@iblai/data-layer 1.13.0 → 1.13.2

package/dist/index.js

@@ -39144,6 +39144,12 @@ Config.axdUrl = 'https://base.manager.iblai.app';
 Config.mentorIframeUrl = 'https://mentor.iblai.tech';
 Config.studioUrl = 'https://studio.iblai.app';
 Config.httpErrorHandlers = {};
+/**
+ * Optional override for how expired auth tokens are re-minted after a 401.
+ * Resolve `true` once fresh tokens are in storage. Left unset, the data
+ * layer mints them itself from the edX session.
+ */
+Config.refreshAuthToken = undefined;
 
 class IblDataLayer {
 }
@@ -39198,6 +39204,133 @@ const iblFakeBaseQuery = react.retry(fakeBaseQueryWithLogging, {
     },
 });
 
+const AUTH_ENDPOINTS = {
+    GET_MFE_CONTEXT: {
+        service: exports.SERVICES.LMS,
+        path: () => `/api/mfe_context`,
+    },
+    APPLE_EXCHANGE_TOKEN: {
+        service: exports.SERVICES.LMS,
+        path: () => `/oauth2/exchange_access_token/apple-id/`,
+    },
+    GET_APP_TOKENS: {
+        service: exports.SERVICES.LMS,
+        path: () => '/api/ibl/manager/consolidated-token/proxy/',
+    },
+    REFRESH_JWT_TOKEN: {
+        service: exports.SERVICES.LEGACY_LMS,
+        path: () => '/ibl-auth/request-jwt/',
+    },
+};
+const AUTH_REDUCER_PATH = 'authApiSlice';
+
+/**
+ * Expiry keys are written alongside the tokens so `hasNonExpiredAuthToken()`
+ * and friends don't treat a freshly minted token as stale.
+ */
+const AXD_TOKEN_EXPIRES_KEY = 'axd_token_expires';
+const DM_TOKEN_EXPIRES_KEY = 'dm_token_expires';
+/** Reads the platform key the tokens should be minted for. */
+const readPlatformKey = async () => {
+    var _a;
+    const storage = IblDataLayer.storage;
+    if (!storage)
+        return null;
+    const raw = await storage.getItem(STORAGE_KEYS.CURRENT_TENANT);
+    if (raw) {
+        try {
+            const key = (_a = JSON.parse(raw)) === null || _a === void 0 ? void 0 : _a.key;
+            if (key)
+                return key;
+        }
+        catch (_b) {
+            // `current_tenant` is occasionally stored as a bare slug rather than the
+            // serialised tenant object; use it as-is.
+            if (raw.trim())
+                return raw;
+        }
+    }
+    return (await storage.getItem(STORAGE_KEYS.TENANT)) || null;
+};
+/**
+ * Mints a fresh set of app tokens from the edX session and writes them to
+ * storage. Deliberately uses `fetch` rather than the data layer's own base
+ * query: routing it through `iblFetchBaseQuery` would re-enter the 401
+ * handling this function exists to serve.
+ */
+const defaultRefreshAuthToken = async () => {
+    var _a, _b;
+    const storage = IblDataLayer.storage;
+    if (!storage)
+        return false;
+    const platformKey = await readPlatformKey();
+    if (!platformKey) {
+        console.warn('[token-refresh] No platform key in storage, cannot refresh');
+        return false;
+    }
+    // The consolidated-token endpoint authenticates with the edX JWT, not with
+    // the axd/dm tokens that just expired.
+    const authHeaders = await getHeaders(AUTH_ENDPOINTS.GET_APP_TOKENS.service);
+    if (!(authHeaders === null || authHeaders === void 0 ? void 0 : authHeaders.Authorization)) {
+        console.warn('[token-refresh] No edX token available, cannot refresh');
+        return false;
+    }
+    const formData = new FormData();
+    formData.append('platform_key', platformKey);
+    const url = `${getServiceUrl(AUTH_ENDPOINTS.GET_APP_TOKENS.service)}${AUTH_ENDPOINTS.GET_APP_TOKENS.path()}`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { Authorization: authHeaders.Authorization },
+        body: formData,
+    });
+    if (!response.ok) {
+        console.warn(`[token-refresh] Mint failed with ${response.status}`);
+        return false;
+    }
+    const body = (await response.json());
+    const axdToken = (_a = body === null || body === void 0 ? void 0 : body.data) === null || _a === void 0 ? void 0 : _a.axd_token;
+    const dmToken = (_b = body === null || body === void 0 ? void 0 : body.data) === null || _b === void 0 ? void 0 : _b.dm_token;
+    if (!(axdToken === null || axdToken === void 0 ? void 0 : axdToken.token) || !(dmToken === null || dmToken === void 0 ? void 0 : dmToken.token)) {
+        console.warn('[token-refresh] Mint returned no tokens');
+        return false;
+    }
+    await storage.setItem(STORAGE_KEYS.AXD_TOKEN_KEY, axdToken.token);
+    await storage.setItem(STORAGE_KEYS.DM_TOKEN_KEY, dmToken.token);
+    if (axdToken.expires) {
+        await storage.setItem(AXD_TOKEN_EXPIRES_KEY, axdToken.expires);
+    }
+    if (dmToken.expires) {
+        await storage.setItem(DM_TOKEN_EXPIRES_KEY, dmToken.expires);
+    }
+    return true;
+};
+/** The refresh currently in flight, if any. */
+let refreshInFlight = null;
+/**
+ * Refreshes the auth tokens, collapsing concurrent callers onto one request.
+ * A page load that fires ten requests in parallel produces ten 401s; without
+ * this they would mint ten token sets and race each other into storage.
+ *
+ * Never rejects — a thrown refresh resolves `false`, which callers read as
+ * "give up and run the registered 401 handler" (i.e. log out).
+ */
+const refreshAuthTokenOnce = async () => {
+    var _a;
+    if (!refreshInFlight) {
+        const refresh = (_a = Config.refreshAuthToken) !== null && _a !== void 0 ? _a : defaultRefreshAuthToken;
+        refreshInFlight = Promise.resolve()
+            .then(() => refresh())
+            .catch((error) => {
+            console.error('[token-refresh] Refresh threw:', error);
+            return false;
+        })
+            .finally(() => {
+            refreshInFlight = null;
+        });
+    }
+    return refreshInFlight;
+};
+
 /**
  * Get the service URL based on the provided service type.
  */
@@ -39292,6 +39425,7 @@ const buildEndpointFromService = (service, serviceFn, options) => {
         async queryFn(args) {
             var _a;
             let lastError;
+            let refreshAttempted = false;
             for (let attempt = 0; attempt <= maxRetries; attempt++) {
                 try {
                     OpenAPI.BASE = getServiceUrl(service);
@@ -39303,6 +39437,17 @@ const buildEndpointFromService = (service, serviceFn, options) => {
                 catch (err) {
                     lastError = err;
                     const status = err === null || err === void 0 ? void 0 : err.status;
+                    // An expired token is recoverable: mint a new one and replay the
+                    // call (headers are rebuilt at the top of the loop) rather than
+                    // dropping straight to the 401 handler, which logs the user out.
+                    // One attempt per call, so a token the server keeps rejecting can't
+                    // loop.
+                    if (status === 401 && !refreshAttempted) {
+                        refreshAttempted = true;
+                        if (await refreshAuthTokenOnce()) {
+                            continue;
+                        }
+                    }
                     // Don't retry auth errors, statuses the endpoint expects as an
                     // empty state, or a spend-cap block (fail fast — no retry storm).
                     if (QUERYFN_NON_RETRYABLE_STATUSES.includes(status) ||
@@ -39457,10 +39602,23 @@ const withNonRetryableErrors = (query$1) => async (args, api, extraOptions) => {
 const iblFetchBaseQuery = async (args, api, extraOptions) => {
     var _a, _b, _c;
     try {
+        const runQuery = () => {
+            var _a;
+            return query.retry(withNonRetryableErrors(baseQuery(args.service, (_a = args === null || args === void 0 ? void 0 : args.isJson) !== null && _a !== void 0 ? _a : true, args === null || args === void 0 ? void 0 : args.contentType, args === null || args === void 0 ? void 0 : args.skipAuth)), {
+                maxRetries: 3,
+            })(args, api, extraOptions);
+        };
         // Executing base query
-        const result = await query.retry(withNonRetryableErrors(baseQuery(args.service, (_a = args === null || args === void 0 ? void 0 : args.isJson) !== null && _a !== void 0 ? _a : true, args === null || args === void 0 ? void 0 : args.contentType, args === null || args === void 0 ? void 0 : args.skipAuth)), {
-            maxRetries: 3,
-        })(args, api, extraOptions);
+        let result = await runQuery();
+        // An expired token is recoverable: mint a new one and replay the request
+        // (`prepareHeaders` re-reads storage per call) rather than dropping
+        // straight to the 401 handler, which logs the user out. One attempt per
+        // request, so a token the server keeps rejecting can't loop.
+        if (((_a = result.error) === null || _a === void 0 ? void 0 : _a.status) === 401 && !(args === null || args === void 0 ? void 0 : args.skipAuth)) {
+            if (await refreshAuthTokenOnce()) {
+                result = await runQuery();
+            }
+        }
         // Query completed
         if (result.error) {
             console.log('[MONETIZATION ERROR HANDLER]: ', { result });
@@ -39534,6 +39692,7 @@ const buildEndpointFromServiceLegacy = (service, serviceFn, options) => {
     return {
         async queryFn(args) {
             let lastError;
+            let refreshAttempted = false;
             for (let attempt = 0; attempt <= maxRetries; attempt++) {
                 try {
                     OpenAPI.BASE = getServiceUrl(service);
@@ -39545,6 +39704,14 @@ const buildEndpointFromServiceLegacy = (service, serviceFn, options) => {
                 catch (err) {
                     lastError = err;
                     const status = err === null || err === void 0 ? void 0 : err.status;
+                    // See the note in `buildEndpointFromService`: refresh once and
+                    // replay before letting a 401 reach the logout handler.
+                    if (status === 401 && !refreshAttempted) {
+                        refreshAttempted = true;
+                        if (await refreshAuthTokenOnce()) {
+                            continue;
+                        }
+                    }
                     if (QUERYFN_NON_RETRYABLE_STATUSES.includes(status) ||
                         expectedErrorStatuses.includes(status)) {
                         break;
@@ -40229,26 +40396,6 @@ const promptsApiSlice = react.createApi({
 });
 const { useGetPromptCategoriesQuery, useLazyGetPromptCategoriesQuery, useGetPromptsQuery, useLazyGetPromptsQuery, useGetPromptsSearchQuery, useLazyGetPromptsSearchQuery, useCreatePromptMutation, useUpdatePromptMutation, useDeletePromptMutation, useGetGuidedPromptsQuery, useLazyGetGuidedPromptsQuery, } = promptsApiSlice;
 
-const AUTH_ENDPOINTS = {
-    GET_MFE_CONTEXT: {
-        service: exports.SERVICES.LMS,
-        path: () => `/api/mfe_context`,
-    },
-    APPLE_EXCHANGE_TOKEN: {
-        service: exports.SERVICES.LMS,
-        path: () => `/oauth2/exchange_access_token/apple-id/`,
-    },
-    GET_APP_TOKENS: {
-        service: exports.SERVICES.LMS,
-        path: () => '/api/ibl/manager/consolidated-token/proxy/',
-    },
-    REFRESH_JWT_TOKEN: {
-        service: exports.SERVICES.LEGACY_LMS,
-        path: () => '/ibl-auth/request-jwt/',
-    },
-};
-const AUTH_REDUCER_PATH = 'authApiSlice';
-
 const authApiSlice = react.createApi({
     reducerPath: AUTH_REDUCER_PATH,
     baseQuery: iblFetchBaseQuery,
@@ -48208,7 +48355,7 @@ const skillsMiddleware = [
     userChatHistoryApiSlice.middleware,
 ];
 
-const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl) => {
+const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpErrorHandler = {}, studioUrl, refreshAuthToken) => {
     IblDataLayer.storage = storageService;
     Config.dmUrl = dmUrl;
     Config.lmsUrl = lmsUrl;
@@ -48217,6 +48364,7 @@ const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpEr
     if (studioUrl) {
         Config.studioUrl = studioUrl;
     }
+    Config.refreshAuthToken = refreshAuthToken;
 };
 
 exports.AGENT_SKILLS_ENDPOINTS = AGENT_SKILLS_ENDPOINTS;