@masterteam/gateway-auth 0.0.21 → 0.0.23

package/fesm2022/masterteam-gateway-auth.mjs

@@ -1,11 +1,12 @@
-import { firstValueFrom, EMPTY, of, defer, from, isObservable, map, tap as tap$1, shareReplay, finalize, catchError as catchError$1, throwError, switchMap as switchMap$1 } from 'rxjs';
-import { HttpClient, HttpContextToken, HttpBackend } from '@angular/common/http';
+import { firstValueFrom, EMPTY, of, defer, from, isObservable, map, tap as tap$1, catchError as catchError$1, throwError, switchMap as switchMap$1 } from 'rxjs';
+import { HttpClient, HttpContextToken, HttpBackend, HttpResponse } from '@angular/common/http';
 import * as i0 from '@angular/core';
 import { InjectionToken, inject, Injectable, computed, input, ChangeDetectionStrategy, Component, signal, effect } from '@angular/core';
 import { Action, Selector, State, Store, select } from '@ngxs/store';
 import { Router, ActivatedRoute } from '@angular/router';
 import { ModalService } from '@masterteam/components/modal';
 import { switchMap, mergeMap, catchError, tap } from 'rxjs/operators';
+import { ToastService } from '@masterteam/components/toast';
 import * as i2 from '@angular/common';
 import { NgTemplateOutlet, CommonModule } from '@angular/common';
 import * as i1 from '@angular/forms';
@@ -1465,6 +1466,9 @@ const runWithRefreshLock = (scopeKey, operation) => {
 };
 const GATEWAY_REFRESH_SCOPE = 'gateway';
 const inflightRefreshByScope = new Map();
+const refreshScopeKey = (scope, applicationCode) => scope === 'gateway'
+    ? GATEWAY_REFRESH_SCOPE
+    : `application:${applicationCode ?? ''}`;
 const getCurrentAuthTokens = (auth) => {
     const accessToken = auth.token();
     const refreshToken = auth.refreshToken();
@@ -1581,20 +1585,22 @@ const executeRefresh = (context, refreshToken) => {
         })));
     });
 };
-const refreshTokens$ = (context, refreshToken) => {
-    const scopeKey = context.scope === 'gateway'
-        ? GATEWAY_REFRESH_SCOPE
-        : `application:${context.applicationCode ?? ''}`;
+const refreshAccessToken = (context, refreshToken) => {
+    const scopeKey = refreshScopeKey(context.scope, context.applicationCode);
     const existing = inflightRefreshByScope.get(scopeKey);
     if (existing) {
         return existing;
     }
-    const observable = from(executeRefresh(context, refreshToken)).pipe(shareReplay({ bufferSize: 1, refCount: true }), finalize(() => {
-        inflightRefreshByScope.delete(scopeKey);
-    }));
-    inflightRefreshByScope.set(scopeKey, observable);
-    return observable;
+    const promise = executeRefresh(context, refreshToken);
+    inflightRefreshByScope.set(scopeKey, promise);
+    promise.finally(() => {
+        if (inflightRefreshByScope.get(scopeKey) === promise) {
+            inflightRefreshByScope.delete(scopeKey);
+        }
+    });
+    return promise;
 };
+const refreshTokens$ = (context, refreshToken) => from(refreshAccessToken(context, refreshToken));
 const prepareRequest = (req, token, markRetried, baseUrl) => {
     let modifiedReq = req;
     if (token) {
@@ -1717,10 +1723,20 @@ const gatewayAuthInterceptor = (req, next) => {
             return throwError(() => refreshError);
         }), switchMap$1((tokens) => next(prepareRequest(req, tokens.accessToken, true, baseUrl))));
     }
+    const initialAccessToken = accessToken;
     return next(prepareRequest(req, tokenToAttach, false, baseUrl)).pipe(catchError$1((error) => {
         if (error?.status !== 401 || isAuthRequest || alreadyRetried) {
             return throwError(() => error);
         }
+        // If a concurrent flow already rotated the token while this request was
+        // in flight, just retry with the freshest token — do NOT trigger another
+        // refresh against the backend.
+        const currentAccessToken = resolved.scope === 'application' && resolved.applicationCode
+            ? (auth.getAppSession(resolved.applicationCode)?.accessToken ?? null)
+            : auth.token();
+        if (currentAccessToken && currentAccessToken !== initialAccessToken) {
+            return next(prepareRequest(req, currentAccessToken, true, baseUrl));
+        }
         const latestAppSession = resolved.scope === 'application' && resolved.applicationCode
             ? auth.getAppSession(resolved.applicationCode)
             : null;
@@ -1752,6 +1768,199 @@ const gatewayAuthInterceptor = (req, next) => {
     }));
 };
 
+const CORRELATION_ID_HEADER = 'X-Correlation-ID';
+function generateCorrelationId() {
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+        return crypto.randomUUID();
+    }
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (char) => {
+        const random = (Math.random() * 16) | 0;
+        const value = char === 'x' ? random : (random & 0x3) | 0x8;
+        return value.toString(16);
+    });
+}
+const correlationIdInterceptor = (req, next) => {
+    if (req.headers.has(CORRELATION_ID_HEADER)) {
+        return next(req);
+    }
+    return next(req.clone({
+        setHeaders: {
+            [CORRELATION_ID_HEADER]: generateCorrelationId(),
+        },
+    }));
+};
+
+const DEFAULT_EXCLUDED_PATHS = [
+    '/health',
+    '/auth/login',
+    '/auth/refresh',
+    '/auth/logout',
+    '/auth/register',
+    '/auth/sso',
+    '/swagger',
+];
+const DEFAULT_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+const DEFAULT_HEADER = 'X-Idempotency-Key';
+function generateUUID() {
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+        return crypto.randomUUID();
+    }
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+function createIdempotencyInterceptor(options) {
+    const excludedPaths = options?.excludedPaths ?? DEFAULT_EXCLUDED_PATHS;
+    const methods = (options?.methods ?? DEFAULT_METHODS).map((m) => m.toUpperCase());
+    const header = options?.headerName ?? DEFAULT_HEADER;
+    const requiresKey = (req) => {
+        if (!methods.includes(req.method.toUpperCase()))
+            return false;
+        if (req.url.includes('/assets/'))
+            return false;
+        if (excludedPaths.some((path) => req.url.includes(path)))
+            return false;
+        return true;
+    };
+    return (req, next) => {
+        if (!requiresKey(req) || req.headers.has(header)) {
+            return next(req);
+        }
+        return next(req.clone({
+            setHeaders: { [header]: generateUUID() },
+        }));
+    };
+}
+const idempotencyInterceptor = createIdempotencyInterceptor();
+
+function createLanguageInterceptor(options) {
+    const header = options.headerName ?? 'Accept-Language';
+    return (req, next) => {
+        const lang = options.getLanguage();
+        if (!lang) {
+            return next(req);
+        }
+        return next(req.clone({
+            setHeaders: { [header]: lang },
+        }));
+    };
+}
+
+const DEFAULT_MUTATING_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+const DEFAULT_SILENT_ENDPOINTS = [
+    'api/dashboards/chart',
+    'api/home/recent/visit',
+    'api/fetch/query',
+    'api/workcenter/runtime',
+    'api/search',
+    'api/process-form-load',
+    '/workspace-record-action-states',
+    '/schedule/read',
+    '/metadata/modules/properties',
+    '/auth/logout',
+    '/auth/login',
+    '/auth/2fa',
+    '/auth/sso',
+    '/schedule/query',
+    '/context/resolve',
+    'read-state',
+    'process-submit/validate',
+    'api/formulas/validate',
+];
+const DEFAULT_NO_MESSAGE_HEADER = 'noMessage';
+function createMessageInterceptor(options) {
+    const silentEndpoints = options?.silentEndpoints ?? DEFAULT_SILENT_ENDPOINTS;
+    const mutating = (options?.mutatingMethods ?? DEFAULT_MUTATING_METHODS).map((m) => m.toUpperCase());
+    const noMessageHeader = options?.noMessageHeader ?? DEFAULT_NO_MESSAGE_HEADER;
+    return (req, next) => {
+        const auth = inject(GatewayAuthFacade);
+        const toast = inject(ToastService);
+        return next(req).pipe(tap$1({
+            next: (res) => {
+                const body = res
+                    ?.body;
+                if (!body?.message)
+                    return;
+                if (req.headers.get(noMessageHeader) === 'true')
+                    return;
+                if (!mutating.includes(req.method.toUpperCase()))
+                    return;
+                if (silentEndpoints.some((endpoint) => req.url.includes(endpoint)))
+                    return;
+                toast.success(body.message);
+            },
+            error: (error) => {
+                const errorMessage = error?.error?.message || error?.error?.Message || '';
+                const errorCode = error?.status || error?.error?.status || error?.error?.code;
+                const showError = (message) => {
+                    if (message)
+                        toast.error(message);
+                };
+                const canRefreshGateway = !!auth.refreshToken() && !isExpired(auth.refreshTokenExpiresAt());
+                const activeCode = auth.activeApplicationCode();
+                const appSession = activeCode ? auth.getAppSession(activeCode) : null;
+                const canRefreshApp = !!appSession?.refreshToken &&
+                    !isExpired(appSession.refreshTokenExpiresAt);
+                switch (errorCode) {
+                    case 401:
+                        if (!isGatewayAuthRequestUrl(req.url) &&
+                            (canRefreshGateway || canRefreshApp)) {
+                            break;
+                        }
+                        auth.logout();
+                        showError(errorMessage);
+                        break;
+                    case 404:
+                        if (req?.responseType !== 'blob') {
+                            showError(errorMessage);
+                        }
+                        break;
+                    case 400: {
+                        const validationErrors = error?.error?.errors;
+                        if (validationErrors && typeof validationErrors === 'object') {
+                            const messages = Object.values(validationErrors)
+                                .flat()
+                                .filter((m) => typeof m === 'string');
+                            messages.forEach(showError);
+                        }
+                        else {
+                            showError(errorMessage);
+                        }
+                        break;
+                    }
+                    case 402:
+                    case 403:
+                    case 422:
+                    case 500:
+                        showError(errorMessage);
+                        break;
+                    default:
+                        if (req.headers.get(noMessageHeader) !== 'true') {
+                            showError(errorMessage);
+                        }
+                        break;
+                }
+            },
+        }));
+    };
+}
+const messageInterceptor = createMessageInterceptor();
+
+function createCacheSessionInterceptor(options) {
+    const field = options.field ?? 'cacheSession';
+    return (req, next) => next(req).pipe(tap$1((event) => {
+        if (!(event instanceof HttpResponse) || !event.body)
+            return;
+        const body = event.body;
+        const value = body[field];
+        if (typeof value === 'string' && value) {
+            options.onCacheSession(value);
+        }
+    }));
+}
+
 class GatewaySsoButtons {
     authFacade = inject(GatewayAuthFacade);
     options = inject(GATEWAY_AUTH_OPTIONS);
@@ -2097,5 +2306,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.8", ngImpor
  * Generated bundle index. Do not edit.
  */
 
-export { AUTH_STATE_DEFAULTS, ClearAllAppSessions, ClearAppSession, ClearError, ClearPendingMfa, ClearRateLimit, ExchangeSsoCode, GATEWAY_AUTH_ACCESS_TOKEN_REFRESH_SKEW_MS, GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_DEVICE_TOKEN_STORAGE_KEY, GATEWAY_AUTH_ENDPOINTS, GATEWAY_AUTH_NGSW_BYPASS_PARAM, GATEWAY_AUTH_OPTIONS, GATEWAY_AUTH_RETRY_CONTEXT, GATEWAY_RATE_LIMIT_ERROR_CODE, GATEWAY_RATE_LIMIT_STATUS, GatewayAuthFacade, GatewayAuthState, GatewayLoginPage, GatewayMfa, GatewaySsoButtons, GatewaySsoCallback, GatewaySsoSession, LaunchApplication, LoadApplications, LoadSsoProviders, Login, LoginFailure, LoginSuccess, Logout, ResendMfa, SetAppSession, SetApplications, SetRateLimit, StartSso, UpdateAppTokens, UpdateTokens, UpdateUserData, VerifyMfa, buildApplicationContextUrl, buildGatewayUrl, buildSsoStartUrl, clearApplicationContextCache, createSecureClientState, extractGatewayRateLimitInfo, fetchApplicationContextCode, gatewayAuthInterceptor, getGatewayErrorMessage, hasGatewayTokens, isExpired, isGatewayAuthRequestUrl, mapGatewayTokens, mapGatewayUser, normalizeGatewayBase, readPersistedGatewayAuthTokens, resolveAccessTokenRefreshSkewMs, resolveApiDateValue, resolveApplicationCodeOption, resolveGatewayAuthPath, resolveGatewayDeviceToken, sanitizePersistedAuthState, withGatewayAuthNgswBypass };
+export { AUTH_STATE_DEFAULTS, ClearAllAppSessions, ClearAppSession, ClearError, ClearPendingMfa, ClearRateLimit, ExchangeSsoCode, GATEWAY_AUTH_ACCESS_TOKEN_REFRESH_SKEW_MS, GATEWAY_AUTH_DEVICE_TOKEN, GATEWAY_AUTH_DEVICE_TOKEN_STORAGE_KEY, GATEWAY_AUTH_ENDPOINTS, GATEWAY_AUTH_NGSW_BYPASS_PARAM, GATEWAY_AUTH_OPTIONS, GATEWAY_AUTH_RETRY_CONTEXT, GATEWAY_RATE_LIMIT_ERROR_CODE, GATEWAY_RATE_LIMIT_STATUS, GatewayAuthFacade, GatewayAuthState, GatewayLoginPage, GatewayMfa, GatewaySsoButtons, GatewaySsoCallback, GatewaySsoSession, LaunchApplication, LoadApplications, LoadSsoProviders, Login, LoginFailure, LoginSuccess, Logout, ResendMfa, SetAppSession, SetApplications, SetRateLimit, StartSso, UpdateAppTokens, UpdateTokens, UpdateUserData, VerifyMfa, buildApplicationContextUrl, buildGatewayUrl, buildSsoStartUrl, clearApplicationContextCache, correlationIdInterceptor, createCacheSessionInterceptor, createIdempotencyInterceptor, createLanguageInterceptor, createMessageInterceptor, createSecureClientState, extractGatewayRateLimitInfo, fetchApplicationContextCode, gatewayAuthInterceptor, getGatewayErrorMessage, hasGatewayTokens, idempotencyInterceptor, isExpired, isGatewayAuthRequestUrl, mapGatewayTokens, mapGatewayUser, messageInterceptor, normalizeGatewayBase, readPersistedGatewayAuthTokens, resolveAccessTokenRefreshSkewMs, resolveApiDateValue, resolveApplicationCodeOption, resolveGatewayAuthPath, resolveGatewayDeviceToken, sanitizePersistedAuthState, withGatewayAuthNgswBypass };
 //# sourceMappingURL=masterteam-gateway-auth.mjs.map