@liveblocks/core 1.3.1 → 1.3.2

package/dist/index.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "1.3.1";
+var PKG_VERSION = "1.3.2";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -1281,6 +1281,7 @@ function parseAuthToken(rawTokenString) {
 // src/auth-manager.ts
 function createAuthManager(authOptions) {
   const authentication = prepareAuthentication(authOptions);
+  const seenTokens = /* @__PURE__ */ new Set();
   const tokens = [];
   const expiryTimes = [];
   const requestPromises = /* @__PURE__ */ new Map();
@@ -1304,8 +1305,6 @@ function createAuthManager(authOptions) {
       }
       if (token.parsed.k === "id" /* ID_TOKEN */) {
         return token;
-      } else if (token.parsed.k === "sec-legacy" /* SECRET_LEGACY */) {
-        return void 0;
       } else if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
         for (const [resource, scopes] of Object.entries(token.parsed.perms)) {
           if (resource.includes("*") && roomId.startsWith(resource.replace("*", "")) || roomId === resource && hasCorrespondingScopes(requestedScope, scopes)) {
@@ -1327,7 +1326,13 @@ function createAuthManager(authOptions) {
       const response = await fetchAuthEndpoint(fetcher, authentication.url, {
         room: roomId
       });
-      return parseAuthToken(response.token);
+      const parsed = parseAuthToken(response.token);
+      if (seenTokens.has(parsed.raw)) {
+        throw new StopRetrying(
+          "The same Liveblocks auth token was issued from the backend before. Caching Liveblocks tokens is not supported."
+        );
+      }
+      return parsed;
     }
     if (authentication.type === "custom") {
       const response = await authentication.callback(roomId);
@@ -1368,8 +1373,11 @@ function createAuthManager(authOptions) {
       const token = await currentPromise;
       const BUFFER = 30;
       const expiresAt = Math.floor(Date.now() / 1e3) + (token.parsed.exp - token.parsed.iat) - BUFFER;
-      tokens.push(token);
-      expiryTimes.push(expiresAt);
+      seenTokens.add(token.raw);
+      if (token.parsed.k !== "sec-legacy" /* SECRET_LEGACY */) {
+        tokens.push(token);
+        expiryTimes.push(expiresAt);
+      }
       return { type: "secret", token };
     } finally {
       requestPromises.delete(roomId);