAC,CAAC,CAAC,aAAa,wBAAwB;CAC1C,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,gEAAgE;EACjE,QAAQ,IAAI,YAAY,UAAU,EAChC,IAAI,iBAA0B;GAC5B,MAAM,IAAI,MAAM,qBAAqB;EACvC,EACF,CAAC;EACD,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KACtB,OAAO,sCAAsC,6CAA6C;CAE9F,CAAC;CAED,CAAA,GAAA,OAAA,GAAA,CAAG,oDAAoD;EACrD,MAAM,UAAU,yBAAyB;EACzC,QAAQ,QAAQ,sCAAsC,WAAW;EACjE,QAAQ,IAAI,YAAY,UAAU,EAAE,gBAAgB,QAAQ,CAAC;EAC7D,OAAO,sCAAsC,6CAA6C;EAE1F,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KACrB,OAAO,sCAAsC,6CAA6C;EAE5F,CAAA,GAAA,OAAA,OAAA,OAAa;GACX,OAAO,sCAAsC,6CAA6C;EAC5F,CAAC,CAAC,CAAC,aAAa,wBAAwB;CAC1C,CAAC;AACH,CAAC"}

package/dist/lib/hexclave-app/apps/implementations/server-app-impl.d.ts

@@ -1,2 +1,2 @@
-import { n as _HexclaveServerAppImplIncomplete } from "../../../../admin-app-impl-Du4dsPO9.js";
+import { n as _HexclaveServerAppImplIncomplete } from "../../../../admin-app-impl-DHs4il4z.js";
 export { _HexclaveServerAppImplIncomplete };

package/dist/lib/hexclave-app/apps/implementations/server-app-impl.js

@@ -4,6 +4,7 @@ let _hexclave_shared = require("@hexclave/shared");
 let _hexclave_shared_dist_utils_results = require("@hexclave/shared/dist/utils/results");
 let __common_js = require("./common.js");
 let _hexclave_shared_dist_sessions = require("@hexclave/shared/dist/sessions");
+let _hexclave_shared_dist_utils_uuids = require("@hexclave/shared/dist/utils/uuids");
 let _simplewebauthn_browser = require("@simplewebauthn/browser");
 let ____________utils_url_js = require("../../../../utils/url.js");
 let ______api_keys_index_js = require("../../api-keys/index.js");
@@ -217,6 +218,15 @@ var _HexclaveServerAppImplIncomplete = class extends __client_app_impl_js._Hexcl
 				query
 			});
 		});
+		this._serverTeamCache = (0, __common_js.createCache)(async ([teamId]) => {
+			if (!(0, _hexclave_shared_dist_utils_uuids.isUuid)(teamId)) return null;
+			try {
+				return await this._interface.getServerTeam(teamId);
+			} catch (error) {
+				if (_hexclave_shared.KnownErrors.TeamNotFound.isInstance(error)) return null;
+				throw error;
+			}
+		});
 		this._serverUserTeamInvitationsCache = (0, __common_js.createCache)(async ([userId]) => {
 			return await this._interface.listServerUserTeamInvitations(userId);
 		});
@@ -710,11 +720,19 @@ var _HexclaveServerAppImplIncomplete = class extends __client_app_impl_js._Hexcl
 			serverMetadata: crud.server_metadata,
 			async update(update) {
 				await app._interface.updateServerTeam(crud.id, (0, ______teams_index_js.serverTeamUpdateOptionsToCrud)(update));
-				await Promise.all([app._serverTeamsCache.refreshWhere(() => true), app._serverUsersCache.refreshWhere(() => true)]);
+				await Promise.all([
+					app._serverTeamCache.refresh([crud.id]),
+					app._serverTeamsCache.refreshWhere(() => true),
+					app._serverUsersCache.refreshWhere(() => true)
+				]);
 			},
 			async delete() {
 				await app._interface.deleteServerTeam(crud.id);
-				await Promise.all([app._serverTeamsCache.refreshWhere(() => true), app._serverUsersCache.refreshWhere(() => true)]);
+				await Promise.all([
+					app._serverTeamCache.refresh([crud.id]),
+					app._serverTeamsCache.refreshWhere(() => true),
+					app._serverUsersCache.refreshWhere(() => true)
+				]);
 			},
 			async listUsers() {
 				return _hexclave_shared_dist_utils_results.Result.orThrow(await app._serverTeamMemberProfilesCache.getOrWait([crud.id], "write-only")).map((u) => app._serverTeamUserFromCrud(u));
@@ -1011,6 +1029,7 @@ var _HexclaveServerAppImplIncomplete = class extends __client_app_impl_js._Hexcl
 	}
 	async createTeam(data) {
 		const team = await this._interface.createServerTeam((0, ______teams_index_js.serverTeamCreateOptionsToCrud)(data));
+		await this._serverTeamCache.refresh([team.id]);
 		await this._serverTeamsCache.refreshWhere(() => true);
 		return this._serverTeamFromCrud(team);
 	}
@@ -1038,7 +1057,9 @@ var _HexclaveServerAppImplIncomplete = class extends __client_app_impl_js._Hexcl
 		if (typeof options === "object" && "apiKey" in options) return await this._getTeamByApiKey(options.apiKey);
 		else {
 			const teamId = options;
-			return (await this.listTeams()).find((t) => t.id === teamId) ?? null;
+			if (teamId == null) return null;
+			const team = _hexclave_shared_dist_utils_results.Result.orThrow(await this._serverTeamCache.getOrWait([teamId], "write-only"));
+			return team == null ? null : this._serverTeamFromCrud(team);
 		}
 	}
 	_createServerDataVaultStore(id) {