@mdbase-dev/connect 0.1.0-beta.55 → 0.1.0-beta.56

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-6M+exMhOm+JESB8xqgBNPFnykP6bx043yY1RbfIP4UidAlareN3dFvCVZDSd1/aj
+sha384-fZeP3Z5L7qaOmLPO0ST72DyQgwJCq0XaamP4LFUHOTWxA2MTeF4eerxdIfULZkEq

package/dist/connection-transport-internals.d.ts

@@ -0,0 +1,22 @@
+import type { GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+import type { ResolvedConnectTimeouts } from "./request-budget.js";
+export interface ConnectionTransportInternals {
+    readonly relayEncryption: "required" | "disabled";
+    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
+    storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
+    tokenKey(collectionId: string): string;
+    pendingMutationKey(collectionId: string): string;
+    directPreferenceKey(): string;
+}
+export interface ConnectionTransportOptions {
+    serverUrl: string;
+    storage: Storage;
+    keyStore: GrantKeyStore;
+    directAccessMode: "auto" | "disabled";
+    loopbackUrl: string;
+    collectionId: string;
+    internals: ConnectionTransportInternals;
+    onChange(): void;
+    timeouts: ResolvedConnectTimeouts;
+}

package/dist/connection-transport-internals.js

@@ -0,0 +1 @@
+export {};

package/dist/connection-transport.d.ts

@@ -1,29 +1,10 @@
 import type { CollectionOperation } from "@mdbase-dev/connect-protocol";
-import { type GrantKeyStore } from "./crypto.js";
 import type { StoredToken } from "./internal-types.js";
 import type { DirectAccessStatus, MdbaseConnectionRoute } from "./connection-types.js";
 import type { ConnectRequestOptions, PendingMutationSummary } from "./operation-types.js";
 import { ConnectionFileTransport } from "./connection-file-transport.js";
-import { type ResolvedConnectTimeouts } from "./request-budget.js";
-export interface ConnectionTransportInternals {
-    readonly relayEncryption: "required" | "disabled";
-    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
-    storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
-    tokenKey(collectionId: string): string;
-    pendingMutationKey(collectionId: string): string;
-    directPreferenceKey(): string;
-}
-export interface ConnectionTransportOptions {
-    serverUrl: string;
-    storage: Storage;
-    keyStore: GrantKeyStore;
-    directAccessMode: "auto" | "disabled";
-    loopbackUrl: string;
-    collectionId: string;
-    internals: ConnectionTransportInternals;
-    onChange(): void;
-    timeouts: ResolvedConnectTimeouts;
-}
+import type { ConnectionTransportOptions } from "./connection-transport-internals.js";
+export type { ConnectionTransportInternals, ConnectionTransportOptions } from "./connection-transport-internals.js";
 export declare class ConnectionTransport {
     private readonly serverUrl;
     private readonly storage;
@@ -62,7 +43,6 @@ export declare class ConnectionTransport {
     performOperation<Result>(operation: CollectionOperation, input: unknown, options?: ConnectRequestOptions): Promise<Result>;
     private performOperationWithinBudget;
     performAuthoritySyncRequest<Result>(collectionId: string, replicaId: string, method: "GET" | "POST", path: string, input?: unknown, options?: ConnectRequestOptions): Promise<Result>;
-    private sendAuthoritySyncRequest;
     private sendOperation;
     private directCapable;
     hasResumableMutationTransport(): boolean;

package/dist/connection-transport.js

@@ -8,6 +8,8 @@ import { directFallbackStatus, isMutation, localNetworkPermission, loopbackReque
 import { apiError, decodeJsonResponse, oauthErrorCode, parseStored, } from "./runtime-utils.js";
 import { readStoredToken } from "./stored-token.js";
 import { withCooperativeRequestBudget, withRequestBudget } from "./request-budget.js";
+import { sendAuthoritySyncRequest } from "./authority-sync-request.js";
+import { freshEncryptedRequest } from "./fresh-encrypted-request.js";
 export class ConnectionTransport {
     serverUrl;
     storage;
@@ -134,7 +136,7 @@ export class ConnectionTransport {
             signal: budget.signal
         }));
     }
-    async performOperationWithinBudget(operation, input, options, storedPending) {
+    async performOperationWithinBudget(operation, input, options, storedPending, freshReadRetried = false) {
         throwIfCancelled(options.signal);
         let token = this.currentToken();
         if (!token)
@@ -199,6 +201,11 @@ export class ConnectionTransport {
         }
         if (!response.ok) {
             const error = apiError(body, "operation_failed", "Collection operation failed.", response.status);
+            if (error.code === "fresh_request_required"
+                && !attempt.pendingMutation
+                && !freshReadRetried) {
+                return this.performOperationWithinBudget(operation, input, options, undefined, true);
+            }
             if (attempt.pendingMutation
                 && (attempt.directDeliveryUncertain
                     || (attempt.encryptedRequest && attempt.resumingMutation))) {
@@ -230,6 +237,12 @@ export class ConnectionTransport {
                     applicationId: responseApplicationId,
                     encryption: responseEncryption
                 }, attempt.encryptedRequest, encryptedResponse);
+                if (!decrypted.ok
+                    && decrypted.problem.code === "fresh_request_required"
+                    && !attempt.pendingMutation
+                    && !freshReadRetried) {
+                    return this.performOperationWithinBudget(operation, input, options, undefined, true);
+                }
                 if (attempt.pendingMutation)
                     this.clearPendingMutation(attempt.requestId);
                 if (!decrypted.ok)
@@ -287,7 +300,7 @@ export class ConnectionTransport {
                 throw connectError("authority_authorization_changed", "Reconnect this collection authority before synchronizing.");
             }
             try {
-                let response = await this.sendAuthoritySyncRequest(token, method, path, input, budget.signal);
+                let response = await sendAuthoritySyncRequest(this.keyStore, token, method, path, input, budget.signal);
                 if (response.status === 401 && token.refreshToken) {
                     token = await this.refreshAuthorization(budget.signal);
                     if (!token.authority
@@ -295,7 +308,7 @@ export class ConnectionTransport {
                         || token.authority.replicaId !== replicaId) {
                         throw connectError("authority_authorization_changed", "Reconnect this collection authority before synchronizing.");
                     }
-                    response = await this.sendAuthoritySyncRequest(token, method, path, input, budget.signal);
+                    response = await sendAuthoritySyncRequest(this.keyStore, token, method, path, input, budget.signal);
                 }
                 const body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned an invalid synchronization response.");
                 if (!response.ok) {
@@ -313,24 +326,6 @@ export class ConnectionTransport {
             }
         });
     }
-    async sendAuthoritySyncRequest(token, method, path, input, signal) {
-        if (!token.authority) {
-            throw connectError("not_remote_authority", "This authorization has no remote authority endpoint.");
-        }
-        const url = `${token.authority.syncUrl}/${path}`;
-        const body = input === undefined ? undefined : JSON.stringify(input);
-        const proof = await authorityProofHeaders(this.keyStore, token, method, url, body, token.authority.accessToken);
-        return fetch(url, {
-            method,
-            headers: {
-                authorization: `Bearer ${token.authority.accessToken}`,
-                ...(input === undefined ? {} : { "content-type": "application/json" }),
-                ...proof
-            },
-            ...(body === undefined ? {} : { body }),
-            signal
-        });
-    }
     async sendOperation(token, operation, input, tryDirect, options = {}, pendingRequestId) {
         let body = input ?? {};
         let encryptedRequest;
@@ -400,6 +395,7 @@ export class ConnectionTransport {
                     throw serverConnectError(error.code, error.message);
                 throw error;
             }
+            requestId = encryptedRequest.request_id;
             body = encryptedRequest;
         }
         else {
@@ -469,6 +465,10 @@ export class ConnectionTransport {
                 throw error;
             }
             let response;
+            if (!pendingMutation) {
+                encryptedRequest = await freshEncryptedRequest(this.keyStore, relayToken, operation, input);
+                requestId = encryptedRequest.request_id;
+            }
             try {
                 response = await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(relayToken.collectionId)}/operations/${operation}`, {
                     method: "POST",

package/dist/fresh-encrypted-request.d.ts

@@ -0,0 +1,4 @@
+import type { CollectionOperation, EncryptedRelayOperationRequest } from "@mdbase-dev/connect-protocol";
+import { type GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+export declare function freshEncryptedRequest(keyStore: GrantKeyStore, token: StoredToken, operation: CollectionOperation, input: unknown): Promise<EncryptedRelayOperationRequest>;

package/dist/fresh-encrypted-request.js

@@ -0,0 +1,28 @@
+import { encryptRelayRequest, RelayCryptoError } from "./crypto.js";
+import { connectError, serverConnectError } from "./errors.js";
+export async function freshEncryptedRequest(keyStore, token, operation, input) {
+    if (!token.encryption || !token.grantId || !token.keyHandle) {
+        throw connectError("authorization_binding_incompatible", "The refreshed authorization no longer supports encrypted connector operations.", {
+            details: {
+                contract: "grant_encryption",
+                required: [1],
+                supported: token.encryption ? [token.encryption.protocol_version] : [],
+                peer: "connector",
+                operation
+            }
+        });
+    }
+    try {
+        return await encryptRelayRequest(keyStore, token.keyHandle, {
+            grantId: token.grantId,
+            applicationId: token.clientId,
+            encryption: token.encryption
+        }, operation, input);
+    }
+    catch (error) {
+        if (error instanceof RelayCryptoError) {
+            throw serverConnectError(error.code, error.message);
+        }
+        throw error;
+    }
+}

package/dist/local-file-transport.d.ts

@@ -17,6 +17,7 @@ export declare class LocalFileTransport {
     private readonly options;
     constructor(options: LocalFileTransportOptions);
     control<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal?: AbortSignal): Promise<Result>;
+    private controlAttempt;
     private decryptControlResponse;
     uploadChunk(session: FileTransferSession, chunkIndex: number, bytes: Uint8Array, signal?: AbortSignal): Promise<void>;
     downloadChunk(session: FileTransferSession, chunkIndex: number, signal?: AbortSignal): Promise<Uint8Array>;

package/dist/local-file-transport.js

@@ -11,11 +11,15 @@ export class LocalFileTransport {
         this.options = options;
     }
     async control(token, method, path, input, signal) {
+        return this.controlAttempt(token, method, path, input, signal, false);
+    }
+    async controlAttempt(token, method, path, input, signal, freshReadRetried) {
         requireEncryption(token);
         const controlInput = localFileControlInput(method, path, input);
         let encryptedRequest = await this.encryptControl(token, controlInput);
         let response;
-        if (await this.options.shouldAttemptDirect(token)) {
+        const triedDirect = await this.options.shouldAttemptDirect(token);
+        if (triedDirect) {
             try {
                 response = await fetch(`${this.options.loopbackUrl}/v1/files/control`, loopbackRequest({
                     method: "POST",
@@ -32,11 +36,18 @@ export class LocalFileTransport {
             if (response && !directFallbackStatus(response.status)) {
                 if (response.ok)
                     this.options.onDirectAvailable();
-                return this.decryptControlResponse(token, encryptedRequest, response);
+                return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried);
             }
             if (response)
                 this.options.onDirectUnavailable();
         }
+        if (triedDirect && method === "GET") {
+            token = token.expiresAt > Date.now() + 30_000
+                ? token
+                : await this.options.refreshAuthorization(signal);
+            requireLocalFileToken(token);
+            encryptedRequest = await this.encryptControl(token, controlInput);
+        }
         response = await this.sendRelayControl(token, encryptedRequest, signal);
         if (await refreshableBindingFailure(response, token)) {
             token = await this.options.refreshAuthorization(signal);
@@ -46,18 +57,30 @@ export class LocalFileTransport {
         }
         if (response.ok)
             this.options.onRelayAvailable();
-        return this.decryptControlResponse(token, encryptedRequest, response);
+        return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried);
     }
-    async decryptControlResponse(token, encryptedRequest, response) {
+    async decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried) {
         const body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned an invalid file control response.");
         if (!response.ok) {
-            throw apiError(body, "operation_failed", "Collection file request failed.", response.status);
+            const error = apiError(body, "operation_failed", "Collection file request failed.", response.status);
+            if (error.code === "fresh_request_required"
+                && method === "GET"
+                && !freshReadRetried) {
+                return this.controlAttempt(token, method, path, input, signal, true);
+            }
+            throw error;
         }
         const encryptedResponse = body?.envelope;
         if (!encryptedResponse) {
             throw connectError("invalid_encrypted_response", "The connector omitted its encrypted file response.");
         }
         const decrypted = await decryptRelayResponse(this.options.keyStore, token.keyHandle, relayBinding(token), encryptedRequest, encryptedResponse);
+        if (!decrypted.ok
+            && decrypted.problem.code === "fresh_request_required"
+            && method === "GET"
+            && !freshReadRetried) {
+            return this.controlAttempt(token, method, path, input, signal, true);
+        }
         if (!decrypted.ok)
             throwEncryptedProblem(decrypted.problem);
         return decrypted.result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.55",
+  "version": "0.1.0-beta.56",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.55"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.56"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",