@nebulr-group/bridge-svelte 0.8.0-beta.1 → 0.8.0

package/dist/auth/guard-cache.d.ts

@@ -0,0 +1,30 @@
+/**
+ * How long a route decision waits for the token refresh a plan, entitlements or
+ * user-state change started. Past it the guard decides with the token it has,
+ * which for a protected route is the old (fail-closed) verdict.
+ */
+export declare const AUTHORIZATION_CHANGE_WAIT_MS = 3000;
+/** Drop the route-guard flag cache so the next route evaluation asks the server again. */
+export declare function invalidateRouteGuardCache(): void;
+/** Current cache generation; changes on every `invalidateRouteGuardCache()`. */
+export declare function guardCacheGeneration(): number;
+/**
+ * Drop the underlying cache WITHOUT bumping the generation — used to discard a
+ * result that landed after an invalidation, which is not itself a new change.
+ */
+export declare function dropFlagCache(): void;
+/**
+ * Register the token refresh started by an authorization-affecting event.
+ * The tracked promise never rejects; it clears itself once settled.
+ */
+export declare function trackAuthorizationChange(refresh: Promise<unknown>): Promise<void>;
+/** The refresh in flight for an authorization change, or `null` when there is none. */
+export declare function pendingAuthorizationChange(): Promise<void> | null;
+/** Forget any pending change (runtime stop / test reset). */
+export declare function clearPendingAuthorizationChange(): void;
+/**
+ * Wait until no authorization-change refresh is in flight, or until `deadline`
+ * (epoch ms). Never throws. Returns immediately — without yielding — when
+ * nothing is pending, so a signed-out visitor's navigation is not delayed.
+ */
+export declare function settleAuthorizationChange(deadline: number): Promise<void>;

package/dist/auth/guard-cache.js

@@ -0,0 +1,102 @@
+// Route-guard cache invalidation (TBP-654). Internal — not re-exported.
+//
+// Route guards read auth-core's FeatureFlagService, a cache with a 5-minute
+// TTL. A plan-targeted rule's verdict depends on the user's plan and token, not
+// on the flag definition, so anything that can change those has to drop the
+// cache — otherwise an upgraded user stays locked out of the page they just
+// paid for until the TTL runs out.
+//
+// The generation counter exists for one race: an evaluation that was already
+// in flight when the cache was invalidated writes its (pre-change) result back
+// into the cache when it lands, with a fresh timestamp. Callers compare the
+// generation before and after reading the cache and re-read when it moved.
+//
+// The pending-change promise exists for a second race: the page learns about a
+// plan change (and shows the new plan) a few hundred ms before the token that
+// carries it arrives. A route decision taken in that window is evaluated with
+// the old token and refuses the page the user can already see they have. The
+// runtime registers the token refresh an authorization-affecting event starts;
+// guards wait for it, bounded, before deciding.
+import { getBridgeAuth } from '../core/bridge-instance.js';
+/**
+ * How long a route decision waits for the token refresh a plan, entitlements or
+ * user-state change started. Past it the guard decides with the token it has,
+ * which for a protected route is the old (fail-closed) verdict.
+ */
+export const AUTHORIZATION_CHANGE_WAIT_MS = 3_000;
+let _generation = 0;
+let _pendingChange = null;
+/** Drop the route-guard flag cache so the next route evaluation asks the server again. */
+export function invalidateRouteGuardCache() {
+    _generation += 1;
+    dropFlagCache();
+}
+/** Current cache generation; changes on every `invalidateRouteGuardCache()`. */
+export function guardCacheGeneration() {
+    return _generation;
+}
+/**
+ * Drop the underlying cache WITHOUT bumping the generation — used to discard a
+ * result that landed after an invalidation, which is not itself a new change.
+ */
+export function dropFlagCache() {
+    try {
+        getBridgeAuth().invalidateFeatureFlagCache();
+    }
+    catch {
+        // BridgeAuth not initialised yet — there is no cache to drop.
+    }
+}
+/**
+ * Register the token refresh started by an authorization-affecting event.
+ * The tracked promise never rejects; it clears itself once settled.
+ */
+export function trackAuthorizationChange(refresh) {
+    const tracked = refresh.then(() => undefined, () => undefined).finally(() => {
+        if (_pendingChange === tracked)
+            _pendingChange = null;
+    });
+    _pendingChange = tracked;
+    return tracked;
+}
+/** The refresh in flight for an authorization change, or `null` when there is none. */
+export function pendingAuthorizationChange() {
+    return _pendingChange;
+}
+/** Forget any pending change (runtime stop / test reset). */
+export function clearPendingAuthorizationChange() {
+    _pendingChange = null;
+}
+/**
+ * Wait until no authorization-change refresh is in flight, or until `deadline`
+ * (epoch ms). Never throws. Returns immediately — without yielding — when
+ * nothing is pending, so a signed-out visitor's navigation is not delayed.
+ */
+export async function settleAuthorizationChange(deadline) {
+    let timer;
+    try {
+        // A change that lands while we wait (a second event after the first
+        // refresh finished) starts a new refresh; wait for that too, within the
+        // same deadline.
+        for (let pending = _pendingChange; pending; pending = _pendingChange) {
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return;
+            const expired = await Promise.race([
+                pending.then(() => false),
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(true), remaining);
+                }),
+            ]);
+            clearTimeout(timer);
+            if (expired)
+                return;
+            if (_pendingChange === pending)
+                return; // settled but not yet cleared
+        }
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/auth/route-guard.d.ts

@@ -1,5 +1,14 @@
+import type { NavigationDecision } from '@nebulr-group/bridge-auth-core';
 export type { FlagRequirement, NavigationDecision, RouteGuard, RouteGuardConfig, RouteRule } from '@nebulr-group/bridge-auth-core';
-export declare function createRouteGuard(flagsReady?: Promise<void>): import("@nebulr-group/bridge-auth-core").RouteGuard;
+export declare function createRouteGuard(flagsReady?: Promise<void>): {
+    checkRouteRestrictions(pathname: string): Promise<string | null>;
+    getNavigationDecision(pathname: string, attempted?: string): Promise<NavigationDecision>;
+    isPublicRoute(pathname: string): boolean;
+    isProtectedRoute(pathname: string): boolean;
+    shouldRedirectToLogin(pathname: string): boolean;
+    getLoginRedirect(): string;
+    resolveReturnTo(attempted: string | null | undefined): string | null;
+};
 /**
  * Does any route rule's `featureFlag` requirement mention this key?
  * (TBP-575.)

package/dist/auth/route-guard.js

@@ -1,6 +1,11 @@
 // src/lib/auth/route-guard.ts — thin wrapper delegating to auth-core via bridge-instance
 import { getBridgeAuth } from '../core/bridge-instance.js';
 import { getConfig, getRouteGuardConfig } from '../client/stores/config.store.js';
+import { logger } from '../shared/logger.js';
+import { AUTHORIZATION_CHANGE_WAIT_MS, dropFlagCache, guardCacheGeneration, settleAuthorizationChange, } from './guard-cache.js';
+// How many times a restriction check is re-run when the cache was invalidated
+// underneath it (TBP-654). Bounded so a burst of invalidations cannot spin.
+const MAX_FRESH_READS = 3;
 export function createRouteGuard(flagsReady) {
     const config = getRouteGuardConfig();
     // TBP-629 — feed the app's own loginRoute into the guard so it can refuse to
@@ -17,38 +22,137 @@ export function createRouteGuard(flagsReady) {
         },
     };
     const guard = getBridgeAuth().createRouteGuard(guardConfig);
-    if (!flagsReady)
-        return guard;
-    // Wrap checkRouteRestrictions to await flagsReady before evaluating
+    // TBP-654 — a restriction check reads the flag cache. If the cache was
+    // invalidated while the check was in flight (plan change, token refresh),
+    // the answer may predate the change AND has just been written back into the
+    // cache. Discard it and ask again.
+    //
+    // Each read first waits (bounded by `deadline`) for a token refresh that a
+    // plan / entitlements / user-state change started: the page shows the new
+    // plan a few hundred ms before the token carrying it lands, and a verdict
+    // taken in between would be evaluated with the old one.
+    async function checkRestrictionsFresh(pathname, deadline) {
+        for (let attempt = 1;; attempt++) {
+            await settleAuthorizationChange(deadline);
+            const generation = guardCacheGeneration();
+            const redirectTo = await guard.checkRouteRestrictions(pathname);
+            if (generation === guardCacheGeneration())
+                return redirectTo;
+            dropFlagCache();
+            if (attempt >= MAX_FRESH_READS)
+                return redirectTo;
+        }
+    }
+    function loginDecision(pathname, attempted) {
+        // TBP-629 — the attempted target (path + query) rides along on every
+        // login decision, including the fail-closed ones below.
+        let returnTo = null;
+        try {
+            returnTo = guard.resolveReturnTo(attempted ?? pathname);
+        }
+        catch {
+            returnTo = null;
+        }
+        let loginUrl = '';
+        try {
+            loginUrl = guard.getLoginRedirect();
+        }
+        catch {
+            // SDK mode never reads loginUrl; hosted mode rebuilds it at redirect time.
+        }
+        return { type: 'login', loginUrl, ...(returnTo ? { returnTo } : {}) };
+    }
+    // TBP-653 — the guard could not reach a decision (network error on a flag
+    // check, malformed config, an exception anywhere in the chain). That must
+    // never let a restricted route through:
+    //   - a public route with no flag/billing requirement stays reachable;
+    //   - a signed-out visitor is sent to login;
+    //   - a signed-in user is treated as failing the route's requirement and
+    //     sent where the rule says a failing user goes.
+    function failClosed(pathname, attempted, err) {
+        logger.error('[route-guard] could not evaluate route; denying access', pathname, err);
+        let rule = null;
+        try {
+            rule = findMatchingRule(pathname, config?.rules ?? []);
+        }
+        catch {
+            rule = null;
+        }
+        const restricted = !!(rule?.featureFlag || rule?.billing === 'hard');
+        let isPublic = false;
+        try {
+            isPublic = guard.isPublicRoute(pathname);
+        }
+        catch {
+            isPublic = false;
+        }
+        if (isPublic && !restricted)
+            return { type: 'allow' };
+        let authenticated = false;
+        try {
+            authenticated = getBridgeAuth().isAuthenticated();
+        }
+        catch {
+            authenticated = false;
+        }
+        if (authenticated) {
+            const to = rule?.redirectTo ?? '/';
+            if (to !== pathname)
+                return { type: 'redirect', to };
+        }
+        return loginDecision(pathname, attempted);
+    }
     return {
         ...guard,
         async checkRouteRestrictions(pathname) {
+            const deadline = Date.now() + AUTHORIZATION_CHANGE_WAIT_MS;
             await flagsReady;
-            return guard.checkRouteRestrictions(pathname);
+            return checkRestrictionsFresh(pathname, deadline);
         },
         async getNavigationDecision(pathname, attempted) {
-            if (guard.shouldRedirectToLogin(pathname)) {
-                // TBP-629 — this branch short-circuits before flagsReady on purpose
-                // (an unauthenticated visitor needs no flag evaluation), which is
-                // exactly why `attempted` has to be threaded through here too. The
-                // wrapper previously rebuilt the decision by hand and would silently
-                // drop any argument auth-core's version learned to accept.
-                const returnTo = guard.resolveReturnTo(attempted ?? pathname);
-                return {
-                    type: 'login',
-                    loginUrl: guard.getLoginRedirect(),
-                    ...(returnTo ? { returnTo } : {}),
-                };
+            // TBP-654 — one bound for the whole decision, however many reads it takes.
+            const deadline = Date.now() + AUTHORIZATION_CHANGE_WAIT_MS;
+            try {
+                // A refresh that fails can sign the session out, so let it land before
+                // the signed-in check too. Nothing pending (always the case for a
+                // signed-out visitor) → no wait at all.
+                await settleAuthorizationChange(deadline);
+                if (guard.shouldRedirectToLogin(pathname)) {
+                    // TBP-629 — this branch short-circuits before flagsReady on purpose
+                    // (an unauthenticated visitor needs no flag evaluation), which is
+                    // exactly why `attempted` has to be threaded through here too.
+                    return loginDecision(pathname, attempted);
+                }
+                await flagsReady;
+                const redirectTo = await checkRestrictionsFresh(pathname, deadline);
+                if (redirectTo) {
+                    return { type: 'redirect', to: redirectTo };
+                }
+                return { type: 'allow' };
             }
-            await flagsReady;
-            const redirectTo = await guard.checkRouteRestrictions(pathname);
-            if (redirectTo) {
-                return { type: 'redirect', to: redirectTo };
+            catch (err) {
+                return failClosed(pathname, attempted, err);
             }
-            return { type: 'allow' };
-        }
+        },
     };
 }
+// Same matching semantics as auth-core's route guard: a RegExp is tested as-is,
+// a string is an exact match unless it contains `*` wildcards. First match wins.
+function toRegExp(pattern) {
+    if (pattern instanceof RegExp)
+        return pattern;
+    const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    if (!pattern.includes('*'))
+        return new RegExp(`^${escaped}$`);
+    return new RegExp(`^${escaped.replace(/\\\*/g, '.*')}$`);
+}
+function findMatchingRule(pathname, rules) {
+    for (const rule of rules) {
+        if (toRegExp(rule.match).test(pathname))
+            return rule;
+    }
+    return null;
+}
 /**
  * Does any route rule's `featureFlag` requirement mention this key?
  * (TBP-575.)

package/dist/client/BridgeBootstrap.d.ts

@@ -3,6 +3,29 @@ import { waitForBridge as _waitForBridge } from '../core/bridge-instance.js';
 import type { BridgeConfig } from '../shared/types/config.js';
 export declare function bridgeBootstrap(url: URL, config: BridgeConfig | string, routeConfig?: RouteGuardConfig, kitFetch?: typeof globalThis.fetch): Promise<{
     flagsReady: Promise<void>;
-} | undefined>;
+}>;
+/**
+ * Re-check Bridge's route rules for `url` from any `load` function, and throw
+ * the same redirect `bridgeBootstrap` would: to your `loginRoute` (or the hosted
+ * login page) for a signed-out visitor on a protected route, or to the rule's
+ * `redirectTo` when a feature-flag or billing requirement is not met.
+ *
+ * `bridgeBootstrap` in your root `+layout.ts` already guards every navigation.
+ * Use this as a second line of defence on pages that must never render for the
+ * wrong visitor. It fails closed: if the decision cannot be made, a protected
+ * route is denied.
+ *
+ * Route guards control what the browser renders. They are not authorization —
+ * your API must still verify the user's token on every request.
+ *
+ * @example
+ * // src/routes/admin/+page.ts
+ * import { assertAuthorized } from '@nebulr-group/bridge-svelte';
+ * export const load = async ({ url }) => {
+ *   await assertAuthorized(url);
+ *   // ...
+ * };
+ */
+export declare function assertAuthorized(url: URL): Promise<void>;
 export declare const bridgeReady: import("svelte/store").Readable<boolean>;
 export { _waitForBridge as waitForBridge };