@nauticana/sail 1.1.1 → 1.1.3

package/README.md

@@ -140,6 +140,8 @@ bootstrapApplication(App, {
 });
 ```
 
+> **Auth-loop breaker.** `authInterceptor` carries a built-in circuit breaker: after 5 `401`/`403`s on token-bearing keel API calls within 10s it opens for 30s and refuses those requests **locally** (never sent), so a stale/rejected session can't drive the app to hammer the API and the edge/CDN. A later success closes it; login (no bearer) is never blocked, so recovery works. No wiring needed beyond registering `authInterceptor`.
+
 ### 5. Create the root component
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "scripts": {

package/src/config.ts

@@ -59,6 +59,15 @@ export interface SailGuiConfig {
   defaultPolicyLanguage?: string;
   /** Route to navigate to after account deletion. Defaults to '/login/local'. */
   accountDeletedRoute?: string;
+
+  // ── OAuth authorization-flow bridge (for an OAuth AS on a different host) ──
+  /** Backend path that mirrors the bearer JWT into an HttpOnly session cookie so
+   * a cross-site OAuth `/authorize` can see the session, e.g. '/api/v1/auth/session-cookie'.
+   * When set, login POSTs here before handing off to an allowed ?return= host. */
+  sessionCookieUrl?: string;
+  /** Hostnames a post-login `?return=` may redirect to (open-redirect allowlist),
+   * e.g. ['mcp.daxoom.com']. Anything not listed is ignored. */
+  allowedReturnHosts?: string[];
 }
 
 export const SAIL_GUI_CONFIG = new InjectionToken<SailGuiConfig>('SailGuiConfig');

package/src/service/auth.interceptor.ts

@@ -1,12 +1,72 @@
-import { HttpInterceptorFn } from '@angular/common/http';
+import { HttpErrorResponse, HttpEventType, HttpInterceptorFn } from '@angular/common/http';
+import { catchError, tap, throwError } from 'rxjs';
 import { isKeelApiUrl } from './rest_url';
 
+// Auth-loop breaker: repeated 401/403s on token-bearing API calls (a stale or
+// rejected session) can drive the app to hammer the API — and the edge/CDN in
+// front of it — indefinitely. After AUTH_FAIL_THRESHOLD failures within
+// AUTH_FAIL_WINDOW_MS the circuit opens for AUTH_CIRCUIT_COOLDOWN_MS: authed API
+// requests are refused locally (never sent) so the storm stops at the browser. A
+// later success closes it; login (no bearer) is never blocked, so recovery works.
+const AUTH_FAIL_WINDOW_MS = 10_000;
+const AUTH_FAIL_THRESHOLD = 5;
+const AUTH_CIRCUIT_COOLDOWN_MS = 30_000;
+const FAIL_KEY = 'keel_auth_401s';
+const OPEN_KEY = 'keel_auth_circuit_until';
+
 export const authInterceptor: HttpInterceptorFn = (req, next) => {
   const token = localStorage.getItem('jwt');
-  if (token && isKeelApiUrl(req.url)) {
-    req = req.clone({
-      setHeaders: { Authorization: `Bearer ${token}` },
-    });
+  const authedApi = !!token && isKeelApiUrl(req.url);
+  if (authedApi) {
+    req = req.clone({ setHeaders: { Authorization: `Bearer ${token}` } });
+  }
+
+  if (authedApi && authCircuitOpen()) {
+    return throwError(() => new HttpErrorResponse({
+      url: req.url,
+      status: 0,
+      statusText: 'auth circuit open: too many 401s — request stopped to prevent a loop',
+    }));
   }
-  return next(req);
+
+  return next(req).pipe(
+    tap((event) => {
+      if (authedApi && event.type === HttpEventType.Response) {
+        clearAuthFailures();
+      }
+    }),
+    catchError((err: HttpErrorResponse) => {
+      if (authedApi && (err.status === 401 || err.status === 403)) {
+        recordAuthFailure();
+      }
+      return throwError(() => err);
+    }),
+  );
 };
+
+function authCircuitOpen(): boolean {
+  return Date.now() < Number(sessionStorage.getItem(OPEN_KEY) ?? 0);
+}
+
+function recordAuthFailure(): void {
+  const now = Date.now();
+  let times: number[];
+  try {
+    times = (JSON.parse(sessionStorage.getItem(FAIL_KEY) ?? '[]') as number[])
+      .filter((t) => now - t < AUTH_FAIL_WINDOW_MS);
+  } catch {
+    times = [];
+  }
+  times.push(now);
+  if (times.length >= AUTH_FAIL_THRESHOLD) {
+    sessionStorage.setItem(OPEN_KEY, String(now + AUTH_CIRCUIT_COOLDOWN_MS));
+    sessionStorage.removeItem(FAIL_KEY);
+  } else {
+    sessionStorage.setItem(FAIL_KEY, JSON.stringify(times));
+  }
+}
+
+function clearAuthFailures(): void {
+  sessionStorage.removeItem(FAIL_KEY);
+  sessionStorage.removeItem(OPEN_KEY);
+}

package/src/service/auth.service.ts

@@ -110,10 +110,40 @@ export abstract class BaseAuthService extends BaseRestService {
     this.token = token;
     this.isLoggedIn.set(true);
     localStorage.setItem('jwt', token);
+    const ret = this.validatedReturnUrl();
+    if (ret && this.guiConfig.sessionCookieUrl) {
+      // OAuth flow: mirror the bearer into a cookie, then hand off to the
+      // (cross-origin) authorization server via a full navigation.
+      this.http.post(this.url(this.guiConfig.sessionCookieUrl), {}, { withCredentials: true })
+          .pipe(take(1))
+          .subscribe({
+            next: () => window.location.assign(ret),
+            error: () => window.location.assign(ret),
+          });
+      return;
+    }
     this.loadAppData();
     this.initRoutes();
   }
 
+  /** A post-login `?return=` URL, only when its host is in allowedReturnHosts and
+   * the scheme is https (or loopback) — an open-redirect guard. '' otherwise. */
+  private validatedReturnUrl(): string {
+    const raw = new URLSearchParams(window.location.search).get('return');
+    if (!raw) return '';
+    try {
+      const u = new URL(raw, window.location.origin);
+      if (u.username || u.password) return '';   // reject userinfo ("user@host") spoofing
+      const host = u.hostname.toLowerCase();
+      const okScheme = u.protocol === 'https:' || host === 'localhost' || host === '127.0.0.1';
+      const allowed = (this.guiConfig.allowedReturnHosts ?? []).some((h) => h.toLowerCase() === host);
+      if (okScheme && allowed) {
+        return u.toString();
+      }
+    } catch { /* malformed → reject */ }
+    return '';
+  }
+
   login(username: string, password: string) {
     // withCredentials so the browser sends the server-set `keel_td` cookie
     // (keel v0.9 trusted-device secret). When it maps to a trusted row, keel