@nauticana/sail 1.1.27 → 1.1.28

package/README.md

@@ -2,7 +2,7 @@
 
 A shared Angular component library for building CRUD-based admin frontends. Provides table management, form handling, navigation, authentication, two-factor authentication, and trusted device management — all driven by metadata from a [keel](https://github.com/nauticana/keel) Go backend.
 
-> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
+> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
 **Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
@@ -315,11 +315,12 @@ interface SailGuiConfig {
 
 ### Password-policy validation
 
-**OAuth sign-in hand-off (v1.1.27, keel v1.2.89).** When the login page is opened with
-`?return=<authorize URL>` and both `oauthServerUrl` and `allowedReturnHosts` are set,
-`completeLogin` posts `{"return": <raw value>}` with the bearer JWT to
+**OAuth sign-in hand-off (v1.1.28, keel v1.2.93).** When the login page is opened with
+`?return=<absolute authorize URL>` and both `oauthServerUrl` and `allowedReturnHosts` are set,
+sail posts `{"return": <raw value>}` with the bearer JWT to
 `{oauthServerUrl}/oauth/session/handoff` and then leaves the SPA with a full navigation to the
-`redirect` keel answers. keel sets the authorization server's own HttpOnly cookie while
+`redirect` keel answers. This runs after a sign-in, and from `loadStoredSession()` when a user
+who is already signed in opens a `/login` route; a 401 rotates the refresh token once and retries. keel sets the authorization server's own HttpOnly cookie while
 redeeming that URL; sail does not opt into cross-origin cookies or send a CSRF token. A
 `return` whose host is not in `allowedReturnHosts`, or a `redirect` outside `oauthServerUrl`'s
 origin, is not followed. Failures set `BaseAuthService.sessionHandoffError` (rendered by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.27",
+  "version": "1.1.28",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "exports": {

package/src/service/auth.service.ts

@@ -25,7 +25,7 @@ export class RefreshSupersededError extends Error {
   constructor() { super('session changed during refresh'); this.name = 'RefreshSupersededError'; }
 }
 
-function handoffErrorMessage(status: number): string {
+function handoffErrorMessage(status: number | undefined): string {
   if (status === 400) return 'This sign-in link is not valid. Start again from the application you were connecting.';
   if (status === 401) return 'Your session was not accepted. Please sign in again.';
   return 'Could not complete sign-in. Please try again.';
@@ -219,25 +219,37 @@ export abstract class BaseAuthService extends BaseRestService {
     this.isLoggedIn.set(true);
     this.sessionHandoffError.set(null);
     resetAuthCircuit(); // a new session must not inherit a prior session's open circuit
-    const ret = this.validatedReturnUrl();
-    const oauthServer = this.oauthServerBase();
-    if (ret && oauthServer) {
-      this.handOffSession(oauthServer, ret, token);
-      return;
-    }
+    if (this.startHandoff()) return;
     this.loadAppData();
     this.initRoutes();
   }
 
+  /** Hands the session to the OAuth authorization server when the page carries an
+   * allowed `?return=` and oauthServerUrl is set; false when there is nothing to hand off. */
+  private startHandoff(): boolean {
+    const ret = this.validatedReturnUrl();
+    const oauthServer = this.oauthServerBase();
+    if (!ret || !oauthServer) return false;
+    this.handOffSession(oauthServer, ret);
+    return true;
+  }
+
   /** Exchange the bearer session for the authorization server's own cookie session
    * (keel POST /oauth/session/handoff), then leave the SPA for the URL it returns.
-   * Any failure stays on the login page; the browser is never sent elsewhere. */
-  private handOffSession(oauthServer: string, ret: string, token: string): void {
-    this.http.post<{ data?: { redirect?: unknown } }>(
+   * A 401 rotates the refresh token once and retries. Any failure stays on the
+   * login page; the browser is never sent elsewhere. */
+  private handOffSession(oauthServer: string, ret: string): void {
+    const mint = (token: string) => this.http.post<{ data?: { redirect?: unknown } }>(
         oauthServer + '/oauth/session/handoff',
         { return: ret },
         { headers: { Authorization: `Bearer ${token}` } },
-    ).pipe(take(1)).subscribe({
+    );
+    mint(this.token ?? '').pipe(
+      catchError((err: HttpErrorResponse) => err.status === 401 && localStorage.getItem('refreshToken')
+        ? this.refreshSession().pipe(mergeMap(mint))
+        : throwError(() => err)),
+      take(1),
+    ).subscribe({
       next: (res) => {
         const redirect = res?.data?.redirect;
         if (typeof redirect !== 'string' || !sameOrigin(redirect, oauthServer)) {
@@ -247,9 +259,9 @@ export abstract class BaseAuthService extends BaseRestService {
         }
         window.location.assign(redirect);
       },
-      error: (err: HttpErrorResponse) => {
+      error: (err: unknown) => {
         console.error('Session handoff failed:', err);
-        this.sessionHandoffError.set(handoffErrorMessage(err.status));
+        this.sessionHandoffError.set(handoffErrorMessage((err as { status?: number } | null)?.status));
       },
     });
   }
@@ -448,11 +460,12 @@ export abstract class BaseAuthService extends BaseRestService {
 
   loadStoredSession() {
     this.token = localStorage.getItem('jwt');
-    if (this.token) {
-      this.isLoggedIn.set(true);
-      this.loadAppData();
-      this.initRoutes();
-    }
+    if (!this.token) return;
+    this.isLoggedIn.set(true);
+    // A signed-in user sent to the login page by the authorization server is handed off without signing in again.
+    if (window.location.pathname.startsWith('/login') && this.startHandoff()) return;
+    this.loadAppData();
+    this.initRoutes();
   }
 
   /** Revoke the refresh token server-side (best effort: the local session is