@nauticana/sail 1.1.9 → 1.1.11

package/src/model/decorator.ts

@@ -1,28 +1,32 @@
 import {
+  registerDecorator,
+  ValidationOptions,
   ValidatorConstraint,
   ValidatorConstraintInterface,
   ValidationArguments,
 } from 'class-validator';
 
-@ValidatorConstraint({ name: 'isNumeric', async: false })
-export class IsNumericConstraint implements ValidatorConstraintInterface {
-  validate(value: any, args: ValidationArguments) {
-    if (typeof value !== 'number') {
+// Plain decimal only — exponential notation ('1e21') must not slip past
+// the precision/scale digit counts.
+const DECIMAL = /^-?\d+(\.\d+)?$/;
+
+@ValidatorConstraint({ name: 'isSailNumeric', async: false })
+export class IsSailNumericConstraint implements ValidatorConstraintInterface {
+  validate(value: unknown, args: ValidationArguments) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
       return false;
     }
 
     const [precision, scale] = args.constraints;
     const valueString = value.toString();
+    if (!DECIMAL.test(valueString)) {
+      return false;
+    }
     const parts = valueString.split('.');
     const integerPart = parts[0].startsWith('-') ? parts[0].substring(1) : parts[0];
     const decimalPart = parts[1] || '';
 
-    // Check total digits vs precision and decimal digits vs scale
-    if (integerPart.length + decimalPart.length > precision || decimalPart.length > scale) {
-      return false;
-    }
-
-    return true;
+    return integerPart.length + decimalPart.length <= precision && decimalPart.length <= scale;
   }
 
   defaultMessage(_args: ValidationArguments) {
@@ -30,9 +34,9 @@ export class IsNumericConstraint implements ValidatorConstraintInterface {
   }
 }
 
-@ValidatorConstraint({ name: 'IsString', async: false })
-export class IsStringConstraint implements ValidatorConstraintInterface {
-  validate(value: any, args: ValidationArguments) {
+@ValidatorConstraint({ name: 'isSailString', async: false })
+export class IsSailStringConstraint implements ValidatorConstraintInterface {
+  validate(value: unknown, args: ValidationArguments) {
     const [maxLength] = args.constraints;
 
     if (typeof value !== 'string') {
@@ -47,28 +51,28 @@ export class IsStringConstraint implements ValidatorConstraintInterface {
   }
 }
 
-import { registerDecorator, ValidationOptions } from 'class-validator';
-
-export function IsNumeric(precision: number, scale: number, validationOptions?: ValidationOptions) {
-  return function (object: Record<string, any>, propertyName: string) {
+// Named IsSail* so they can't be confused with class-validator's own
+// IsString/IsNumber on import.
+export function IsSailNumeric(precision: number, scale: number, validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
     registerDecorator({
       target: object.constructor,
       propertyName: propertyName,
       options: validationOptions,
       constraints: [precision, scale],
-      validator: IsNumericConstraint,
+      validator: IsSailNumericConstraint,
     });
   };
 }
 
-export function IsString(maxLength: number, validationOptions?: ValidationOptions) {
-  return function (object: Record<string, any>, propertyName: string) {
+export function IsSailString(maxLength: number, validationOptions?: ValidationOptions) {
+  return function (object: object, propertyName: string) {
     registerDecorator({
       target: object.constructor,
       propertyName: propertyName,
       options: validationOptions,
       constraints: [maxLength],
-      validator: IsStringConstraint,
+      validator: IsSailStringConstraint,
     });
   };
 }

package/src/service/api-response.interceptor.ts

@@ -34,7 +34,10 @@ export const apiResponseInterceptor: HttpInterceptorFn = (req, next) => {
     map(event => {
       if (isFinalResponse(event)) {
         const body = event.body as Record<string, unknown> | null;
-        if (body && typeof body === 'object' && 'data' in body) {
+        // keel's common.APIResponse is `{data, pagination?, meta}` with `meta`
+        // always present. Requiring both keys keeps a legitimate body that
+        // merely contains a `data` field from being truncated to it.
+        if (body && typeof body === 'object' && 'data' in body && 'meta' in body) {
           return event.clone({ body: body['data'] });
         }
       }

package/src/service/auth.interceptor.ts

@@ -1,6 +1,8 @@
 import { HttpErrorResponse, HttpEventType, HttpInterceptorFn } from '@angular/common/http';
+import { inject, Injector } from '@angular/core';
 import { catchError, tap, throwError } from 'rxjs';
 import { isKeelApiUrl } from './rest_url';
+import { BaseAuthService } from './auth.service';
 
 // Auth-loop breaker: repeated 401s on token-bearing API calls (a stale session) can
 // drive the app to hammer the API/CDN. After AUTH_FAIL_THRESHOLD within
@@ -13,7 +15,18 @@ const AUTH_CIRCUIT_COOLDOWN_MS = 30_000;
 const FAIL_KEY = 'keel_auth_401s';
 const OPEN_KEY = 'keel_auth_circuit_until';
 
+/** Error-body code carried by the synthetic circuit-open rejection, so
+ *  consumers can tell "session expired, request refused locally" apart from a
+ *  real 401 and from a network failure (status 0). */
+export const AUTH_CIRCUIT_OPEN_CODE = 'sail_auth_circuit_open';
+
 export const authInterceptor: HttpInterceptorFn = (req, next) => {
+  // Resolved lazily per event to avoid a DI cycle (BaseAuthService → HttpClient
+  // → interceptors) and so an open circuit clears the dead session even when it
+  // was opened by a previous page load.
+  const injector = inject(Injector);
+  const expireSession = () => injector.get(BaseAuthService, null, { optional: true })?.sessionExpired();
+
   const token = localStorage.getItem('jwt');
   const authedApi = !!token && isKeelApiUrl(req.url);
   if (authedApi) {
@@ -21,10 +34,15 @@ export const authInterceptor: HttpInterceptorFn = (req, next) => {
   }
 
   if (authedApi && authCircuitOpen()) {
+    expireSession();
     return throwError(() => new HttpErrorResponse({
       url: req.url,
-      status: 0,
-      statusText: 'auth circuit open: too many 401s — request stopped to prevent a loop',
+      status: 401,
+      statusText: 'Unauthorized',
+      error: {
+        code: AUTH_CIRCUIT_OPEN_CODE,
+        detail: 'auth circuit open: too many 401s — request stopped to prevent a loop',
+      },
     }));
   }
 
@@ -35,8 +53,8 @@ export const authInterceptor: HttpInterceptorFn = (req, next) => {
       }
     }),
     catchError((err: HttpErrorResponse) => {
-      if (authedApi && err.status === 401) {
-        recordAuthFailure();
+      if (authedApi && err.status === 401 && recordAuthFailure()) {
+        expireSession();
       }
       return throwError(() => err);
     }),
@@ -47,7 +65,8 @@ function authCircuitOpen(): boolean {
   return Date.now() < Number(sessionStorage.getItem(OPEN_KEY) ?? 0);
 }
 
-function recordAuthFailure(): void {
+/** Returns true when this failure crossed the threshold and opened the circuit. */
+function recordAuthFailure(): boolean {
   const now = Date.now();
   let times: number[];
   try {
@@ -60,9 +79,10 @@ function recordAuthFailure(): void {
   if (times.length >= AUTH_FAIL_THRESHOLD) {
     sessionStorage.setItem(OPEN_KEY, String(now + AUTH_CIRCUIT_COOLDOWN_MS));
     sessionStorage.removeItem(FAIL_KEY);
-  } else {
-    sessionStorage.setItem(FAIL_KEY, JSON.stringify(times));
+    return true;
   }
+  sessionStorage.setItem(FAIL_KEY, JSON.stringify(times));
+  return false;
 }
 
 function clearAuthFailures(): void {